@pushary/agent-hooks 1.9.8 → 1.9.10

package/dist/{chunk-2A53H4S6.js → chunk-5MQYA3YL.js}

@@ -1,21 +1,21 @@
-import {
-  activeHookSource,
-  activeIdentity
-} from "./chunk-KHNFLYJO.js";
 import {
   defersToNativeMode,
   reportMachineDenial
-} from "./chunk-IHO3YQAN.js";
+} from "./chunk-CJYM4ZHV.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-ZSTSEBG7.js";
+} from "./chunk-IIVZZMSO.js";
 import {
   announceSubscriptionRequired,
   denyReasonFrom,
   isDeferAnswer,
   oncePerSession
 } from "./chunk-5OP5MQI7.js";
+import {
+  activeHookSource,
+  activeIdentity
+} from "./chunk-7HGR5GNY.js";
 import {
   UNNAMED_ACTION,
   approvalAwaitingRetry,
@@ -39,7 +39,7 @@ import {
   reportEvent,
   scopePathFor,
   settleQuestionsForToolUse
-} from "./chunk-KRCR2CRQ.js";
+} from "./chunk-LDQGURCF.js";
 import {
   DEFAULT_SESSION
 } from "./chunk-N6IOSZOE.js";
@@ -53,25 +53,26 @@ import {
   requestGate,
   sendNotification,
   waitForQuestion
-} from "./chunk-2VZAALEJ.js";
+} from "./chunk-ZSGJYSF2.js";
 import {
   SubscriptionRequiredError
-} from "./chunk-MKTJEXZ3.js";
+} from "./chunk-I3W7GJ5R.js";
 import {
   getMachineId
-} from "./chunk-DUZVXBBU.js";
+} from "./chunk-H4F5O3RE.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-5QUPKDI5.js";
+} from "./chunk-2M52CFVO.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-7DVNSQWF.js";
+} from "./chunk-TCXL5FQQ.js";
 import {
   AGENT_QUESTION_STRATEGY,
   DECISION_STOP_REASON,
   GATE_BLOCK_REASON_MAX_LENGTH,
   GATE_WIRE,
+  PLAN_DECLINED_REASON,
   UNVERIFIABLE_APPROVAL_REASON,
   WITHDRAWN_APPROVAL_REASON,
   agentQuestionStrategy,
@@ -83,9 +84,9 @@ import {
   claudePermissionRequestOutput,
   claudePermissionRulesFromSettings,
   claudePreToolUseOutput,
-  claudePromptsBeforeAnEdit,
+  claudeStoppedPermissionRequestOutput,
   claudeStoppedPreToolUseOutput,
-  editAsksAtTheAgentsPrompt,
+  editGoesToTheAgentsPrompt,
   effectiveWaitSeconds,
   hookHoldWindowMs,
   hookWaitClamped,
@@ -96,9 +97,9 @@ import {
   isPusharyOwnTool,
   parseAgentQuestionAnswers,
   parseAgentQuestions,
-  resolveGate,
-  stoppedOutput
-} from "./chunk-I5IJRMNV.js";
+  questionHandedToTheTerminal,
+  resolveGate
+} from "./chunk-5RGA636G.js";
 
 // src/claude-permission-rules.ts
 import { readFileSync, statSync } from "fs";
@@ -450,7 +451,7 @@ var askQuestionByQuestion = async (apiKey, input, parsed, projectName, deadline)
   return answers;
 };
 var handleAskUserQuestion = async (apiKey, input, modeState) => {
-  if (modeState.askHandoff) return void 0;
+  if (questionHandedToTheTerminal(input.tool_name, modeState)) return void 0;
   const parsed = parseQuestions(input.tool_input ?? {});
   if (!parsed) return void 0;
   const projectName = basename(input.cwd ?? process.cwd());
@@ -496,7 +497,7 @@ var handleExitPlanMode = async (apiKey, input) => {
     return void 0;
   }
   if (value === PLAN_APPROVE) return allow();
-  return deny("Plan declined from the phone. Ask what to change before coding.");
+  return deny(PLAN_DECLINED_REASON);
 };
 var handleKeyless = (input) => {
   try {
@@ -617,7 +618,7 @@ var handlePreToolUse = async (input, canonical) => {
       return void 0;
     }
     if (claudeAllowlistOwnsCall(gateInput, verdict, input.permission_mode, claudePermissionRulesFor(input))) return void 0;
-    if (claudePromptsBeforeAnEdit(input.permission_mode) && editAsksAtTheAgentsPrompt(gateInput, verdict)) return handleTerminalOnly();
+    if (editGoesToTheAgentsPrompt({ source: ACTIVE_SOURCE, event: "PreToolUse", permissionMode: input.permission_mode }, gateInput, verdict)) return handleTerminalOnly();
     switch (verdict.kind) {
       case "allow":
         return allow();
@@ -637,7 +638,7 @@ var handlePreToolUse = async (input, canonical) => {
 };
 var permReqAllow = (updatedInput) => claudePermissionRequestOutput("allow", void 0, updatedInput);
 var permReqDeny = (message) => claudePermissionRequestOutput("deny", message);
-var permReqHalted = (reason) => stoppedOutput(permReqDeny(reason), reason);
+var permReqHalted = (reason) => claudeStoppedPermissionRequestOutput(reason);
 var toPermissionRequestOutput = (hookOutput) => {
   if (!hookOutput) return void 0;
   const d = hookOutput.hookSpecificOutput;

package/dist/{chunk-I5IJRMNV.js → chunk-5RGA636G.js}

@@ -2186,7 +2186,9 @@ function agentQuestionStrategy(source, event, toolName) {
   if (source !== null && event === "PreToolUse" && UPDATED_INPUT_QUESTION_SOURCES.has(source)) return AGENT_QUESTION_STRATEGY.updatedInput;
   return AGENT_QUESTION_STRATEGY.native;
 }
-var ASKED_IN_EVERY_MODE_TOOLS = [AGENT_QUESTION_TOOL, "ExitPlanMode"];
+var questionHandedToTheTerminal = (toolName, modeState) => toolName === AGENT_QUESTION_TOOL && modeState.askHandoff === true;
+var EXIT_PLAN_MODE_TOOL = "ExitPlanMode";
+var ASKED_IN_EVERY_MODE_TOOLS = [AGENT_QUESTION_TOOL, EXIT_PLAN_MODE_TOOL];
 var ASKED_IN_EVERY_MODE = new Set(ASKED_IN_EVERY_MODE_TOOLS);
 var isAskedInEveryMode = (toolName) => ASKED_IN_EVERY_MODE.has(toolName);
 var NATIVE_BLOCK_EVENTS = /* @__PURE__ */ new Set(["PermissionDenied"]);
@@ -2267,6 +2269,12 @@ var resolveGate = (input) => {
 };
 var editAsksAtTheAgentsPrompt = (input, verdict) => verdict.kind === "gate" && !verdict.scopeReason && (input.modeState.mode ?? input.config.modeOverride ?? null) === null && !aChosenRuleGoverns(input) && verdict.policy.mode === "push_first" && ACCEPT_EDITS_DEFER_TOOLS.has(input.toolName);
 var claudePromptsBeforeAnEdit = (permissionMode) => permissionMode === "default";
+var runsTheClaudeHook = (source) => source === null || source === "claude" || hookCompatibleProfileBySource(source) !== void 0;
+var agentPromptsBeforeAnEdit = ({ source, event, permissionMode }) => {
+  if (source === "codex") return event === "PermissionRequest";
+  return event === "PreToolUse" && runsTheClaudeHook(source) && claudePromptsBeforeAnEdit(permissionMode);
+};
+var editGoesToTheAgentsPrompt = (call, input, verdict) => agentPromptsBeforeAnEdit(call) && editAsksAtTheAgentsPrompt(input, verdict);
 var MAX_AGENT_PERMISSION_RULES_PER_KIND = 256;
 var MAX_AGENT_PERMISSION_RULE_LENGTH = 512;
 var isAgentPermissionRule = (value) => typeof value === "string" && value.length > 0 && value.length <= MAX_AGENT_PERMISSION_RULE_LENGTH;
@@ -2437,6 +2445,7 @@ var claudePermissionRequestOutput = (decision, reason, updatedInput) => ({
     decision: decision === "allow" ? { behavior: "allow", ...updatedInput ? { updatedInput } : {} } : { behavior: "deny", ...reason ? { message: reason } : {} }
   }
 });
+var DENIED_FROM_PUSHARY_REASON = "Denied from Pushary";
 var gateOutputFor = (source, event, decision, reason) => {
   let output;
   if (source === "claude" || source === "vscode") {
@@ -2452,7 +2461,7 @@ var gateOutputFor = (source, event, decision, reason) => {
       output = {
         hookSpecificOutput: {
           hookEventName: "PermissionRequest",
-          decision: decision === "allow" ? { behavior: "allow" } : { behavior: "deny", message: reason ?? "Denied from Pushary" }
+          decision: decision === "allow" ? { behavior: "allow" } : { behavior: "deny", message: reason ?? DENIED_FROM_PUSHARY_REASON }
         }
       };
     } else if (event === "PreToolUse" && decision === "deny") {
@@ -2460,19 +2469,19 @@ var gateOutputFor = (source, event, decision, reason) => {
         hookSpecificOutput: {
           hookEventName: "PreToolUse",
           permissionDecision: "deny",
-          permissionDecisionReason: reason ?? "Denied from Pushary"
+          permissionDecisionReason: reason ?? DENIED_FROM_PUSHARY_REASON
         }
       };
     }
   } else if (source === "gemini" && event === "BeforeTool" && decision !== "ask") {
-    output = decision === "allow" ? { decision: "allow" } : { decision: "deny", reason: reason ?? "Denied from Pushary" };
+    output = decision === "allow" ? { decision: "allow" } : { decision: "deny", reason: reason ?? DENIED_FROM_PUSHARY_REASON };
   } else if (source === "opencode" && event === OPENCODE_APPROVAL_EVENT) {
-    output = decision === "deny" ? { status: "deny", reason: reason ?? "Denied from Pushary" } : { status: decision };
+    output = decision === "deny" ? { status: "deny", reason: reason ?? DENIED_FROM_PUSHARY_REASON } : { status: decision };
   } else if (source === "cursor" && CURSOR_GATE_EVENTS.includes(event)) {
     output = decision === "allow" ? { permission: "allow" } : decision === "ask" && event !== "preToolUse" ? { permission: "ask" } : {
       permission: "deny",
       user_message: "Command denied via Pushary.",
-      agent_message: reason ?? "Denied from Pushary"
+      agent_message: reason ?? DENIED_FROM_PUSHARY_REASON
     };
   } else {
     const profile = hookCompatibleProfileBySource(source);
@@ -2500,7 +2509,9 @@ var renderElicitationOutput = (event, action, content) => ELICITATION_EVENTS.inc
 var UNVERIFIABLE_APPROVAL_REASON = "Pushary could not create a verifiable approval. Retry the action.";
 var DECISION_STOP_REASON = "Approval was cancelled or became unavailable. Retry only after resolving it.";
 var WITHDRAWN_APPROVAL_REASON = "The phone question was withdrawn. Approve in the current client.";
+var PLAN_DECLINED_REASON = "Plan declined from the phone. Ask what to change before coding.";
 var claudeStoppedPreToolUseOutput = (reason) => stoppedOutput(claudePreToolUseOutput("deny", reason), reason);
+var claudeStoppedPermissionRequestOutput = (reason) => stoppedOutput(claudePermissionRequestOutput("deny", reason), reason);
 var ELICITATION_ANSWERABLE_MODE = "form";
 var ELICITATION_MIN_OPTIONS = 2;
 var ELICITATION_MAX_MULTI_QUESTIONS = 4;
@@ -2866,6 +2877,7 @@ export {
   shouldDeferToNativeMode,
   AGENT_QUESTION_STRATEGY,
   agentQuestionStrategy,
+  questionHandedToTheTerminal,
   CODEX_RESCUE_TOOL_NAME,
   isBlockedActionRequest,
   BLOCKED_ACTION_GRANT_TTL_SECONDS,
@@ -2874,8 +2886,7 @@ export {
   isPermissionRequestOwnedByPreToolUse,
   CLAUDE_PRETOOLUSE_MATCHER,
   resolveGate,
-  editAsksAtTheAgentsPrompt,
-  claudePromptsBeforeAnEdit,
+  editGoesToTheAgentsPrompt,
   claudePermissionRulesFromSettings,
   claudeConsultsItsAllowlist,
   agentRulesAllowEveryInput,
@@ -2888,7 +2899,6 @@ export {
   machineDecisionFor,
   claudePermissionDeniedOutput,
   codexStopRescueOutput,
-  stoppedOutput,
   claudePreToolUseOutput,
   PENDING_COMMAND_PREFIX,
   pendingCommandEvents,
@@ -2898,7 +2908,9 @@ export {
   UNVERIFIABLE_APPROVAL_REASON,
   DECISION_STOP_REASON,
   WITHDRAWN_APPROVAL_REASON,
+  PLAN_DECLINED_REASON,
   claudeStoppedPreToolUseOutput,
+  claudeStoppedPermissionRequestOutput,
   ELICITATION_ANSWERABLE_MODE,
   readElicitationFields,
   planElicitationAsk,

package/dist/{chunk-IAD2RT4L.js → chunk-6KNC6KLL.js}

@@ -14,19 +14,19 @@ import {
 } from "./chunk-U4TMAANR.js";
 import {
   callMcpTool
-} from "./chunk-MKTJEXZ3.js";
+} from "./chunk-I3W7GJ5R.js";
 import {
   reportedInstallSource
-} from "./chunk-FQ2GORVG.js";
+} from "./chunk-Q3UMWSE4.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-7DVNSQWF.js";
+} from "./chunk-TCXL5FQQ.js";
 import {
   NO_PAIRING_COMPUTER,
   PAIR_TTL_SECONDS,
   classifyConfirmResponse,
   isAnswerSource
-} from "./chunk-I5IJRMNV.js";
+} from "./chunk-5RGA636G.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {

package/dist/{chunk-KHNFLYJO.js → chunk-7HGR5GNY.js}

@@ -3,17 +3,17 @@ import {
   addGeminiMcpServer,
   removeGeminiMcpServer,
   supportedClaudeEvents
-} from "./chunk-3I6IVOZV.js";
+} from "./chunk-PR2VDVCP.js";
 import {
   CLAUDE_CODE_AGENT,
   parseApplyPatchFiles
-} from "./chunk-KRCR2CRQ.js";
+} from "./chunk-LDQGURCF.js";
 import {
   guardBinary,
   holdBudgetOf,
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-ZBHUHJG6.js";
+} from "./chunk-UJZ7AGSC.js";
 import {
   HOOK_LOCATOR_BINARY,
   PHONE_ANSWERED_TOOLS,
@@ -21,7 +21,7 @@ import {
   hookCompatibleProfileBySource,
   toToolLookup,
   withHookHoldBudget
-} from "./chunk-I5IJRMNV.js";
+} from "./chunk-5RGA636G.js";
 
 // src/claude-config.ts
 import { join } from "path";

package/dist/{chunk-BEJRK4DF.js → chunk-AKPHYSEL.js}

@@ -2,25 +2,25 @@ import {
   SIGNED_OUT_ON_MAC_MESSAGE,
   describeSignedOutKey,
   readSignedOutDiagnosis
-} from "./chunk-2WXF3QJR.js";
+} from "./chunk-LXA236ZQ.js";
 import {
   createIo
 } from "./chunk-U4TMAANR.js";
 import {
   readKeySource
-} from "./chunk-N4QSPI3B.js";
+} from "./chunk-GTZ4HIHU.js";
 import {
   absoluteUrl,
   checkApiKey,
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-LWOO567I.js";
+} from "./chunk-XXLCYKVS.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
 import {
   getBaseUrl
-} from "./chunk-5QUPKDI5.js";
+} from "./chunk-2M52CFVO.js";
 
 // src/cli/report-key.ts
 var { dim, yellow } = createIo();
@@ -90,5 +90,6 @@ var exitOnFailedSettingsRequest = async (response, settings) => {
 
 export {
   printKeyCheck,
+  APPROVAL_SETTINGS_PATH,
   exitOnFailedSettingsRequest
 };

package/dist/{chunk-ZBK6E2OR.js → chunk-APP43AW7.js}

@@ -1,6 +1,6 @@
 import {
   redactSecretsFromContent
-} from "./chunk-I5IJRMNV.js";
+} from "./chunk-5RGA636G.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";

package/dist/chunk-BOSXFI7L.js

@@ -0,0 +1,52 @@
+import {
+  macAppBridgeAvailable
+} from "./chunk-QAGWWDXQ.js";
+import {
+  keyPrefix
+} from "./chunk-GTZ4HIHU.js";
+import {
+  bridgeAgentKey
+} from "./chunk-UJZ7AGSC.js";
+import {
+  readJsonSafe
+} from "./chunk-T7E75EKA.js";
+import {
+  isValidApiKey
+} from "./chunk-5RGA636G.js";
+
+// src/shared-mcp-key.ts
+var asRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+var pusharyKey = (value) => typeof value === "string" && isValidApiKey(value.trim()) ? value.trim() : null;
+var bearerKey = (authorization) => typeof authorization === "string" && authorization.startsWith("Bearer ") ? pusharyKey(authorization.slice("Bearer ".length)) : null;
+var mcpServerBearer = (mcpServers) => bearerKey(asRecord(asRecord(asRecord(mcpServers)?.pushary)?.headers)?.Authorization);
+var appAgentKey = (bridgeAgentKey2) => pusharyKey(asRecord(bridgeAgentKey2)?.key);
+var setupReceiptKey = (claudeMcpReceipt) => bearerKey(asRecord(asRecord(asRecord(claudeMcpReceipt)?.installedPushary)?.headers)?.Authorization);
+var macAppKeepsMcpEntry = (entryKey, keys) => {
+  if (!entryKey) return true;
+  if (keys.appKey) return entryKey === keys.appKey;
+  return entryKey !== keys.setupKey;
+};
+
+// src/mac-app-key.ts
+var NOT_CONNECTED = { kind: "not_connected" };
+var CONNECTED_THROUGH_MAC_APP = "This computer is connected through the Pushary Mac app";
+var PAIR_FROM_MAC_APP = "Pair a phone from the Pushary Mac app: Settings > Phone > Pair.";
+var readMacAppAgentKey = () => {
+  const stored = readJsonSafe(bridgeAgentKey());
+  return stored.kind === "ok" ? appAgentKey(stored.value) : null;
+};
+var macAppConnectionOf = (appKey, appInstalled) => appKey !== null && appInstalled() ? { kind: "connected", keyPrefix: keyPrefix(appKey) } : NOT_CONNECTED;
+var readMacAppConnection = () => macAppConnectionOf(readMacAppAgentKey(), macAppBridgeAvailable);
+var readMacAppConnectionWhenKeyless = (cliKey) => cliKey ? NOT_CONNECTED : readMacAppConnection();
+
+export {
+  pusharyKey,
+  mcpServerBearer,
+  setupReceiptKey,
+  macAppKeepsMcpEntry,
+  CONNECTED_THROUGH_MAC_APP,
+  PAIR_FROM_MAC_APP,
+  readMacAppAgentKey,
+  readMacAppConnection,
+  readMacAppConnectionWhenKeyless
+};

package/dist/{chunk-WS4H76EP.js → chunk-BTFUSQFB.js}

@@ -3,11 +3,11 @@ import {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-ZBK6E2OR.js";
+} from "./chunk-APP43AW7.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-CLOSJ4ES.js";
+} from "./chunk-MISUKJGW.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;

package/dist/{chunk-B64KHETR.js → chunk-BVPPYR7B.js}

@@ -1,6 +1,6 @@
 import {
   SETUP_FLAGS
-} from "./chunk-DL7XWKYV.js";
+} from "./chunk-ZGADIZDS.js";
 import {
   parseFlags
 } from "./chunk-GMXKITVA.js";
@@ -9,7 +9,7 @@ import {
 } from "./chunk-7QLSKOSU.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-7DVNSQWF.js";
+} from "./chunk-TCXL5FQQ.js";
 import {
   CLAUDE_CONNECTOR_GUIDE,
   CLAUDE_CONNECTOR_STEPS,
@@ -17,7 +17,7 @@ import {
   CLAUDE_CONNECTOR_URL,
   COWORK_CONNECTOR_LIMIT,
   COWORK_STANDING_INSTRUCTIONS
-} from "./chunk-I5IJRMNV.js";
+} from "./chunk-5RGA636G.js";
 
 // src/cli/cowork.ts
 import { readFileSync } from "fs";

package/dist/{chunk-TCWKTUAE.js → chunk-BVSIM4EF.js}

@@ -1,10 +1,10 @@
 import {
   pusharyHookExecutable
-} from "./chunk-2QGYMY7A.js";
+} from "./chunk-SIHYBIEN.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-ZBHUHJG6.js";
+} from "./chunk-UJZ7AGSC.js";
 
 // src/cursor-config.ts
 var hookCommandOf = (entry) => {

package/dist/{chunk-BXET3ALR.js → chunk-C6QTMWJZ.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-ZBHUHJG6.js";
+} from "./chunk-UJZ7AGSC.js";
 import {
   readJsonSafe,
   writeFileAtomic
@@ -13,7 +13,7 @@ import {
   serializeDeclinedAgents,
   withDeclinedAgent,
   withoutDeclinedAgent
-} from "./chunk-I5IJRMNV.js";
+} from "./chunk-5RGA636G.js";
 
 // src/declined-agents-file.ts
 import { join } from "path";

package/dist/{chunk-IHO3YQAN.js → chunk-CJYM4ZHV.js}

@@ -5,7 +5,7 @@ import {
   permissionDeniedAction,
   releaseThrottle,
   reportEvent
-} from "./chunk-KRCR2CRQ.js";
+} from "./chunk-LDQGURCF.js";
 import {
   DEFAULT_SESSION
 } from "./chunk-N6IOSZOE.js";
@@ -13,7 +13,7 @@ import {
   machineDecisionFor,
   shouldDeferToNativeMode,
   wireVerdictFor
-} from "./chunk-I5IJRMNV.js";
+} from "./chunk-5RGA636G.js";
 
 // src/machine-decision-audit.ts
 import { basename } from "path";

package/dist/{chunk-6TE27XZR.js → chunk-DAOQT4WK.js}

@@ -1,9 +1,9 @@
 import {
   CODEX_HOOK_STATUS
-} from "./chunk-MGRFDGWU.js";
+} from "./chunk-Y7JM47CI.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-7DVNSQWF.js";
+} from "./chunk-TCXL5FQQ.js";
 
 // src/setup/codex-trust.ts
 var CODEX_TRUST_TELEMETRY = {

package/dist/{chunk-V5HPPF3E.js → chunk-DL6QHS7V.js}

@@ -2,7 +2,7 @@ import {
   autoUpdateLock,
   installPackageGlobally,
   npmErrorMessage
-} from "./chunk-ZBHUHJG6.js";
+} from "./chunk-UJZ7AGSC.js";
 import {
   writeJsonAtomic
 } from "./chunk-T7E75EKA.js";

package/dist/{chunk-DPGSLWOS.js → chunk-DWO4RLYK.js}

@@ -4,40 +4,40 @@ import {
   savePin,
   verifyRecipients
 } from "./chunk-SGZJ5LYH.js";
-import {
-  hookOwnerOf
-} from "./chunk-YIG2R3BJ.js";
 import {
   ensureDaemonRunning
-} from "./chunk-LKLVTG3V.js";
+} from "./chunk-RPQLZLKC.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-ZBK6E2OR.js";
+} from "./chunk-APP43AW7.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-CLOSJ4ES.js";
+} from "./chunk-MISUKJGW.js";
 import {
   transcriptEnvironmentPreference,
   transcriptsEnabled
-} from "./chunk-M6BZZFVQ.js";
+} from "./chunk-QGRENWJL.js";
+import {
+  hookOwnerOf
+} from "./chunk-SIHYBIEN.js";
 import {
   readTranscriptPreference
-} from "./chunk-N4QSPI3B.js";
+} from "./chunk-GTZ4HIHU.js";
 import {
   codexHome,
   pusharyDir
-} from "./chunk-ZBHUHJG6.js";
+} from "./chunk-UJZ7AGSC.js";
 import {
   writeJsonAtomic
 } from "./chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-5QUPKDI5.js";
+} from "./chunk-2M52CFVO.js";
 
 // src/transcript-registration.ts
 import { createHash } from "crypto";

package/dist/{chunk-GU3EJCVV.js → chunk-EA5NWDK7.js}

@@ -1,3 +1,6 @@
+// src/hooks-spec.ts
+var CURSOR_GATE_SCRIPT = "pushary-gate.mjs";
+
 // src/diagnostics/service-runtime.ts
 var unescapeXml = (value) => value.replaceAll("&quot;", '"').replaceAll("&apos;", "'").replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&amp;", "&");
 var unquoteSystemd = (value) => value.replaceAll('\\"', '"').replaceAll("\\\\", "\\").replaceAll("%%", "%");
@@ -37,6 +40,7 @@ var versionManagerOf = (execPath) => {
 var describeVersionManagerPin = (execPath, manager) => `The background service is pinned to ${execPath}, which ${manager} manages. Switching Node versions strands it; run pushary daemon install afterwards.`;
 
 export {
+  CURSOR_GATE_SCRIPT,
   readServiceExecPath,
   versionManagerOf,
   describeVersionManagerPin

package/dist/{chunk-I6MJXLMY.js → chunk-EVC765EO.js}

@@ -10,10 +10,10 @@ import {
   resolvePackageVersionFromBinary,
   resolvePathBinary,
   resolvePathBinaryAsync
-} from "./chunk-ZBHUHJG6.js";
+} from "./chunk-UJZ7AGSC.js";
 import {
   MANAGED_PROVIDERS
-} from "./chunk-I5IJRMNV.js";
+} from "./chunk-5RGA636G.js";
 
 // src/setup/codex-install.ts
 var NATIVE_BINARY_MIN_BYTES = 20 * 1024 * 1024;

package/dist/{chunk-WG3K4TCH.js → chunk-GQYX24UC.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-ZBHUHJG6.js";
+} from "./chunk-UJZ7AGSC.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-N4QSPI3B.js → chunk-GTZ4HIHU.js}

@@ -1,6 +1,6 @@
 import {
   resolveInstallSourceFor
-} from "./chunk-FQ2GORVG.js";
+} from "./chunk-Q3UMWSE4.js";
 import {
   backupFile,
   readJsonSafe,
@@ -9,7 +9,7 @@ import {
 } from "./chunk-T7E75EKA.js";
 import {
   configFilePath
-} from "./chunk-5QUPKDI5.js";
+} from "./chunk-2M52CFVO.js";
 
 // src/shell-alias.ts
 import { homedir } from "os";
@@ -322,19 +322,20 @@ var shellProfileCandidates = () => {
   const fallbacks = FALLBACK_RCS.map((name) => join2(homedir2(), name));
   return resolved ? [resolved.path, ...fallbacks.filter((path) => path !== resolved.path)] : fallbacks;
 };
-var findExportedKeyLine = (profiles = shellProfileCandidates()) => {
-  for (const path of profiles) {
-    let contents;
-    try {
-      contents = readFileSync2(path, "utf8");
-    } catch {
-      continue;
-    }
-    const found = findKeyExport(contents);
-    if (found) return { path, ...found };
+var readProfileOrNull = (path) => {
+  try {
+    return readFileSync2(path, "utf8");
+  } catch {
+    return null;
   }
-  return null;
 };
+var exportedKeyLineIn = (path) => {
+  const contents = readProfileOrNull(path);
+  const found = contents === null ? null : findKeyExport(contents);
+  return found ? [{ path, ...found }] : [];
+};
+var findExportedKeyLines = (profiles = shellProfileCandidates()) => profiles.flatMap(exportedKeyLineIn);
+var findExportedKeyLine = (profiles = shellProfileCandidates()) => findExportedKeyLines(profiles)[0] ?? null;
 
 export {
   CANDIDATE_RCS,
@@ -354,5 +355,6 @@ export {
   readKeySource,
   readMacAppKeyPrefix,
   recordMacAppKeyPrefix,
+  findExportedKeyLines,
   findExportedKeyLine
 };

package/dist/{chunk-DUZVXBBU.js → chunk-H4F5O3RE.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-ZBHUHJG6.js";
+} from "./chunk-UJZ7AGSC.js";
 import {
   writeFileAtomic
 } from "./chunk-T7E75EKA.js";