pushary 1.8.0

package/dist/chunk-AHV4LNB5.js

@@ -0,0 +1,377 @@
+import {
+  HOOK_BUDGETS,
+  OPENCODE_APPROVAL_EVENT
+} from "./chunk-NQTHFF4W.js";
+
+// src/opencode-plugin.ts
+var OPENCODE_PLUGIN_MARKER = "pushary-opencode-plugin w1";
+var OPENCODE_PLUGIN_PLACEHOLDER = "__PUSHARY_COMMAND__";
+var OPENCODE_PLUGIN_FILE = "pushary.js";
+var OPENCODE_PLUGIN_DIR = "plugins";
+var OPENCODE_PLUGIN_SIBLING = "package.json";
+var OPENCODE_PLUGIN_SIBLING_CONTENTS = `${JSON.stringify({ type: "module" }, null, 2)}
+`;
+var OPENCODE_ASKED_EVENTS = ["permission.asked", "permission.updated"];
+var OPENCODE_REPLIED_EVENT = "permission.replied";
+var OPENCODE_IDLE_EVENT = "session.idle";
+var approvalTimeoutMs = () => (HOOK_BUDGETS.opencode.budgetSeconds - HOOK_BUDGETS.opencode.guardSeconds) * 1e3;
+var openCodePluginSource = () => `// Pushary for OpenCode. Generated by @pushary/agent-hooks \u2014 do not edit.
+// ${OPENCODE_PLUGIN_MARKER}
+//
+// OpenCode finds a plugin by globbing {plugin,plugins}/*.{ts,js} under its config
+// directory and importing it, so this file is the whole install.
+//
+// It decides nothing. Each hook builds the payload OpenCode handed it, writes it
+// to the Pushary hook command on stdin, and reads a verdict back. The policy
+// engine, the phone, the wait and the settlement all live behind that command.
+//
+// Approvals ride the event stream rather than the "permission.ask" hook, which is
+// declared in @opencode-ai/plugin and called by nothing. Permission.ask publishes
+// "permission.asked" and blocks on a Deferred that only a reply resolves, so this
+// answers that reply on the person's behalf when Pushary has a verdict.
+//
+// Failure is silence. A missing command, a crash, a timeout, unreadable bytes and
+// an unparseable reply all leave OpenCode's own prompt exactly as it was. The
+// worst this file may do to somebody is nothing at all.
+
+import { spawn } from "node:child_process"
+
+const COMMAND = ${OPENCODE_PLUGIN_PLACEHOLDER}
+const APPROVAL_TIMEOUT_MS = ${approvalTimeoutMs()}
+const TELEMETRY_TIMEOUT_MS = 10000
+const MAX_REPLY_BYTES = 65536
+// One entry per call in flight. Bounded because a long session must not grow them
+// without limit, and evicted oldest-first because whatever is still waiting on an
+// answer is the newest thing in here, never the oldest.
+const MAX_TRACKED = 256
+
+const text = (value) => (typeof value === "string" && value.length > 0 ? value : undefined)
+
+const remember = (map, key, value) => {
+  if (!key || value === undefined) return
+  if (map.size >= MAX_TRACKED) map.delete(map.keys().next().value)
+  map.set(key, value)
+}
+
+const run = (payload, timeoutMs, onSpawn) =>
+  new Promise((resolve) => {
+    let settled = false
+    const finish = (value) => {
+      if (settled) return
+      settled = true
+      clearTimeout(timer)
+      resolve(value)
+    }
+
+    let child
+    try {
+      child = spawn(COMMAND[0], COMMAND.slice(1), { stdio: ["pipe", "pipe", "ignore"] })
+    } catch {
+      return finish(null)
+    }
+    if (onSpawn) onSpawn(child)
+
+    const timer = setTimeout(() => {
+      try {
+        child.kill("SIGKILL")
+      } catch {}
+      finish(null)
+    }, timeoutMs)
+    if (typeof timer.unref === "function") timer.unref()
+
+    let out = ""
+    child.stdout.on("data", (chunk) => {
+      if (out.length < MAX_REPLY_BYTES) out += chunk
+    })
+    child.on("error", () => finish(null))
+    child.on("close", () => {
+      const body = out.trim()
+      if (!body) return finish(null)
+      try {
+        finish(JSON.parse(body))
+      } catch {
+        finish(null)
+      }
+    })
+
+    try {
+      child.stdin.on("error", () => {})
+      child.stdin.end(JSON.stringify(payload))
+    } catch {
+      finish(null)
+    }
+  })
+
+// Telemetry is fire and forget: the agent has already acted and is only being
+// observed, so nothing here may hold up the next turn.
+const tell = (payload) => {
+  void run(payload, TELEMETRY_TIMEOUT_MS)
+}
+
+// What OpenCode gates on, and what it hands over with it. Verified against its own
+// tools: bash asks with { command }, write and edit both ask under "edit" with
+// { filepath, diff }, webfetch with { url }, and a shell command reaching outside
+// the worktree asks a second time under "external_directory".
+const inputFrom = (permission, metadata) => {
+  const meta = metadata && typeof metadata === "object" ? metadata : {}
+  const command = text(meta.command)
+  if (command) return { command }
+  const filepath = text(meta.filepath) ?? text(meta.file_path)
+  // The diff rides along, because it is what the person is actually approving.
+  // OpenCode computes it before raising the permission and hands it over; without
+  // it the phone shows a filename and nothing to judge.
+  if (filepath) return { file_path: filepath, ...(text(meta.diff) ? { diff: meta.diff } : {}) }
+  const url = text(meta.url)
+  if (url) return { url }
+  return { permission }
+}
+
+// Two spellings of one request: the runtime publishes PermissionV1.Request
+// ({ permission, patterns }), the generated SDK types say Permission ({ type,
+// pattern }). Whichever arrives, the id and the session are what we need.
+const askedFrom = (properties) => {
+  if (!properties || typeof properties !== "object") return null
+  const id = text(properties.id)
+  const sessionID = text(properties.sessionID)
+  if (!id || !sessionID) return null
+  return {
+    id,
+    sessionID,
+    permission: text(properties.permission) ?? text(properties.type) ?? "unknown",
+    metadata: properties.metadata,
+    title: text(properties.title),
+    callID: text(properties.callID) ?? text(properties.tool && properties.tool.callID),
+  }
+}
+
+const repliedID = (properties) => {
+  if (!properties || typeof properties !== "object") return undefined
+  return text(properties.requestID) ?? text(properties.permissionID) ?? text(properties.id)
+}
+
+export const PusharyPlugin = async ({ client, directory, worktree }) => {
+  const cwd = worktree || directory || process.cwd()
+  // OpenCode raises a permission under a coarse key \u2014 "edit" covers both write and
+  // edit \u2014 and names the actual tool only on tool.execute.before. Keeping the
+  // pairing is what lets a rule written for Write mean Write here too.
+  const tools = new Map()
+  // Every gate still waiting. Held so a person answering in the terminal can end
+  // ours: whoever answers first wins, and the loser stops asking.
+  const waiting = new Map()
+
+  const base = (sessionID) => ({ session_id: sessionID ?? "", cwd })
+
+  // Replying is the whole approval. Two shapes, because the client handed to a
+  // plugin is generated: v1 exposes postSessionIdPermissionsPermissionId against
+  // /session/{id}/permissions/{permissionID}, v2 exposes permission.reply against
+  // /permission/{requestID}/reply. Both routes are live in the server today.
+  const respond = async (asked, allow) => {
+    const legacy = client && typeof client.postSessionIdPermissionsPermissionId === "function"
+      ? () => client.postSessionIdPermissionsPermissionId({
+          path: { id: asked.sessionID, permissionID: asked.id },
+          body: { response: allow ? "once" : "reject" },
+        })
+      : null
+    const current = client && client.permission && typeof client.permission.reply === "function"
+      ? () => client.permission.reply({
+          // Current v2 uses flat parameters; older generated clients read path/body.
+          requestID: asked.id, reply: allow ? "once" : "reject",
+          path: { requestID: asked.id },
+          body: { reply: allow ? "once" : "reject" },
+        }, { throwOnError: true })
+      : null
+
+    for (const attempt of [legacy, current]) {
+      if (!attempt) continue
+      try {
+        const result = await attempt()
+        if (result && result.error) continue
+        return
+      } catch {
+        // The person answered first, or this client does not serve that route.
+        // Either way the next shape is the only thing left to try.
+      }
+    }
+  }
+
+  const gate = async (asked) => {
+    const reply = await run({
+      ...base(asked.sessionID),
+      hook_event_name: "${OPENCODE_APPROVAL_EVENT}",
+      tool_name: tools.get(asked.callID) ?? asked.permission,
+      tool_input: inputFrom(asked.permission, asked.metadata),
+      permission_id: asked.id,
+      permission_type: asked.permission,
+      title: asked.title,
+    }, APPROVAL_TIMEOUT_MS, (child) => remember(waiting, asked.id, child))
+
+    // Gone means the terminal already answered while we were asking. Replying now
+    // would be answering a question nobody is holding open any more.
+    if (!waiting.delete(asked.id)) return
+
+    const status = reply && typeof reply === "object" ? reply.status : undefined
+    if (status !== "allow" && status !== "deny") return
+    await respond(asked, status === "allow")
+  }
+
+  const withdraw = (id) => {
+    const child = id && waiting.get(id)
+    if (!child) return
+    waiting.delete(id)
+    // SIGTERM rather than SIGKILL: the hook cancels its outstanding question on
+    // the way out, so the phone stops showing a decision the terminal has taken.
+    try {
+      child.kill("SIGTERM")
+    } catch {}
+  }
+
+  return {
+    "tool.execute.before": async (input) => {
+      remember(tools, input && input.callID, input && input.tool)
+    },
+
+    "tool.execute.after": async (input, output) => {
+      const call = input && input.callID
+      if (call) tools.delete(call)
+      tell({
+        ...base(input && input.sessionID),
+        hook_event_name: "tool.execute.after",
+        tool_name: text(input && input.tool) ?? "unknown",
+        tool_input: input && input.args && typeof input.args === "object" ? input.args : {},
+        tool_result: { title: text(output && output.title), output: text(output && output.output) },
+      })
+    },
+
+    "chat.message": async (input, output) => {
+      const parts = output && Array.isArray(output.parts) ? output.parts : []
+      const prompt = parts
+        .filter((part) => part && part.type === "text" && typeof part.text === "string")
+        .map((part) => part.text)
+        .join("\\n")
+        .trim()
+      if (!prompt) return
+      tell({ ...base(input && input.sessionID), hook_event_name: "chat.message", prompt })
+    },
+
+    event: async ({ event }) => {
+      // Never allowed to throw: the host calls this hook without awaiting it, so a
+      // rejection here is an unhandled rejection in somebody's editor.
+      try {
+        const type = event && event.type
+        const properties = event && event.properties
+        if (${JSON.stringify(OPENCODE_ASKED_EVENTS)}.includes(type)) {
+          const asked = askedFrom(properties)
+          if (asked) void gate(asked)
+          return
+        }
+        if (type === ${JSON.stringify(OPENCODE_REPLIED_EVENT)}) {
+          withdraw(repliedID(properties))
+          return
+        }
+        // session.idle is the turn boundary \u2014 OpenCode's equivalent of Claude's
+        // Stop, not of its SessionEnd. Nothing else on the stream is relayed: the
+        // receipts already arrive through the hooks above, and reporting the same
+        // moment twice would double every row on the account.
+        if (type === ${JSON.stringify(OPENCODE_IDLE_EVENT)}) {
+          tell({
+            ...base(properties && properties.sessionID),
+            hook_event_name: ${JSON.stringify(OPENCODE_IDLE_EVENT)},
+          })
+        }
+      } catch {}
+    },
+
+    dispose: async () => {
+      for (const id of Array.from(waiting.keys())) withdraw(id)
+      tools.clear()
+    },
+  }
+}
+`;
+var openCodePluginModule = () => ({
+  marker: OPENCODE_PLUGIN_MARKER,
+  source: openCodePluginSource(),
+  placeholder: OPENCODE_PLUGIN_PLACEHOLDER,
+  sibling: {
+    path: OPENCODE_PLUGIN_SIBLING,
+    contents: OPENCODE_PLUGIN_SIBLING_CONTENTS
+  }
+});
+var renderOpenCodePlugin = (module, argv) => module.source.replace(module.placeholder, JSON.stringify(argv));
+var isOpenCodePluginOurs = (contents) => contents.includes(OPENCODE_PLUGIN_MARKER);
+
+// src/opencode-config.ts
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var OPENCODE_HOOK_BINARY = "pushary-opencode-hook";
+var openCodeConfigDirFrom = (home, env = process.env) => env.OPENCODE_CONFIG_DIR?.trim() || join(env.XDG_CONFIG_HOME?.trim() || join(home, ".config"), "opencode");
+var openCodeConfigDir = () => openCodeConfigDirFrom(homedir());
+var OPENCODE_PLUGIN_PATH = `${OPENCODE_PLUGIN_DIR}/${OPENCODE_PLUGIN_FILE}`;
+var openCodePluginDir = () => join(openCodeConfigDir(), OPENCODE_PLUGIN_DIR);
+var openCodePluginFile = () => join(openCodePluginDir(), OPENCODE_PLUGIN_FILE);
+var OPENCODE_HOOK_EVENTS = [
+  { event: OPENCODE_APPROVAL_EVENT, delivery: "approval", timeout: HOOK_BUDGETS.opencode.budgetSeconds },
+  { event: "tool.execute.after", delivery: "telemetry", timeout: 10 },
+  { event: "chat.message", delivery: "telemetry", timeout: 10 },
+  { event: OPENCODE_IDLE_EVENT, delivery: "telemetry", timeout: 10 }
+];
+var hasForeignPlugins = (entries) => entries.some((entry) => entry !== OPENCODE_PLUGIN_FILE && /\.(ts|js)$/.test(entry));
+var installOpenCodePlugin = (argv, dir = openCodePluginDir()) => {
+  mkdirSync(dir, { recursive: true });
+  const plugin = join(dir, OPENCODE_PLUGIN_FILE);
+  writeFileSync(plugin, renderOpenCodePlugin(openCodePluginModule(), argv), "utf-8");
+  const sibling = join(dir, OPENCODE_PLUGIN_SIBLING);
+  if (existsSync(sibling)) return { plugin, wroteSibling: false };
+  writeFileSync(sibling, OPENCODE_PLUGIN_SIBLING_CONTENTS, "utf-8");
+  return { plugin, wroteSibling: true };
+};
+var openCodeWired = (dir = openCodePluginDir()) => {
+  try {
+    return isOpenCodePluginOurs(readFileSync(join(dir, OPENCODE_PLUGIN_FILE), "utf-8"));
+  } catch {
+    return false;
+  }
+};
+var OPENCODE_MCP_URL = "https://pushary.com/api/mcp/mcp";
+var OPENCODE_CONFIG_FILE = "opencode.json";
+var openCodeConfigFile = () => join(openCodeConfigDir(), OPENCODE_CONFIG_FILE);
+var OPENCODE_INSTRUCTIONS_FILE = "AGENTS.md";
+var openCodeInstructionsFile = () => join(openCodeConfigDir(), OPENCODE_INSTRUCTIONS_FILE);
+var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+var addOpenCodeMcpServer = (config, apiKey) => {
+  const servers = asRecord(config.mcp) ?? {};
+  servers.pushary = {
+    type: "remote",
+    url: OPENCODE_MCP_URL,
+    enabled: true,
+    headers: { Authorization: `Bearer ${apiKey}` }
+  };
+  config.mcp = servers;
+};
+var removeOpenCodeMcpServer = (config) => {
+  const servers = asRecord(config.mcp);
+  if (!servers || !("pushary" in servers)) return false;
+  delete servers.pushary;
+  if (Object.keys(servers).length === 0) delete config.mcp;
+  return true;
+};
+
+export {
+  OPENCODE_PLUGIN_PLACEHOLDER,
+  OPENCODE_PLUGIN_SIBLING,
+  OPENCODE_PLUGIN_SIBLING_CONTENTS,
+  isOpenCodePluginOurs,
+  OPENCODE_HOOK_BINARY,
+  openCodeConfigDirFrom,
+  openCodeConfigDir,
+  openCodePluginDir,
+  openCodePluginFile,
+  hasForeignPlugins,
+  installOpenCodePlugin,
+  openCodeWired,
+  openCodeConfigFile,
+  openCodeInstructionsFile,
+  addOpenCodeMcpServer,
+  removeOpenCodeMcpServer
+};

package/dist/chunk-AXPCESYO.js

@@ -0,0 +1,197 @@
+import {
+  CLAUDE_HOOK_EVENTS,
+  supportedClaudeEvents
+} from "./chunk-3EVPNIBE.js";
+import {
+  guardBinary,
+  holdBudgetOf,
+  isProtectedByScope,
+  registerHookEntry
+} from "./chunk-A2A2YTMG.js";
+import {
+  HOOK_LOCATOR_BINARY,
+  withHookHoldBudget
+} from "./chunk-NQTHFF4W.js";
+
+// src/claude-config.ts
+import { join } from "path";
+import { isDeepStrictEqual } from "util";
+var PUSHARY_MCP_URL = "https://pushary.com/api/mcp/mcp";
+var PUSHARY_PERMISSION_RULE = "mcp__pushary__*";
+var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+var ensureRecord = (target, key) => {
+  const existing = asRecord(target[key]);
+  if (existing) return existing;
+  const created = {};
+  target[key] = created;
+  return created;
+};
+var isPusharyPermission = (rule) => typeof rule === "string" && (rule.includes("pushary") || rule.includes("MCP(pushary"));
+var HOOK_BINARIES = /* @__PURE__ */ new Set([
+  ...CLAUDE_HOOK_EVENTS.map((hook) => hook.binary),
+  HOOK_LOCATOR_BINARY
+]);
+var namesPusharyBinary = (command) => command.split(/[\s/\\"']+/).some((segment) => HOOK_BINARIES.has(segment.replace(/\.(cmd|exe)$/i, "")));
+var isPusharyHook = (entry2, scope) => {
+  const hooks = asRecord(entry2)?.hooks;
+  if (!Array.isArray(hooks)) return false;
+  return hooks.some((hook) => {
+    const command = String(asRecord(hook)?.command ?? "");
+    if (isProtectedByScope(command, scope)) return false;
+    return namesPusharyBinary(command);
+  });
+};
+var pusharyMcpServer = (apiKey) => ({
+  type: "http",
+  url: PUSHARY_MCP_URL,
+  headers: { Authorization: `Bearer ${apiKey}` }
+});
+var addClaudeMcpServer = (config, apiKey) => {
+  const mcpServers = ensureRecord(config, "mcpServers");
+  mcpServers.pushary = pusharyMcpServer(apiKey);
+};
+var isClaudeMcpSnapshot = (value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const snapshot = value;
+  return typeof snapshot.hadMcpServers === "boolean" && typeof snapshot.mcpServersWasRecord === "boolean" && (!snapshot.hadMcpServers || snapshot.mcpServersWasRecord || Object.hasOwn(snapshot, "mcpServers")) && typeof snapshot.hadPushary === "boolean" && (!snapshot.hadPushary || Object.hasOwn(snapshot, "pushary")) && (!Object.hasOwn(snapshot, "installedPushary") || asRecord(snapshot.installedPushary)?.type === "http" && asRecord(snapshot.installedPushary)?.url === PUSHARY_MCP_URL);
+};
+var captureClaudeMcpServer = (config, apiKey) => {
+  const mcpServers = asRecord(config.mcpServers);
+  const hadMcpServers = Object.hasOwn(config, "mcpServers");
+  return {
+    hadMcpServers,
+    mcpServersWasRecord: Boolean(mcpServers),
+    ...hadMcpServers && !mcpServers ? { mcpServers: structuredClone(config.mcpServers) } : {},
+    hadPushary: Boolean(mcpServers && Object.hasOwn(mcpServers, "pushary")),
+    ...mcpServers && Object.hasOwn(mcpServers, "pushary") ? { pushary: structuredClone(mcpServers.pushary) } : {},
+    ...apiKey ? { installedPushary: pusharyMcpServer(apiKey) } : {}
+  };
+};
+var updateClaudeMcpSnapshot = (snapshot, apiKey) => ({
+  ...snapshot,
+  installedPushary: pusharyMcpServer(apiKey)
+});
+var restoreClaudeMcpServer = (config, snapshot) => {
+  const mcpServers = asRecord(config.mcpServers);
+  const current = asRecord(mcpServers?.pushary);
+  if (Object.hasOwn(snapshot, "installedPushary")) {
+    if (!isDeepStrictEqual(mcpServers?.pushary, snapshot.installedPushary)) return false;
+  } else if (current?.type !== "http" || current.url !== PUSHARY_MCP_URL) {
+    return false;
+  }
+  if (!snapshot.mcpServersWasRecord) {
+    if (Object.keys(mcpServers).length === 1) {
+      if (snapshot.hadMcpServers) config.mcpServers = structuredClone(snapshot.mcpServers);
+      else delete config.mcpServers;
+    } else {
+      delete mcpServers.pushary;
+    }
+  } else if (snapshot.hadPushary) {
+    mcpServers.pushary = structuredClone(snapshot.pushary);
+  } else {
+    delete mcpServers.pushary;
+    if (!snapshot.hadMcpServers && Object.keys(mcpServers).length === 0) delete config.mcpServers;
+  }
+  return true;
+};
+var removeClaudeMcpServers = (config) => {
+  let changed = false;
+  const removeFrom = (target) => {
+    const mcpServers = asRecord(target.mcpServers);
+    if (!mcpServers?.pushary) return;
+    delete mcpServers.pushary;
+    if (Object.keys(mcpServers).length === 0) delete target.mcpServers;
+    changed = true;
+  };
+  removeFrom(config);
+  const projects = asRecord(config.projects);
+  if (projects) {
+    for (const project of Object.values(projects)) {
+      const projectConfig = asRecord(project);
+      if (projectConfig) removeFrom(projectConfig);
+    }
+  }
+  return changed;
+};
+var removePusharyToolPermissions = (settings) => {
+  const permissions = asRecord(settings.permissions);
+  if (!permissions || !Array.isArray(permissions.allow)) return false;
+  const filtered = permissions.allow.filter((rule) => !isPusharyPermission(rule));
+  if (filtered.length === permissions.allow.length) return false;
+  if (filtered.length === 0) delete permissions.allow;
+  else permissions.allow = filtered;
+  if (Object.keys(permissions).length === 0) delete settings.permissions;
+  return true;
+};
+var addPusharyToolPermissions = (settings) => {
+  const permissions = ensureRecord(settings, "permissions");
+  const allow = Array.isArray(permissions.allow) ? permissions.allow : [];
+  const filtered = allow.filter((rule) => !isPusharyPermission(rule));
+  if (!filtered.includes(PUSHARY_PERMISSION_RULE)) {
+    filtered.push(PUSHARY_PERMISSION_RULE);
+  }
+  permissions.allow = filtered;
+};
+var addPusharyHooks = (settings, binDir, version = null) => {
+  const resolve = (name) => guardBinary(binDir ? join(binDir, name) : name);
+  const hooks = ensureRecord(settings, "hooks");
+  const supported = new Map(supportedClaudeEvents(version).map((hook) => [hook.event, hook]));
+  for (const known of CLAUDE_HOOK_EVENTS) {
+    const current = Array.isArray(hooks[known.event]) ? hooks[known.event] : [];
+    const definition = supported.get(known.event);
+    if (definition) {
+      hooks[known.event] = registerHookEntry(current, isPusharyHook, entry(definition, resolve));
+      continue;
+    }
+    const others = current.filter((item) => !isPusharyHook(item));
+    if (others.length > 0) {
+      hooks[known.event] = others;
+    } else {
+      delete hooks[known.event];
+    }
+  }
+};
+var entry = (definition, resolve) => ({
+  ...definition.matcher ? { matcher: definition.matcher } : {},
+  hooks: [{
+    type: "command",
+    command: withHookHoldBudget(resolve(definition.binary), holdBudgetOf(definition)),
+    timeout: definition.timeout
+  }]
+});
+var removePusharySettings = (settings, scope) => {
+  let changed = scope?.keepMcpServer === true ? false : removeClaudeMcpServers(settings);
+  if (scope?.keepMcpServer !== true && removePusharyToolPermissions(settings)) changed = true;
+  const hooks = asRecord(settings.hooks);
+  if (hooks) {
+    for (const { event: key } of CLAUDE_HOOK_EVENTS) {
+      const entries = hooks[key];
+      if (!Array.isArray(entries)) continue;
+      const filtered = entries.filter((entry2) => !isPusharyHook(entry2, scope));
+      if (filtered.length !== entries.length) {
+        if (filtered.length === 0) {
+          delete hooks[key];
+        } else {
+          hooks[key] = filtered;
+        }
+        changed = true;
+      }
+    }
+    if (Object.keys(hooks).length === 0) delete settings.hooks;
+  }
+  return changed;
+};
+
+export {
+  isPusharyHook,
+  addClaudeMcpServer,
+  isClaudeMcpSnapshot,
+  captureClaudeMcpServer,
+  updateClaudeMcpSnapshot,
+  restoreClaudeMcpServer,
+  removeClaudeMcpServers,
+  removePusharyToolPermissions,
+  addPusharyToolPermissions,
+  addPusharyHooks,
+  removePusharySettings
+};

package/dist/chunk-C2WCPBF7.js

@@ -0,0 +1,86 @@
+import {
+  HOOK_LOCATOR_BINARY
+} from "./chunk-NQTHFF4W.js";
+
+// src/diagnostics/bridge.ts
+import { execFileSync } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var BRIDGE_BUNDLE_IDENTIFIER = "com.pushary.app";
+var BRIDGE_HELPER_SUFFIX = "/Contents/Helpers/pushary-bridge";
+var BRIDGE_BUNDLE_ROOTS = ["/Applications/Pushary.app", "$HOME/Applications/Pushary.app"];
+var expandHome = (path, home) => path.replaceAll("$HOME", home);
+var parseBridgeStub = (contents, stubPath) => {
+  const helperSuffix = contents.match(/^H=(\S+)$/m)?.[1] ?? BRIDGE_HELPER_SUFFIX;
+  const cachePath = contents.match(/^C="([^"\n]+)"$/m)?.[1] ?? join(dirname(stubPath), ".bridge-cache");
+  const rootsLine = contents.match(/^for P in ((?:"[^"\n]*"\s*)+); do$/m)?.[1];
+  const bundleRoots = rootsLine ? [...rootsLine.matchAll(/"([^"]*)"/g)].map((match) => match[1]) : BRIDGE_BUNDLE_ROOTS;
+  const bundleIdentifier = contents.match(/kMDItemCFBundleIdentifier == "([^"]+)"/)?.[1] ?? BRIDGE_BUNDLE_IDENTIFIER;
+  return { helperSuffix, cachePath, bundleRoots, bundleIdentifier };
+};
+var resolveBridgeStub = (stubPath, probe) => {
+  const contents = probe.readFile(stubPath);
+  if (contents === null) return { kind: "no-stub", stub: stubPath };
+  const shape = parseBridgeStub(contents, stubPath);
+  const helperIn = (bundle) => `${bundle}${shape.helperSuffix}`;
+  const looked = [];
+  for (const root of shape.bundleRoots.map((root2) => expandHome(root2, probe.home))) {
+    looked.push(root);
+    if (probe.exists(helperIn(root))) return { kind: "bundle", helper: helperIn(root), via: "root" };
+  }
+  const cached = shape.cachePath ? probe.readFile(shape.cachePath)?.split("\n")[0]?.trim() : void 0;
+  if (cached) {
+    looked.push(cached);
+    if (probe.exists(helperIn(cached))) return { kind: "bundle", helper: helperIn(cached), via: "cache" };
+  }
+  for (const found of probe.mdfind(shape.bundleIdentifier)) {
+    looked.push(found);
+    if (probe.exists(helperIn(found))) return { kind: "bundle", helper: helperIn(found), via: "spotlight" };
+  }
+  return { kind: "missing", stub: stubPath, looked };
+};
+var BRIDGE_GONE_MESSAGE = "the Mac app is gone but its hooks remain; run pushary setup or reinstall the app";
+var describeBridgeResolution = (resolution) => {
+  switch (resolution.kind) {
+    case "bundle":
+      return `${resolution.helper} (${resolution.via === "root" ? "installed" : resolution.via === "cache" ? "cached path" : "found by Spotlight"})`;
+    case "missing":
+      return BRIDGE_GONE_MESSAGE;
+    case "no-stub":
+      return `${resolution.stub} is not there; ${BRIDGE_GONE_MESSAGE}`;
+  }
+};
+var isBridgeLocator = (executable) => executable !== null && executable.split(/[/\\]/).pop() === HOOK_LOCATOR_BINARY;
+var spotlight = (bundleIdentifier) => {
+  if (process.platform !== "darwin") return [];
+  try {
+    return execFileSync("/usr/bin/mdfind", [`kMDItemCFBundleIdentifier == "${bundleIdentifier}"`], {
+      encoding: "utf-8",
+      timeout: 5e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).split("\n").map((line) => line.trim()).filter((line) => line !== "");
+  } catch {
+    return [];
+  }
+};
+var readOrNull = (path) => {
+  try {
+    return readFileSync(path, "utf-8");
+  } catch {
+    return null;
+  }
+};
+var liveBridgeProbe = () => ({
+  exists: existsSync,
+  readFile: readOrNull,
+  mdfind: spotlight,
+  home: homedir()
+});
+
+export {
+  resolveBridgeStub,
+  describeBridgeResolution,
+  isBridgeLocator,
+  liveBridgeProbe
+};