pushary 1.9.111 → 1.9.113

package/dist/chunk-GGBGKQIZ.js

@@ -0,0 +1,454 @@
+import {
+  MANAGED_CLAUDE_SETTINGS_BY_PLATFORM
+} from "./chunk-6E2D22Y5.js";
+import {
+  declinedAgentsFile,
+  readDeclinedAgents
+} from "./chunk-BWSXWX6T.js";
+import {
+  OPENCODE_HOOK_BINARY,
+  openCodeConfigDir,
+  openCodePluginArgv,
+  openCodePluginFile
+} from "./chunk-KB2EEK5T.js";
+import {
+  liveCursorGateCoverage
+} from "./chunk-IWUYKDDW.js";
+import {
+  compatibleConfigFile,
+  compatibleHookEvents,
+  grokHome,
+  parseConfigDocument
+} from "./chunk-OJGHJIFQ.js";
+import {
+  DEFAULT_HOOKS_KEY_PATH,
+  GEMINI_HOOK_BINARY,
+  GEMINI_HOOK_EVENTS,
+  hooksAt
+} from "./chunk-NK5XT4RS.js";
+import {
+  CODEX_EARLIER_APPROVAL_MATCHERS,
+  CODEX_HOOK_BINARY,
+  CODEX_HOOK_EVENTS,
+  NO_SPOTLIGHT,
+  bridgeCache,
+  bridgeStub,
+  claudeConfigDir,
+  claudeSettings,
+  claudeSettingsLocal,
+  codexConfigToml,
+  codexHome,
+  codexHookPositions,
+  codexHooksFeatureDisabled,
+  codexHooksJson,
+  codexTrustGaps,
+  cursorUserHooks,
+  geminiSettings,
+  hookBinaryNameOf,
+  hookExecutableName,
+  installedBridgeBundleRoots,
+  isBridgeLocator,
+  liveBridgeProbe,
+  macAppBridgeIsInstalled,
+  parseHookArgv,
+  parseHookCommand,
+  supportedClaudeEvents
+} from "./chunk-RLBTKTOK.js";
+import {
+  readRegularJsonFile,
+  readRegularTextFile
+} from "./chunk-T5I4PKOQ.js";
+import {
+  CURSOR_GATE_EVENTS,
+  CURSOR_GATE_SCRIPT,
+  HOOK_COMPATIBLE_PROFILES,
+  HOOK_WIRING_PROFILE_LENGTH,
+  HOOK_WIRING_REPORT_VERSION,
+  OPENCODE_APPROVAL_EVENT,
+  isRecord,
+  matcherMatchesEveryCall
+} from "./chunk-KPCVIH52.js";
+
+// src/hook-wiring.ts
+import { createHash } from "crypto";
+import { realpathSync, statSync } from "fs";
+import { homedir } from "os";
+import { dirname, isAbsolute, resolve } from "path";
+var HOOK_WIRING_MAX_FILE_BYTES = 16 * 1024 * 1024;
+var COMMAND_HOOK_TYPE = "command";
+var CODEX_TRUST_GAPS_THAT_SWITCH_OFF = /* @__PURE__ */ new Set(["disabled", "asynchronous"]);
+var CODEX_TRUST_GAP_UNTRUSTED = "untrusted";
+var MATCHER_ALTERNATIVE_SEPARATOR = "|";
+var SIMPLE_CLAUDE_CODE_MATCHER = /^[a-zA-Z0-9_|]+$/;
+var TABLE_PATTERN_WILDCARD = ".*";
+var TABLE_PATTERN_SAMPLE = "probe";
+var UNRESTRICTED_MATCHER_PROBES = ["Bash", "Write", "Edit", "Read", "apply_patch", "run_shell_command", "mcp__probe__tool", "probe"];
+var EXECUTE_BITS = 73;
+var WINDOWS_PLATFORM = "win32";
+var NO_EVENTS = /* @__PURE__ */ new Set();
+var NO_HANDLERS = /* @__PURE__ */ new Map();
+var NO_EARLIER_MATCHERS = {};
+var approvalEventsOf = (definitions, binaryOf, earlierMatchers = NO_EARLIER_MATCHERS) => definitions.filter((definition) => definition.delivery === "approval").map((definition) => ({
+  event: definition.event,
+  binary: binaryOf(definition),
+  matcher: definition.matcher ?? null,
+  earlierMatchers: earlierMatchers[definition.event] ?? [],
+  cliOnly: definition.cliOnly === true
+}));
+var eventsWithBinary = (events, binary) => events.map((event) => ({ event, binary, matcher: null, earlierMatchers: [], cliOnly: false }));
+var CODEX_APPROVAL_EVENTS = approvalEventsOf(CODEX_HOOK_EVENTS, () => CODEX_HOOK_BINARY, CODEX_EARLIER_APPROVAL_MATCHERS);
+var hookWiringAgentOf = (target) => {
+  switch (target.kind) {
+    case "claude":
+      return "claude";
+    case "codex":
+      return "codex";
+    case "gemini":
+      return "gemini";
+    case "cursor":
+      return "cursor";
+    case "opencode":
+      return "opencode";
+    case "compatible":
+      return target.profile.source;
+  }
+};
+var hookWiringApprovalEvents = (target) => {
+  switch (target.kind) {
+    case "claude":
+      return approvalEventsOf(supportedClaudeEvents(null), (hook) => hook.binary);
+    case "codex":
+      return CODEX_APPROVAL_EVENTS;
+    case "gemini":
+      return approvalEventsOf(GEMINI_HOOK_EVENTS, () => GEMINI_HOOK_BINARY);
+    case "cursor":
+      return eventsWithBinary(CURSOR_GATE_EVENTS, hookBinaryNameOf(CURSOR_GATE_SCRIPT));
+    case "opencode":
+      return eventsWithBinary([OPENCODE_APPROVAL_EVENT], OPENCODE_HOOK_BINARY);
+    case "compatible":
+      return approvalEventsOf(compatibleHookEvents(target.profile), (hook) => hook.binary);
+  }
+};
+var configFileOf = (target) => {
+  switch (target.kind) {
+    case "claude":
+    case "gemini":
+      return target.settingsFile;
+    case "opencode":
+      return target.pluginFile;
+    case "codex":
+    case "cursor":
+    case "compatible":
+      return target.hooksFile;
+  }
+};
+var hooksKeyPathOf = (target) => target.kind === "compatible" ? target.profile.hooksKeyPath : DEFAULT_HOOKS_KEY_PATH;
+var handlerTypeOf = (target) => target.kind === "cursor" ? "optional" : "required";
+var hookWiringProfileOf = (machineId, configFile) => createHash("sha256").update(`${machineId}\0${resolve(configFile)}`, "utf8").digest("hex").slice(0, HOOK_WIRING_PROFILE_LENGTH);
+var requiredApprovalEvents = (events, owner) => events.filter((event) => !(event.cliOnly && owner === "app")).map((event) => event.event);
+var isSwitchedOff = (reading, required) => reading.switchedOff || reading.trustGaps.some((gap) => CODEX_TRUST_GAPS_THAT_SWITCH_OFF.has(gap.kind) && required.has(gap.event));
+var isUntrusted = (reading, required) => reading.trustGaps.some((gap) => gap.kind === CODEX_TRUST_GAP_UNTRUSTED && required.has(gap.event));
+var weakeningOf = (switchedOff, wiring) => {
+  if (switchedOff) return "switched_off";
+  if (wiring.missing.length > 0) return "events_missing";
+  return wiring.narrowed.length > 0 ? "matcher_narrowed" : null;
+};
+var guardedStateOf = (reading, required) => isUntrusted(reading, required) ? "untrusted" : "wired";
+var requiredEventWiringOf = (required, wiredEvents, narrowedEvents) => ({
+  missing: required.filter((event) => !wiredEvents.has(event) && !narrowedEvents.has(event)),
+  narrowed: required.filter((event) => !wiredEvents.has(event) && narrowedEvents.has(event))
+});
+var hookWiringOf = (reading) => {
+  if (!reading.configDirExists) return null;
+  const base = { agent: reading.agent, profile: reading.profile };
+  if (reading.hooks.kind === "unreadable") {
+    return { ...base, state: reading.declined ? "disconnected" : "unreadable", owner: null };
+  }
+  const owner = reading.hooks.kind === "read" ? reading.hooks.owner : null;
+  if (reading.declined) return { ...base, state: "disconnected", owner };
+  const required = requiredApprovalEvents(reading.approvalEvents, owner);
+  const wiring = reading.hooks.kind === "read" ? requiredEventWiringOf(required, reading.hooks.wiredEvents, reading.hooks.narrowedEvents) : requiredEventWiringOf(required, NO_EVENTS, NO_EVENTS);
+  if (wiring.missing.length === required.length) return { ...base, state: "missing", owner };
+  const requiredSet = new Set(required);
+  const weakenedBy = weakeningOf(isSwitchedOff(reading, requiredSet), wiring);
+  if (weakenedBy) {
+    return { ...base, state: "weakened", owner, weakenedBy, ...wiring.missing.length > 0 ? { missing: wiring.missing } : {} };
+  }
+  return { ...base, state: guardedStateOf(reading, requiredSet), owner };
+};
+var isCommandHandler = (handler, handlerType) => handler.type === COMMAND_HOOK_TYPE || handlerType === "optional" && handler.type === void 0;
+var handlerOf = (handler, matcher, handlerType) => {
+  if (!isCommandHandler(handler, handlerType) || typeof handler.command !== "string") return [];
+  const command = parseHookCommand(handler.command);
+  return command ? [{ raw: handler.command, command, matcher }] : [];
+};
+var handlersInEntry = (entry, handlerType) => {
+  if (!isRecord(entry)) return [];
+  if (!Array.isArray(entry.hooks)) return handlerOf(entry, entry.matcher, handlerType);
+  return entry.hooks.filter(isRecord).flatMap((handler) => handlerOf(handler, entry.matcher, handlerType));
+};
+var handlersOnEvent = (entries, handlerType) => Array.isArray(entries) ? entries.flatMap((entry) => handlersInEntry(entry, handlerType)) : [];
+var handlersByEventIn = (hooks, handlerType) => new Map(isRecord(hooks) ? Object.entries(hooks).map(([event, entries]) => [event, handlersOnEvent(entries, handlerType)]) : []);
+var matcherAlternatives = (matcher) => matcher.split(MATCHER_ALTERNATIVE_SEPARATOR);
+var compiledMatcher = (matcher) => {
+  try {
+    return new RegExp(matcher);
+  } catch {
+    return null;
+  }
+};
+var regexToolMatch = (matcher) => {
+  const pattern = compiledMatcher(matcher);
+  return (tool) => pattern !== null && pattern.test(tool);
+};
+var toolMatchOf = (semantics, matcher) => {
+  if (semantics === "regex" || !SIMPLE_CLAUDE_CODE_MATCHER.test(matcher)) return regexToolMatch(matcher);
+  const names = new Set(matcherAlternatives(matcher));
+  return (tool) => names.has(tool);
+};
+var tableToolSamples = (tableMatcher) => matcherAlternatives(tableMatcher).map((alternative) => alternative.replaceAll(TABLE_PATTERN_WILDCARD, TABLE_PATTERN_SAMPLE));
+var coverageOfSamples = (samples, matches) => {
+  const matched = samples.filter(matches).length;
+  if (matched === samples.length) return "covers";
+  return matched > 0 ? "narrows" : "misses";
+};
+var unrestrictedEventCoverage = (matcher, matches, event) => {
+  if (UNRESTRICTED_MATCHER_PROBES.every(matches)) return "covers";
+  return event.earlierMatchers.includes(matcher) ? "narrows" : "misses";
+};
+var tableMatcherCoverage = (semantics) => (matcher, event) => {
+  if (matcherMatchesEveryCall(matcher)) return "covers";
+  if (typeof matcher !== "string") return "misses";
+  const matches = toolMatchOf(semantics, matcher);
+  if (event.matcher === null) return unrestrictedEventCoverage(matcher, matches, event);
+  return coverageOfSamples(tableToolSamples(event.matcher), matches);
+};
+var matcherSemanticsOf = (target) => target.kind === "codex" || target.kind === "gemini" ? "regex" : "claude_code";
+var coverageDecidedElsewhere = () => "covers";
+var runsBinary = (command, binary, context) => {
+  if (!command.runsExecutable) return false;
+  if (isBridgeLocator(command.executable)) return context.isLiveBridge(command.executable);
+  return hookExecutableName(command.executable) === binary && context.isRunnableBinary(command);
+};
+var coveredHandlerOf = (handler, event, coverageOf) => {
+  const coverage = coverageOf(handler.matcher, event);
+  return coverage === "misses" ? [] : [{ handler, coverage }];
+};
+var approvalHandlersOn = (handlersByEvent, event, context, coverageOf) => ({
+  event,
+  handlers: (handlersByEvent.get(event.event) ?? []).filter((handler) => runsBinary(handler.command, event.binary, context)).flatMap((handler) => coveredHandlerOf(handler, event, coverageOf))
+});
+var coversTableMatcher = (approval) => approval.handlers.some((covered) => covered.coverage === "covers");
+var isBridgeHandler = (handler) => isBridgeLocator(handler.command.executable);
+var hasLiveBridgeAnywhere = (handlersByEvent, isLiveBridge) => [...handlersByEvent.values()].flat().some((handler) => handler.command.runsExecutable && isBridgeHandler(handler) && isLiveBridge(handler.command.executable));
+var approvalOwnerOf = (running, liveBridgeAnywhere) => {
+  const covering = running.flatMap((approval) => approval.handlers.filter((covered) => covered.coverage === "covers").map((covered) => covered.handler));
+  if (covering.length > 0) return covering.some(isBridgeHandler) ? "app" : "cli";
+  if (running.some((approval) => approval.handlers.some((covered) => !isBridgeHandler(covered.handler)))) return "cli";
+  return liveBridgeAnywhere ? "app" : null;
+};
+var eventNamesOf = (approvals) => new Set(approvals.map((approval) => approval.event.event));
+var approvalWiringOf = (handlersByEvent, events, context, coverageOf) => {
+  const running = events.map((event) => approvalHandlersOn(handlersByEvent, event, context, coverageOf)).filter((approval) => approval.handlers.length > 0);
+  return {
+    owner: approvalOwnerOf(running, hasLiveBridgeAnywhere(handlersByEvent, context.isLiveBridge)),
+    wiredEvents: eventNamesOf(running.filter(coversTableMatcher)),
+    narrowedEvents: eventNamesOf(running.filter((approval) => !coversTableMatcher(approval)))
+  };
+};
+var readJsonDocument = (path) => {
+  const result = readRegularJsonFile(path, HOOK_WIRING_MAX_FILE_BYTES);
+  if (result.kind === "missing") return { kind: "missing" };
+  if (result.kind === "ok" && isRecord(result.value)) return { kind: "read", document: result.value };
+  return { kind: "unreadable" };
+};
+var jsonDocumentOrEmpty = (path) => {
+  if (path === null) return {};
+  const reading = readJsonDocument(path);
+  return reading.kind === "read" ? reading.document : {};
+};
+var textOrNull = (path) => {
+  const result = readRegularTextFile(path, HOOK_WIRING_MAX_FILE_BYTES);
+  return result.kind === "ok" ? result.value : null;
+};
+var tomlDocumentOrEmpty = (path) => {
+  const document = parseConfigDocument(textOrNull(path), "toml");
+  return document.kind === "parsed" ? document.value : {};
+};
+var handlersIn = (document, target) => handlersByEventIn(hooksAt(document, hooksKeyPathOf(target)), handlerTypeOf(target));
+var tableFileReading = (reading, target, context) => reading.kind === "read" ? { kind: "read", ...approvalWiringOf(handlersIn(reading.document, target), hookWiringApprovalEvents(target), context, tableMatcherCoverage(matcherSemanticsOf(target))) } : reading;
+var cursorFileReading = (target, context) => {
+  const reading = readJsonDocument(target.hooksFile);
+  if (reading.kind !== "read") return reading;
+  const wiring = approvalWiringOf(handlersIn(reading.document, target), hookWiringApprovalEvents(target), context, coverageDecidedElsewhere);
+  const coverage = liveCursorGateCoverage(reading.document, { hooksFile: target.hooksFile, probe: context.probe });
+  const runsPushary = (event) => wiring.wiredEvents.has(event);
+  return {
+    kind: "read",
+    owner: wiring.owner,
+    wiredEvents: new Set(coverage.full.filter(runsPushary)),
+    narrowedEvents: new Set(coverage.partial.filter(runsPushary))
+  };
+};
+var openCodeHandlers = (argv) => {
+  const command = parseHookArgv(argv);
+  return command ? /* @__PURE__ */ new Map([[OPENCODE_APPROVAL_EVENT, [{ raw: argv.join(" "), command, matcher: void 0 }]]]) : NO_HANDLERS;
+};
+var openCodeFileReading = (target, context) => {
+  const result = readRegularTextFile(target.pluginFile, HOOK_WIRING_MAX_FILE_BYTES);
+  if (result.kind === "missing") return { kind: "missing" };
+  if (result.kind !== "ok") return { kind: "unreadable" };
+  const handlersByEvent = openCodeHandlers(openCodePluginArgv(result.value) ?? []);
+  return { kind: "read", ...approvalWiringOf(handlersByEvent, hookWiringApprovalEvents(target), context, tableMatcherCoverage(matcherSemanticsOf(target))) };
+};
+var isDirectory = (path) => {
+  try {
+    return statSync(path).isDirectory();
+  } catch {
+    return false;
+  }
+};
+var claudeHooksSwitchedOff = (user, local, managed) => [user, local, managed].some((settings) => settings.disableAllHooks === true) || managed.allowManagedHooksOnly === true;
+var codexTrustCommandIn = (document) => {
+  const handlersByEvent = handlersByEventIn(hooksAt(document, DEFAULT_HOOKS_KEY_PATH), "required");
+  const handlers = CODEX_APPROVAL_EVENTS.flatMap((event) => handlersByEvent.get(event.event) ?? []);
+  return handlers.find((handler) => hookExecutableName(handler.command.executable) === CODEX_HOOK_BINARY)?.raw ?? "";
+};
+var codexHookTrustGapsIn = (config, document, hooksFile) => codexTrustGaps(config, document, hooksFile, codexTrustCommandIn(document), codexHookPositions(document));
+var CODEX_HOOKS_UNREADABLE = { kind: "unreadable" };
+var readCodexHooksOnDisk = (configFile, hooksFile) => {
+  const config = parseConfigDocument(textOrNull(configFile), "toml");
+  const hooks = readJsonDocument(hooksFile);
+  if (config.kind !== "parsed" || hooks.kind !== "read") return CODEX_HOOKS_UNREADABLE;
+  return {
+    kind: "read",
+    hooksFeatureOff: codexHooksFeatureDisabled(config.value),
+    gaps: codexHookTrustGapsIn(config.value, hooks.document, hooksFile)
+  };
+};
+var UNSWITCHED = { switchedOff: false, trustGaps: [] };
+var readClaudeTarget = (target, context) => {
+  const settings = readJsonDocument(target.settingsFile);
+  return {
+    hooks: tableFileReading(settings, target, context),
+    switchedOff: claudeHooksSwitchedOff(
+      settings.kind === "read" ? settings.document : {},
+      jsonDocumentOrEmpty(target.localSettingsFile),
+      jsonDocumentOrEmpty(target.managedSettingsFile)
+    ),
+    trustGaps: []
+  };
+};
+var readCodexTarget = (target, context) => {
+  const hooksDocument = readJsonDocument(target.hooksFile);
+  const hooks = tableFileReading(hooksDocument, target, context);
+  if (hooksDocument.kind !== "read") return { hooks, ...UNSWITCHED };
+  const config = tomlDocumentOrEmpty(target.configFile);
+  return {
+    hooks,
+    switchedOff: codexHooksFeatureDisabled(config),
+    trustGaps: codexHookTrustGapsIn(config, hooksDocument.document, target.hooksFile)
+  };
+};
+var readAgentSpecific = (target, context) => {
+  switch (target.kind) {
+    case "claude":
+      return readClaudeTarget(target, context);
+    case "codex":
+      return readCodexTarget(target, context);
+    case "opencode":
+      return { hooks: openCodeFileReading(target, context), ...UNSWITCHED };
+    case "cursor":
+      return { hooks: cursorFileReading(target, context), ...UNSWITCHED };
+    case "gemini":
+    case "compatible":
+      return { hooks: tableFileReading(readJsonDocument(configFileOf(target)), target, context), ...UNSWITCHED };
+  }
+};
+var readHookWiringTarget = (target, machineId, declined, context) => {
+  const agent = hookWiringAgentOf(target);
+  return {
+    agent,
+    profile: hookWiringProfileOf(machineId, configFileOf(target)),
+    configDirExists: isDirectory(target.configDir),
+    declined: declined.has(agent),
+    approvalEvents: hookWiringApprovalEvents(target),
+    ...readAgentSpecific(target, context)
+  };
+};
+var realpathOrNull = (path) => {
+  try {
+    return realpathSync(path);
+  } catch {
+    return null;
+  }
+};
+var canonicalLiveBridge = (location, probe) => {
+  const stub = realpathOrNull(location.stub);
+  if (stub === null || !macAppBridgeIsInstalled(location, probe)) return () => false;
+  return (executable) => isAbsolute(executable) && isBridgeLocator(executable) && realpathOrNull(executable) === stub;
+};
+var regularFileMode = (path) => {
+  try {
+    const stats = statSync(path);
+    return stats.isFile() ? stats.mode : null;
+  } catch {
+    return null;
+  }
+};
+var runnableBinaryCheck = (platform) => (command) => {
+  if (!isAbsolute(command.executable)) return false;
+  const mode = regularFileMode(command.executable);
+  if (mode === null) return false;
+  return command.runsThroughNode || platform === WINDOWS_PLATFORM || (mode & EXECUTE_BITS) !== 0;
+};
+var hookWiringReadContext = (bridge, platform) => {
+  const probe = { ...liveBridgeProbe(), readFile: textOrNull, mdfind: NO_SPOTLIGHT };
+  return { probe, isLiveBridge: canonicalLiveBridge(bridge, probe), isRunnableBinary: runnableBinaryCheck(platform) };
+};
+var compatibleConfigDirOf = (profile, hooksFile) => profile.configFile.root === "grok_home" ? grokHome() : dirname(hooksFile);
+var compatibleTarget = (profile) => {
+  const hooksFile = compatibleConfigFile(profile);
+  return { kind: "compatible", profile, configDir: compatibleConfigDirOf(profile, hooksFile), hooksFile };
+};
+var hookWiringLocations = (platform = process.platform) => ({
+  declinedAgentsFile: declinedAgentsFile(),
+  bridge: { stub: bridgeStub(), cache: bridgeCache(), bundleRoots: installedBridgeBundleRoots(homedir()) },
+  targets: [
+    {
+      kind: "claude",
+      configDir: claudeConfigDir(),
+      settingsFile: claudeSettings(),
+      localSettingsFile: claudeSettingsLocal(),
+      managedSettingsFile: MANAGED_CLAUDE_SETTINGS_BY_PLATFORM[platform] ?? null
+    },
+    { kind: "codex", configDir: codexHome(), hooksFile: codexHooksJson(), configFile: codexConfigToml() },
+    { kind: "gemini", configDir: dirname(geminiSettings()), settingsFile: geminiSettings() },
+    { kind: "cursor", configDir: dirname(cursorUserHooks()), hooksFile: cursorUserHooks() },
+    { kind: "opencode", configDir: openCodeConfigDir(), pluginFile: openCodePluginFile() },
+    ...HOOK_COMPATIBLE_PROFILES.map(compatibleTarget)
+  ]
+});
+var readHookWiring = (machineId, locations = hookWiringLocations()) => {
+  const declined = new Set(readDeclinedAgents(locations.declinedAgentsFile));
+  const context = hookWiringReadContext(locations.bridge, process.platform);
+  const agents = locations.targets.flatMap((target) => {
+    const entry = hookWiringOf(readHookWiringTarget(target, machineId, declined, context));
+    return entry ? [entry] : [];
+  });
+  return { version: HOOK_WIRING_REPORT_VERSION, agents };
+};
+var readHookWiringSafely = (read, reportFailure) => {
+  try {
+    return read();
+  } catch (error) {
+    reportFailure(error);
+    return null;
+  }
+};
+
+export {
+  readCodexHooksOnDisk,
+  readHookWiring,
+  readHookWiringSafely
+};

package/dist/{chunk-YXFLZ2LO.js → chunk-GI3266RE.js}

@@ -4,10 +4,10 @@ import {
   keyPrefix,
   readConfigFileKey,
   readMacAppKeyPrefix
-} from "./chunk-NUU2JVOG.js";
+} from "./chunk-22OATDEL.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-KHWNW4AS.js";
+} from "./chunk-JCHF4VR3.js";
 
 // src/key-signed-out.ts
 var VERDICT_BY_CHECK = {

package/dist/{chunk-X5P3IO37.js → chunk-GNP6I5XM.js}

@@ -9,13 +9,13 @@ import {
   installedCodexApp,
   readCodexAppRuntime,
   shellQuoted
-} from "./chunk-YI5I2TF3.js";
+} from "./chunk-BYL7RNOM.js";
 import {
   writeHuman
 } from "./chunk-QCGNGEGE.js";
 import {
   xml
-} from "./chunk-SSW4QRGU.js";
+} from "./chunk-3ZU77DJH.js";
 import {
   writeFileAtomic
 } from "./chunk-T5I4PKOQ.js";

package/dist/{chunk-R3KDA7JB.js → chunk-GQFT3QTC.js}

@@ -1,12 +1,12 @@
 import {
   CODEX_HOOK_STATUS
-} from "./chunk-3AX5BKYN.js";
+} from "./chunk-GBT74TNN.js";
 import {
   retryAgentCommand
-} from "./chunk-Y3N7LIFV.js";
+} from "./chunk-MPG4HYQ6.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-KHWNW4AS.js";
+} from "./chunk-JCHF4VR3.js";
 
 // src/setup/codex-trust.ts
 var CODEX_TRUST_TELEMETRY = {
@@ -18,6 +18,16 @@ var CODEX_TRUST_TELEMETRY = {
 };
 var isUnanswered = (confirmation) => confirmation.kind === "skipped" || confirmation.kind === "unavailable";
 var codexTrustOutcome = (confirmation, portedTrustWritten) => isUnanswered(confirmation) && !portedTrustWritten ? "manual" : CODEX_TRUST_TELEMETRY[confirmation.kind];
+var CODEX_APPROVALS_BY_TRUST = {
+  verified: "on",
+  pretrusted: "on",
+  unverified: "on",
+  manual: "hooks_not_running"
+};
+var GAPS_THAT_STOP_A_HOOK = /* @__PURE__ */ new Set(["untrusted", "disabled", "asynchronous"]);
+var CODEX_SETTINGS_STOP_A_HOOK = "Codex's own settings stop a Pushary hook from running: hooks are turned off in config.toml, or a hook is turned off or not trusted in Codex's hooks list (/hooks, or Settings then Hooks in the ChatGPT app). Run pushary doctor to see which, and how to fix it.";
+var codexSettingsStopAHook = (onDisk) => onDisk.kind === "read" && (onDisk.hooksFeatureOff || onDisk.gaps.some((gap) => GAPS_THAT_STOP_A_HOOK.has(gap.kind)));
+var codexApprovalsWithHooks = (trust, onDisk) => trust === "unverified" && codexSettingsStopAHook(onDisk) ? "hooks_not_running" : CODEX_APPROVALS_BY_TRUST[trust];
 var CODEX_TRUST_REFUSED = "Codex did not accept the trust Pushary asked for, so its hooks are not trusted yet. Open Codex, run /hooks, and choose Trust for the Pushary hooks.";
 var CODEX_HOOK_REMEDY = {
   asynchronous: "re-run setup to restore blocking permission hooks",
@@ -110,6 +120,8 @@ var describeHermesState = (state) => {
 
 export {
   codexTrustOutcome,
+  CODEX_SETTINGS_STOP_A_HOOK,
+  codexApprovalsWithHooks,
   CODEX_HOOK_REMEDY,
   needsCodexTrustStep,
   describeCodexTrustConfirmation,

package/dist/{chunk-O76PTPKP.js → chunk-GSJUGW3A.js}

@@ -1,6 +1,6 @@
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-KHWNW4AS.js";
+} from "./chunk-JCHF4VR3.js";
 
 // src/config.ts
 import { readFileSync } from "fs";

package/dist/{chunk-OECCPPO6.js → chunk-HJ566HEV.js}

@@ -1,9 +1,9 @@
 import {
   pusharyFetch
-} from "./chunk-5RVL2CQK.js";
+} from "./chunk-XQFHB2EK.js";
 import {
   getBaseUrl
-} from "./chunk-O76PTPKP.js";
+} from "./chunk-GSJUGW3A.js";
 import {
   NetworkError
 } from "./chunk-YU2EUD7O.js";
@@ -13,7 +13,7 @@ import {
 import {
   isValidApiKey,
   normalizeKeyScope
-} from "./chunk-DZE26BID.js";
+} from "./chunk-KPCVIH52.js";
 
 // src/session.ts
 var samePusharyAccount = (left, right) => left.kind === "ok" && right.kind === "ok" && left.identity.workspaceId !== "" && left.identity.workspaceId === right.identity.workspaceId && left.identity.siteId === right.identity.siteId;

package/dist/{chunk-7HDO5W4C.js → chunk-I7HSE5LD.js}

@@ -27,11 +27,11 @@ import {
   toolResultErrorText,
   transcriptTokensIn,
   transcriptUsageRequest
-} from "./chunk-FYVRA5GN.js";
+} from "./chunk-FQSFN5ZE.js";
 import {
   branchFor,
   repoKeyFor
-} from "./chunk-NVPCETJ3.js";
+} from "./chunk-4I6FWGZ5.js";
 import {
   cancelQuestion,
   clientErrorKindOf,
@@ -39,34 +39,34 @@ import {
   reportClientError,
   sendNotification,
   waitForAnswer
-} from "./chunk-TILEGY4M.js";
+} from "./chunk-44O6GG4I.js";
 import {
   withRetry
-} from "./chunk-EPMIBLCE.js";
+} from "./chunk-WUREJCUJ.js";
 import {
   fetchAsCredential
-} from "./chunk-PYAPWXVP.js";
+} from "./chunk-NPG4WCIM.js";
 import {
   getMachineId
-} from "./chunk-SDQQ43FT.js";
+} from "./chunk-F5TQ6TCH.js";
 import {
   reportedInstallSource
-} from "./chunk-LTVILMEZ.js";
+} from "./chunk-JRW5HK32.js";
 import {
   IDLE_PROMPT_NOTIFICATION,
   NOTIFICATION_PUSH_TYPES,
   POSTTOOLUSE_MIRROR_ONLY_TOOLS,
   canonicalJson,
   claudeConfigDir
-} from "./chunk-PCFIYMK4.js";
+} from "./chunk-RLBTKTOK.js";
 import {
   compareVersion,
   parseVersion
-} from "./chunk-QQMT2JIC.js";
+} from "./chunk-RIBCPWOB.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-O76PTPKP.js";
+} from "./chunk-GSJUGW3A.js";
 import {
   writeFileAtomic,
   writeJsonAtomicDurable
@@ -94,7 +94,7 @@ import {
   resolveAutoResolveOrigin,
   resolvePolicy,
   unansweredRefusalReason
-} from "./chunk-DZE26BID.js";
+} from "./chunk-KPCVIH52.js";
 
 // src/pending.ts
 import { join } from "path";

package/dist/{chunk-QVGE26SZ.js → chunk-IWUYKDDW.js}

@@ -1,17 +1,17 @@
 import {
   pusharyHookExecutable
-} from "./chunk-NZZFIIH6.js";
+} from "./chunk-NK5XT4RS.js";
 import {
   bridgeResolvesToApp,
   cursorUserHooks,
   executableFileName,
   isBridgeLocator,
   liveBridgeProbe
-} from "./chunk-PCFIYMK4.js";
+} from "./chunk-RLBTKTOK.js";
 import {
   atLeast,
   parseVersion
-} from "./chunk-QQMT2JIC.js";
+} from "./chunk-RIBCPWOB.js";
 import {
   CURSOR_GATE_COVERAGE,
   CURSOR_GATE_SCRIPT,
@@ -21,7 +21,7 @@ import {
   isCursorHookPayload,
   isRecord,
   toolsCoveredByGateEntry
-} from "./chunk-DZE26BID.js";
+} from "./chunk-KPCVIH52.js";
 
 // src/cursor-gate-registration.ts
 import { dirname, isAbsolute, join, resolve } from "path";

package/dist/{chunk-KHWNW4AS.js → chunk-JCHF4VR3.js}

@@ -2,7 +2,7 @@ import {
   DISCONNECT_AGENT_IDS,
   SETUP_AGENT_CHOICES,
   isApprovalMode
-} from "./chunk-DZE26BID.js";
+} from "./chunk-KPCVIH52.js";
 
 // src/cli/mode-request.ts
 var parseDuration = (value) => {

package/dist/{chunk-LTVILMEZ.js → chunk-JRW5HK32.js}

@@ -1,9 +1,9 @@
 import {
   configFilePath
-} from "./chunk-O76PTPKP.js";
+} from "./chunk-GSJUGW3A.js";
 import {
   normalizeInstallSource
-} from "./chunk-DZE26BID.js";
+} from "./chunk-KPCVIH52.js";
 
 // src/install-source.ts
 import { readFileSync } from "fs";