pushary 1.8.0

package/dist/chunk-QCGNGEGE.js

@@ -0,0 +1,15 @@
+// src/cli/human.ts
+var stream = process.stdout;
+var setHumanStream = (target) => {
+  stream = target;
+};
+var writeHuman = (text) => {
+  stream.write(text);
+};
+var humanIsTty = () => stream === process.stdout && process.stdout.isTTY === true;
+
+export {
+  setHumanStream,
+  writeHuman,
+  humanIsTty
+};

package/dist/chunk-R7437YI3.js

@@ -0,0 +1,151 @@
+import {
+  buildTranscriptRecords,
+  decodePublicKey,
+  generateSessionKey,
+  wrapSessionKey
+} from "./chunk-MPWXGONV.js";
+import {
+  fetchTranscriptRecipients,
+  uploadTranscriptRecords
+} from "./chunk-SAXBC4AZ.js";
+
+// src/live-session.ts
+var MAX_TRANSCRIPT_QUEUE = 100;
+var MAX_TRANSCRIPT_TEXT = 32 * 1024;
+var LIVE_SESSION_HEARTBEAT_MS = 6e4;
+var liveSessionSleep = (ms, signal) => new Promise((resolve) => {
+  if (signal.aborted) return resolve();
+  const timer = setTimeout(done, ms);
+  function done() {
+    clearTimeout(timer);
+    signal.removeEventListener("abort", done);
+    resolve();
+  }
+  signal.addEventListener("abort", done, { once: true });
+});
+var postLiveSession = (options, path, body) => {
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  const timeout = setTimeout(abort, options.requestTimeoutMs ?? 1e4);
+  if (options.signal.aborted) abort();
+  else options.signal.addEventListener("abort", abort, { once: true });
+  return fetch(`${options.baseUrl}${path}`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${options.apiKey}`, "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+    signal: controller.signal
+  }).finally(() => {
+    clearTimeout(timeout);
+    options.signal.removeEventListener("abort", abort);
+  });
+};
+var postLiveSessionUntilAccepted = async (options, path, body) => {
+  while (!options.signal.aborted) {
+    try {
+      const response = await postLiveSession(options, path, body);
+      if (response.ok) return;
+      if (response.status < 500 && response.status !== 429) {
+        throw new Error(`${path} rejected (${response.status})`);
+      }
+    } catch (error) {
+      if (options.signal.aborted) throw error;
+      if (error instanceof Error && error.message.startsWith(`${path} rejected`)) throw error;
+    }
+    await liveSessionSleep(options.pollIntervalMs ?? 2e3, options.signal);
+  }
+  throw new Error("Live session stopped before it linked");
+};
+var startLiveSessionHeartbeat = (options, body, intervalMs = LIVE_SESSION_HEARTBEAT_MS, onBeat) => {
+  const timer = setInterval(() => {
+    if (!options.signal.aborted) {
+      onBeat?.();
+      void postLiveSession(options, "/api/agent/event", body).catch(() => {
+      });
+    }
+  }, intervalMs);
+  timer.unref();
+  return () => clearInterval(timer);
+};
+var LiveTranscriptRelay = class {
+  constructor(options, sessionId) {
+    this.options = options;
+    this.sessionId = sessionId;
+  }
+  queue = [];
+  sessionKey = null;
+  wrappedKey = null;
+  providerWrappedKey = null;
+  providerKeyId = null;
+  keyUploaded = false;
+  keyRejected = false;
+  flushing = null;
+  add(value) {
+    if (this.keyRejected) return;
+    const raw = JSON.stringify(value);
+    if (raw.length > MAX_TRANSCRIPT_TEXT) return;
+    if (this.queue.length === MAX_TRANSCRIPT_QUEUE) this.queue.shift();
+    this.queue.push(raw);
+    void this.flush();
+  }
+  async flush() {
+    if (this.flushing) return this.flushing;
+    if (this.queue.length === 0) return;
+    this.flushing = this.drainQueue().finally(() => {
+      this.flushing = null;
+    });
+    return this.flushing;
+  }
+  async drainQueue() {
+    while (this.queue.length > 0 && await this.flushBatch()) {
+    }
+  }
+  async flushBatch() {
+    try {
+      if (!this.sessionKey) {
+        const recipients = await fetchTranscriptRecipients(this.options.apiKey, this.options.baseUrl);
+        if (!recipients) return false;
+        this.sessionKey = generateSessionKey();
+        this.wrappedKey = wrapSessionKey(this.sessionKey, decodePublicKey(recipients.phonePublicKey));
+        if (recipients.provider) {
+          this.providerWrappedKey = wrapSessionKey(this.sessionKey, decodePublicKey(recipients.provider.publicKey));
+          this.providerKeyId = recipients.provider.keyId;
+        }
+      }
+      const count = Math.min(this.queue.length, 50);
+      const records = buildTranscriptRecords(this.queue.slice(0, count), this.sessionKey).records;
+      if (records.length === 0) {
+        this.queue.splice(0, count);
+        return true;
+      }
+      const result = await uploadTranscriptRecords(this.options.apiKey, {
+        sessionId: this.sessionId,
+        machineId: this.options.machineId,
+        dataEncryptionKey: this.keyUploaded ? void 0 : this.wrappedKey ?? void 0,
+        providerWrappedSessionKey: this.keyUploaded ? void 0 : this.providerWrappedKey ?? void 0,
+        providerKeyId: this.keyUploaded ? void 0 : this.providerKeyId ?? void 0,
+        records
+      }, this.options.baseUrl);
+      if (result.keyConflict) {
+        this.keyRejected = true;
+        this.queue.length = 0;
+        return false;
+      }
+      if (result.ok) {
+        this.keyUploaded ||= result.keyRegistered;
+        this.queue.splice(0, count);
+        return true;
+      }
+      return false;
+    } catch {
+      return false;
+    }
+  }
+};
+
+export {
+  liveSessionSleep,
+  postLiveSession,
+  postLiveSessionUntilAccepted,
+  startLiveSessionHeartbeat,
+  LiveTranscriptRelay
+};

package/dist/chunk-RHR6NARM.js

@@ -0,0 +1,305 @@
+import {
+  spawnClaude
+} from "./chunk-XHKBHWLX.js";
+import {
+  codexHome,
+  codexHooksJsonIn,
+  isPusharyCodexCommand,
+  resolvePathBinary
+} from "./chunk-A2A2YTMG.js";
+import {
+  getPackageVersion
+} from "./chunk-NQTHFF4W.js";
+
+// src/codex-app-server.ts
+import { existsSync, realpathSync } from "fs";
+import { join } from "path";
+var CODEX_HOOK_STATUS = {
+  trusted: "trusted",
+  untrusted: "untrusted",
+  modified: "modified",
+  managed: "managed",
+  disabled: "disabled",
+  notListed: "not listed"
+};
+var CODEX_APP_SERVER_ARGS = ["app-server"];
+var CODEX_APP_SERVER_TIMEOUT_MS = 1e4;
+var TERMINATE_GRACE_MS = 1e3;
+var MAX_RPC_LINE = 4 * 1024 * 1024;
+var STDERR_TAIL_LIMIT = 400;
+var PUSHARY_CLIENT_NAME = "pushary";
+var METHOD_INITIALIZE = "initialize";
+var METHOD_INITIALIZED = "initialized";
+var METHOD_HOOKS_LIST = "hooks/list";
+var METHOD_CONFIG_BATCH_WRITE = "config/batchWrite";
+var HOOKS_STATE_KEY_PATH = "hooks.state";
+var CODEX_INSTALLATION_ID_FILE = "installation_id";
+var CODEX_NOT_ASKED = {
+  notInteractive: "Pushary only starts Codex when you run setup, upgrade or doctor yourself at a terminal",
+  noCodexOnPath: "there is no codex command on PATH",
+  neverOpened: "Codex has not been opened on this machine yet",
+  insideAnApp: "the codex command resolves inside an app bundle, which Pushary does not run"
+};
+var UNRECOGNISED_LISTING = "Codex answered hooks/list in a shape Pushary does not recognise";
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isCodexListedHook = (value) => isRecord(value) && typeof value.key === "string" && typeof value.eventName === "string" && typeof value.command === "string" && typeof value.sourcePath === "string" && typeof value.enabled === "boolean" && typeof value.isManaged === "boolean" && typeof value.currentHash === "string" && typeof value.trustStatus === "string";
+var listedHookFields = (hook) => ({
+  key: hook.key,
+  eventName: hook.eventName,
+  command: hook.command,
+  sourcePath: hook.sourcePath,
+  enabled: hook.enabled,
+  isManaged: hook.isManaged,
+  currentHash: hook.currentHash,
+  trustStatus: hook.trustStatus
+});
+var diagnosticMessages = (value) => {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((entry) => {
+    if (typeof entry === "string") return [entry];
+    if (isRecord(entry) && typeof entry.message === "string") return [entry.message];
+    return [];
+  });
+};
+var hooksListingOf = (result) => {
+  if (!isRecord(result) || !Array.isArray(result.data)) return null;
+  const hooks = [];
+  const warnings = [];
+  for (const layer of result.data) {
+    if (!isRecord(layer) || !Array.isArray(layer.hooks)) return null;
+    hooks.push(...layer.hooks.filter(isCodexListedHook).map(listedHookFields));
+    warnings.push(...diagnosticMessages(layer.warnings), ...diagnosticMessages(layer.errors));
+  }
+  return { hooks, warnings };
+};
+var isPusharyHookIn = (hooksJsonPath, hook) => hook.sourcePath === hooksJsonPath && isPusharyCodexCommand(hook.command);
+var isTrustableByPushary = (hook) => hook.enabled && !hook.isManaged && hook.trustStatus !== CODEX_HOOK_STATUS.managed;
+var pusharyHooksIn = (hooks, hooksJsonPath) => hooks.filter((hook) => isPusharyHookIn(hooksJsonPath, hook));
+var selectPusharyCodexHooks = (hooks, hooksJsonPath) => pusharyHooksIn(hooks, hooksJsonPath).filter(isTrustableByPushary);
+var codexTrustVerdict = (hooks, hooksJsonPath) => {
+  if (pusharyHooksIn(hooks, hooksJsonPath).length === 0) return { kind: "unlisted" };
+  const untrusted = selectPusharyCodexHooks(hooks, hooksJsonPath).filter((hook) => hook.trustStatus !== CODEX_HOOK_STATUS.trusted);
+  return untrusted.length === 0 ? { kind: "trusted" } : { kind: "untrusted", hooks: untrusted };
+};
+var codexTrustEdit = (hooks) => ({
+  edits: [{
+    keyPath: HOOKS_STATE_KEY_PATH,
+    mergeStrategy: "upsert",
+    value: Object.fromEntries(hooks.map((hook) => [hook.key, { trusted_hash: hook.currentHash }]))
+  }],
+  reloadUserConfig: true
+});
+var initializeParams = (clientVersion) => ({
+  clientInfo: { name: PUSHARY_CLIENT_NAME, title: null, version: clientVersion }
+});
+var hooksListParams = (cwd) => ({ cwds: [cwd] });
+var hookEventOf = (eventName) => eventName.charAt(0).toUpperCase() + eventName.slice(1);
+var readingOf = (hook) => ({
+  event: hookEventOf(hook.eventName),
+  status: hook.enabled ? hook.trustStatus : CODEX_HOOK_STATUS.disabled
+});
+var codexHookTrustByEvent = (events, hooks) => events.map((event) => hooks.map(readingOf).find((reading) => reading.event === event) ?? { event, status: CODEX_HOOK_STATUS.notListed });
+var CODEX_TRUST_FAILURES = /* @__PURE__ */ new Set([CODEX_HOOK_STATUS.untrusted, CODEX_HOOK_STATUS.modified]);
+var isCodexTrustFailure = (reading) => CODEX_TRUST_FAILURES.has(reading.status);
+var eventsWithStatus = (readings, status) => readings.filter((reading) => reading.status === status).map((reading) => reading.event);
+var assessCodexHookTrust = (events, hooks) => {
+  const readings = codexHookTrustByEvent(events, hooks);
+  const notListed = eventsWithStatus(readings, CODEX_HOOK_STATUS.notListed);
+  if (readings.length > 0 && notListed.length === readings.length) return { kind: "unlisted" };
+  const disabled = eventsWithStatus(readings, CODEX_HOOK_STATUS.disabled);
+  const failures = readings.filter(isCodexTrustFailure);
+  if (failures.length > 0) return { kind: "untrusted", failures, notListed, disabled };
+  const trusted = eventsWithStatus(readings, CODEX_HOOK_STATUS.trusted).length;
+  return { kind: "trusted", trusted, total: readings.length, notListed, disabled };
+};
+var mayAskCodex = (conditions) => {
+  if (!conditions.interactive) return { kind: "skipped", reason: CODEX_NOT_ASKED.notInteractive };
+  if (!conditions.codexOnPath) return { kind: "skipped", reason: CODEX_NOT_ASKED.noCodexOnPath };
+  if (!conditions.codexOpenedBefore) return { kind: "skipped", reason: CODEX_NOT_ASKED.neverOpened };
+  if (conditions.codexOnPath.split(/[\\/]/).some((part) => part.toLowerCase().endsWith(".app"))) {
+    return { kind: "skipped", reason: CODEX_NOT_ASKED.insideAnApp };
+  }
+  return { kind: "ask", binary: conditions.codexOnPath };
+};
+var canonicalPath = (path) => {
+  try {
+    return realpathSync(path);
+  } catch {
+    return path;
+  }
+};
+var withCanonicalSources = (hooks) => hooks.map((hook) => ({ ...hook, sourcePath: canonicalPath(hook.sourcePath) }));
+var hasExited = (child) => child.exitCode !== null || child.signalCode !== null;
+var waitForExit = (child, ms) => new Promise((resolve) => {
+  if (hasExited(child)) return resolve(true);
+  const timer = setTimeout(() => resolve(false), ms);
+  child.once("exit", () => {
+    clearTimeout(timer);
+    resolve(true);
+  });
+});
+var terminate = async (child) => {
+  if (child.pid === void 0 || hasExited(child)) return;
+  child.stdin?.end();
+  child.kill("SIGTERM");
+  if (await waitForExit(child, TERMINATE_GRACE_MS)) return;
+  child.kill("SIGKILL");
+  await waitForExit(child, TERMINATE_GRACE_MS);
+};
+var rpcErrorMessage = (error) => isRecord(error) && typeof error.message === "string" ? error.message : "Codex returned an error";
+var describeExit = (code, signal, stderr) => {
+  const how = signal ? `signal ${signal}` : `code ${code ?? "unknown"}`;
+  const tail = stderr.trim();
+  return tail ? `Codex app-server exited (${how}): ${tail}` : `Codex app-server exited (${how})`;
+};
+var runCodexAppServer = (launch, conversation) => {
+  const child = spawnClaude(launch.binary, CODEX_APP_SERVER_ARGS, {
+    cwd: launch.codexHome,
+    env: { ...process.env, CODEX_HOME: launch.codexHome },
+    stdio: ["pipe", "pipe", "pipe"],
+    windowsHide: true
+  });
+  const pending = /* @__PURE__ */ new Map();
+  let nextId = 1;
+  let buffer = "";
+  let stderrTail = "";
+  let stoppedReason = null;
+  let stop = () => {
+  };
+  const stopped = new Promise((resolve) => {
+    stop = (reason) => {
+      if (stoppedReason !== null) return;
+      stoppedReason = reason;
+      for (const settle of pending.values()) settle({ kind: "error", message: reason });
+      pending.clear();
+      resolve({ kind: "unavailable", reason });
+    };
+  });
+  const write = (message) => {
+    if (stoppedReason === null) child.stdin?.write(`${JSON.stringify(message)}
+`);
+  };
+  const handleLine = (line) => {
+    let message;
+    try {
+      message = JSON.parse(line);
+    } catch {
+      return;
+    }
+    if (!isRecord(message) || typeof message.id !== "number" || "method" in message) return;
+    const settle = pending.get(message.id);
+    if (!settle) return;
+    pending.delete(message.id);
+    settle("error" in message && message.error !== void 0 && message.error !== null ? { kind: "error", message: rpcErrorMessage(message.error) } : { kind: "result", value: message.result });
+  };
+  child.stdin?.on("error", () => {
+  });
+  child.stdout?.setEncoding("utf8");
+  child.stdout?.on("data", (chunk) => {
+    buffer += chunk;
+    let newline = buffer.indexOf("\n");
+    while (newline >= 0) {
+      handleLine(buffer.slice(0, newline));
+      buffer = buffer.slice(newline + 1);
+      newline = buffer.indexOf("\n");
+    }
+    if (buffer.length > MAX_RPC_LINE) stop("Codex app-server sent an oversized message");
+  });
+  child.stderr?.setEncoding("utf8");
+  child.stderr?.on("data", (chunk) => {
+    stderrTail = (stderrTail + chunk).slice(-STDERR_TAIL_LIMIT);
+  });
+  child.once("error", (error) => stop(`could not start ${launch.binary}: ${error.message}`));
+  child.once("close", (code, signal) => stop(describeExit(code, signal, stderrTail)));
+  const timer = setTimeout(
+    () => stop(`Codex app-server did not answer within ${launch.timeoutMs / 1e3}s`),
+    launch.timeoutMs
+  );
+  const session = {
+    request: (method, params) => {
+      if (stoppedReason !== null) return Promise.resolve({ kind: "error", message: stoppedReason });
+      const id = nextId++;
+      return new Promise((resolve) => {
+        pending.set(id, resolve);
+        write({ id, method, params });
+      });
+    },
+    notify: (method) => write({ method })
+  };
+  const conversed = conversation(session).catch((error) => ({
+    kind: "unavailable",
+    reason: error instanceof Error ? error.message : String(error)
+  }));
+  return Promise.race([conversed, stopped]).finally(async () => {
+    clearTimeout(timer);
+    await terminate(child);
+  });
+};
+var launchOf = (options) => {
+  const home = options.codexHome ?? codexHome();
+  const binary = options.codexOnPath === void 0 ? resolvePathBinary("codex") ?? null : options.codexOnPath;
+  const decision = mayAskCodex({
+    interactive: options.interactive ?? process.stdout.isTTY === true,
+    codexOnPath: binary ? canonicalPath(binary) : null,
+    codexOpenedBefore: existsSync(join(home, CODEX_INSTALLATION_ID_FILE))
+  });
+  if (decision.kind === "skipped") return decision;
+  return { binary: decision.binary, codexHome: home, timeoutMs: options.timeoutMs ?? CODEX_APP_SERVER_TIMEOUT_MS };
+};
+var isSkipped = (value) => "kind" in value && value.kind === "skipped";
+var openSession = async (session) => {
+  const initialized = await session.request(METHOD_INITIALIZE, initializeParams(getPackageVersion()));
+  if (initialized.kind === "error") return { kind: "unavailable", reason: `Codex refused initialize: ${initialized.message}` };
+  session.notify(METHOD_INITIALIZED);
+  return null;
+};
+var listHooks = async (session, launch) => {
+  const listed = await session.request(METHOD_HOOKS_LIST, hooksListParams(launch.codexHome));
+  if (listed.kind === "error") return { kind: "unavailable", reason: `Codex could not list hooks: ${listed.message}` };
+  const listing = hooksListingOf(listed.value);
+  if (!listing) return { kind: "unavailable", reason: UNRECOGNISED_LISTING };
+  return { hooks: withCanonicalSources(listing.hooks), warnings: listing.warnings };
+};
+var isListing = (value) => !("kind" in value);
+var confirmationAfterWrite = (listing, hooksJsonPath, writeError) => {
+  const verdict = codexTrustVerdict(listing.hooks, hooksJsonPath);
+  if (verdict.kind === "trusted") return { kind: "verified", wrote: true };
+  if (verdict.kind === "unlisted") return { kind: "unlisted", warnings: listing.warnings };
+  return { kind: "refused", hooks: verdict.hooks.map(readingOf), writeError };
+};
+var trustConversation = (launch, hooksJsonPath) => async (session) => {
+  const unavailable = await openSession(session);
+  if (unavailable) return unavailable;
+  const before = await listHooks(session, launch);
+  if (!isListing(before)) return before;
+  const verdict = codexTrustVerdict(before.hooks, hooksJsonPath);
+  if (verdict.kind === "trusted") return { kind: "verified", wrote: false };
+  if (verdict.kind === "unlisted") return { kind: "unlisted", warnings: before.warnings };
+  const written = await session.request(METHOD_CONFIG_BATCH_WRITE, codexTrustEdit(verdict.hooks));
+  const after = await listHooks(session, launch);
+  if (!isListing(after)) return after;
+  return confirmationAfterWrite(after, hooksJsonPath, written.kind === "error" ? written.message : null);
+};
+var listingConversation = (launch, hooksJsonPath) => async (session) => {
+  const unavailable = await openSession(session);
+  if (unavailable) return unavailable;
+  const listing = await listHooks(session, launch);
+  if (!isListing(listing)) return listing;
+  return { kind: "listed", hooks: pusharyHooksIn(listing.hooks, hooksJsonPath) };
+};
+var ensureCodexTrustsPusharyHooks = async (options = {}) => {
+  const launch = launchOf(options);
+  if (isSkipped(launch)) return launch;
+  return runCodexAppServer(launch, trustConversation(launch, canonicalPath(codexHooksJsonIn(launch.codexHome))));
+};
+var readCodexTrustForPusharyHooks = async (options = {}) => {
+  const launch = launchOf(options);
+  if (isSkipped(launch)) return launch;
+  return runCodexAppServer(launch, listingConversation(launch, canonicalPath(codexHooksJsonIn(launch.codexHome))));
+};
+
+export {
+  assessCodexHookTrust,
+  ensureCodexTrustsPusharyHooks,
+  readCodexTrustForPusharyHooks
+};

package/dist/chunk-SAXBC4AZ.js

@@ -0,0 +1,60 @@
+import {
+  getBaseUrl
+} from "./chunk-GPEGOGRJ.js";
+
+// src/transcript-api.ts
+var fetchTranscriptRecipients = async (apiKey, baseUrl = getBaseUrl()) => {
+  try {
+    const res = await fetch(`${baseUrl}/api/agent/encryption-account`, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(5e3)
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    if (typeof data.publicKey !== "string" || data.publicKey.length === 0) return null;
+    if (data.providerRecovery === void 0 || data.providerRecovery === null) {
+      return { phonePublicKey: data.publicKey, provider: null };
+    }
+    if (typeof data.providerRecovery !== "object") return null;
+    const provider = data.providerRecovery;
+    if (typeof provider.required !== "boolean" || typeof provider.keyId !== "string" || provider.keyId.length === 0 || typeof provider.publicKey !== "string" || provider.publicKey.length === 0) return null;
+    return {
+      phonePublicKey: data.publicKey,
+      provider: { required: provider.required, keyId: provider.keyId, publicKey: provider.publicKey }
+    };
+  } catch {
+    return null;
+  }
+};
+var fetchAccountPublicKey = async (apiKey, baseUrl = getBaseUrl()) => (await fetchTranscriptRecipients(apiKey, baseUrl))?.phonePublicKey ?? null;
+var uploadTranscriptRecords = async (apiKey, params, baseUrl = getBaseUrl()) => {
+  try {
+    const res = await fetch(`${baseUrl}/api/agent/transcript`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
+      body: JSON.stringify(params),
+      signal: AbortSignal.timeout(15e3)
+    });
+    const body = await res.json().catch(() => null);
+    const keyRegistered = body?.keyRegistered === true;
+    const keyConflict = body?.keyConflict === true;
+    const keyUnavailable = res.status === 503;
+    const ids = (value) => Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
+    return {
+      ok: res.ok && !keyConflict && (params.dataEncryptionKey === void 0 || keyRegistered),
+      keyRegistered,
+      keyConflict,
+      keyUnavailable,
+      settledIds: Array.isArray(body?.settledIds) ? ids(body.settledIds) : null,
+      rejectedIds: ids(body?.rejectedIds)
+    };
+  } catch {
+    return { ok: false, keyRegistered: false, keyConflict: false, keyUnavailable: false, settledIds: null, rejectedIds: [] };
+  }
+};
+
+export {
+  fetchTranscriptRecipients,
+  fetchAccountPublicKey,
+  uploadTranscriptRecords
+};

package/dist/chunk-SGZJ5LYH.js

@@ -0,0 +1,76 @@
+import {
+  writeJsonAtomicDurable
+} from "./chunk-T7E75EKA.js";
+
+// src/transcript-recipient-pin.ts
+import { existsSync, mkdirSync, readFileSync, rmSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var pinFile = () => process.env.PUSHARY_RECIPIENT_PIN_FILE?.trim() || join(homedir(), ".pushary", "recipients.json");
+var asPin = (offer) => ({
+  phonePublicKey: offer.phonePublicKey,
+  providerKeyId: offer.provider?.keyId ?? null,
+  providerPublicKey: offer.provider?.publicKey ?? null
+});
+var loadPin = () => {
+  const path = pinFile();
+  if (!existsSync(path)) return null;
+  try {
+    const raw = JSON.parse(readFileSync(path, "utf-8"));
+    if (typeof raw.phonePublicKey !== "string" || raw.phonePublicKey.length === 0) return null;
+    return {
+      phonePublicKey: raw.phonePublicKey,
+      providerKeyId: typeof raw.providerKeyId === "string" ? raw.providerKeyId : null,
+      providerPublicKey: typeof raw.providerPublicKey === "string" ? raw.providerPublicKey : null
+    };
+  } catch {
+    return null;
+  }
+};
+var savePin = (pin) => {
+  const path = pinFile();
+  try {
+    mkdirSync(dirname(path), { recursive: true, mode: 448 });
+    writeJsonAtomicDurable(path, pin, 384);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var clearPin = () => {
+  try {
+    rmSync(pinFile(), { force: true });
+  } catch {
+  }
+};
+var verifyRecipients = (offer, pinned) => {
+  if (!pinned) return { kind: "first-use", pin: asPin(offer) };
+  const next = asPin(offer);
+  const changed = [];
+  if (next.phonePublicKey !== pinned.phonePublicKey) changed.push("the phone key this machine seals to");
+  if (next.providerKeyId !== pinned.providerKeyId) changed.push("the compliance recovery key id");
+  if (next.providerPublicKey !== pinned.providerPublicKey) changed.push("the compliance recovery key");
+  return changed.length === 0 ? { kind: "match" } : { kind: "changed", changed };
+};
+var fingerprint = (publicKey) => {
+  const hex = Buffer.from(publicKey, "base64").toString("hex").toUpperCase();
+  return (hex.slice(0, 8).match(/.{2}/g) ?? []).join(" ");
+};
+var changedRecipientsMessage = (verdict, offer) => [
+  "[pushary] Transcript sync stopped: the keys this machine seals transcripts to have changed.",
+  ...verdict.changed.map((what) => `[pushary]   changed: ${what}`),
+  `[pushary]   now offered: phone ${fingerprint(offer.phonePublicKey)}${offer.provider ? `, recovery ${offer.provider.keyId.slice(0, 8)}` : ", no recovery key"}`,
+  "[pushary] If you reinstalled the app or rotated a key, this is expected. Compare the",
+  "[pushary] fingerprint above with the one in the app under Settings, then run:",
+  "[pushary]   pushary transcripts trust --rotate",
+  "[pushary] Until then nothing is uploaded, so no turn is sealed to a key you have not seen."
+].join("\n");
+
+export {
+  loadPin,
+  savePin,
+  clearPin,
+  verifyRecipients,
+  fingerprint,
+  changedRecipientsMessage
+};

package/dist/chunk-SIFVFP6T.js

@@ -0,0 +1,70 @@
+import {
+  parseVersion
+} from "./chunk-3EVPNIBE.js";
+
+// src/setup/agent-probe.ts
+import { execSync } from "child_process";
+import { readFileSync, realpathSync } from "fs";
+
+// src/setup/claude-version.ts
+import { dirname, basename, join } from "path";
+var versionFromInstallPath = (path) => {
+  const name = basename(path);
+  return /^\d+\.\d+\.\d+$/.test(name) ? parseVersion(name) : null;
+};
+var versionFromManifest = (probe, binPath) => {
+  let dir = dirname(binPath);
+  for (let depth = 0; depth < 4; depth++) {
+    const raw = probe.readFile(join(dir, "package.json"));
+    if (raw) {
+      try {
+        const { version } = JSON.parse(raw);
+        if (typeof version === "string") {
+          const parsed = parseVersion(version);
+          if (parsed) return parsed;
+        }
+      } catch {
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+};
+var readClaudeVersion = (probe) => {
+  const onPath2 = probe.resolveOnPath();
+  if (!onPath2) return null;
+  const resolved = probe.realpath(onPath2) ?? onPath2;
+  return versionFromInstallPath(resolved) ?? versionFromManifest(probe, resolved);
+};
+
+// src/setup/agent-probe.ts
+var onPath = (name) => {
+  const command = process.platform === "win32" ? "where" : "which";
+  try {
+    const found = execSync(`${command} ${name}`, { encoding: "utf-8", stdio: "pipe", timeout: 5e3 }).split("\n")[0].trim();
+    return found || null;
+  } catch {
+    return null;
+  }
+};
+var realpath = (path) => {
+  try {
+    return realpathSync(path);
+  } catch {
+    return null;
+  }
+};
+var readFile = (path) => {
+  try {
+    return readFileSync(path, "utf-8");
+  } catch {
+    return null;
+  }
+};
+var detectClaudeVersion = () => readClaudeVersion({ resolveOnPath: () => onPath("claude"), realpath, readFile });
+
+export {
+  detectClaudeVersion
+};