pushary 1.9.103 → 1.9.105

package/dist/bin/pushary-daemon.js

@@ -1,30 +1,42 @@
 #!/usr/bin/env node
 import {
   inspectConfiguredManagedProviders
-} from "../chunk-RMFL62HR.js";
+} from "../chunk-P3H6I656.js";
+import {
+  MANAGED_CLAUDE_SETTINGS_BY_PLATFORM
+} from "../chunk-WUIWHGKF.js";
+import {
+  declinedAgentsFile,
+  readDeclinedAgents
+} from "../chunk-GBHP3LML.js";
 import {
   HEARTBEAT_INTERVAL_MS,
   sendHeartbeat
-} from "../chunk-7OZOFTTB.js";
-import "../chunk-RVSRPDRF.js";
+} from "../chunk-J5PUKKCT.js";
+import "../chunk-VKTW5WVB.js";
 import {
   readSignedOutDiagnosis
-} from "../chunk-ZXK46QT4.js";
+} from "../chunk-772NHSQB.js";
 import {
   HERMES_INSTALL_MARKER_FILE,
   defaultHermesHome,
   parseHermesInstallMarker
-} from "../chunk-COBOR3ST.js";
+} from "../chunk-NM44KCO6.js";
 import {
   writeHuman
 } from "../chunk-QCGNGEGE.js";
-import "../chunk-SXAZPWL7.js";
-import "../chunk-JECH4NJL.js";
-import "../chunk-AZSOH2SF.js";
-import "../chunk-PM34Z5WX.js";
+import "../chunk-UXIUCMFO.js";
+import "../chunk-FJYUB3ZK.js";
+import "../chunk-DA57ZI62.js";
+import {
+  OPENCODE_HOOK_BINARY,
+  openCodeConfigDir,
+  openCodePluginArgv,
+  openCodePluginFile
+} from "../chunk-IHQRLJEP.js";
 import {
   exitOnHelpFlag
-} from "../chunk-WPK2UWDU.js";
+} from "../chunk-B5Q44HKN.js";
 import {
   codexBinaryIsBroken,
   detectProviderLiveCapabilities,
@@ -33,8 +45,8 @@ import {
   launchableProviders,
   resolveControlPolicy,
   trackProviderInventory
-} from "../chunk-J6SSLXSU.js";
-import "../chunk-YETNUPV5.js";
+} from "../chunk-GESW4OSZ.js";
+import "../chunk-IGO5NDQY.js";
 import {
   SESSION_REAP_SILENCE_MS,
   describeIdleWindow,
@@ -42,17 +54,29 @@ import {
   listProcessProofs,
   ownsLiveProcess,
   silentSpawnedProofs
-} from "../chunk-T7G6IIV4.js";
-import "../chunk-LURFSDCL.js";
+} from "../chunk-FE5JENEJ.js";
+import "../chunk-ROVLRXBI.js";
 import {
   readLocalAutoUpdateReport
-} from "../chunk-EOD3DBIN.js";
+} from "../chunk-5IAW6G3K.js";
+import {
+  liveCursorGateCoverage
+} from "../chunk-OINGJICB.js";
 import {
   startRegisteredTranscripts
-} from "../chunk-KTM2X3XQ.js";
-import "../chunk-G7RMOSRX.js";
+} from "../chunk-DS672F57.js";
+import "../chunk-HXBQTPKC.js";
 import "../chunk-G66WIAST.js";
-import "../chunk-UOE26LPT.js";
+import {
+  compatibleConfigFile,
+  compatibleHookEvents,
+  grokHome,
+  parseConfigDocument
+} from "../chunk-JLJJRBTD.js";
+import {
+  pendingCommandReceipts,
+  removePendingCommand
+} from "../chunk-KHZCJP7P.js";
 import {
   DAEMON_LEASE_RENEW_INTERVAL_MS,
   acquireDaemonLease,
@@ -69,54 +93,82 @@ import {
   requestDaemonHandoff,
   stopDaemonRunning,
   writeDaemonNeedsLogin
-} from "../chunk-NZQEABRO.js";
+} from "../chunk-HONSMBF2.js";
 import {
-  hookOwnerOf
-} from "../chunk-VD6CAELE.js";
-import "../chunk-WVAJSBI2.js";
-import "../chunk-VJOMBYY5.js";
-import "../chunk-NMUI3ZWG.js";
-import "../chunk-3OIUMHHO.js";
+  DEFAULT_HOOKS_KEY_PATH,
+  GEMINI_HOOK_BINARY,
+  GEMINI_HOOK_EVENTS,
+  hookOwnerOf,
+  hooksAt
+} from "../chunk-MFJHLVIZ.js";
+import "../chunk-76JOLPST.js";
+import "../chunk-DH22FQAS.js";
+import "../chunk-GUIS6ASL.js";
+import "../chunk-YPY4YCIZ.js";
+import "../chunk-4XE3DVF7.js";
 import "../chunk-XMSDA5WA.js";
-import "../chunk-3Q2X3T3U.js";
+import "../chunk-CJTJ55DR.js";
+import "../chunk-LMDXQIYT.js";
+import "../chunk-IAASPG5B.js";
+import "../chunk-POFBE6ZY.js";
+import "../chunk-PFZCLG55.js";
+import "../chunk-EMSRB2KH.js";
+import "../chunk-LL7SW4RL.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
-import {
-  readControlMode
-} from "../chunk-HYAQIKYB.js";
-import {
-  pendingCommandReceipts,
-  removePendingCommand
-} from "../chunk-Z2TX7DVU.js";
-import "../chunk-MP3SEXXJ.js";
-import "../chunk-4QO267OY.js";
-import "../chunk-ZCYLCD6L.js";
-import "../chunk-POFBE6ZY.js";
-import "../chunk-V5DV7XZN.js";
-import "../chunk-7BIVBOD5.js";
-import "../chunk-KLJ2CTT7.js";
 import {
   getMachineId
-} from "../chunk-6N5DQG5F.js";
-import "../chunk-AFGMZZEB.js";
+} from "../chunk-I3IUS4SR.js";
+import {
+  readControlMode
+} from "../chunk-B7O4CXFX.js";
+import "../chunk-Z5FV7LTD.js";
 import {
+  CODEX_EARLIER_APPROVAL_MATCHERS,
+  CODEX_HOOK_BINARY,
+  CODEX_HOOK_EVENTS,
+  NO_SPOTLIGHT,
+  bridgeCache,
+  bridgeStub,
   claudeConfigDir,
-  codexHome
-} from "../chunk-O7ITTNDD.js";
+  claudeSettings,
+  claudeSettingsLocal,
+  codexConfigToml,
+  codexHome,
+  codexHookPositions,
+  codexHooksFeatureDisabled,
+  codexHooksJson,
+  codexTrustGaps,
+  cursorUserHooks,
+  geminiSettings,
+  hookBinaryNameOf,
+  hookExecutableName,
+  installedBridgeBundleRoots,
+  isBridgeLocator,
+  liveBridgeProbe,
+  macAppBridgeIsInstalled,
+  parseHookArgv,
+  parseHookCommand,
+  supportedClaudeEvents
+} from "../chunk-JCSJEMTA.js";
 import {
-  resolveBinary,
-  writeJsonAtomicDurable
-} from "../chunk-BQHZRH6S.js";
+  resolveBinary
+} from "../chunk-ZCBTCW3T.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-KOUB4ZLX.js";
-import "../chunk-PPY5N2E6.js";
+} from "../chunk-GKCDMAUM.js";
+import "../chunk-YU2EUD7O.js";
+import {
+  readRegularJsonFile,
+  readRegularTextFile,
+  writeJsonAtomicDurable
+} from "../chunk-T5I4PKOQ.js";
 import {
   EXIT
-} from "../chunk-KZERVKTD.js";
-import "../chunk-PWGD5EP6.js";
+} from "../chunk-BG4HHB7E.js";
+import "../chunk-YDQ6OJMF.js";
 import "../chunk-ZVU6WMMU.js";
 import {
   CLAUDE_INBOX,
@@ -126,8 +178,14 @@ import {
   CLAUDE_WAKE,
   CLAUDE_WAKE_API,
   COMMAND_RECOVERY,
+  CURSOR_GATE_EVENTS,
+  CURSOR_GATE_SCRIPT,
+  HOOK_COMPATIBLE_PROFILES,
+  HOOK_WIRING_PROFILE_LENGTH,
+  HOOK_WIRING_REPORT_VERSION,
   NATIVE_INPUT,
   NativeInputAgent,
+  OPENCODE_APPROVAL_EVENT,
   claudeInboxAction,
   claudeWakeDecision,
   claudeWakeWaitingOn,
@@ -137,6 +195,8 @@ import {
   isCodexInputReceipt,
   isCodexQueuedReceipt,
   isCommandAcknowledgementReceipt,
+  isRecord,
+  matcherMatchesEveryCall,
   nativeIdentifier,
   nativeInputAction,
   nativeRecord,
@@ -146,7 +206,7 @@ import {
   parseHermesAdmission,
   parseHermesReplayCursor,
   qualifyHermesReceiptMode
-} from "../chunk-4FAJQPFY.js";
+} from "../chunk-O5TB2LMQ.js";
 import "../chunk-MLKGABMK.js";
 
 // src/native-host-receiver.ts
@@ -234,8 +294,8 @@ var Rpc = class _Rpc {
       followRedirects: false
     });
     const rpc = new _Rpc(socket, timeout);
-    await new Promise((resolve3, reject) => {
-      socket.once("open", resolve3);
+    await new Promise((resolve4, reject) => {
+      socket.once("open", resolve4);
       socket.once("error", reject);
     });
     if (protocols.length && socket.protocol !== protocols[0]) {
@@ -246,12 +306,12 @@ var Rpc = class _Rpc {
   }
   request(method, params) {
     const id = ++this.sequence;
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(id);
         reject(new Error("native RPC timeout"));
       }, this.timeout);
-      this.pending.set(id, { resolve: resolve3, reject, timer });
+      this.pending.set(id, { resolve: resolve4, reject, timer });
       this.socket.send(
         JSON.stringify({ jsonrpc: "2.0", id, method, params }),
         (error) => {
@@ -272,7 +332,7 @@ var Rpc = class _Rpc {
     this.socket.terminate();
   }
 };
-var controlRequest = (path, request, timeout) => new Promise((resolve3, reject) => {
+var controlRequest = (path, request, timeout) => new Promise((resolve4, reject) => {
   const s = createConnection(path);
   let buffer = "";
   const timer = setTimeout(() => {
@@ -293,7 +353,7 @@ var controlRequest = (path, request, timeout) => new Promise((resolve3, reject)
     }
     if (!buffer.includes("\n")) return;
     try {
-      resolve3(JSON.parse(buffer.slice(0, buffer.indexOf("\n"))));
+      resolve4(JSON.parse(buffer.slice(0, buffer.indexOf("\n"))));
     } catch {
       reject(new Error("invalid native control response"));
     }
@@ -1420,9 +1480,376 @@ var startClaudeInboxReceiver = (apiKey, machineId, options = {}) => {
 
 // src/spawn-daemon.ts
 import { execFileSync as execFileSync2, spawn } from "child_process";
-import { existsSync, statSync as statSync2 } from "fs";
+import { existsSync, statSync as statSync3 } from "fs";
+import { homedir as homedir4 } from "os";
+import { basename as basename3, dirname as dirname4, join as join5 } from "path";
+
+// src/hook-wiring.ts
+import { createHash as createHash4 } from "crypto";
+import { realpathSync as realpathSync2, statSync as statSync2 } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename as basename3, dirname as dirname3, join as join5 } from "path";
+import { dirname as dirname3, isAbsolute as isAbsolute2, resolve as resolve3 } from "path";
+var HOOK_WIRING_MAX_FILE_BYTES = 16 * 1024 * 1024;
+var COMMAND_HOOK_TYPE = "command";
+var CODEX_TRUST_GAPS_THAT_SWITCH_OFF = /* @__PURE__ */ new Set(["disabled", "asynchronous"]);
+var CODEX_TRUST_GAP_UNTRUSTED = "untrusted";
+var MATCHER_ALTERNATIVE_SEPARATOR = "|";
+var SIMPLE_CLAUDE_CODE_MATCHER = /^[a-zA-Z0-9_|]+$/;
+var TABLE_PATTERN_WILDCARD = ".*";
+var TABLE_PATTERN_SAMPLE = "probe";
+var UNRESTRICTED_MATCHER_PROBES = ["Bash", "Write", "Edit", "Read", "apply_patch", "run_shell_command", "mcp__probe__tool", "probe"];
+var EXECUTE_BITS = 73;
+var WINDOWS_PLATFORM = "win32";
+var NO_EVENTS = /* @__PURE__ */ new Set();
+var NO_HANDLERS = /* @__PURE__ */ new Map();
+var NO_EARLIER_MATCHERS = {};
+var approvalEventsOf = (definitions, binaryOf, earlierMatchers = NO_EARLIER_MATCHERS) => definitions.filter((definition) => definition.delivery === "approval").map((definition) => ({
+  event: definition.event,
+  binary: binaryOf(definition),
+  matcher: definition.matcher ?? null,
+  earlierMatchers: earlierMatchers[definition.event] ?? [],
+  cliOnly: definition.cliOnly === true
+}));
+var eventsWithBinary = (events, binary) => events.map((event) => ({ event, binary, matcher: null, earlierMatchers: [], cliOnly: false }));
+var CODEX_APPROVAL_EVENTS = approvalEventsOf(CODEX_HOOK_EVENTS, () => CODEX_HOOK_BINARY, CODEX_EARLIER_APPROVAL_MATCHERS);
+var hookWiringAgentOf = (target) => {
+  switch (target.kind) {
+    case "claude":
+      return "claude";
+    case "codex":
+      return "codex";
+    case "gemini":
+      return "gemini";
+    case "cursor":
+      return "cursor";
+    case "opencode":
+      return "opencode";
+    case "compatible":
+      return target.profile.source;
+  }
+};
+var hookWiringApprovalEvents = (target) => {
+  switch (target.kind) {
+    case "claude":
+      return approvalEventsOf(supportedClaudeEvents(null), (hook) => hook.binary);
+    case "codex":
+      return CODEX_APPROVAL_EVENTS;
+    case "gemini":
+      return approvalEventsOf(GEMINI_HOOK_EVENTS, () => GEMINI_HOOK_BINARY);
+    case "cursor":
+      return eventsWithBinary(CURSOR_GATE_EVENTS, hookBinaryNameOf(CURSOR_GATE_SCRIPT));
+    case "opencode":
+      return eventsWithBinary([OPENCODE_APPROVAL_EVENT], OPENCODE_HOOK_BINARY);
+    case "compatible":
+      return approvalEventsOf(compatibleHookEvents(target.profile), (hook) => hook.binary);
+  }
+};
+var configFileOf = (target) => {
+  switch (target.kind) {
+    case "claude":
+    case "gemini":
+      return target.settingsFile;
+    case "opencode":
+      return target.pluginFile;
+    case "codex":
+    case "cursor":
+    case "compatible":
+      return target.hooksFile;
+  }
+};
+var hooksKeyPathOf = (target) => target.kind === "compatible" ? target.profile.hooksKeyPath : DEFAULT_HOOKS_KEY_PATH;
+var handlerTypeOf = (target) => target.kind === "cursor" ? "optional" : "required";
+var hookWiringProfileOf = (machineId, configFile) => createHash4("sha256").update(`${machineId}\0${resolve3(configFile)}`, "utf8").digest("hex").slice(0, HOOK_WIRING_PROFILE_LENGTH);
+var requiredApprovalEvents = (events, owner) => events.filter((event) => !(event.cliOnly && owner === "app")).map((event) => event.event);
+var isSwitchedOff = (reading, required) => reading.switchedOff || reading.trustGaps.some((gap) => CODEX_TRUST_GAPS_THAT_SWITCH_OFF.has(gap.kind) && required.has(gap.event));
+var isUntrusted = (reading, required) => reading.trustGaps.some((gap) => gap.kind === CODEX_TRUST_GAP_UNTRUSTED && required.has(gap.event));
+var weakeningOf = (switchedOff, wiring) => {
+  if (switchedOff) return "switched_off";
+  if (wiring.missing.length > 0) return "events_missing";
+  return wiring.narrowed.length > 0 ? "matcher_narrowed" : null;
+};
+var guardedStateOf = (reading, required) => isUntrusted(reading, required) ? "untrusted" : "wired";
+var requiredEventWiringOf = (required, wiredEvents, narrowedEvents) => ({
+  missing: required.filter((event) => !wiredEvents.has(event) && !narrowedEvents.has(event)),
+  narrowed: required.filter((event) => !wiredEvents.has(event) && narrowedEvents.has(event))
+});
+var hookWiringOf = (reading) => {
+  if (!reading.configDirExists) return null;
+  const base = { agent: reading.agent, profile: reading.profile };
+  if (reading.hooks.kind === "unreadable") {
+    return { ...base, state: reading.declined ? "disconnected" : "unreadable", owner: null };
+  }
+  const owner = reading.hooks.kind === "read" ? reading.hooks.owner : null;
+  if (reading.declined) return { ...base, state: "disconnected", owner };
+  const required = requiredApprovalEvents(reading.approvalEvents, owner);
+  const wiring = reading.hooks.kind === "read" ? requiredEventWiringOf(required, reading.hooks.wiredEvents, reading.hooks.narrowedEvents) : requiredEventWiringOf(required, NO_EVENTS, NO_EVENTS);
+  if (wiring.missing.length === required.length) return { ...base, state: "missing", owner };
+  const requiredSet = new Set(required);
+  const weakenedBy = weakeningOf(isSwitchedOff(reading, requiredSet), wiring);
+  if (weakenedBy) {
+    return { ...base, state: "weakened", owner, weakenedBy, ...wiring.missing.length > 0 ? { missing: wiring.missing } : {} };
+  }
+  return { ...base, state: guardedStateOf(reading, requiredSet), owner };
+};
+var isCommandHandler = (handler, handlerType) => handler.type === COMMAND_HOOK_TYPE || handlerType === "optional" && handler.type === void 0;
+var handlerOf = (handler, matcher, handlerType) => {
+  if (!isCommandHandler(handler, handlerType) || typeof handler.command !== "string") return [];
+  const command = parseHookCommand(handler.command);
+  return command ? [{ raw: handler.command, command, matcher }] : [];
+};
+var handlersInEntry = (entry, handlerType) => {
+  if (!isRecord(entry)) return [];
+  if (!Array.isArray(entry.hooks)) return handlerOf(entry, entry.matcher, handlerType);
+  return entry.hooks.filter(isRecord).flatMap((handler) => handlerOf(handler, entry.matcher, handlerType));
+};
+var handlersOnEvent = (entries, handlerType) => Array.isArray(entries) ? entries.flatMap((entry) => handlersInEntry(entry, handlerType)) : [];
+var handlersByEventIn = (hooks, handlerType) => new Map(isRecord(hooks) ? Object.entries(hooks).map(([event, entries]) => [event, handlersOnEvent(entries, handlerType)]) : []);
+var matcherAlternatives = (matcher) => matcher.split(MATCHER_ALTERNATIVE_SEPARATOR);
+var compiledMatcher = (matcher) => {
+  try {
+    return new RegExp(matcher);
+  } catch {
+    return null;
+  }
+};
+var regexToolMatch = (matcher) => {
+  const pattern = compiledMatcher(matcher);
+  return (tool) => pattern !== null && pattern.test(tool);
+};
+var toolMatchOf = (semantics, matcher) => {
+  if (semantics === "regex" || !SIMPLE_CLAUDE_CODE_MATCHER.test(matcher)) return regexToolMatch(matcher);
+  const names = new Set(matcherAlternatives(matcher));
+  return (tool) => names.has(tool);
+};
+var tableToolSamples = (tableMatcher) => matcherAlternatives(tableMatcher).map((alternative) => alternative.replaceAll(TABLE_PATTERN_WILDCARD, TABLE_PATTERN_SAMPLE));
+var coverageOfSamples = (samples, matches) => {
+  const matched = samples.filter(matches).length;
+  if (matched === samples.length) return "covers";
+  return matched > 0 ? "narrows" : "misses";
+};
+var unrestrictedEventCoverage = (matcher, matches, event) => {
+  if (UNRESTRICTED_MATCHER_PROBES.every(matches)) return "covers";
+  return event.earlierMatchers.includes(matcher) ? "narrows" : "misses";
+};
+var tableMatcherCoverage = (semantics) => (matcher, event) => {
+  if (matcherMatchesEveryCall(matcher)) return "covers";
+  if (typeof matcher !== "string") return "misses";
+  const matches = toolMatchOf(semantics, matcher);
+  if (event.matcher === null) return unrestrictedEventCoverage(matcher, matches, event);
+  return coverageOfSamples(tableToolSamples(event.matcher), matches);
+};
+var matcherSemanticsOf = (target) => target.kind === "codex" || target.kind === "gemini" ? "regex" : "claude_code";
+var coverageDecidedElsewhere = () => "covers";
+var runsBinary = (command, binary, context) => {
+  if (!command.runsExecutable) return false;
+  if (isBridgeLocator(command.executable)) return context.isLiveBridge(command.executable);
+  return hookExecutableName(command.executable) === binary && context.isRunnableBinary(command);
+};
+var coveredHandlerOf = (handler, event, coverageOf) => {
+  const coverage = coverageOf(handler.matcher, event);
+  return coverage === "misses" ? [] : [{ handler, coverage }];
+};
+var approvalHandlersOn = (handlersByEvent, event, context, coverageOf) => ({
+  event,
+  handlers: (handlersByEvent.get(event.event) ?? []).filter((handler) => runsBinary(handler.command, event.binary, context)).flatMap((handler) => coveredHandlerOf(handler, event, coverageOf))
+});
+var coversTableMatcher = (approval) => approval.handlers.some((covered) => covered.coverage === "covers");
+var isBridgeHandler = (handler) => isBridgeLocator(handler.command.executable);
+var hasLiveBridgeAnywhere = (handlersByEvent, isLiveBridge) => [...handlersByEvent.values()].flat().some((handler) => handler.command.runsExecutable && isBridgeHandler(handler) && isLiveBridge(handler.command.executable));
+var approvalOwnerOf = (running, liveBridgeAnywhere) => {
+  const covering = running.flatMap((approval) => approval.handlers.filter((covered) => covered.coverage === "covers").map((covered) => covered.handler));
+  if (covering.length > 0) return covering.some(isBridgeHandler) ? "app" : "cli";
+  if (running.some((approval) => approval.handlers.some((covered) => !isBridgeHandler(covered.handler)))) return "cli";
+  return liveBridgeAnywhere ? "app" : null;
+};
+var eventNamesOf = (approvals) => new Set(approvals.map((approval) => approval.event.event));
+var approvalWiringOf = (handlersByEvent, events, context, coverageOf) => {
+  const running = events.map((event) => approvalHandlersOn(handlersByEvent, event, context, coverageOf)).filter((approval) => approval.handlers.length > 0);
+  return {
+    owner: approvalOwnerOf(running, hasLiveBridgeAnywhere(handlersByEvent, context.isLiveBridge)),
+    wiredEvents: eventNamesOf(running.filter(coversTableMatcher)),
+    narrowedEvents: eventNamesOf(running.filter((approval) => !coversTableMatcher(approval)))
+  };
+};
+var readJsonDocument = (path) => {
+  const result = readRegularJsonFile(path, HOOK_WIRING_MAX_FILE_BYTES);
+  if (result.kind === "missing") return { kind: "missing" };
+  if (result.kind === "ok" && isRecord(result.value)) return { kind: "read", document: result.value };
+  return { kind: "unreadable" };
+};
+var jsonDocumentOrEmpty = (path) => {
+  if (path === null) return {};
+  const reading = readJsonDocument(path);
+  return reading.kind === "read" ? reading.document : {};
+};
+var textOrNull = (path) => {
+  const result = readRegularTextFile(path, HOOK_WIRING_MAX_FILE_BYTES);
+  return result.kind === "ok" ? result.value : null;
+};
+var tomlDocumentOrEmpty = (path) => {
+  const document = parseConfigDocument(textOrNull(path), "toml");
+  return document.kind === "parsed" ? document.value : {};
+};
+var handlersIn = (document, target) => handlersByEventIn(hooksAt(document, hooksKeyPathOf(target)), handlerTypeOf(target));
+var tableFileReading = (reading, target, context) => reading.kind === "read" ? { kind: "read", ...approvalWiringOf(handlersIn(reading.document, target), hookWiringApprovalEvents(target), context, tableMatcherCoverage(matcherSemanticsOf(target))) } : reading;
+var cursorFileReading = (target, context) => {
+  const reading = readJsonDocument(target.hooksFile);
+  if (reading.kind !== "read") return reading;
+  const wiring = approvalWiringOf(handlersIn(reading.document, target), hookWiringApprovalEvents(target), context, coverageDecidedElsewhere);
+  const coverage = liveCursorGateCoverage(reading.document, { hooksFile: target.hooksFile, probe: context.probe });
+  const runsPushary = (event) => wiring.wiredEvents.has(event);
+  return {
+    kind: "read",
+    owner: wiring.owner,
+    wiredEvents: new Set(coverage.full.filter(runsPushary)),
+    narrowedEvents: new Set(coverage.partial.filter(runsPushary))
+  };
+};
+var openCodeHandlers = (argv) => {
+  const command = parseHookArgv(argv);
+  return command ? /* @__PURE__ */ new Map([[OPENCODE_APPROVAL_EVENT, [{ raw: argv.join(" "), command, matcher: void 0 }]]]) : NO_HANDLERS;
+};
+var openCodeFileReading = (target, context) => {
+  const result = readRegularTextFile(target.pluginFile, HOOK_WIRING_MAX_FILE_BYTES);
+  if (result.kind === "missing") return { kind: "missing" };
+  if (result.kind !== "ok") return { kind: "unreadable" };
+  const handlersByEvent = openCodeHandlers(openCodePluginArgv(result.value) ?? []);
+  return { kind: "read", ...approvalWiringOf(handlersByEvent, hookWiringApprovalEvents(target), context, tableMatcherCoverage(matcherSemanticsOf(target))) };
+};
+var isDirectory = (path) => {
+  try {
+    return statSync2(path).isDirectory();
+  } catch {
+    return false;
+  }
+};
+var claudeHooksSwitchedOff = (user, local, managed) => [user, local, managed].some((settings) => settings.disableAllHooks === true) || managed.allowManagedHooksOnly === true;
+var codexTrustCommandIn = (document) => {
+  const handlersByEvent = handlersByEventIn(hooksAt(document, DEFAULT_HOOKS_KEY_PATH), "required");
+  const handlers = CODEX_APPROVAL_EVENTS.flatMap((event) => handlersByEvent.get(event.event) ?? []);
+  return handlers.find((handler) => hookExecutableName(handler.command.executable) === CODEX_HOOK_BINARY)?.raw ?? "";
+};
+var codexHookTrustGapsIn = (config, document, hooksFile) => codexTrustGaps(config, document, hooksFile, codexTrustCommandIn(document), codexHookPositions(document));
+var UNSWITCHED = { switchedOff: false, trustGaps: [] };
+var readClaudeTarget = (target, context) => {
+  const settings = readJsonDocument(target.settingsFile);
+  return {
+    hooks: tableFileReading(settings, target, context),
+    switchedOff: claudeHooksSwitchedOff(
+      settings.kind === "read" ? settings.document : {},
+      jsonDocumentOrEmpty(target.localSettingsFile),
+      jsonDocumentOrEmpty(target.managedSettingsFile)
+    ),
+    trustGaps: []
+  };
+};
+var readCodexTarget = (target, context) => {
+  const hooksDocument = readJsonDocument(target.hooksFile);
+  const hooks = tableFileReading(hooksDocument, target, context);
+  if (hooksDocument.kind !== "read") return { hooks, ...UNSWITCHED };
+  const config = tomlDocumentOrEmpty(target.configFile);
+  return {
+    hooks,
+    switchedOff: codexHooksFeatureDisabled(config),
+    trustGaps: codexHookTrustGapsIn(config, hooksDocument.document, target.hooksFile)
+  };
+};
+var readAgentSpecific = (target, context) => {
+  switch (target.kind) {
+    case "claude":
+      return readClaudeTarget(target, context);
+    case "codex":
+      return readCodexTarget(target, context);
+    case "opencode":
+      return { hooks: openCodeFileReading(target, context), ...UNSWITCHED };
+    case "cursor":
+      return { hooks: cursorFileReading(target, context), ...UNSWITCHED };
+    case "gemini":
+    case "compatible":
+      return { hooks: tableFileReading(readJsonDocument(configFileOf(target)), target, context), ...UNSWITCHED };
+  }
+};
+var readHookWiringTarget = (target, machineId, declined, context) => {
+  const agent = hookWiringAgentOf(target);
+  return {
+    agent,
+    profile: hookWiringProfileOf(machineId, configFileOf(target)),
+    configDirExists: isDirectory(target.configDir),
+    declined: declined.has(agent),
+    approvalEvents: hookWiringApprovalEvents(target),
+    ...readAgentSpecific(target, context)
+  };
+};
+var realpathOrNull = (path) => {
+  try {
+    return realpathSync2(path);
+  } catch {
+    return null;
+  }
+};
+var canonicalLiveBridge = (location, probe) => {
+  const stub = realpathOrNull(location.stub);
+  if (stub === null || !macAppBridgeIsInstalled(location, probe)) return () => false;
+  return (executable) => isAbsolute2(executable) && isBridgeLocator(executable) && realpathOrNull(executable) === stub;
+};
+var regularFileMode = (path) => {
+  try {
+    const stats = statSync2(path);
+    return stats.isFile() ? stats.mode : null;
+  } catch {
+    return null;
+  }
+};
+var runnableBinaryCheck = (platform) => (command) => {
+  if (!isAbsolute2(command.executable)) return false;
+  const mode = regularFileMode(command.executable);
+  if (mode === null) return false;
+  return command.runsThroughNode || platform === WINDOWS_PLATFORM || (mode & EXECUTE_BITS) !== 0;
+};
+var hookWiringReadContext = (bridge, platform) => {
+  const probe = { ...liveBridgeProbe(), readFile: textOrNull, mdfind: NO_SPOTLIGHT };
+  return { probe, isLiveBridge: canonicalLiveBridge(bridge, probe), isRunnableBinary: runnableBinaryCheck(platform) };
+};
+var compatibleConfigDirOf = (profile, hooksFile) => profile.configFile.root === "grok_home" ? grokHome() : dirname3(hooksFile);
+var compatibleTarget = (profile) => {
+  const hooksFile = compatibleConfigFile(profile);
+  return { kind: "compatible", profile, configDir: compatibleConfigDirOf(profile, hooksFile), hooksFile };
+};
+var hookWiringLocations = (platform = process.platform) => ({
+  declinedAgentsFile: declinedAgentsFile(),
+  bridge: { stub: bridgeStub(), cache: bridgeCache(), bundleRoots: installedBridgeBundleRoots(homedir3()) },
+  targets: [
+    {
+      kind: "claude",
+      configDir: claudeConfigDir(),
+      settingsFile: claudeSettings(),
+      localSettingsFile: claudeSettingsLocal(),
+      managedSettingsFile: MANAGED_CLAUDE_SETTINGS_BY_PLATFORM[platform] ?? null
+    },
+    { kind: "codex", configDir: codexHome(), hooksFile: codexHooksJson(), configFile: codexConfigToml() },
+    { kind: "gemini", configDir: dirname3(geminiSettings()), settingsFile: geminiSettings() },
+    { kind: "cursor", configDir: dirname3(cursorUserHooks()), hooksFile: cursorUserHooks() },
+    { kind: "opencode", configDir: openCodeConfigDir(), pluginFile: openCodePluginFile() },
+    ...HOOK_COMPATIBLE_PROFILES.map(compatibleTarget)
+  ]
+});
+var readHookWiring = (machineId, locations = hookWiringLocations()) => {
+  const declined = new Set(readDeclinedAgents(locations.declinedAgentsFile));
+  const context = hookWiringReadContext(locations.bridge, process.platform);
+  const agents = locations.targets.flatMap((target) => {
+    const entry = hookWiringOf(readHookWiringTarget(target, machineId, declined, context));
+    return entry ? [entry] : [];
+  });
+  return { version: HOOK_WIRING_REPORT_VERSION, agents };
+};
+var readHookWiringSafely = (read, reportFailure) => {
+  try {
+    return read();
+  } catch (error) {
+    reportFailure(error);
+    return null;
+  }
+};
 
 // src/stop-requests.ts
 var STOP_CAPABILITY = "stop";
@@ -1605,13 +2032,13 @@ var resolveSpawnDirectory = (requested, options = {}) => {
   const fallbackDir = options.fallbackDir ?? process.cwd();
   const value = requested?.trim();
   if (!value) return { ok: true, cwd: fallbackDir };
-  const homeDir = options.homeDir ?? homedir3();
+  const homeDir = options.homeDir ?? homedir4();
   const cwd = value === "~" ? homeDir : value.startsWith("~/") || value.startsWith("~\\") ? join5(homeDir, value.slice(2)) : value;
   if (!(options.exists ?? existsSync)(cwd)) {
     return { ok: false, message: `Directory does not exist: ${value}` };
   }
   try {
-    if (!(options.isDirectory ?? ((path) => statSync2(path).isDirectory()))(cwd)) {
+    if (!(options.isDirectory ?? ((path) => statSync3(path).isDirectory()))(cwd)) {
       return { ok: false, message: `Not a directory: ${value}` };
     }
   } catch {
@@ -1703,9 +2130,9 @@ var runSpawnDaemon = async () => {
     describedProviders = description;
   });
   describedProviders = describeLaunchableProviders(inventory.current.capabilities);
-  const siblingEntry = process.argv[1] ? join5(dirname3(process.argv[1]), "pushary.js") : "";
-  const codexBridgeEntry = process.argv[1] ? join5(dirname3(process.argv[1]), "pushary-codex-bridge.js") : "pushary-codex-bridge";
-  const geminiBridgeEntry = process.argv[1] ? join5(dirname3(process.argv[1]), "pushary-gemini-bridge.js") : "pushary-gemini-bridge";
+  const siblingEntry = process.argv[1] ? join5(dirname4(process.argv[1]), "pushary.js") : "";
+  const codexBridgeEntry = process.argv[1] ? join5(dirname4(process.argv[1]), "pushary-codex-bridge.js") : "pushary-codex-bridge";
+  const geminiBridgeEntry = process.argv[1] ? join5(dirname4(process.argv[1]), "pushary-gemini-bridge.js") : "pushary-gemini-bridge";
   const spawnDirect = siblingEntry.length > 0 && existsSync(siblingEntry);
   const existing = readDaemonStatus();
   let handoff;
@@ -1805,7 +2232,7 @@ var runSpawnDaemon = async () => {
     if (!plan) {
       return Promise.reject(new Error(FLAG_SHAPED_PROMPT_MESSAGE));
     }
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       try {
         const child = plan.direct ? spawn(plan.command, plan.args, { cwd, detached: true, stdio: "ignore", env }) : spawnClaude(plan.command, plan.args, { cwd, detached: true, stdio: "ignore", env });
         let started = false;
@@ -1835,7 +2262,7 @@ var runSpawnDaemon = async () => {
           }
           child.unref();
           log(`spawn ${req.id}: launched a phone-requested ${plan.agent} session in ${basename3(cwd)} (pid ${child.pid ?? "unknown"})`);
-          resolve3(typeof child.pid === "number" ? child.pid : null);
+          resolve4(typeof child.pid === "number" ? child.pid : null);
         });
       } catch (err) {
         reject(err);
@@ -1855,7 +2282,7 @@ var runSpawnDaemon = async () => {
       return launched || ownsLiveProcess(request);
     },
     selfPid: process.pid,
-    sleep: (ms) => new Promise((resolve3) => setTimeout(resolve3, ms)),
+    sleep: (ms) => new Promise((resolve4) => setTimeout(resolve4, ms)),
     isAlive: (pid) => {
       try {
         process.kill(pid, 0);
@@ -1913,7 +2340,7 @@ var runSpawnDaemon = async () => {
           completedStops.delete(acknowledgement.stopId);
           break;
         }
-        if (attempt < 2) await new Promise((resolve3) => setTimeout(resolve3, 200 * (attempt + 1)));
+        if (attempt < 2) await new Promise((resolve4) => setTimeout(resolve4, 200 * (attempt + 1)));
       }
     }
     async function apply() {
@@ -2084,13 +2511,15 @@ var runSpawnDaemon = async () => {
       return;
     }
     const result = await sendHeartbeat(apiKey, {
+      machineId,
       repoKey: basename3(process.cwd()),
       capabilities: [
         ...launchAdvertisement(inventory.current.capabilities),
         STOP_CAPABILITY,
         STOP_ACK_CAPABILITY
       ],
-      autoUpdate: readLocalAutoUpdateReport()
+      autoUpdate: readLocalAutoUpdateReport(),
+      hookWiring: readHookWiringSafely(() => readHookWiring(machineId), (err) => log(`hook wiring could not be read: ${errMsg(err)}`))
     });
     if (result.kind === "ok") {
       daemonLease.recordSuccessfulHeartbeat();
@@ -2116,13 +2545,13 @@ var runSpawnDaemon = async () => {
   log(hasSpawnProvider(inventory.current.capabilities) ? `daemon online (pid ${process.pid}): this machine (${machineId}) can now be sent a new session from your phone. Ctrl-C to stop.` : `daemon online (pid ${process.pid}): no supported Claude, Codex, or Gemini CLI was found, so phone-start is unavailable. Ctrl-C to stop.`);
   timer = setTimeout(tick, 0);
   const signals = daemonSignals();
-  await new Promise((resolve3) => {
+  await new Promise((resolve4) => {
     const onSignal = () => finish();
     for (const signal of signals) process.on(signal, onSignal);
     finish = () => {
       teardown();
       for (const signal of signals) process.off(signal, onSignal);
-      resolve3();
+      resolve4();
     };
   });
   return 0;