@vibe-commit/capture 0.2.2 → 0.3.0

package/dist/agent_hooks.d.ts

@@ -22,13 +22,26 @@
  *
  *   1. **APPEND, never replace.** A foreign entry is never removed, rewritten or
  *      reordered. Ours goes last.
- *   2. **IDEMPOTENT via a marker.** JSON has nowhere to put a comment, so ours
- *      carries `_vibecommit`. Without it, `connect` run twice appends twice and
+ *   2. **IDEMPOTENT — by the marker when it survives, and by OUR EXACT COMMAND
+ *      when it does not.** JSON has nowhere to put a comment, so ours carries
+ *      `_vibecommit`. Without an identity, `connect` run twice appends twice and
  *      the hook fires twice per event — two processes racing on one session
  *      state file. ⚠ The marker field is TOLERATED by all three readers, and
  *      that is measured rather than assumed: Codex parses and clamps with the
  *      field present on the inner and outer object alike, and Cursor's validator
  *      checks only known members (`HWu`/`jWu`/`$Wu` in its bundle).
+ *
+ *      ⛔ **BUT TOLERATED ON READ IS NOT KEPT ON WRITE — `CR-224`, `TODOS[138]`.**
+ *      Claude Code's own settings writer STRIPS unknown keys from hook entries
+ *      the next time it saves `settings.json` for any reason. MEASURED against
+ *      Claude Code 2.1.285 with a throwaway `CLAUDE_CONFIG_DIR`: an entry
+ *      carrying `_vibecommit`, a second foreign key on the entry and a third on
+ *      the inner hook went through `claude plugin marketplace add` (which writes
+ *      `extraKnownMarketplaces`) and came back with ALL THREE gone — while an
+ *      unknown TOP-LEVEL key survived, so it is the hooks schema that strips,
+ *      not the file writer wholesale. So on the one machine that matters most the
+ *      marker is gone by the second `connect`, and a marker-only identity
+ *      appended a duplicate every run. See `isOurs` for what replaced it.
  *   3. ⛔ **REFUSE on unparseable, never overwrite.** A file we could not read is
  *      a file whose contents we cannot preserve. Overwriting it would be the
  *      destructive outcome wearing a success message — the exact defect class
@@ -57,17 +70,42 @@
  * registers nothing, and reports success — the same matches-nothing failure as
  * an unrecognised event name, relocated to the document level.
  */
+import type { AgentId } from "./agents/types.js";
 /**
- * What marks an entry as ours.
+ * What marks an entry as ours — the FAST PATH, not the whole identity.
  *
- * ⚠ **A FIELD, not a substring of the command.** Matching on the command text
- * would claim a user's own hook that happens to mention this product, and would
- * lose track of ours the moment the binary path changed — which is exactly when
- * idempotence matters, because that is a re-`connect`.
+ * ⚠ **A FIELD, never a substring of the command.** A substring match would claim
+ * a user's own hook that happens to mention this product. ⛔ But a field is only
+ * as durable as the host lets it be, and Claude Code's writer drops it (rule 2
+ * above, measured). So an entry WITHOUT the marker is still ours when its
+ * command is one we could have written — see `isOurs`, which anchors on the
+ * WHOLE command string and never on part of it.
  */
 export declare const AGENT_HOOK_MARKER = "vibecommit-capture-hook v1";
 /** Which document shape an agent's hook config uses. See the module docblock. */
 export type HookDocShape = "claude" | "cursor";
+/**
+ * The command an agent's config invokes.
+ *
+ * ⛔ **`hook` LEADS, AND THE FLAG NEVER DOES.** `invocationMode` returns `"hook"`
+ * only when `argv[0] === "hook"`, so a registered command whose first argument
+ * is `--agent=` runs the binary INTERACTIVELY — inside a hook, printing to a
+ * stream the agent reads back into the user's turn. `registry.ts` names this as
+ * the trap the wave was most likely to ship, and `test/agent-registry.test.ts`
+ * holds both arms.
+ *
+ * ⚠ **The flag is passed explicitly for every agent, Claude Code included**,
+ * even though `DEFAULT_AGENT_ID` makes it redundant there. A config that names
+ * its own agent is self-describing, and — since Cursor reads Claude Code's
+ * settings and maps them onto its own events — it is the only thing that tells
+ * the two invocations apart when both fire.
+ *
+ * ⚠ **It lives HERE, beside its own inverse (`HOOK_COMMAND`), since `CR-224`.**
+ * The merge below recognises our entry by this exact shape once the host has
+ * stripped the marker, so the builder and the recogniser are one grammar and
+ * must not be able to drift apart across two files.
+ */
+export declare function hookCommand(binPath: string, agentId: AgentId): string;
 /** One event we want registered, already in the agent's own vocabulary. */
 export interface HookRegistration {
     /** The agent's OWN spelling — `SessionEnd` or `sessionEnd`, never canonical. */
@@ -100,7 +138,14 @@ export type MergeOutcome = {
  * That split is deliberate: every rule in the module docblock is a property of
  * this function, and none of them needs a real `~/.claude` to check.
  */
-export declare function mergeHookDocument(raw: string | null, shape: HookDocShape, registrations: readonly HookRegistration[]): MergeOutcome;
+export declare function mergeHookDocument(raw: string | null, shape: HookDocShape, registrations: readonly HookRegistration[], 
+/**
+ * Does the binary an existing entry points at still exist? Consulted ONLY by
+ * the moved-directory arm of `commandIsOurs` (`TODOS[144]`). ⚠ The default
+ * answers "yes" — the direction in which a doubt leaves a WORKING hook alone
+ * and costs at most a duplicate. `writeAgentHooks` passes `existsSync`.
+ */
+binaryExists?: (path: string) => boolean): MergeOutcome;
 export type AgentHookInstall = {
     readonly kind: "installed";
     readonly path: string;

package/dist/agent_hooks.js

@@ -22,13 +22,26 @@
  *
  *   1. **APPEND, never replace.** A foreign entry is never removed, rewritten or
  *      reordered. Ours goes last.
- *   2. **IDEMPOTENT via a marker.** JSON has nowhere to put a comment, so ours
- *      carries `_vibecommit`. Without it, `connect` run twice appends twice and
+ *   2. **IDEMPOTENT — by the marker when it survives, and by OUR EXACT COMMAND
+ *      when it does not.** JSON has nowhere to put a comment, so ours carries
+ *      `_vibecommit`. Without an identity, `connect` run twice appends twice and
  *      the hook fires twice per event — two processes racing on one session
  *      state file. ⚠ The marker field is TOLERATED by all three readers, and
  *      that is measured rather than assumed: Codex parses and clamps with the
  *      field present on the inner and outer object alike, and Cursor's validator
  *      checks only known members (`HWu`/`jWu`/`$Wu` in its bundle).
+ *
+ *      ⛔ **BUT TOLERATED ON READ IS NOT KEPT ON WRITE — `CR-224`, `TODOS[138]`.**
+ *      Claude Code's own settings writer STRIPS unknown keys from hook entries
+ *      the next time it saves `settings.json` for any reason. MEASURED against
+ *      Claude Code 2.1.285 with a throwaway `CLAUDE_CONFIG_DIR`: an entry
+ *      carrying `_vibecommit`, a second foreign key on the entry and a third on
+ *      the inner hook went through `claude plugin marketplace add` (which writes
+ *      `extraKnownMarketplaces`) and came back with ALL THREE gone — while an
+ *      unknown TOP-LEVEL key survived, so it is the hooks schema that strips,
+ *      not the file writer wholesale. So on the one machine that matters most the
+ *      marker is gone by the second `connect`, and a marker-only identity
+ *      appended a duplicate every run. See `isOurs` for what replaced it.
  *   3. ⛔ **REFUSE on unparseable, never overwrite.** A file we could not read is
  *      a file whose contents we cannot preserve. Overwriting it would be the
  *      destructive outcome wearing a success message — the exact defect class
@@ -57,21 +70,68 @@
  * registers nothing, and reports success — the same matches-nothing failure as
  * an unrecognised event name, relocated to the document level.
  */
-import { chmodSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
 /**
- * What marks an entry as ours.
+ * What marks an entry as ours — the FAST PATH, not the whole identity.
  *
- * ⚠ **A FIELD, not a substring of the command.** Matching on the command text
- * would claim a user's own hook that happens to mention this product, and would
- * lose track of ours the moment the binary path changed — which is exactly when
- * idempotence matters, because that is a re-`connect`.
+ * ⚠ **A FIELD, never a substring of the command.** A substring match would claim
+ * a user's own hook that happens to mention this product. ⛔ But a field is only
+ * as durable as the host lets it be, and Claude Code's writer drops it (rule 2
+ * above, measured). So an entry WITHOUT the marker is still ours when its
+ * command is one we could have written — see `isOurs`, which anchors on the
+ * WHOLE command string and never on part of it.
  */
 export const AGENT_HOOK_MARKER = "vibecommit-capture-hook v1";
 /** The field carrying it. Leading underscore: a hint that it is not the agent's. */
 const MARKER_KEY = "_vibecommit";
 /** The `version` we mint when CREATING a `cursor` document. */
 const CURSOR_CONFIG_VERSION = 1;
+/**
+ * The command an agent's config invokes.
+ *
+ * ⛔ **`hook` LEADS, AND THE FLAG NEVER DOES.** `invocationMode` returns `"hook"`
+ * only when `argv[0] === "hook"`, so a registered command whose first argument
+ * is `--agent=` runs the binary INTERACTIVELY — inside a hook, printing to a
+ * stream the agent reads back into the user's turn. `registry.ts` names this as
+ * the trap the wave was most likely to ship, and `test/agent-registry.test.ts`
+ * holds both arms.
+ *
+ * ⚠ **The flag is passed explicitly for every agent, Claude Code included**,
+ * even though `DEFAULT_AGENT_ID` makes it redundant there. A config that names
+ * its own agent is self-describing, and — since Cursor reads Claude Code's
+ * settings and maps them onto its own events — it is the only thing that tells
+ * the two invocations apart when both fire.
+ *
+ * ⚠ **It lives HERE, beside its own inverse (`HOOK_COMMAND`), since `CR-224`.**
+ * The merge below recognises our entry by this exact shape once the host has
+ * stripped the marker, so the builder and the recogniser are one grammar and
+ * must not be able to drift apart across two files.
+ */
+export function hookCommand(binPath, agentId) {
+    return `${quote(binPath)} hook --agent=${agentId}`;
+}
+/** Double-quote for the shells these configs are read by. */
+function quote(value) {
+    return `"${value.replace(/(["\\$`])/g, "\\$1")}"`;
+}
+/**
+ * ⛔ `hookCommand`'s output, recognised — ANCHORED AT BOTH ENDS.
+ *
+ * The quoted path is `quote`'s grammar exactly: any character except the four it
+ * escapes, or one of those four behind a backslash. `^…$` is the whole point:
+ * `time "<ours>" hook --agent=x`, `"<ours>" hook --agent=x && echo done` and
+ * `echo "<ours>" hook --agent=x` are all the USER's commands, and a pattern
+ * without both anchors would claim them.
+ */
+const HOOK_COMMAND = /^"((?:[^"\\$`]|\\["\\$`])*)" hook --agent=([a-z][a-z0-9-]*)$/;
+/** `hookCommand`, inverted. `null` for anything it could not have produced. */
+function parseHookCommand(command) {
+    const match = HOOK_COMMAND.exec(command);
+    if (match === null)
+        return null;
+    return { binPath: match[1].replace(/\\(["\\$`])/g, "$1"), agentId: match[2] };
+}
 /**
  * ⛔ **THE WHOLE MERGE, AS A PURE FUNCTION ON TEXT.**
  *
@@ -81,7 +141,14 @@ const CURSOR_CONFIG_VERSION = 1;
  * That split is deliberate: every rule in the module docblock is a property of
  * this function, and none of them needs a real `~/.claude` to check.
  */
-export function mergeHookDocument(raw, shape, registrations) {
+export function mergeHookDocument(raw, shape, registrations, 
+/**
+ * Does the binary an existing entry points at still exist? Consulted ONLY by
+ * the moved-directory arm of `commandIsOurs` (`TODOS[144]`). ⚠ The default
+ * answers "yes" — the direction in which a doubt leaves a WORKING hook alone
+ * and costs at most a duplicate. `writeAgentHooks` passes `existsSync`.
+ */
+binaryExists = () => true) {
     let doc;
     if (raw === null || raw.trim() === "") {
         doc = {};
@@ -133,30 +200,124 @@ export function mergeHookDocument(raw, shape, registrations) {
         }
         const entries = [...(current ?? [])];
         const ours = entryFor(shape, registration);
-        const at = entries.findIndex(isOurs);
+        const mine = (entry) => isOurs(entry, shape, registration, binaryExists);
+        const at = entries.findIndex(mine);
         if (at >= 0) {
             // ⛔ REFRESH IN PLACE, and the position is kept. The binary path moves on
             // every reinstall, so this arm is the ordinary one on a re-`connect` — and
             // appending instead would grow the array without bound.
             entries[at] = ours;
+            // ⛔ AND EVERY OTHER COPY OF OURS GOES (`CR-224`). A machine that ran a
+            // marker-only `connect` N times after its host stripped the marker holds N
+            // copies, each spawning a process on every event. Refreshing only the first
+            // would leave N-1 of them firing forever; a re-run has to CONVERGE to one.
+            // Only entries `isOurs` claims are removed — rule 1 is about foreign ones,
+            // and the claim is anchored on the whole command, so this cannot reach one.
+            for (let i = entries.length - 1; i > at; i -= 1) {
+                if (mine(entries[i]))
+                    entries.splice(i, 1);
+            }
             updated.push(registration.event);
         }
         else {
             entries.push(ours);
             added.push(registration.event);
         }
-        foreign += entries.filter((entry) => !isOurs(entry)).length;
+        foreign += entries.filter((entry) => !mine(entry)).length;
         hooks[registration.event] = entries;
     }
     doc.hooks = hooks;
     return { kind: "merged", text: `${JSON.stringify(doc, null, 2)}\n`, added, updated, foreign };
 }
-/** Ours? ⛔ By the marker alone — never by the command, which changes. */
-function isOurs(entry) {
-    return (entry !== null &&
-        typeof entry === "object" &&
-        !Array.isArray(entry) &&
-        entry[MARKER_KEY] === AGENT_HOOK_MARKER);
+/**
+ * Ours? ⛔ **By the marker, or by being EXACTLY an entry we could have written.**
+ *
+ * The marker is the fast path and is enough on its own — it is the only field
+ * nothing but this module writes. Without it (`CR-224`: Claude Code's writer
+ * strips it), an entry is ours only when ALL of these hold:
+ *
+ *   1. **Its keys are ours and nobody else's.** `{ hooks: [one hook] }` for the
+ *      `claude` shape, `{ command, timeout }` for `cursor`, and the one inner
+ *      hook carries only `type`/`command`/`timeout`. A `matcher`, a second
+ *      inner hook or any other key means someone EDITED it, and refreshing it
+ *      would silently delete their edit.
+ *   2. **Its command is ours** — see `commandIsOurs`.
+ *
+ * ⚠ **THE FAILURE DIRECTION IS DELIBERATE.** A false "not ours" costs one
+ * duplicate entry, which `claimFiring` (`CR-195`/U4a) already turns into a
+ * single capture. A false "ours" overwrites a user's hook — the one outcome this
+ * module exists to make impossible. Every doubt resolves to "not ours".
+ */
+function isOurs(entry, shape, registration, binaryExists) {
+    if (!isRecord(entry))
+        return false;
+    if (entry[MARKER_KEY] === AGENT_HOOK_MARKER)
+        return true;
+    if (shape === "cursor") {
+        return (hasOnlyKeys(entry, ["command", "timeout"]) &&
+            typeof entry.command === "string" &&
+            commandIsOurs(entry.command, registration.command, binaryExists));
+    }
+    if (!hasOnlyKeys(entry, ["hooks"]) || !Array.isArray(entry.hooks) || entry.hooks.length !== 1) {
+        return false;
+    }
+    const inner = entry.hooks[0];
+    return (isRecord(inner) &&
+        hasOnlyKeys(inner, ["type", "command", "timeout"]) &&
+        inner.type === "command" &&
+        typeof inner.command === "string" &&
+        commandIsOurs(inner.command, registration.command, binaryExists));
+}
+/**
+ * ⛔ **THE WHOLE STRING, NEVER A SUBSTRING — the trap `TODOS[138]` names.**
+ *
+ * Two arms, and only two:
+ *
+ *   - **Identical** to the command we are about to write. The ordinary re-run.
+ *   - **`hookCommand`'s exact shape with only the binary's DIRECTORY changed.**
+ *     This is the reinstall — an nvm switch or a new npm prefix moves
+ *     `<prefix>/bin/vibecommit`, the command text moves with it, and an
+ *     identical-only rule would append a second entry beside one that now
+ *     points at a binary that may not exist (so fails on every event). Both
+ *     sides must parse as the whole `"<path>" hook --agent=<id>` grammar, name
+ *     the SAME agent (Cursor reads Claude Code's config, so the `--agent=` tail
+ *     is what tells the two apart), and end in the SAME binary name. What a
+ *     foreign tool would need to be claimed is our exact argv AND a binary with
+ *     our name — which is our binary.
+ *
+ * ⚠ Invoking the same install by a different NAME (`…/bin/vibecommit` vs
+ * `…/dist/index.js`) is not matched and leaves one duplicate. That is the safe
+ * direction (see `isOurs`), and `index.js` is too generic a name to claim on.
+ *
+ * ⛔ **AND THE MOVED-DIRECTORY ARM CLAIMS ONLY A DEAD PATH (`TODOS[144]`).** A
+ * claimed entry is REPLACED, so this arm decides which binary the user's hooks
+ * run. Claiming a LIVE one hands the hook to whatever binary ran `connect` —
+ * and a throwaway install (`npx`, a temp prefix, a test harness's artifacts
+ * dir) is exactly that: Gate A repointed a machine's working capture at a
+ * directory about to be deleted, after which every hook fails quietly and
+ * capture stops. Without this arm the same run appends a second entry and the
+ * working one keeps firing (`claimFiring` makes it one capture). So: a moved
+ * path is claimed only when the binary it names is GONE — the reinstall this
+ * arm exists for (an uninstalled prefix, a removed nvm version) — and a live
+ * one is left alone. ⚠ Cost, accepted: two live installs leave two entries
+ * until one is removed; a duplicate is the safe failure, a hijack is not.
+ */
+function commandIsOurs(candidate, ours, binaryExists) {
+    if (candidate === ours)
+        return true;
+    const theirs = parseHookCommand(candidate);
+    const mine = parseHookCommand(ours);
+    if (theirs === null || mine === null)
+        return false;
+    return (theirs.agentId === mine.agentId &&
+        basename(theirs.binPath) === basename(mine.binPath) &&
+        !binaryExists(theirs.binPath));
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function hasOnlyKeys(value, allowed) {
+    return Object.keys(value).every((key) => allowed.includes(key));
 }
 /** Our entry, in the shape that agent's reader actually validates. */
 function entryFor(shape, registration) {
@@ -204,7 +365,7 @@ export function writeAgentHooks(path, shape, registrations) {
         // the write below rather than being guessed at here.
         raw = null;
     }
-    const merged = mergeHookDocument(raw, shape, registrations);
+    const merged = mergeHookDocument(raw, shape, registrations, existsSync);
     if (merged.kind === "refused")
         return { kind: "refused", path, why: merged.why };
     const temp = join(dirname(path), `.${AGENT_HOOK_MARKER.replace(/\W+/g, "-")}.tmp`);

package/dist/agent_hooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent_hooks.js","sourceRoot":"","sources":["../src/agent_hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AAE9D,oFAAoF;AACpF,MAAM,UAAU,GAAG,aAAa,CAAC;AAKjC,+DAA+D;AAC/D,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAyBhC;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAkB,EAClB,KAAmB,EACnB,aAA0C;IAE1C,IAAI,GAA4B,CAAC;IAEjC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtC,GAAG,GAAG,EAAE,CAAC;IACX,CAAC;SAAM,CAAC;QACN,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,oDAAoD;YACpD,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,GAAG,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB;aAC/D,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,mCAAmC,EAAE,CAAC;QACvE,CAAC;QACD,GAAG,GAAG,EAAE,GAAI,MAAkC,EAAE,CAAC;IACnD,CAAC;IAED,2EAA2E;IAC3E,+EAA+E;IAC/E,8EAA8E;IAC9E,IAAI,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACpD,GAAG,CAAC,OAAO,GAAG,qBAAqB,CAAC;IACtC,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC;IAChC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,aAAa,KAAK,IAAI,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAChG,4EAA4E;YAC5E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,yCAAyC,EAAE,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAA4B;QACrC,GAAG,CAAE,aAAqD,IAAI,EAAE,CAAC;KAClE,CAAC;IAEF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,GAAG,EAAE,WAAW,YAAY,CAAC,KAAK,mCAAmC;aACtE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAE,OAAiC,IAAI,EAAE,CAAC,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAE3C,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACZ,yEAAyE;YACzE,2EAA2E;YAC3E,wDAAwD;YACxD,OAAO,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5D,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACtC,CAAC;IAED,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;IAClB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAChG,CAAC;AAED,yEAAyE;AACzE,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,CACL,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAiC,CAAC,UAAU,CAAC,KAAK,iBAAiB,CACrE,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAS,QAAQ,CAAC,KAAmB,EAAE,YAA8B;IACnE,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,0EAA0E;QAC1E,6EAA6E;QAC7E,wCAAwC;QACxC,OAAO;YACL,CAAC,UAAU,CAAC,EAAE,iBAAiB;YAC/B,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,OAAO,EAAE,YAAY,CAAC,UAAU;SACjC,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,6BAA6B;IAC7B,OAAO;QACL,CAAC,UAAU,CAAC,EAAE,iBAAiB;QAC/B,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,UAAU,EAAE;SACrF;KACF,CAAC;AACJ,CAAC;AAQD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,KAAmB,EACnB,aAA0C;IAE1C,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,qDAAqD;QACrD,GAAG,GAAG,IAAI,CAAC;IACb,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IAEjF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnF,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;QAC1D,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9C,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;IAChG,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACvE,+EAA+E;IAC/E,6EAA6E;IAC7E,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAC9B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE;QACnC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"agent_hooks.js","sourceRoot":"","sources":["../src/agent_hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC9G,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIpD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AAE9D,oFAAoF;AACpF,MAAM,UAAU,GAAG,aAAa,CAAC;AAKjC,+DAA+D;AAC/D,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,OAAgB;IAC3D,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,OAAO,EAAE,CAAC;AACrD,CAAC;AAED,6DAA6D;AAC7D,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC;AACpD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,8DAA8D,CAAC;AAEpF,+EAA+E;AAC/E,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChF,CAAC;AAyBD;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAkB,EAClB,KAAmB,EACnB,aAA0C;AAC1C;;;;;GAKG;AACH,eAA0C,GAAG,EAAE,CAAC,IAAI;IAEpD,IAAI,GAA4B,CAAC;IAEjC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtC,GAAG,GAAG,EAAE,CAAC;IACX,CAAC;SAAM,CAAC;QACN,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,oDAAoD;YACpD,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,GAAG,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB;aAC/D,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,mCAAmC,EAAE,CAAC;QACvE,CAAC;QACD,GAAG,GAAG,EAAE,GAAI,MAAkC,EAAE,CAAC;IACnD,CAAC;IAED,2EAA2E;IAC3E,+EAA+E;IAC/E,8EAA8E;IAC9E,IAAI,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACpD,GAAG,CAAC,OAAO,GAAG,qBAAqB,CAAC;IACtC,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC;IAChC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,aAAa,KAAK,IAAI,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAChG,4EAA4E;YAC5E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,yCAAyC,EAAE,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAA4B;QACrC,GAAG,CAAE,aAAqD,IAAI,EAAE,CAAC;KAClE,CAAC;IAEF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,GAAG,EAAE,WAAW,YAAY,CAAC,KAAK,mCAAmC;aACtE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAE,OAAiC,IAAI,EAAE,CAAC,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAE3C,MAAM,IAAI,GAAG,CAAC,KAAc,EAAW,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;QAC3F,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACZ,yEAAyE;YACzE,2EAA2E;YAC3E,wDAAwD;YACxD,OAAO,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;YACnB,uEAAuE;YACvE,2EAA2E;YAC3E,4EAA4E;YAC5E,2EAA2E;YAC3E,2EAA2E;YAC3E,4EAA4E;YAC5E,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;oBAAE,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1D,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACtC,CAAC;IAED,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;IAClB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAChG,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,MAAM,CACb,KAAc,EACd,KAAmB,EACnB,YAA8B,EAC9B,YAAuC;IAEvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAEzD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,CACL,WAAW,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC1C,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;YACjC,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CACjE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAY,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,WAAW,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,KAAK,SAAS;QACxB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CACjE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,SAAS,aAAa,CACpB,SAAiB,EACjB,IAAY,EACZ,YAAuC;IAEvC,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnD,OAAO,CACL,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;QAC/B,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QACnD,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,KAA8B,EAAE,OAA0B;IAC7E,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,sEAAsE;AACtE,SAAS,QAAQ,CAAC,KAAmB,EAAE,YAA8B;IACnE,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,0EAA0E;QAC1E,6EAA6E;QAC7E,wCAAwC;QACxC,OAAO;YACL,CAAC,UAAU,CAAC,EAAE,iBAAiB;YAC/B,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,OAAO,EAAE,YAAY,CAAC,UAAU;SACjC,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,6BAA6B;IAC7B,OAAO;QACL,CAAC,UAAU,CAAC,EAAE,iBAAiB;QAC/B,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,UAAU,EAAE;SACrF;KACF,CAAC;AACJ,CAAC;AAQD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,KAAmB,EACnB,aAA0C;IAE1C,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,qDAAqD;QACrD,GAAG,GAAG,IAAI,CAAC;IACb,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IAEjF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnF,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;QAC1D,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9C,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;IAChG,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACvE,+EAA+E;IAC/E,6EAA6E;IAC7E,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAC9B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE;QACnC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1C,CAAC"}

package/dist/agent_install.d.ts

@@ -46,23 +46,6 @@ export interface AgentHookOutcome {
     readonly path: string;
     readonly install: AgentHookInstall | null;
 }
-/**
- * The command an agent's config invokes.
- *
- * ⛔ **`hook` LEADS, AND THE FLAG NEVER DOES.** `invocationMode` returns `"hook"`
- * only when `argv[0] === "hook"`, so a registered command whose first argument
- * is `--agent=` runs the binary INTERACTIVELY — inside a hook, printing to a
- * stream the agent reads back into the user's turn. `registry.ts` names this as
- * the trap the wave was most likely to ship, and `test/agent-registry.test.ts`
- * holds both arms.
- *
- * ⚠ **The flag is passed explicitly for every agent, Claude Code included**,
- * even though `DEFAULT_AGENT_ID` makes it redundant there. A config that names
- * its own agent is self-describing, and — since Cursor reads Claude Code's
- * settings and maps them onto its own events — it is the only thing that tells
- * the two invocations apart when both fire.
- */
-export declare function hookCommand(binPath: string, agentId: AgentId): string;
 /** Every event this client registers, in one agent's own vocabulary. */
 export declare function registrationsFor(dialect: TranscriptDialect, binPath: string): readonly HookRegistration[];
 /** Is this agent on the machine at all? The DIRECTORY, never the config file. */

package/dist/agent_install.js

@@ -40,32 +40,9 @@
  */
 import { existsSync } from "node:fs";
 import { dirname } from "node:path";
-import { writeAgentHooks } from "./agent_hooks.js";
+import { hookCommand, writeAgentHooks, } from "./agent_hooks.js";
 import { DIALECTS } from "./agents/registry.js";
 import { HOOK_EVENTS } from "./agents/types.js";
-/**
- * The command an agent's config invokes.
- *
- * ⛔ **`hook` LEADS, AND THE FLAG NEVER DOES.** `invocationMode` returns `"hook"`
- * only when `argv[0] === "hook"`, so a registered command whose first argument
- * is `--agent=` runs the binary INTERACTIVELY — inside a hook, printing to a
- * stream the agent reads back into the user's turn. `registry.ts` names this as
- * the trap the wave was most likely to ship, and `test/agent-registry.test.ts`
- * holds both arms.
- *
- * ⚠ **The flag is passed explicitly for every agent, Claude Code included**,
- * even though `DEFAULT_AGENT_ID` makes it redundant there. A config that names
- * its own agent is self-describing, and — since Cursor reads Claude Code's
- * settings and maps them onto its own events — it is the only thing that tells
- * the two invocations apart when both fire.
- */
-export function hookCommand(binPath, agentId) {
-    return `${quote(binPath)} hook --agent=${agentId}`;
-}
-/** Double-quote for the shells these configs are read by. */
-function quote(value) {
-    return `"${value.replace(/(["\\$`])/g, "\\$1")}"`;
-}
 /** Every event this client registers, in one agent's own vocabulary. */
 export function registrationsFor(dialect, binPath) {
     return HOOK_EVENTS.map((event) => ({

package/dist/agent_install.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent_install.js","sourceRoot":"","sources":["../src/agent_install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAgD,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAwC,MAAM,mBAAmB,CAAC;AAStF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,OAAgB;IAC3D,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,OAAO,EAAE,CAAC;AACrD,CAAC;AAED,6DAA6D;AAC7D,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC;AACpD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAC9B,OAA0B,EAC1B,OAAe;IAEf,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAChC,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QACzC,sEAAsE;QACtE,sEAAsE;QACtE,4EAA4E;QAC5E,4EAA4E;QAC5E,mDAAmD;QACnD,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;KACtF,CAAC,CAAC,CAAC;AACN,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,OAA0B,EAAE,IAAY,EAAE,GAAsB;IAC3F,OAAO,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,GAAsB,EACtB,OAAe;IAEf,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACtD,CAAC;QACD,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,IAAI;YACJ,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;SAC7F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"agent_install.js","sourceRoot":"","sources":["../src/agent_install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EACL,WAAW,EACX,eAAe,GAGhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAwC,MAAM,mBAAmB,CAAC;AAStF,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAC9B,OAA0B,EAC1B,OAAe;IAEf,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAChC,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QACzC,sEAAsE;QACtE,sEAAsE;QACtE,4EAA4E;QAC5E,4EAA4E;QAC5E,mDAAmD;QACnD,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;KACtF,CAAC,CAAC,CAAC;AACN,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,OAA0B,EAAE,IAAY,EAAE,GAAsB;IAC3F,OAAO,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,GAAsB,EACtB,OAAe;IAEf,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACtD,CAAC;QACD,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,IAAI;YACJ,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;SAC7F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/agents/cursor.js

@@ -19,27 +19,63 @@
  */
 import { cursorHooksPath, cursorTranscriptRoot, isCursorTranscript } from "../paths.js";
 /**
- * ⛔ **UNMEASURED, AND ADOPTED AS A FLOOR RATHER THAN GUESSED.**
+ * ⭐ **MEASURED. `D5`'s SECOND HALF IS ANSWERED (`TODOS[130]`), AND THE ANSWER IS
+ * THAT CURSOR IMPOSES NO NUMBER OF ITS OWN.**
  *
- * ⚠ **`D5` HAD TWO HALVES AND ONLY ONE OF THEM IS ANSWERED (D205).** It asked
- * for the exact `hook_event_name` strings Cursor sends *and* the timeouts its
- * `~/.cursor/hooks.json` registers. The STRINGS are now measured — see
- * `eventNames` below, read out of the shipped app bundle, which is what
- * discharged `CR-195`'s block. ⛔ **The TIMEOUTS below are still not measured**,
- * and are deliberately left as the floor they always were rather than quietly
- * promoted on the strength of the other half. Nothing installs a Cursor hook
- * today, so no Cursor hook has ever fired and these numbers remain unreachable
- * in production.
+ * `D5` asked for the exact `hook_event_name` strings Cursor sends *and* the
+ * timeouts its `~/.cursor/hooks.json` registers. D205 discharged the strings
+ * from the shipped app bundle. The timeouts are now read the same way, out of
+ * `workbench.desktop.main.js` — the validator `Fed` and the executor
+ * `_executeCommandHookScript`:
  *
- * ⚠ **The direction of safety is what picks them.** Too WIDE and the agent
- * kills the process before this client's watchdog fires — which loses the
- * exit-0/silent-stdout contract, the one outcome DESIGN.md §13.7 forbids. Too
- * TIGHT and an invocation sends less and the next one picks it up. So the
- * registry's tightest existing pair is taken as a FLOOR: it holds whatever
- * Cursor turns out to register, down to Codex's 3 s cap.
+ * | question | measured |
+ * |---|---|
+ * | is there a per-hook `timeout`? | **yes**, and it is in **SECONDS** |
+ * | is it clamped or capped? | **NO** — above `3600` Cursor only `console.warn`s |
+ * | rejected when? | non-number, or `<= 0`. Nothing else. |
+ * | default when omitted | **60 s** — `(t.timeout ?? ROi) * 1e3`, `ROi = 60` |
+ * | enforcement | real: killed, **exit code 124**, logged `timed out after Ns` |
+ * | on timeout | `failClosed: true` BLOCKS the tool; otherwise the step proceeds |
  *
- * ⛔ **This is a refusal to guess, not a measurement of Cursor**, and `CR-195`
- * owns the real numbers once `D5` comes back.
+ * ⛔ **SO THERE WAS NEVER A CURSOR NUMBER TO DISCOVER. Cursor honours whatever we
+ * register.** The old header said `CR-195` "owns the real numbers once `D5` comes
+ * back"; `D5` is back, and the real numbers are ours to choose.
+ *
+ * ## ⚠ THE NUMBERS BELOW DO NOT CHANGE — BUT THEIR JUSTIFICATION DOES
+ *
+ * They were a defensive floor against a cap that might exist. They are now a
+ * DELIBERATE PAIR, and the reasoning is no longer conditional:
+ *
+ *   - We register **3 s**, so Cursor kills the hook at 3 s and not before.
+ *   - Our own watchdog is **2.2 s**, so it always fires **800 ms FIRST**.
+ *
+ * That ordering is the whole point. `DESIGN.md §13.7` forbids one outcome — the
+ * agent killing us before we can exit 0 with silent stdout — and the old header
+ * could only *hope* the registered value held. It holds: the client watchdog
+ * leads the registered timeout by construction, on a value Cursor does not
+ * override.
+ *
+ * ⚠ And note the direction against Cursor's own default: **60 s**. Registering
+ * 3 s TIGHTENS by twenty-fold. An omitted `timeout` would leave a wedged hook
+ * stalling an agent step for a full minute, so writing this field is not
+ * ceremony — it is the difference between a 2.2 s worst case and a 60 s one.
+ *
+ * ## ⛔ WHAT THIS MEASUREMENT IS, AND WHAT IT IS NOT
+ *
+ * It is a reading of **shipped code**, not an observed firing — the same
+ * standing as D205's strings, and the same limit. It proves what Cursor's
+ * validator accepts and what its executor does with the value. It does **not**
+ * prove a hook of ours has been fired by a real Cursor session and killed at
+ * 3 s. That confirmation is cheap now that the signal is known — **exit code
+ * 124** and `Hook … timed out after 3s` in Cursor's log — and it is owed.
+ *
+ * ⚠ **Both clauses of the old header were false when it was written, which is
+ * why this row existed.** It said *"Nothing installs a Cursor hook today, so no
+ * Cursor hook has ever fired and these numbers remain unreachable in
+ * production."* `CURSOR` carries a `hookConfig`, so `installAgentHooks` writes
+ * `~/.cursor/hooks.json` on any machine with Cursor present — and that shipped
+ * in `0.2.0` and is live in `0.2.3`. The numbers were reachable, in users'
+ * hands, and documented as unreachable.
  */
 const CURSOR_REGISTERED_MS = 3_000;
 const CURSOR_CLIENT_MS = 2_200;

package/dist/agents/cursor.js.map

@@ -1 +1 @@
-{"version":3,"file":"cursor.js","sourceRoot":"","sources":["../../src/agents/cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGxF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,MAAM,CAAC,MAAM,MAAM,GAAsB;IACvC,EAAE,EAAE,QAAQ;IACZ,SAAS,EAAE,QAAQ;IACnB,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,uDAAuD;IACvD,cAAc,EAAE,oBAAoB;IACpC,wEAAwE;IACxE,uEAAuE;IACvE,UAAU,EAAE,kBAAkB;IAC9B,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,iEAAiE;IACjE,+EAA+E;IAC/E,mEAAmE;IACnE,EAAE;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,EAAE;IACF,6EAA6E;IAC7E,8EAA8E;IAC9E,qDAAqD;IACrD,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE;IAChF,yEAAyE;IACzE,4EAA4E;IAC5E,uEAAuE;IACvE,6EAA6E;IAC7E,2EAA2E;IAC3E,uDAAuD;IACvD,yEAAyE;IACzE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE;IACtE,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,mBAAmB,EAAE,oBAAoB;YACzC,cAAc,EAAE,gBAAgB;SACjC;QACD,UAAU,EAAE;YACV,mBAAmB,EAAE,oBAAoB;YACzC,cAAc,EAAE,gBAAgB;SACjC;QACD,UAAU,EAAE;YACV,mBAAmB,EAAE,oBAAoB;YACzC,cAAc,EAAE,gBAAgB;SACjC;KACF;IACD,wEAAwE;IACxE,uDAAuD;IACvD,+EAA+E;IAC/E,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,+DAA+D;IAC/D,oBAAoB,EAAE,UAAU;IAChC,SAAS,EAAE,QAAQ;IACnB,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,+EAA+E;IAC/E,yBAAyB;IACzB,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI;IAC5B,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,0CAA0C;CAC3C,CAAC"}
+{"version":3,"file":"cursor.js","sourceRoot":"","sources":["../../src/agents/cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGxF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,MAAM,CAAC,MAAM,MAAM,GAAsB;IACvC,EAAE,EAAE,QAAQ;IACZ,SAAS,EAAE,QAAQ;IACnB,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,uDAAuD;IACvD,cAAc,EAAE,oBAAoB;IACpC,wEAAwE;IACxE,uEAAuE;IACvE,UAAU,EAAE,kBAAkB;IAC9B,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,iEAAiE;IACjE,+EAA+E;IAC/E,mEAAmE;IACnE,EAAE;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,EAAE;IACF,6EAA6E;IAC7E,8EAA8E;IAC9E,qDAAqD;IACrD,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE;IAChF,yEAAyE;IACzE,4EAA4E;IAC5E,uEAAuE;IACvE,6EAA6E;IAC7E,2EAA2E;IAC3E,uDAAuD;IACvD,yEAAyE;IACzE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE;IACtE,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,mBAAmB,EAAE,oBAAoB;YACzC,cAAc,EAAE,gBAAgB;SACjC;QACD,UAAU,EAAE;YACV,mBAAmB,EAAE,oBAAoB;YACzC,cAAc,EAAE,gBAAgB;SACjC;QACD,UAAU,EAAE;YACV,mBAAmB,EAAE,oBAAoB;YACzC,cAAc,EAAE,gBAAgB;SACjC;KACF;IACD,wEAAwE;IACxE,uDAAuD;IACvD,+EAA+E;IAC/E,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,+DAA+D;IAC/D,oBAAoB,EAAE,UAAU;IAChC,SAAS,EAAE,QAAQ;IACnB,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,+EAA+E;IAC/E,yBAAyB;IACzB,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI;IAC5B,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,0CAA0C;CAC3C,CAAC"}

package/dist/commands/auth.d.ts

@@ -36,19 +36,27 @@
  * that discipline theatre. It is refused loudly rather than quietly ignored,
  * because a user who typed it needs to be told it is now in their history.
  *
- * ## What this verb is NOT
+ * ## ⚠ Browser FIRST since `CR-226`; the paste is the fallback, not gone
  *
- * It is not sign-in, and it does not mint. `mintIngestCredential` exists in
- * `vibecommit-mcp` with no route in front of it, so on this side of the wire the
- * plaintext still comes from the web app's `POST /api/ingest-credentials`, shown
- * once, and the human carries it here. Putting a route in front of the minter is
- * the PKCE work `connect.ts` defers; this verb makes the paste path first-class,
- * it does not remove the paste.
+ * This note used to say the verb "is not sign-in, and it does not mint", because
+ * `mintIngestCredential` in `vibecommit-mcp` had no route in front of it and the
+ * only plaintext producer was the web app's `POST /api/ingest-credentials`. The
+ * route now exists (`POST /oauth/ingest-credential`), so on a terminal this verb
+ * signs in through the browser and mints the credential there
+ * (`browser_credential.ts`). The paste below is unchanged and still reached:
  *
- * @provenance vibecommit-mcp src/oauth/ingest_credential.ts — no route mints one, re-verified
- * @provenance vibecommit-web app/api/ingest-credentials/route.ts — the only producer, verified
+ *   - `--stdin`, or no TTY — the CI shape. Never a browser, exactly as before.
+ *   - `--paste` — a human who already holds a credential from the dashboard.
+ *   - any browser step failing — its reason is printed, then the prompt runs.
+ *
+ * ⚠ So there is no path on which `CR-226` makes the pre-existing flow worse:
+ * every failure lands on the prompt that was the whole verb before it.
+ *
+ * @provenance vibecommit-mcp src/transport/server.ts — POST /oauth/ingest-credential is the mint route, verified
+ * @provenance vibecommit-web app/api/ingest-credentials/route.ts — the dashboard producer the paste path still serves, verified
  */
 import type { CommandContext } from "./context.js";
+import type { BrowserCredential, Retry } from "./browser_credential.js";
 export interface AuthDeps {
     /**
      * Read the secret from a terminal WITHOUT ECHOING IT. Injected for the same
@@ -62,5 +70,12 @@ export interface AuthDeps {
     readonly readSecret?: (prompt: string) => Promise<string>;
     /** Read the whole of stdin. The pipe path, and the only path on a non-TTY. */
     readonly readStdin?: () => Promise<string>;
+    /**
+     * The browser mint — `CR-226`. Injected like the two readers above, and for
+     * the same reason: left out, this verb is the paste-only verb it was before,
+     * so a test that forgot to stub it cannot reach a server or open a browser.
+     * `src/index.ts` passes the real one.
+     */
+    readonly browser?: (ctx: CommandContext, retry: Retry) => Promise<BrowserCredential>;
 }
 export declare function auth(ctx: CommandContext, argv: readonly string[], deps?: AuthDeps): Promise<number>;