pushary 1.8.0

package/dist/chunk-J5TIV3J6.js

@@ -0,0 +1,238 @@
+import {
+  addClaudeMcpServer,
+  addPusharyToolPermissions,
+  isPusharyHook,
+  removeClaudeMcpServers
+} from "./chunk-AXPCESYO.js";
+import {
+  CLAUDE_HOOK_EVENTS,
+  addGeminiMcpServer,
+  removeGeminiMcpServer
+} from "./chunk-3EVPNIBE.js";
+import {
+  CLAUDE_CODE_AGENT,
+  parseApplyPatchFiles
+} from "./chunk-CULUZTWQ.js";
+import {
+  guardBinary,
+  holdBudgetOf,
+  registerHookEntry
+} from "./chunk-A2A2YTMG.js";
+import {
+  PHONE_ANSWERED_TOOLS,
+  hookCompatibleProfile,
+  hookCompatibleProfileBySource,
+  toToolLookup,
+  withHookHoldBudget
+} from "./chunk-NQTHFF4W.js";
+
+// src/compatible-config.ts
+import { homedir } from "os";
+import { isAbsolute, join, resolve } from "path";
+var AGENT_FLAG = "--agent";
+var SOURCE_FLAG = "--source";
+var agentArgument = (profile) => `${AGENT_FLAG}=${profile.agentType}`;
+var profileFromArgv = (argv) => {
+  const named = namedAgent(argv);
+  if (named !== void 0) return hookCompatibleProfile(named);
+  const source = namedSource(argv);
+  return source === void 0 ? void 0 : hookCompatibleProfileBySource(source);
+};
+var activeIdentity = (argv) => {
+  const profile = profileFromArgv(argv);
+  return profile ? { type: profile.agentType, label: profile.label } : CLAUDE_CODE_AGENT;
+};
+var namedAgent = (argv) => {
+  const prefix = `${AGENT_FLAG}=`;
+  return argv.find((argument) => argument.startsWith(prefix))?.slice(prefix.length);
+};
+var namedSource = (argv) => {
+  const inline = argv.find((argument) => argument.startsWith(`${SOURCE_FLAG}=`));
+  if (inline) return inline.slice(SOURCE_FLAG.length + 1);
+  const index = argv.indexOf(SOURCE_FLAG);
+  return index === -1 ? void 0 : argv[index + 1] ?? "";
+};
+var activeHookSource = (argv) => {
+  const named = namedAgent(argv);
+  if (named !== void 0) return hookCompatibleProfile(named)?.source ?? null;
+  const source = namedSource(argv);
+  if (source === void 0) return "claude";
+  return source === "claude" ? "claude" : hookCompatibleProfileBySource(source)?.source ?? null;
+};
+var PATCH_INPUT_KEYS = ["command", "patch", "input"];
+var patchedFiles = (toolInput) => [...new Set(PATCH_INPUT_KEYS.flatMap((key) => parseApplyPatchFiles(toolInput[key])))];
+var lookupFor = (profile, input) => {
+  const absolute = (path) => input.cwd && !isAbsolute(path) ? resolve(input.cwd, path) : path;
+  const toolInput = input.tool_input ?? {};
+  const lookup = toToolLookup(profile, input.tool_name ?? "", toolInput, absolute);
+  if (!lookup.unreadable) return lookup;
+  const files = patchedFiles(toolInput);
+  return files.length === 1 ? { ...lookup, input: { ...lookup.input, file_path: absolute(files[0]) }, unreadable: false } : lookup;
+};
+var normalizeToolCall = (profile, input) => {
+  if (!profile || !input.tool_name) return input;
+  const lookup = lookupFor(profile, input);
+  return { ...input, tool_name: lookup.tool, tool_input: lookup.input };
+};
+var underHome = (segments, home = homedir()) => join(home, ...segments);
+var compatibleConfigFile = (profile, home) => underHome(profile.configFile, home);
+var compatibleMcpFile = (profile, home) => profile.mcp ? underHome(profile.mcp.file, home) : null;
+var compatibleInstructionsFile = (profile, home) => profile.instructions ? underHome(profile.instructions.file, home) : null;
+var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+var ensureRecord = (target, key) => {
+  const existing = asRecord(target[key]);
+  if (existing) return existing;
+  const created = {};
+  target[key] = created;
+  return created;
+};
+var descend = (config, keyPath) => keyPath.reduce(ensureRecord, config);
+var findMap = (config, keyPath) => keyPath.reduce((node, key) => node && asRecord(node[key]), config);
+var pruneEmptyMap = (config, keyPath) => {
+  if (keyPath.length === 0) return false;
+  const parent = findMap(config, keyPath.slice(0, -1));
+  const key = keyPath[keyPath.length - 1];
+  const map = asRecord(parent?.[key]);
+  if (!parent || !map || Object.keys(map).length > 0) return false;
+  delete parent[key];
+  return true;
+};
+var aliasesFor = (profile, canonical) => Object.entries(profile.toolAliases).flatMap(([agentName, target]) => target === canonical ? [agentName] : []);
+var carriesPhoneAnswer = (profile, canonical) => profile.wire === "legacy_decision" && PHONE_ANSWERED_TOOLS.has(canonical);
+var translateMatcher = (profile, matcher) => {
+  const spellings = matcher.split("|").filter((canonical) => !carriesPhoneAnswer(profile, canonical)).flatMap((canonical) => [canonical, ...aliasesFor(profile, canonical)]);
+  return [.../* @__PURE__ */ new Set([...spellings, ...profile.extraMatchers])].join("|");
+};
+var TOOL_MATCHED_EVENTS = /* @__PURE__ */ new Set(["PreToolUse", "PostToolUse"]);
+var withoutMatcher = ({ matcher, ...hook }) => hook;
+var compatibleHookEvents = (profile) => CLAUDE_HOOK_EVENTS.filter((hook) => profile.events.includes(hook.event)).map((hook) => {
+  if (!hook.matcher) return hook;
+  if (!TOOL_MATCHED_EVENTS.has(hook.event)) return withoutMatcher(hook);
+  return { ...hook, matcher: translateMatcher(profile, hook.matcher) };
+});
+var WRITTEN = { ok: true };
+var ROOT_KEY = "(root)";
+var dotted = (segments) => segments.join(".") || ROOT_KEY;
+var hooksShapeConflict = (config, profile) => {
+  if (!asRecord(config)) return ROOT_KEY;
+  const walked = [];
+  let node = config;
+  for (const key of profile.hooksKeyPath) {
+    if (node[key] === void 0) return void 0;
+    const nested = asRecord(node[key]);
+    if (!nested) return dotted([...walked, key]);
+    walked.push(key);
+    node = nested;
+  }
+  const clash = CLAUDE_HOOK_EVENTS.find(({ event }) => node[event] !== void 0 && !Array.isArray(node[event]));
+  return clash ? dotted([...walked, clash.event]) : void 0;
+};
+var permissionsShapeConflict = (config) => {
+  if (!asRecord(config)) return ROOT_KEY;
+  if (config.permissions === void 0) return void 0;
+  const permissions = asRecord(config.permissions);
+  if (!permissions) return "permissions";
+  return permissions.allow !== void 0 && !Array.isArray(permissions.allow) ? "permissions.allow" : void 0;
+};
+var addCompatibleToolPermissions = (config) => {
+  const conflictAt = permissionsShapeConflict(config);
+  if (conflictAt) return { ok: false, conflictAt };
+  addPusharyToolPermissions(config);
+  return WRITTEN;
+};
+var entryFor = (profile, definition, resolve2) => ({
+  ...definition.matcher ? { matcher: definition.matcher } : {},
+  hooks: [{
+    type: "command",
+    command: withHookHoldBudget(
+      `${resolve2(definition.binary)} ${agentArgument(profile)}`,
+      holdBudgetOf(definition)
+    ),
+    timeout: definition.timeout
+  }]
+});
+var addCompatibleHooks = (config, profile, binDir) => {
+  const conflictAt = hooksShapeConflict(config, profile);
+  if (conflictAt) return { ok: false, conflictAt };
+  const resolve2 = (name) => guardBinary(binDir ? join(binDir, name) : name);
+  const hooks = descend(config, profile.hooksKeyPath);
+  const supported = new Map(compatibleHookEvents(profile).map((hook) => [hook.event, hook]));
+  for (const known of CLAUDE_HOOK_EVENTS) {
+    const current = Array.isArray(hooks[known.event]) ? hooks[known.event] : [];
+    const definition = supported.get(known.event);
+    if (definition) {
+      hooks[known.event] = registerHookEntry(current, isPusharyHook, entryFor(profile, definition, resolve2));
+      continue;
+    }
+    const others = current.filter((item) => !isPusharyHook(item));
+    if (others.length > 0) hooks[known.event] = others;
+    else delete hooks[known.event];
+  }
+  return WRITTEN;
+};
+var removeCompatibleHooks = (config, profile, scope) => {
+  const hooks = findMap(config, profile.hooksKeyPath);
+  if (!hooks) return false;
+  let changed = false;
+  for (const { event } of CLAUDE_HOOK_EVENTS) {
+    const entries = hooks[event];
+    if (!Array.isArray(entries)) continue;
+    const kept = entries.filter((entry) => !isPusharyHook(entry, scope));
+    if (kept.length === entries.length) continue;
+    if (kept.length === 0) delete hooks[event];
+    else hooks[event] = kept;
+    changed = true;
+  }
+  const pruned = pruneEmptyMap(config, profile.hooksKeyPath);
+  return changed || pruned;
+};
+var hasCompatibleHooks = (config, profile) => {
+  const hooks = findMap(config, profile.hooksKeyPath);
+  if (!hooks) return false;
+  return compatibleHookEvents(profile).some(({ event }) => {
+    const entries = hooks[event];
+    return Array.isArray(entries) && entries.some((entry) => isPusharyHook(entry));
+  });
+};
+var missingCompatibleHookEvents = (config, profile) => {
+  const hooks = findMap(config, profile.hooksKeyPath);
+  return compatibleHookEvents(profile).filter(({ event }) => {
+    const entries = hooks?.[event];
+    return !Array.isArray(entries) || !entries.some((entry) => isPusharyHook(entry));
+  }).map(({ event }) => event);
+};
+var compatiblePermissionRuleFile = (profile, home) => profile.permissionRuleFile ? underHome(profile.permissionRuleFile, home) : null;
+var addCompatibleMcpServer = (config, profile, apiKey) => {
+  if (!profile.mcp) return;
+  if (profile.mcp.shape === "gemini_http") {
+    addGeminiMcpServer(config, apiKey);
+    return;
+  }
+  addClaudeMcpServer(config, apiKey);
+  if (!profile.mcp.trusted) return;
+  const server = asRecord(asRecord(config.mcpServers)?.pushary);
+  if (server) server.trust = true;
+};
+var removeCompatibleMcpServer = (config, profile) => {
+  if (!profile.mcp) return false;
+  return profile.mcp.shape === "gemini_http" ? removeGeminiMcpServer(config) : removeClaudeMcpServers(config);
+};
+
+export {
+  profileFromArgv,
+  activeIdentity,
+  activeHookSource,
+  normalizeToolCall,
+  compatibleConfigFile,
+  compatibleMcpFile,
+  compatibleInstructionsFile,
+  compatibleHookEvents,
+  addCompatibleToolPermissions,
+  addCompatibleHooks,
+  removeCompatibleHooks,
+  hasCompatibleHooks,
+  missingCompatibleHookEvents,
+  compatiblePermissionRuleFile,
+  addCompatibleMcpServer,
+  removeCompatibleMcpServer
+};

package/dist/chunk-JU6W3XAU.js

@@ -0,0 +1,64 @@
+import {
+  isSafeReadOnlyCommand
+} from "./chunk-NQTHFF4W.js";
+
+// src/ledger.ts
+import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";
+import { join, dirname } from "path";
+import { homedir } from "os";
+var ledgerPath = () => process.env.PUSHARY_LEDGER_FILE?.trim() || join(homedir(), ".pushary", "local-ledger.jsonl");
+var MAX_LEDGER_BYTES = 1e6;
+var isGatingMoment = (toolName, toolInput) => {
+  const command = typeof toolInput?.command === "string" ? toolInput.command : void 0;
+  if (toolName === "Bash" && command && isSafeReadOnlyCommand(command)) return false;
+  return true;
+};
+var recordKeylessMoment = (entry) => {
+  try {
+    const path = ledgerPath();
+    const dir = dirname(path);
+    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+    if (existsSync(path) && statSync(path).size > MAX_LEDGER_BYTES) {
+      rmSync(`${path}.1`, { force: true });
+      renameSync(path, `${path}.1`);
+    }
+    appendFileSync(path, `${JSON.stringify(entry)}
+`, "utf-8");
+  } catch {
+  }
+};
+var readLedgerSummary = (days = 7) => {
+  const sinceMs = Date.now() - days * 864e5;
+  const summary = { count: 0, sessions: 0, byTool: {}, sinceMs };
+  const sessions = /* @__PURE__ */ new Set();
+  for (const path of [`${ledgerPath()}.1`, ledgerPath()]) {
+    let raw;
+    try {
+      raw = readFileSync(path, "utf-8");
+    } catch {
+      continue;
+    }
+    for (const line of raw.split("\n")) {
+      if (!line.trim()) continue;
+      let entry;
+      try {
+        entry = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      if (typeof entry.ts !== "number" || entry.ts < sinceMs) continue;
+      summary.count += 1;
+      const tool = typeof entry.tool === "string" && entry.tool ? entry.tool : "Other";
+      summary.byTool[tool] = (summary.byTool[tool] ?? 0) + 1;
+      sessions.add(entry.sessionId || `${entry.project ?? "unknown"}:no-session`);
+    }
+  }
+  summary.sessions = sessions.size;
+  return summary;
+};
+
+export {
+  isGatingMoment,
+  recordKeylessMoment,
+  readLedgerSummary
+};

package/dist/chunk-JYG4B33G.js

@@ -0,0 +1,227 @@
+import {
+  canOpenBrowser,
+  openInBrowser
+} from "./chunk-PUZZELE6.js";
+import {
+  generateKeypair,
+  openSealedKey,
+  publicKeyFingerprint
+} from "./chunk-3EGEA4KH.js";
+import {
+  getBaseUrl
+} from "./chunk-GPEGOGRJ.js";
+
+// src/cli/login-ui.ts
+import { hostname } from "os";
+
+// src/cli/login.ts
+var START_PATH = "/api/cli/auth/start";
+var CLAIM_PATH = "/api/cli/auth/claim";
+var DEFAULT_TIMEOUT_MS = 1e4;
+var post = async (url, body, fetchImpl) => fetchImpl(url, {
+  method: "POST",
+  headers: { "Content-Type": "application/json" },
+  body: JSON.stringify(body),
+  signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS)
+});
+var asString = (value) => typeof value === "string" && value ? value : null;
+var asNumber = (value, fallback) => typeof value === "number" && Number.isFinite(value) ? value : fallback;
+var startLogin = async (machineLabel, cliVersion, deps = {}) => {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const baseUrl = deps.baseUrl ?? getBaseUrl();
+  const keypair = generateKeypair();
+  let response;
+  try {
+    response = await post(
+      `${baseUrl}${START_PATH}`,
+      { cliPublicKey: keypair.publicKeyB64, machineLabel, cliVersion },
+      fetchImpl
+    );
+  } catch (err) {
+    return { kind: "unavailable", detail: err instanceof Error ? err.message : "network error" };
+  }
+  if (response.status === 429) {
+    const retry = Number(response.headers.get("retry-after") ?? "60");
+    return { kind: "rate-limited", retryAfterSeconds: Number.isFinite(retry) ? retry : 60 };
+  }
+  if (!response.ok) {
+    return { kind: "unavailable", detail: `HTTP ${response.status}` };
+  }
+  const body = await response.json().catch(() => null);
+  const loginId = body ? asString(body.loginId) : null;
+  const userCode = body ? asString(body.userCode) : null;
+  if (!body || !loginId || !userCode) {
+    return { kind: "unavailable", detail: "the server did not return a login code" };
+  }
+  return {
+    kind: "ok",
+    start: {
+      loginId,
+      userCode,
+      verificationUrl: asString(body.verificationUrl) ?? `${baseUrl}/cli/authorize`,
+      // The cadence comes from the server so a later change needs no CLI release.
+      intervalMs: Math.max(1, asNumber(body.interval, 2)) * 1e3,
+      expiresInSeconds: Math.max(1, asNumber(body.expiresInSeconds, 900)),
+      fingerprint: asString(body.fingerprint) ?? publicKeyFingerprint(keypair.publicKeyB64),
+      keypair
+    }
+  };
+};
+var pollOnce = async (start, deps = {}) => {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const baseUrl = deps.baseUrl ?? getBaseUrl();
+  let response;
+  try {
+    response = await fetchImpl(`${baseUrl}${CLAIM_PATH}?id=${encodeURIComponent(start.loginId)}`, {
+      signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS)
+    });
+  } catch (err) {
+    return { kind: "unreachable", detail: err instanceof Error ? err.message : "network error" };
+  }
+  if (!response.ok) return { kind: "unreachable", detail: `HTTP ${response.status}` };
+  const body = await response.json().catch(() => null);
+  if (!body) return { kind: "unreachable", detail: "unreadable response" };
+  switch (body.status) {
+    case "authorized": {
+      const sealed = asString(body.sealed);
+      if (!sealed) return { kind: "unreachable", detail: "authorized without a sealed key" };
+      try {
+        return {
+          kind: "authorized",
+          apiKey: openSealedKey(sealed, start.keypair),
+          siteSlug: asString(body.siteSlug) ?? "",
+          keyName: asString(body.keyName) ?? "CLI"
+        };
+      } catch {
+        return { kind: "unreachable", detail: "the key did not decrypt" };
+      }
+    }
+    case "payment_required":
+      return {
+        kind: "payment-required",
+        checkoutUrl: asString(body.checkoutUrl) ?? `${baseUrl}/dashboard/settings?tab=billing`,
+        plan: asString(body.plan) ?? "agent"
+      };
+    case "rejected":
+      return { kind: "rejected" };
+    case "expired":
+      return { kind: "expired" };
+    case "needs_workspace":
+      return { kind: "needs-workspace" };
+    default:
+      return { kind: "pending", expiresInSeconds: asNumber(body.expiresInSeconds, 0) };
+  }
+};
+var waitForLogin = async (start, handlers = {}, deps = {}) => {
+  const now = deps.now ?? Date.now;
+  const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const deadline = now() + start.expiresInSeconds * 1e3;
+  let polls = 0;
+  let consecutiveFailures = 0;
+  const noticed = /* @__PURE__ */ new Set();
+  while (now() < deadline) {
+    const state = await pollOnce(start, deps);
+    polls += 1;
+    if (state.kind === "authorized" || state.kind === "rejected" || state.kind === "expired") {
+      return { state, polls };
+    }
+    if (state.kind === "unreachable") {
+      consecutiveFailures += 1;
+      if (consecutiveFailures === 3 && !noticed.has("unreachable")) {
+        noticed.add("unreachable");
+        handlers.onNotice?.(state);
+      }
+    } else {
+      consecutiveFailures = 0;
+      if ((state.kind === "needs-workspace" || state.kind === "payment-required") && !noticed.has(state.kind)) {
+        noticed.add(state.kind);
+        handlers.onNotice?.(state);
+      }
+    }
+    handlers.onTick?.(state, Math.max(0, Math.ceil((deadline - now()) / 1e3)));
+    await sleep(start.intervalMs);
+  }
+  return { state: { kind: "expired" }, polls };
+};
+var cancelLogin = async (start, deps = {}) => {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const baseUrl = deps.baseUrl ?? getBaseUrl();
+  try {
+    await fetchImpl(`${baseUrl}${START_PATH}`, {
+      method: "DELETE",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ loginId: start.loginId, cliPublicKey: start.keypair.publicKeyB64 }),
+      signal: AbortSignal.timeout(5e3)
+    });
+  } catch {
+  }
+};
+
+// src/cli/login-ui.ts
+var runBrowserLogin = async (ui, options, deps = {}) => {
+  const started = await startLogin(hostname(), options.cliVersion, deps);
+  if (started.kind === "rate-limited") {
+    return { kind: "unavailable", detail: `too many attempts, retry in ${started.retryAfterSeconds}s` };
+  }
+  if (started.kind === "unavailable") {
+    return { kind: "unavailable", detail: started.detail };
+  }
+  const start = started.start;
+  let cancelled = false;
+  const onSignal = () => {
+    if (cancelled) return;
+    cancelled = true;
+    void cancelLogin(start, deps).finally(() => {
+      ui.say("");
+      ui.say("  Cancelled. Nothing was written.");
+      process.exit(130);
+    });
+  };
+  process.on("SIGINT", onSignal);
+  process.on("SIGHUP", onSignal);
+  try {
+    ui.say("");
+    ui.say(`  ${ui.bold("Sign in to Pushary")}`);
+    ui.say("");
+    ui.say(`  1. Open ${ui.cyan(start.verificationUrl)}`);
+    ui.say(`  2. Enter this code: ${ui.bold(start.userCode)}`);
+    ui.say("");
+    ui.say(`  ${ui.dim(`This terminal shows fingerprint ${start.fingerprint}. The page shows the same one.`)}`);
+    ui.say(`  ${ui.dim("The code is only on your screen. Nobody can send you a link that fills it in.")}`);
+    ui.say("");
+    if (!options.noBrowser && canOpenBrowser() && openInBrowser(start.verificationUrl)) {
+      ui.say(`  ${ui.dim("Opened your browser.")}`);
+    }
+    const notice = (state2) => {
+      if (state2.kind === "needs-workspace") {
+        ui.say(`  ${ui.yellow("!")} Waiting on a workspace. Finish creating one in the browser and this continues on its own.`);
+      } else if (state2.kind === "payment-required") {
+        ui.say(`  ${ui.yellow("!")} A plan is needed before a key can be issued. Nothing was created yet.`);
+        ui.say(`  ${ui.dim("Choose one at")} ${ui.cyan(state2.checkoutUrl)}`);
+        ui.say(`  ${ui.dim("Keep the browser tab open and this finishes on its own once the plan is active.")}`);
+        ui.say(`  ${ui.dim("If you closed it, reopen the page and enter the same code again.")}`);
+        if (!options.noBrowser && canOpenBrowser()) openInBrowser(state2.checkoutUrl);
+      } else if (state2.kind === "unreachable") {
+        ui.say(`  ${ui.yellow("!")} Still trying. pushary.com is not answering ${ui.dim(`(${state2.detail})`)}`);
+      }
+    };
+    const { state } = await waitForLogin(start, { onNotice: notice }, deps);
+    if (state.kind === "authorized") {
+      return {
+        kind: "ok",
+        apiKey: state.apiKey,
+        siteSlug: state.siteSlug,
+        keyName: state.keyName
+      };
+    }
+    if (state.kind === "rejected") return { kind: "rejected" };
+    return { kind: "expired" };
+  } finally {
+    process.off("SIGINT", onSignal);
+    process.off("SIGHUP", onSignal);
+  }
+};
+
+export {
+  runBrowserLogin
+};