@pushary/agent-hooks 1.9.7 → 1.9.9

package/dist/{chunk-QFEM7R6T.js → chunk-KQFTBQ66.js}

@@ -14,36 +14,36 @@ import {
   IDLE_PROMPT_NOTIFICATION,
   NOTIFICATION_PUSH_TYPES,
   POSTTOOLUSE_MIRROR_ONLY_TOOLS
-} from "./chunk-6DJTDHBI.js";
+} from "./chunk-MD4SVNT6.js";
 import {
   cancelQuestion,
   isPolicyConfig,
   sendNotification,
   waitForAnswer
-} from "./chunk-D6S5EKXA.js";
+} from "./chunk-WRPYCIV2.js";
+import {
+  withRetry
+} from "./chunk-6AYSKVLL.js";
 import {
   clientErrorKindOf,
   reportClientError
-} from "./chunk-AVNKVF7N.js";
-import {
-  withRetry
-} from "./chunk-L76HTPU6.js";
+} from "./chunk-UPIZSCYD.js";
 import {
   getMachineId
-} from "./chunk-KYO45G5L.js";
+} from "./chunk-KOWFRUIT.js";
 import {
   reportedInstallSource
-} from "./chunk-4D2AYNSE.js";
+} from "./chunk-BNSKVIAW.js";
 import {
   canonicalJson
-} from "./chunk-ZUTU43FT.js";
+} from "./chunk-Z23ZBYDW.js";
 import {
   writeFileAtomic
 } from "./chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-Z6HPS67T.js";
+} from "./chunk-IRHABAQT.js";
 import {
   ACTION_BODY_MAX,
   AGENT_LABELS_BY_TYPE,
@@ -70,7 +70,7 @@ import {
   resolvePolicy,
   toToolLookup,
   truncateLine
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-5RGA636G.js";
 
 // src/policy.ts
 import { createHash } from "crypto";

package/dist/chunk-LENBKYRB.js

@@ -0,0 +1,50 @@
+import {
+  pusharyHookExecutable
+} from "./chunk-BYLKCZ2G.js";
+import {
+  isProtectedByScope,
+  registerHookEntry
+} from "./chunk-Z23ZBYDW.js";
+
+// src/cursor-config.ts
+var hookCommandOf = (entry) => {
+  const command = entry && typeof entry === "object" && !Array.isArray(entry) ? entry.command : void 0;
+  return typeof command === "string" ? command : "";
+};
+var isPusharyCursorEntry = (entry) => pusharyHookExecutable(hookCommandOf(entry)) !== null;
+var registerCursorGate = (existing, entry) => registerHookEntry(existing, isPusharyCursorEntry, entry);
+var withoutPusharyCursorHooks = (hooks, scope) => {
+  let removed = 0;
+  const kept = {};
+  for (const [event, entries] of Object.entries(hooks)) {
+    if (!Array.isArray(entries)) {
+      kept[event] = entries;
+      continue;
+    }
+    const others = entries.filter((entry) => !isPusharyCursorEntry(entry) || isProtectedByScope(hookCommandOf(entry), scope));
+    removed += entries.length - others.length;
+    if (others.length > 0 || entries.length === 0) kept[event] = others;
+  }
+  return { hooks: kept, removed };
+};
+var CURSOR_PLUGIN_NAME = "pushary";
+var CURSOR_PLUGIN_STAGING_PREFIX = ".pushary-staging-";
+var CURSOR_PLUGIN_BACKUP_INFIX = ".pushary-backup-";
+var isCursorPluginLeftover = (name) => name.startsWith(`${CURSOR_PLUGIN_NAME}${CURSOR_PLUGIN_BACKUP_INFIX}`) || name.startsWith(CURSOR_PLUGIN_STAGING_PREFIX);
+var isPusharyCursorPluginManifest = (contents) => {
+  try {
+    const manifest = JSON.parse(contents);
+    return typeof manifest === "object" && manifest !== null && !Array.isArray(manifest) && manifest.name === CURSOR_PLUGIN_NAME;
+  } catch {
+    return false;
+  }
+};
+
+export {
+  registerCursorGate,
+  withoutPusharyCursorHooks,
+  CURSOR_PLUGIN_STAGING_PREFIX,
+  CURSOR_PLUGIN_BACKUP_INFIX,
+  isCursorPluginLeftover,
+  isPusharyCursorPluginManifest
+};

package/dist/{chunk-JCWZ23MJ.js → chunk-M3STIAGU.js}

@@ -5,16 +5,16 @@ import {
 import {
   NOTIFICATION_MATCHED_TYPES,
   POSTTOOLUSE_MIRRORED_TOOLS
-} from "./chunk-6DJTDHBI.js";
+} from "./chunk-MD4SVNT6.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-ZUTU43FT.js";
+} from "./chunk-Z23ZBYDW.js";
 import {
   CLAUDE_PRETOOLUSE_MATCHER,
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-5RGA636G.js";
 
 // src/gemini-config.ts
 var GEMINI_HOOK_BINARY = "pushary-gemini-hook";

package/dist/{chunk-6DJTDHBI.js → chunk-MD4SVNT6.js}

@@ -1,6 +1,6 @@
 import {
   PRETOOLUSE_GATED_TOOLS
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-5RGA636G.js";
 
 // src/claude-tools.ts
 var POSTTOOLUSE_MIRROR_ONLY_TOOLS = ["TodoWrite", "Task", "WebFetch", "WebSearch"];

package/dist/{chunk-7264S5HZ.js → chunk-MLGIVVSG.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-ZUTU43FT.js";
+} from "./chunk-Z23ZBYDW.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-H7MMU64M.js → chunk-NGKUXZID.js}

@@ -8,10 +8,10 @@ import {
   codexHooksJsonIn,
   isPusharyCodexCommand,
   resolvePathBinary
-} from "./chunk-ZUTU43FT.js";
+} from "./chunk-Z23ZBYDW.js";
 import {
   getPackageVersion
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-5RGA636G.js";
 
 // src/codex-app-server.ts
 import { existsSync, realpathSync } from "fs";

package/dist/{chunk-JWQZSYCK.js → chunk-NUVGDBZC.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-ZUTU43FT.js";
+} from "./chunk-Z23ZBYDW.js";
 import {
   readJsonSafe
 } from "./chunk-T7E75EKA.js";

package/dist/{chunk-AQ55ZSSS.js → chunk-OAYWO5NP.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-3EGEA4KH.js";
 import {
   getBaseUrl
-} from "./chunk-Z6HPS67T.js";
+} from "./chunk-IRHABAQT.js";
 
 // src/cli/login-ui.ts
 import { hostname } from "os";

package/dist/chunk-Q6C6ILUS.js

@@ -0,0 +1,49 @@
+import {
+  findExportedKeyLine,
+  keyPrefix,
+  readConfigFileKey,
+  readMacAppKeyPrefix
+} from "./chunk-REU2VQPH.js";
+import {
+  NPX_LATEST_COMMAND
+} from "./chunk-5DCDQ5VW.js";
+
+// src/key-signed-out.ts
+var VERDICT_BY_CHECK = {
+  ok: "accepted",
+  locked: "accepted",
+  rejected: "rejected",
+  malformed: "unchecked",
+  unreachable: "unchecked"
+};
+var activeKeyVerdictOf = (check) => check === null ? "unchecked" : VERDICT_BY_CHECK[check.kind];
+var NOT_SIGNED_OUT = { kind: "none" };
+var isMacAppKey = (key, macAppKeyPrefix) => keyPrefix(key) === macAppKeyPrefix;
+var diagnoseSignedOutKey = (evidence) => {
+  const adopted = evidence.macAppKeyPrefix;
+  if (evidence.configKey !== null || adopted === null) return NOT_SIGNED_OUT;
+  if (evidence.activeKey !== null) {
+    if (!isMacAppKey(evidence.activeKey, adopted) || evidence.activeKeyVerdict === "accepted") return NOT_SIGNED_OUT;
+  }
+  const exported = evidence.exportedKey;
+  return { kind: "signed_out_on_mac", deadExport: exported && isMacAppKey(exported.key, adopted) ? exported : null };
+};
+var SIGNED_OUT_ON_MAC_MESSAGE = "This computer used the key the Pushary Mac app signed in with, and it was signed out on this Mac, so it no longer works here.";
+var describeSignedOutKey = (diagnosis) => [
+  `Run pushary login, or re-run ${NPX_LATEST_COMMAND} setup, to connect this computer again.`,
+  ...diagnosis.deadExport ? [`${diagnosis.deadExport.path} line ${diagnosis.deadExport.line} still exports the old key (${keyPrefix(diagnosis.deadExport.key)}). Delete that line, or let login replace it, then open a new terminal.`] : []
+];
+var readSignedOutDiagnosis = (activeKey, activeKeyVerdict) => diagnoseSignedOutKey({
+  configKey: readConfigFileKey(),
+  macAppKeyPrefix: readMacAppKeyPrefix(),
+  activeKey,
+  activeKeyVerdict,
+  exportedKey: findExportedKeyLine()
+});
+
+export {
+  activeKeyVerdictOf,
+  SIGNED_OUT_ON_MAC_MESSAGE,
+  describeSignedOutKey,
+  readSignedOutDiagnosis
+};

package/dist/{chunk-MBK7N46B.js → chunk-QIOIO7VN.js}

@@ -3,27 +3,27 @@ import {
   expectedLaunchCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "./chunk-T7Y5EADL.js";
+} from "./chunk-F7R3SZ4Q.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   hasDaemonServiceDefinition,
   readDaemonNeedsLogin,
   readDaemonStatus
-} from "./chunk-VXRXFU6Q.js";
+} from "./chunk-SZ4Q6ZVS.js";
 import {
   readControlMode,
   readKeySource
-} from "./chunk-ADSQDYYG.js";
+} from "./chunk-REU2VQPH.js";
 import {
   getMachineId
-} from "./chunk-KYO45G5L.js";
+} from "./chunk-KOWFRUIT.js";
 import {
   getBaseUrl
-} from "./chunk-Z6HPS67T.js";
+} from "./chunk-IRHABAQT.js";
 import {
   getPackageVersion
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-5RGA636G.js";
 
 // src/machines.ts
 import { hostname } from "os";

package/dist/{chunk-KFKL3FHS.js → chunk-QRXPWW3M.js}

@@ -1,6 +1,6 @@
 import {
   pusharyFetch
-} from "./chunk-JXISQ7DT.js";
+} from "./chunk-5N5L6DNN.js";
 import {
   NetworkError
 } from "./chunk-7QLSKOSU.js";
@@ -9,11 +9,11 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   getBaseUrl
-} from "./chunk-Z6HPS67T.js";
+} from "./chunk-IRHABAQT.js";
 import {
   isValidApiKey,
   normalizeKeyScope
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-5RGA636G.js";
 
 // src/session.ts
 var samePusharyAccount = (left, right) => left.kind === "ok" && right.kind === "ok" && left.identity.workspaceId !== "" && left.identity.workspaceId === right.identity.workspaceId && left.identity.siteId === right.identity.siteId;
@@ -167,6 +167,7 @@ var describeKeyCheck = (check, baseUrl = getBaseUrl()) => {
 
 export {
   samePusharyAccount,
+  absoluteUrl,
   checkApiKey,
   keyCheckFromResponse,
   describeKeyCheck

package/dist/{chunk-7OIWWZAD.js → chunk-QTIUJZRX.js}

@@ -1,6 +1,6 @@
 import {
   SETUP_FLAGS
-} from "./chunk-SBLPHUEB.js";
+} from "./chunk-ZGADIZDS.js";
 import {
   parseFlags
 } from "./chunk-GMXKITVA.js";
@@ -9,7 +9,7 @@ import {
 } from "./chunk-7QLSKOSU.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-STQRUH3S.js";
+} from "./chunk-5DCDQ5VW.js";
 import {
   CLAUDE_CONNECTOR_GUIDE,
   CLAUDE_CONNECTOR_STEPS,
@@ -17,7 +17,7 @@ import {
   CLAUDE_CONNECTOR_URL,
   COWORK_CONNECTOR_LIMIT,
   COWORK_STANDING_INSTRUCTIONS
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-5RGA636G.js";
 
 // src/cli/cowork.ts
 import { readFileSync } from "fs";

package/dist/{chunk-XWAYAO3V.js → chunk-R5RIVOPL.js}

@@ -1,9 +1,9 @@
 import {
   registerTranscript
-} from "./chunk-BTQGAXZ3.js";
+} from "./chunk-COQ64C4F.js";
 import {
   writeDegraded
-} from "./chunk-AVNKVF7N.js";
+} from "./chunk-UPIZSCYD.js";
 
 // src/tool-hook-input.ts
 var OPTIONAL_TEXT_FIELDS = ["hook_event_name", "session_id", "cwd", "transcript_path", "tool_use_id", "permission_mode"];

package/dist/{chunk-ADSQDYYG.js → chunk-REU2VQPH.js}

@@ -1,6 +1,6 @@
 import {
   resolveInstallSourceFor
-} from "./chunk-4D2AYNSE.js";
+} from "./chunk-BNSKVIAW.js";
 import {
   backupFile,
   readJsonSafe,
@@ -9,7 +9,7 @@ import {
 } from "./chunk-T7E75EKA.js";
 import {
   configFilePath
-} from "./chunk-Z6HPS67T.js";
+} from "./chunk-IRHABAQT.js";
 
 // src/shell-alias.ts
 import { homedir } from "os";
@@ -110,6 +110,20 @@ var isDisabledExport = (line) => {
   return OUR_EXPORT.test(trimmed.slice(1, -LOGOUT_MARK.length).trim());
 };
 var keyPrefix = (key) => key.split(".")[0] ?? key;
+var MAC_APP_KEY_PREFIX_FIELD = "macAppKeyPrefix";
+var KEY_PREFIX_SHAPE = /^pk_[a-f0-9]+$/;
+var findKeyExport = (contents) => {
+  const lines = contents.split("\n");
+  for (const [index, line] of lines.entries()) {
+    const key = line.match(OUR_EXPORT)?.[2];
+    if (key) return { line: index + 1, key };
+  }
+  return null;
+};
+var keepMacAppKeyPrefix = (current, apiKey) => {
+  const { [MAC_APP_KEY_PREFIX_FIELD]: recorded, ...rest } = current;
+  return recorded === keyPrefix(apiKey) ? { ...rest, [MAC_APP_KEY_PREFIX_FIELD]: recorded } : rest;
+};
 var manualKeyStepFor = (kind, platform) => kind === "no-rc" || platform === "win32" ? "config-only" : "paste-export";
 var rcResult = (kind, over = {}) => ({
   kind,
@@ -208,7 +222,7 @@ var writeKey = (apiKey, options = {}) => {
   writeJsonAtomic(
     configPath,
     {
-      ...current,
+      ...keepMacAppKeyPrefix(current, apiKey),
       apiKey,
       installSource: resolveInstallSourceFor(current),
       ...options.controlMode ? { controlMode: options.controlMode } : {},
@@ -227,7 +241,7 @@ var clearKey = (options = {}) => {
   const existing = readJsonSafe(configPath);
   let removedFromConfig = false;
   if (existing.kind === "ok" && typeof existing.value.apiKey === "string") {
-    const { apiKey: _dropped, ...rest } = existing.value;
+    const { apiKey: _dropped, [MAC_APP_KEY_PREFIX_FIELD]: _adopted, ...rest } = existing.value;
     writeJsonAtomic(configPath, rest, KEY_FILE_MODE);
     restrictFile(configPath);
     removedFromConfig = true;
@@ -289,6 +303,38 @@ var readKeySource = () => {
   if (fileKey) return { kind: "config", key: fileKey, origin: configPath, drift: null };
   return { kind: "none", key: null, origin: null, drift: null };
 };
+var readMacAppKeyPrefix = (configPath = configFilePath()) => {
+  const result = readJsonSafe(configPath);
+  if (result.kind !== "ok") return null;
+  const recorded = result.value[MAC_APP_KEY_PREFIX_FIELD];
+  return typeof recorded === "string" && KEY_PREFIX_SHAPE.test(recorded) ? recorded : null;
+};
+var recordMacAppKeyPrefix = (apiKey, configPath = configFilePath()) => {
+  const result = readJsonSafe(configPath);
+  if (result.kind !== "ok" || result.value.apiKey !== apiKey) return false;
+  if (result.value[MAC_APP_KEY_PREFIX_FIELD] === keyPrefix(apiKey)) return false;
+  writeJsonAtomic(configPath, { ...result.value, [MAC_APP_KEY_PREFIX_FIELD]: keyPrefix(apiKey) }, KEY_FILE_MODE);
+  restrictFile(configPath);
+  return true;
+};
+var shellProfileCandidates = () => {
+  const resolved = resolveShellRc();
+  const fallbacks = FALLBACK_RCS.map((name) => join2(homedir2(), name));
+  return resolved ? [resolved.path, ...fallbacks.filter((path) => path !== resolved.path)] : fallbacks;
+};
+var findExportedKeyLine = (profiles = shellProfileCandidates()) => {
+  for (const path of profiles) {
+    let contents;
+    try {
+      contents = readFileSync2(path, "utf8");
+    } catch {
+      continue;
+    }
+    const found = findKeyExport(contents);
+    if (found) return { path, ...found };
+  }
+  return null;
+};
 
 export {
   CANDIDATE_RCS,
@@ -305,5 +351,8 @@ export {
   readConfigFileKey,
   readControlMode,
   readTranscriptPreference,
-  readKeySource
+  readKeySource,
+  readMacAppKeyPrefix,
+  recordMacAppKeyPrefix,
+  findExportedKeyLine
 };

package/dist/{chunk-GKI6LFAV.js → chunk-RQ32ADJP.js}

@@ -3,11 +3,11 @@ import {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-AUUXS44H.js";
+} from "./chunk-APP43AW7.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-4FK6RZVJ.js";
+} from "./chunk-462EQA6K.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;

package/dist/{chunk-VXRXFU6Q.js → chunk-SZ4Q6ZVS.js}

@@ -4,14 +4,14 @@ import {
 } from "./chunk-XHKBHWLX.js";
 import {
   readControlMode
-} from "./chunk-ADSQDYYG.js";
+} from "./chunk-REU2VQPH.js";
 import {
   getMachineId
-} from "./chunk-KYO45G5L.js";
+} from "./chunk-KOWFRUIT.js";
 import {
   pusharyDir,
   resolveGlobalBinary
-} from "./chunk-ZUTU43FT.js";
+} from "./chunk-Z23ZBYDW.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -20,14 +20,14 @@ import {
 } from "./chunk-T7E75EKA.js";
 import {
   getApiKey
-} from "./chunk-Z6HPS67T.js";
+} from "./chunk-IRHABAQT.js";
 import {
   CLI_PACKAGE_NAMES,
   cmdShimTarget,
   getPackageVersion,
   globalPackageFolder,
   globalRootFor
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-5RGA636G.js";
 
 // src/daemon-lifecycle.ts
 import { dirname, join, win32 as win32Path } from "path";
@@ -720,8 +720,9 @@ var stopDaemonRunning = async (options = {}) => {
   safeUnlink(lockPath(dir));
   return { kind: "stopped" };
 };
+var DAEMON_LOGIN_REASONS = ["key_rejected", "plan_inactive", "key_missing", "mac_signed_out"];
 var needsLoginPath = (dir) => join(dir, "daemon-needs-login.json");
-var isLoginReason = (value) => value === "key_rejected" || value === "plan_inactive";
+var isLoginReason = (value) => DAEMON_LOGIN_REASONS.includes(value);
 var parseDaemonNeedsLogin = (value) => {
   if (typeof value !== "object" || value === null) return null;
   const record = value;
@@ -751,7 +752,13 @@ var clearDaemonNeedsLogin = (options = {}) => {
   safeUnlink(path);
   return true;
 };
-var describeDaemonLoginBlock = (record) => record.reason === "key_rejected" ? `this machine's key was rejected at ${record.at}; run \`pushary login\` to sign in again` : `this workspace had no active plan at ${record.at}; pick one at pushary.com/dashboard/settings?tab=billing, then run \`pushary login\``;
+var DAEMON_LOGIN_BLOCK_DESCRIPTIONS = {
+  key_rejected: (at) => `this machine's key was rejected at ${at}; run \`pushary login\` to sign in again`,
+  plan_inactive: (at) => `this workspace had no active plan at ${at}; pick one at pushary.com/dashboard/settings?tab=billing, then run \`pushary login\``,
+  key_missing: (at) => `this machine had no key at ${at}; run \`pushary login\` to sign in again`,
+  mac_signed_out: (at) => `the key this machine shared with the Pushary Mac app was signed out on this Mac at ${at}; run \`pushary login\` to sign in again`
+};
+var describeDaemonLoginBlock = (record) => DAEMON_LOGIN_BLOCK_DESCRIPTIONS[record.reason](record.at);
 var recoverDaemonAfterLogin = (options = {}) => {
   const cleared = clearDaemonNeedsLogin(options);
   if (!cleared || readControlMode(join(options.dir ?? pusharyDir(), "config.json")) === "off" || !hasDaemonServiceDefinition(options)) {

package/dist/{chunk-KT5E2RLS.js → chunk-T6ZN4TEF.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_HOLD_BUDGET_ENV,
   hookHoldBudgetProof
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-5RGA636G.js";
 
 // src/hold-budget.ts
 var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {

package/dist/{chunk-UFVGSEWH.js → chunk-TO3PS646.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   renderCommandHelp
-} from "./chunk-STQRUH3S.js";
+} from "./chunk-5DCDQ5VW.js";
 import {
   getPackageVersion
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-5RGA636G.js";
 
 // src/cli/usage.ts
 var exitOnHelpFlag = (command) => {