@pushary/agent-hooks 1.9.8 → 1.9.10

package/dist/{chunk-MKTJEXZ3.js → chunk-I3W7GJ5R.js}

@@ -1,12 +1,12 @@
 import {
   keyCheckFromResponse
-} from "./chunk-LWOO567I.js";
+} from "./chunk-XXLCYKVS.js";
 import {
   installNetworkDefaults
-} from "./chunk-TCQ43LSG.js";
+} from "./chunk-UM5WXBKN.js";
 import {
   getBaseUrl
-} from "./chunk-5QUPKDI5.js";
+} from "./chunk-2M52CFVO.js";
 
 // src/retry.ts
 var isRetryable = (err) => {

package/dist/{chunk-ZSTSEBG7.js → chunk-IIVZZMSO.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-I5IJRMNV.js";
+} from "./chunk-5RGA636G.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-KRCR2CRQ.js → chunk-LDQGURCF.js}

@@ -14,36 +14,36 @@ import {
   IDLE_PROMPT_NOTIFICATION,
   NOTIFICATION_PUSH_TYPES,
   POSTTOOLUSE_MIRROR_ONLY_TOOLS
-} from "./chunk-CD47ZFFZ.js";
+} from "./chunk-MD4SVNT6.js";
 import {
   cancelQuestion,
   isPolicyConfig,
   sendNotification,
   waitForAnswer
-} from "./chunk-2VZAALEJ.js";
+} from "./chunk-ZSGJYSF2.js";
+import {
+  withRetry
+} from "./chunk-I3W7GJ5R.js";
 import {
   clientErrorKindOf,
   reportClientError
-} from "./chunk-DKMD6AWR.js";
-import {
-  withRetry
-} from "./chunk-MKTJEXZ3.js";
+} from "./chunk-NQ67AF3V.js";
 import {
   getMachineId
-} from "./chunk-DUZVXBBU.js";
+} from "./chunk-H4F5O3RE.js";
 import {
   reportedInstallSource
-} from "./chunk-FQ2GORVG.js";
+} from "./chunk-Q3UMWSE4.js";
 import {
   canonicalJson
-} from "./chunk-ZBHUHJG6.js";
+} from "./chunk-UJZ7AGSC.js";
 import {
   writeFileAtomic
 } from "./chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-5QUPKDI5.js";
+} from "./chunk-2M52CFVO.js";
 import {
   ACTION_BODY_MAX,
   AGENT_LABELS_BY_TYPE,
@@ -70,7 +70,7 @@ import {
   resolvePolicy,
   toToolLookup,
   truncateLine
-} from "./chunk-I5IJRMNV.js";
+} from "./chunk-5RGA636G.js";
 
 // src/policy.ts
 import { createHash } from "crypto";

package/dist/{chunk-2WXF3QJR.js → chunk-LXA236ZQ.js}

@@ -3,10 +3,10 @@ import {
   keyPrefix,
   readConfigFileKey,
   readMacAppKeyPrefix
-} from "./chunk-N4QSPI3B.js";
+} from "./chunk-GTZ4HIHU.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-7DVNSQWF.js";
+} from "./chunk-TCXL5FQQ.js";
 
 // src/key-signed-out.ts
 var VERDICT_BY_CHECK = {

package/dist/{chunk-CD47ZFFZ.js → chunk-MD4SVNT6.js}

@@ -1,6 +1,6 @@
 import {
   PRETOOLUSE_GATED_TOOLS
-} from "./chunk-I5IJRMNV.js";
+} from "./chunk-5RGA636G.js";
 
 // src/claude-tools.ts
 var POSTTOOLUSE_MIRROR_ONLY_TOOLS = ["TodoWrite", "Task", "WebFetch", "WebSearch"];

package/dist/{chunk-CLOSJ4ES.js → chunk-MISUKJGW.js}

@@ -1,6 +1,6 @@
 import {
   getBaseUrl
-} from "./chunk-5QUPKDI5.js";
+} from "./chunk-2M52CFVO.js";
 
 // src/transcript-api.ts
 var fetchTranscriptRecipients = async (apiKey, baseUrl = getBaseUrl()) => {

package/dist/{chunk-DKMD6AWR.js → chunk-NQ67AF3V.js}

@@ -4,18 +4,18 @@ import {
 } from "./chunk-POFBE6ZY.js";
 import {
   isNetworkFailure
-} from "./chunk-TCQ43LSG.js";
+} from "./chunk-UM5WXBKN.js";
 import {
   clientReportClaims
-} from "./chunk-ZBHUHJG6.js";
+} from "./chunk-UJZ7AGSC.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-5QUPKDI5.js";
+} from "./chunk-2M52CFVO.js";
 import {
   CLIENT_REPORT_PATH,
   degradedLine
-} from "./chunk-I5IJRMNV.js";
+} from "./chunk-5RGA636G.js";
 
 // src/client-report-claim.ts
 import { createHash } from "crypto";

package/dist/{chunk-HRULIYDU.js → chunk-OL2Z7WI4.js}

@@ -1,9 +1,9 @@
 import {
   parseSseMessages
-} from "./chunk-MKTJEXZ3.js";
+} from "./chunk-I3W7GJ5R.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-7DVNSQWF.js";
+} from "./chunk-TCXL5FQQ.js";
 
 // src/mcp-stdio-bridge.ts
 var MCP_BRIDGE_BINARY = "pushary-mcp";

package/dist/{chunk-MXHTGVFZ.js → chunk-PNC5ZQFS.js}

@@ -1,36 +1,31 @@
-import {
-  agentHookOwner,
-  macAppBridgeAvailable,
-  openCodePluginOwner
-} from "./chunk-3Z3A37WD.js";
 import {
   ensureCodexTrustsPusharyHooks
-} from "./chunk-MGRFDGWU.js";
+} from "./chunk-Y7JM47CI.js";
+import {
+  detectClaudeVersion
+} from "./chunk-RIVNNBEK.js";
 import {
   OPENCODE_HOOK_BINARY,
+  agentHookOwner,
   installOpenCodePlugin,
+  macAppBridgeAvailable,
   openCodeHookArgv,
   openCodePluginDir,
   openCodeWired
-} from "./chunk-MFF3ONG5.js";
+} from "./chunk-QAGWWDXQ.js";
 import {
   addClaudeMcpServer,
   addPusharyHooks,
   addPusharyToolPermissions
-} from "./chunk-KHNFLYJO.js";
-import {
-  detectClaudeVersion
-} from "./chunk-RIVNNBEK.js";
-import {
-  planHooks
-} from "./chunk-YIG2R3BJ.js";
+} from "./chunk-7HGR5GNY.js";
 import {
   claudeUnprovenHolds,
   claudeWired,
   codexUnprovenHolds,
   codexWired,
-  geminiWired
-} from "./chunk-2QGYMY7A.js";
+  geminiWired,
+  planHooks
+} from "./chunk-SIHYBIEN.js";
 import {
   CLAUDE_HOOK_BINARY,
   CLAUDE_HOOK_EVENTS,
@@ -41,7 +36,7 @@ import {
   needsReregistration,
   registrationSignatures,
   supportedClaudeEvents
-} from "./chunk-3I6IVOZV.js";
+} from "./chunk-PR2VDVCP.js";
 import {
   formatVersion
 } from "./chunk-6ICPEJY5.js";
@@ -64,7 +59,7 @@ import {
   registrationHolderOf,
   resolveGlobalBinary,
   vscodePluginMcp
-} from "./chunk-ZBHUHJG6.js";
+} from "./chunk-UJZ7AGSC.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -335,9 +330,10 @@ var SETUP_CHOICE_BY_REAPPLY_ID = {
   codex: "codex",
   gemini: "gemini_cli",
   cursor: "cursor",
-  vscode: "vscode"
+  vscode: "vscode",
+  opencode: "opencode"
 };
-var reapplyHookOwner = (id, appAvailable) => id === "opencode" ? openCodePluginOwner(appAvailable) : agentHookOwner(SETUP_CHOICE_BY_REAPPLY_ID[id], appAvailable);
+var reapplyHookOwner = (id, appAvailable) => agentHookOwner(SETUP_CHOICE_BY_REAPPLY_ID[id], appAvailable);
 var reapplyHolder = (id, appAvailable) => planHooks({ owner: reapplyHookOwner(id, appAvailable), takeOverHooks: false, nonInteractive: true }) === "keep" ? "app" : "cli";
 var KEPT_FOR_APP = { configured: true, reapplied: false, hooks: false, mcp: false };
 var FAILED_REAPPLY = { configured: false, reapplied: false, hooks: false, mcp: false, failed: true };

package/dist/{chunk-3I6IVOZV.js → chunk-PR2VDVCP.js}

@@ -5,16 +5,16 @@ import {
 import {
   NOTIFICATION_MATCHED_TYPES,
   POSTTOOLUSE_MIRRORED_TOOLS
-} from "./chunk-CD47ZFFZ.js";
+} from "./chunk-MD4SVNT6.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-ZBHUHJG6.js";
+} from "./chunk-UJZ7AGSC.js";
 import {
   CLAUDE_PRETOOLUSE_MATCHER,
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY
-} from "./chunk-I5IJRMNV.js";
+} from "./chunk-5RGA636G.js";
 
 // src/gemini-config.ts
 var GEMINI_HOOK_BINARY = "pushary-gemini-hook";

package/dist/{chunk-FQ2GORVG.js → chunk-Q3UMWSE4.js}

@@ -1,9 +1,9 @@
 import {
   configFilePath
-} from "./chunk-5QUPKDI5.js";
+} from "./chunk-2M52CFVO.js";
 import {
   normalizeInstallSource
-} from "./chunk-I5IJRMNV.js";
+} from "./chunk-5RGA636G.js";
 
 // src/install-source.ts
 import { readFileSync } from "fs";

package/dist/{chunk-MFF3ONG5.js → chunk-QAGWWDXQ.js}

@@ -1,14 +1,39 @@
 import {
-  guardedArgv
-} from "./chunk-ZBHUHJG6.js";
+  compatibleConfigFile
+} from "./chunk-7HGR5GNY.js";
+import {
+  hookOwnerOf,
+  hookOwnerOfCommands,
+  liveBridgeProbe,
+  resolveBridgeStub
+} from "./chunk-SIHYBIEN.js";
+import {
+  AGENT_CHOICES
+} from "./chunk-ZGADIZDS.js";
+import {
+  claudeSettings,
+  codexHooksJson,
+  cursorUserHooks,
+  geminiSettings,
+  guardedArgv,
+  pusharyDir,
+  vscodePluginDir
+} from "./chunk-UJZ7AGSC.js";
+import {
+  readJsonSafe
+} from "./chunk-T7E75EKA.js";
 import {
   HOOK_BUDGETS,
-  OPENCODE_APPROVAL_EVENT
-} from "./chunk-I5IJRMNV.js";
+  HOOK_COMPATIBLE_PROFILES,
+  HOOK_LOCATOR_BINARY,
+  OPENCODE_APPROVAL_EVENT,
+  hookCompatibleProfile
+} from "./chunk-5RGA636G.js";
 
 // src/opencode-plugin.ts
 var OPENCODE_PLUGIN_MARKER = "pushary-opencode-plugin w1";
 var OPENCODE_PLUGIN_PLACEHOLDER = "__PUSHARY_COMMAND__";
+var OPENCODE_APPROVAL_EVENTS_PLACEHOLDER = "__PUSHARY_APPROVAL_EVENTS__";
 var OPENCODE_PLUGIN_FILE = "pushary.js";
 var OPENCODE_PLUGIN_DIR = "plugins";
 var OPENCODE_PLUGIN_SIBLING = "package.json";
@@ -262,7 +287,7 @@ export const PusharyPlugin = async ({ client, directory, worktree }) => {
       try {
         const type = event && event.type
         const properties = event && event.properties
-        if (${JSON.stringify(OPENCODE_ASKED_EVENTS)}.includes(type)) {
+        if (${OPENCODE_APPROVAL_EVENTS_PLACEHOLDER}.includes(type)) {
           const asked = askedFrom(properties)
           if (asked) void gate(asked)
           return
@@ -295,12 +320,16 @@ var openCodePluginModule = () => ({
   marker: OPENCODE_PLUGIN_MARKER,
   source: openCodePluginSource(),
   placeholder: OPENCODE_PLUGIN_PLACEHOLDER,
+  approvalEvents: {
+    placeholder: OPENCODE_APPROVAL_EVENTS_PLACEHOLDER,
+    events: OPENCODE_ASKED_EVENTS
+  },
   sibling: {
     path: OPENCODE_PLUGIN_SIBLING,
     contents: OPENCODE_PLUGIN_SIBLING_CONTENTS
   }
 });
-var renderOpenCodePlugin = (module, argv) => module.source.replace(module.placeholder, JSON.stringify(argv));
+var renderOpenCodePlugin = (module, argv, holdsApprovals = true) => module.source.replace(module.placeholder, JSON.stringify(argv)).replace(module.approvalEvents.placeholder, JSON.stringify(holdsApprovals ? module.approvalEvents.events : []));
 var COMMAND_LINE = /^const COMMAND = (.*)$/m;
 var isArgv = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
 var openCodePluginArgv = (contents) => {
@@ -375,11 +404,47 @@ var removeOpenCodeMcpServer = (config) => {
   return true;
 };
 
+// src/setup/agent-hook-owner.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+var COMPATIBLE_HOOK_FILES = Object.fromEntries(
+  HOOK_COMPATIBLE_PROFILES.map((profile) => [profile.agentType, () => compatibleConfigFile(profile)])
+);
+var HOOK_FILES = {
+  claude_code: claudeSettings,
+  codex: codexHooksJson,
+  gemini_cli: geminiSettings,
+  cursor: cursorUserHooks,
+  vscode: () => join2(vscodePluginDir(), "hooks", "hooks.json"),
+  ...COMPATIBLE_HOOK_FILES
+};
+var agentHookFile = (agent) => HOOK_FILES[agent]?.() ?? null;
+var agentHooksKeyPath = (agent) => hookCompatibleProfile(agent)?.hooksKeyPath;
+var readTextOrNull = (path) => {
+  try {
+    return readFileSync2(path, "utf-8");
+  } catch {
+    return null;
+  }
+};
+var openCodePluginOwner = (appAvailable) => {
+  const contents = readTextOrNull(openCodePluginFile());
+  return hookOwnerOfCommands(contents === null ? [] : openCodePluginArgv(contents) ?? [], appAvailable);
+};
+var agentHookOwner = (agent, appAvailable) => {
+  if (agent === "opencode") return openCodePluginOwner(appAvailable);
+  const file = agentHookFile(agent);
+  if (!file) return "none";
+  const document = readJsonSafe(file);
+  return hookOwnerOf(document.kind === "ok" ? document.value : null, appAvailable, agentHooksKeyPath(agent));
+};
+var cliOwnsAnyAgentHooks = (appAvailable) => AGENT_CHOICES.some((agent) => agentHookOwner(agent, appAvailable) === "cli");
+var macAppBridgeAvailable = () => resolveBridgeStub(join2(pusharyDir(), "bin", HOOK_LOCATOR_BINARY), liveBridgeProbe()).kind === "bundle";
+
 export {
   OPENCODE_PLUGIN_PLACEHOLDER,
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
-  openCodePluginArgv,
   isOpenCodePluginOurs,
   OPENCODE_HOOK_BINARY,
   openCodeHookArgv,
@@ -393,5 +458,10 @@ export {
   openCodeConfigFile,
   openCodeInstructionsFile,
   addOpenCodeMcpServer,
-  removeOpenCodeMcpServer
+  removeOpenCodeMcpServer,
+  agentHookFile,
+  agentHooksKeyPath,
+  agentHookOwner,
+  cliOwnsAnyAgentHooks,
+  macAppBridgeAvailable
 };

package/dist/{chunk-M6BZZFVQ.js → chunk-QGRENWJL.js}

@@ -1,6 +1,6 @@
 import {
   readTranscriptPreference
-} from "./chunk-N4QSPI3B.js";
+} from "./chunk-GTZ4HIHU.js";
 
 // src/transcript-setting.ts
 var transcriptEnvironmentPreference = () => {

package/dist/{chunk-LKLVTG3V.js → chunk-RPQLZLKC.js}

@@ -4,14 +4,14 @@ import {
 } from "./chunk-XHKBHWLX.js";
 import {
   readControlMode
-} from "./chunk-N4QSPI3B.js";
+} from "./chunk-GTZ4HIHU.js";
 import {
   getMachineId
-} from "./chunk-DUZVXBBU.js";
+} from "./chunk-H4F5O3RE.js";
 import {
   pusharyDir,
   resolveGlobalBinary
-} from "./chunk-ZBHUHJG6.js";
+} from "./chunk-UJZ7AGSC.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -20,14 +20,14 @@ import {
 } from "./chunk-T7E75EKA.js";
 import {
   getApiKey
-} from "./chunk-5QUPKDI5.js";
+} from "./chunk-2M52CFVO.js";
 import {
   CLI_PACKAGE_NAMES,
   cmdShimTarget,
   getPackageVersion,
   globalPackageFolder,
   globalRootFor
-} from "./chunk-I5IJRMNV.js";
+} from "./chunk-5RGA636G.js";
 
 // src/daemon-lifecycle.ts
 import { dirname, join, win32 as win32Path } from "path";

package/dist/{chunk-KFF7G225.js → chunk-S2DAKKQQ.js}

@@ -1,13 +1,13 @@
 import {
   openCodeConfigDirFrom
-} from "./chunk-MFF3ONG5.js";
+} from "./chunk-QAGWWDXQ.js";
 import {
   codexHomeFrom,
   resolvePathBinary
-} from "./chunk-ZBHUHJG6.js";
+} from "./chunk-UJZ7AGSC.js";
 import {
   HOOK_COMPATIBLE_PROFILES
-} from "./chunk-I5IJRMNV.js";
+} from "./chunk-5RGA636G.js";
 
 // src/hermes-config.ts
 import { execFileSync } from "child_process";

package/dist/chunk-SB2GN6OP.js

@@ -0,0 +1,71 @@
+// src/key-revocation.ts
+var SELF_REVOKE_PATH = "/api/v1/server/keys/self/revoke";
+var DEVICE_KEY_PATH = "/api/agent/device-key";
+var FULL_ACCESS_ONLY_STATUS = 403;
+var REVOKE_TIMEOUT_MS = 1e4;
+var readRevokedCount = async (response) => {
+  try {
+    const body = await response.json();
+    const revoked = typeof body === "object" && body !== null && "revoked" in body ? body.revoked : void 0;
+    return typeof revoked === "number" && Number.isInteger(revoked) && revoked >= 0 ? revoked : null;
+  } catch {
+    return null;
+  }
+};
+var revokeAgentKey = async (apiKey, baseUrl, fetchImpl) => {
+  const response = await fetchImpl(`${baseUrl}${DEVICE_KEY_PATH}`, {
+    method: "DELETE",
+    headers: { Authorization: `Bearer ${apiKey}` },
+    signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS)
+  });
+  if (!response.ok) return { kind: "refused", status: response.status };
+  const revoked = await readRevokedCount(response);
+  if (revoked === null) return { kind: "refused", status: response.status };
+  return revoked > 0 ? { kind: "revoked" } : { kind: "not_accepted" };
+};
+var revokeOwnKey = async (apiKey, baseUrl, fetchImpl = fetch) => {
+  try {
+    const response = await fetchImpl(`${baseUrl}${SELF_REVOKE_PATH}`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
+      signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS)
+    });
+    if (response.status === 401) return { kind: "not_accepted" };
+    if (response.status === FULL_ACCESS_ONLY_STATUS) return await revokeAgentKey(apiKey, baseUrl, fetchImpl);
+    if (!response.ok) return { kind: "refused", status: response.status };
+    return { kind: "revoked" };
+  } catch (err) {
+    return { kind: "unreachable", detail: err instanceof Error ? err.message : "network error" };
+  }
+};
+var REVOKE_DETAIL = {
+  revoked: "Revoked the key on pushary.com.",
+  not_accepted: "pushary.com had already stopped accepting the key.",
+  refused: "pushary.com refused to revoke the key",
+  unreachable: "Could not reach pushary.com to revoke the key"
+};
+var describeRevokeAttempt = (attempt) => {
+  if (attempt.kind === "refused") return `${REVOKE_DETAIL.refused} (HTTP ${attempt.status}).`;
+  if (attempt.kind === "unreachable") return `${REVOKE_DETAIL.unreachable}: ${attempt.detail}`;
+  return REVOKE_DETAIL[attempt.kind];
+};
+var keyNoLongerAccepted = (attempt) => attempt.kind === "revoked" || attempt.kind === "not_accepted";
+var keyValidityOf = (check) => {
+  switch (check.kind) {
+    case "ok":
+    case "locked":
+      return "valid";
+    case "rejected":
+    case "malformed":
+      return "invalid";
+    case "unreachable":
+      return "unknown";
+  }
+};
+
+export {
+  revokeOwnKey,
+  describeRevokeAttempt,
+  keyNoLongerAccepted,
+  keyValidityOf
+};