pushary 1.9.8 → 1.9.9

package/dist/bin/pushary-prompt-hook.js

@@ -1,46 +1,45 @@
 #!/usr/bin/env node
-import {
-  activeHookSource,
-  activeIdentity
-} from "../chunk-KHNFLYJO.js";
 import {
   readHookInput
-} from "../chunk-WWOHTTVP.js";
-import "../chunk-DPGSLWOS.js";
+} from "../chunk-R5RIVOPL.js";
+import "../chunk-COQ64C4F.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-YIG2R3BJ.js";
-import "../chunk-DL7XWKYV.js";
-import "../chunk-LKLVTG3V.js";
-import "../chunk-2QGYMY7A.js";
-import "../chunk-3I6IVOZV.js";
-import "../chunk-WG3K4TCH.js";
-import "../chunk-ZBK6E2OR.js";
-import "../chunk-CLOSJ4ES.js";
-import "../chunk-M6BZZFVQ.js";
+import "../chunk-SZ4Q6ZVS.js";
+import "../chunk-APP43AW7.js";
+import "../chunk-462EQA6K.js";
+import "../chunk-VIIHC42X.js";
 import "../chunk-XHKBHWLX.js";
+import {
+  activeHookSource,
+  activeIdentity
+} from "../chunk-UF6RBP5V.js";
+import "../chunk-BYLKCZ2G.js";
+import "../chunk-M3STIAGU.js";
+import "../chunk-ZGADIZDS.js";
+import "../chunk-MLGIVVSG.js";
+import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
+import "../chunk-REU2VQPH.js";
 import {
   handleUserPrompt
-} from "../chunk-KRCR2CRQ.js";
+} from "../chunk-KQFTBQ66.js";
 import "../chunk-N6IOSZOE.js";
-import "../chunk-CD47ZFFZ.js";
-import "../chunk-2VZAALEJ.js";
-import "../chunk-DKMD6AWR.js";
+import "../chunk-MD4SVNT6.js";
+import "../chunk-WRPYCIV2.js";
+import "../chunk-6AYSKVLL.js";
+import "../chunk-QRXPWW3M.js";
+import "../chunk-UPIZSCYD.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-GMXKITVA.js";
-import "../chunk-N4QSPI3B.js";
-import "../chunk-MKTJEXZ3.js";
-import "../chunk-LWOO567I.js";
-import "../chunk-TCQ43LSG.js";
-import "../chunk-DUZVXBBU.js";
+import "../chunk-5N5L6DNN.js";
+import "../chunk-KOWFRUIT.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-FQ2GORVG.js";
-import "../chunk-ZBHUHJG6.js";
+import "../chunk-BNSKVIAW.js";
+import "../chunk-Z23ZBYDW.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-5QUPKDI5.js";
-import "../chunk-7DVNSQWF.js";
-import "../chunk-I5IJRMNV.js";
+import "../chunk-IRHABAQT.js";
+import "../chunk-5DCDQ5VW.js";
+import "../chunk-5RGA636G.js";
 
 // bin/pushary-prompt-hook.ts
 var AGENT = activeIdentity(process.argv);

package/dist/bin/pushary-session-end-hook.js

@@ -2,48 +2,47 @@
 import {
   WRAPPER_ACTIVE_ENV
 } from "../chunk-PQ4K74WL.js";
-import {
-  activeHookSource,
-  activeIdentity
-} from "../chunk-KHNFLYJO.js";
 import {
   readHookInput
-} from "../chunk-WWOHTTVP.js";
-import "../chunk-DPGSLWOS.js";
+} from "../chunk-R5RIVOPL.js";
+import "../chunk-COQ64C4F.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-YIG2R3BJ.js";
-import "../chunk-DL7XWKYV.js";
-import "../chunk-LKLVTG3V.js";
-import "../chunk-2QGYMY7A.js";
-import "../chunk-3I6IVOZV.js";
-import "../chunk-WG3K4TCH.js";
-import "../chunk-ZBK6E2OR.js";
-import "../chunk-CLOSJ4ES.js";
-import "../chunk-M6BZZFVQ.js";
+import "../chunk-SZ4Q6ZVS.js";
+import "../chunk-APP43AW7.js";
+import "../chunk-462EQA6K.js";
+import "../chunk-VIIHC42X.js";
 import "../chunk-XHKBHWLX.js";
+import {
+  activeHookSource,
+  activeIdentity
+} from "../chunk-UF6RBP5V.js";
+import "../chunk-BYLKCZ2G.js";
+import "../chunk-M3STIAGU.js";
+import "../chunk-ZGADIZDS.js";
+import "../chunk-MLGIVVSG.js";
+import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
+import "../chunk-REU2VQPH.js";
 import {
   handleSessionEnd
-} from "../chunk-KRCR2CRQ.js";
+} from "../chunk-KQFTBQ66.js";
 import "../chunk-N6IOSZOE.js";
-import "../chunk-CD47ZFFZ.js";
-import "../chunk-2VZAALEJ.js";
-import "../chunk-DKMD6AWR.js";
+import "../chunk-MD4SVNT6.js";
+import "../chunk-WRPYCIV2.js";
+import "../chunk-6AYSKVLL.js";
+import "../chunk-QRXPWW3M.js";
+import "../chunk-UPIZSCYD.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-GMXKITVA.js";
-import "../chunk-N4QSPI3B.js";
-import "../chunk-MKTJEXZ3.js";
-import "../chunk-LWOO567I.js";
-import "../chunk-TCQ43LSG.js";
-import "../chunk-DUZVXBBU.js";
+import "../chunk-5N5L6DNN.js";
+import "../chunk-KOWFRUIT.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-FQ2GORVG.js";
-import "../chunk-ZBHUHJG6.js";
+import "../chunk-BNSKVIAW.js";
+import "../chunk-Z23ZBYDW.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-5QUPKDI5.js";
-import "../chunk-7DVNSQWF.js";
-import "../chunk-I5IJRMNV.js";
+import "../chunk-IRHABAQT.js";
+import "../chunk-5DCDQ5VW.js";
+import "../chunk-5RGA636G.js";
 
 // bin/pushary-session-end-hook.ts
 var AGENT = activeIdentity(process.argv);

package/dist/bin/pushary-session-start-hook.js

@@ -1,57 +1,55 @@
 #!/usr/bin/env node
 import {
   reapplyClaudeForVersion
-} from "../chunk-MXHTGVFZ.js";
-import "../chunk-3Z3A37WD.js";
-import "../chunk-MGRFDGWU.js";
-import "../chunk-MFF3ONG5.js";
-import {
-  activeHookSource,
-  activeIdentity
-} from "../chunk-KHNFLYJO.js";
+} from "../chunk-6EBGOHDJ.js";
+import "../chunk-NGKUXZID.js";
 import "../chunk-RIVNNBEK.js";
 import {
   triggerAutoUpdate
-} from "../chunk-7PT35RY2.js";
+} from "../chunk-K545B734.js";
 import {
   readHookInput
-} from "../chunk-WWOHTTVP.js";
-import "../chunk-DPGSLWOS.js";
+} from "../chunk-R5RIVOPL.js";
+import "../chunk-COQ64C4F.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-YIG2R3BJ.js";
-import "../chunk-DL7XWKYV.js";
-import "../chunk-LKLVTG3V.js";
-import "../chunk-2QGYMY7A.js";
-import "../chunk-3I6IVOZV.js";
-import "../chunk-WG3K4TCH.js";
-import "../chunk-ZBK6E2OR.js";
-import "../chunk-CLOSJ4ES.js";
-import "../chunk-M6BZZFVQ.js";
+import "../chunk-SZ4Q6ZVS.js";
+import "../chunk-APP43AW7.js";
+import "../chunk-462EQA6K.js";
+import "../chunk-VIIHC42X.js";
 import "../chunk-XHKBHWLX.js";
+import "../chunk-BZLHTMT6.js";
+import {
+  activeHookSource,
+  activeIdentity
+} from "../chunk-UF6RBP5V.js";
+import "../chunk-BYLKCZ2G.js";
+import "../chunk-M3STIAGU.js";
+import "../chunk-ZGADIZDS.js";
+import "../chunk-MLGIVVSG.js";
+import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
+import "../chunk-REU2VQPH.js";
 import {
   CLAUDE_CODE_AGENT,
   handleSessionStart
-} from "../chunk-KRCR2CRQ.js";
+} from "../chunk-KQFTBQ66.js";
 import "../chunk-N6IOSZOE.js";
-import "../chunk-CD47ZFFZ.js";
-import "../chunk-2VZAALEJ.js";
-import "../chunk-DKMD6AWR.js";
+import "../chunk-MD4SVNT6.js";
+import "../chunk-WRPYCIV2.js";
+import "../chunk-6AYSKVLL.js";
+import "../chunk-QRXPWW3M.js";
+import "../chunk-UPIZSCYD.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-GMXKITVA.js";
-import "../chunk-N4QSPI3B.js";
-import "../chunk-MKTJEXZ3.js";
-import "../chunk-LWOO567I.js";
-import "../chunk-TCQ43LSG.js";
-import "../chunk-DUZVXBBU.js";
+import "../chunk-5N5L6DNN.js";
+import "../chunk-KOWFRUIT.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-FQ2GORVG.js";
-import "../chunk-ZBHUHJG6.js";
+import "../chunk-BNSKVIAW.js";
+import "../chunk-Z23ZBYDW.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-5QUPKDI5.js";
-import "../chunk-7DVNSQWF.js";
-import "../chunk-I5IJRMNV.js";
+import "../chunk-IRHABAQT.js";
+import "../chunk-5DCDQ5VW.js";
+import "../chunk-5RGA636G.js";
 
 // bin/pushary-session-start-hook.ts
 var AGENT = activeIdentity(process.argv);

package/dist/bin/pushary-setup.js

@@ -1,40 +1,36 @@
 #!/usr/bin/env node
 import {
   runBrowserLogin
-} from "../chunk-NWDG3MSW.js";
+} from "../chunk-OAYWO5NP.js";
 import {
   coworkOutput,
   coworkSelection
-} from "../chunk-B64KHETR.js";
+} from "../chunk-QTIUJZRX.js";
 import "../chunk-PUZZELE6.js";
 import {
   clearDeclinedAgent,
   declinedAgentForSetupChoice
-} from "../chunk-BXET3ALR.js";
-import {
-  agentHookFile,
-  agentHookOwner,
-  macAppBridgeAvailable
-} from "../chunk-3Z3A37WD.js";
+} from "../chunk-EIAEUG7G.js";
 import {
+  CURSOR_GATE_SCRIPT,
   describeVersionManagerPin,
   versionManagerOf
-} from "../chunk-GU3EJCVV.js";
+} from "../chunk-EA5NWDK7.js";
 import {
   codexTrustOutcome,
   describeCodexTrustConfirmation,
   needsCodexTrustStep
-} from "../chunk-6TE27XZR.js";
+} from "../chunk-DP3WX7FW.js";
 import {
   writeStdoutFully
 } from "../chunk-EO23EUOK.js";
 import {
   ensureCodexTrustsPusharyHooks
-} from "../chunk-MGRFDGWU.js";
+} from "../chunk-NGKUXZID.js";
 import {
   readManagedControlEvidence,
   waitForMachineReadiness
-} from "../chunk-2QTO5YIT.js";
+} from "../chunk-QIOIO7VN.js";
 import {
   describeSetupSideEffects,
   installAgentSkill,
@@ -44,7 +40,7 @@ import {
   CURSOR_PLUGIN_BACKUP_INFIX,
   CURSOR_PLUGIN_STAGING_PREFIX,
   registerCursorGate
-} from "../chunk-TCWKTUAE.js";
+} from "../chunk-LENBKYRB.js";
 import {
   HERMES_PIP_PACKAGE,
   describeDetection,
@@ -57,7 +53,7 @@ import {
   runHermesConfigScript,
   shortenHome,
   vscodeSettingsTargets
-} from "../chunk-KFF7G225.js";
+} from "../chunk-UAP5DS6P.js";
 import {
   AgentConfigError,
   FX_PUSHARY_TOOLS_RULE,
@@ -81,39 +77,10 @@ import {
   withFxPusharyServer,
   writeFxProfile,
   writeInstructionBlock
-} from "../chunk-ZN3C6GBG.js";
+} from "../chunk-6W5M3MSE.js";
 import {
   MCP_BRIDGE_BINARY
-} from "../chunk-HRULIYDU.js";
-import {
-  OPENCODE_HOOK_BINARY,
-  addOpenCodeMcpServer,
-  installOpenCodePlugin,
-  openCodeConfigDir,
-  openCodeConfigFile,
-  openCodeHookArgv,
-  openCodeInstructionsFile,
-  openCodePluginDir,
-  openCodePluginFile,
-  openCodeWired
-} from "../chunk-MFF3ONG5.js";
-import {
-  addClaudeMcpServer,
-  addCompatibleHooks,
-  addCompatibleMcpServer,
-  addCompatibleToolPermissions,
-  addPusharyHooks,
-  addPusharyToolPermissions,
-  captureClaudeMcpServer,
-  compatibleConfigFile,
-  compatibleHookEvents,
-  compatibleInstructionsFile,
-  compatibleMcpFile,
-  compatiblePermissionRuleFile,
-  hasCompatibleHooks,
-  isClaudeMcpSnapshot,
-  updateClaudeMcpSnapshot
-} from "../chunk-KHNFLYJO.js";
+} from "../chunk-H5T27W7M.js";
 import {
   checkCodexInstall,
   detectProviderLiveCapabilities,
@@ -121,29 +88,14 @@ import {
   hasSpawnProvider,
   nodeCodexInstallProbe,
   resolveControlPolicy
-} from "../chunk-I6MJXLMY.js";
+} from "../chunk-F7R3SZ4Q.js";
 import {
   detectClaudeVersion
 } from "../chunk-RIVNNBEK.js";
 import {
   describeAutoUpdateAnnouncement,
   takeAutoUpdateAnnouncement
-} from "../chunk-7PT35RY2.js";
-import {
-  KEEP_HINT,
-  captureHookTakeover,
-  captureMcpServer,
-  describeAppOwnership,
-  describeHookOwnership,
-  mcpBearerKey,
-  planHooks
-} from "../chunk-YIG2R3BJ.js";
-import {
-  AGENT_CHOICES,
-  effectiveControlMode,
-  effectiveVerify,
-  parseSetupOptions
-} from "../chunk-DL7XWKYV.js";
+} from "../chunk-K545B734.js";
 import {
   DAEMON_COLD_START_TIMEOUT_MS,
   clearDaemonNeedsLogin,
@@ -157,35 +109,11 @@ import {
   replaceDaemonService,
   stopDaemonService,
   waitForDaemonRemoteProof
-} from "../chunk-LKLVTG3V.js";
-import {
-  claudeWired,
-  codexWired,
-  geminiWired,
-  pusharyHookExecutable
-} from "../chunk-2QGYMY7A.js";
-import {
-  GEMINI_HOOK_BINARY,
-  addGeminiHooks,
-  addGeminiMcpServer
-} from "../chunk-3I6IVOZV.js";
-import "../chunk-WG3K4TCH.js";
+} from "../chunk-SZ4Q6ZVS.js";
 import {
   transcriptPreferenceForSetup
-} from "../chunk-M6BZZFVQ.js";
+} from "../chunk-VIIHC42X.js";
 import "../chunk-XHKBHWLX.js";
-import {
-  compareVersion,
-  parseVersion
-} from "../chunk-6ICPEJY5.js";
-import {
-  reportEvent
-} from "../chunk-KRCR2CRQ.js";
-import "../chunk-N6IOSZOE.js";
-import "../chunk-CD47ZFFZ.js";
-import "../chunk-2VZAALEJ.js";
-import "../chunk-DKMD6AWR.js";
-import "../chunk-POFBE6ZY.js";
 import {
   BROWSER_CONNECT_COMMAND,
   confirmAppConnection,
@@ -196,17 +124,78 @@ import {
   printConnectInstructions,
   roundTripEvidence,
   verifyRoundTrip
-} from "../chunk-IAD2RT4L.js";
+} from "../chunk-DCCSULXK.js";
 import "../chunk-3EGEA4KH.js";
 import {
   setHumanStream
 } from "../chunk-QCGNGEGE.js";
+import {
+  OPENCODE_HOOK_BINARY,
+  addOpenCodeMcpServer,
+  agentHookFile,
+  agentHookOwner,
+  installOpenCodePlugin,
+  macAppBridgeAvailable,
+  openCodeConfigDir,
+  openCodeConfigFile,
+  openCodeHookArgv,
+  openCodeInstructionsFile,
+  openCodePluginDir,
+  openCodePluginFile,
+  openCodeWired
+} from "../chunk-BZLHTMT6.js";
+import {
+  addClaudeMcpServer,
+  addCompatibleHooks,
+  addCompatibleMcpServer,
+  addCompatibleToolPermissions,
+  addPusharyHooks,
+  addPusharyToolPermissions,
+  captureClaudeMcpServer,
+  compatibleConfigFile,
+  compatibleHookEvents,
+  compatibleInstructionsFile,
+  compatibleMcpFile,
+  compatiblePermissionRuleFile,
+  hasCompatibleHooks,
+  isClaudeMcpSnapshot,
+  updateClaudeMcpSnapshot
+} from "../chunk-UF6RBP5V.js";
 import {
   ansiPainter,
   createIo,
   useColor
 } from "../chunk-U4TMAANR.js";
+import {
+  KEEP_HINT,
+  captureHookTakeover,
+  captureMcpServer,
+  claudeWired,
+  codexWired,
+  describeAppOwnership,
+  describeHookOwnership,
+  geminiWired,
+  mcpBearerKey,
+  planHooks,
+  pusharyHookExecutable
+} from "../chunk-BYLKCZ2G.js";
+import {
+  GEMINI_HOOK_BINARY,
+  addGeminiHooks,
+  addGeminiMcpServer
+} from "../chunk-M3STIAGU.js";
+import {
+  AGENT_CHOICES,
+  effectiveControlMode,
+  effectiveVerify,
+  parseSetupOptions
+} from "../chunk-ZGADIZDS.js";
+import "../chunk-MLGIVVSG.js";
 import "../chunk-GMXKITVA.js";
+import {
+  compareVersion,
+  parseVersion
+} from "../chunk-6ICPEJY5.js";
 import {
   KEY_FILE_MODE,
   exportLine,
@@ -219,22 +208,30 @@ import {
   recordMacAppKeyPrefix,
   resolveShellRc,
   writeKey
-} from "../chunk-N4QSPI3B.js";
-import "../chunk-MKTJEXZ3.js";
+} from "../chunk-REU2VQPH.js";
+import {
+  reportEvent
+} from "../chunk-KQFTBQ66.js";
+import "../chunk-N6IOSZOE.js";
+import "../chunk-MD4SVNT6.js";
+import "../chunk-WRPYCIV2.js";
+import "../chunk-6AYSKVLL.js";
 import {
   checkApiKey,
   describeKeyCheck,
   samePusharyAccount
-} from "../chunk-LWOO567I.js";
-import "../chunk-TCQ43LSG.js";
-import "../chunk-DUZVXBBU.js";
+} from "../chunk-QRXPWW3M.js";
+import "../chunk-UPIZSCYD.js";
+import "../chunk-POFBE6ZY.js";
+import "../chunk-5N5L6DNN.js";
+import "../chunk-KOWFRUIT.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-FQ2GORVG.js";
+import "../chunk-BNSKVIAW.js";
 import {
   NpmMissingError,
   addCodexHookTrust,
@@ -266,6 +263,7 @@ import {
   geminiSettings,
   guardBinary,
   guardCursorGate,
+  guardNodeScript,
   guardedArgv,
   hermesConfigReceipt,
   hookTakeoverReceipt,
@@ -278,18 +276,18 @@ import {
   resolveGlobalBinary,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-ZBHUHJG6.js";
+} from "../chunk-Z23ZBYDW.js";
 import {
   backupFile,
   readJsonSafe,
   writeFileAtomic,
   writeJsonAtomic
 } from "../chunk-T7E75EKA.js";
-import "../chunk-5QUPKDI5.js";
+import "../chunk-IRHABAQT.js";
 import {
   NPX_LATEST_COMMAND,
   renderCommandHelp
-} from "../chunk-7DVNSQWF.js";
+} from "../chunk-5DCDQ5VW.js";
 import {
   HOOK_COMPATIBLE_PROFILES,
   PRETOOLUSE_GATED_TOOLS,
@@ -303,7 +301,7 @@ import {
   isValidApiKey,
   launchedPackage,
   ownPackageName
-} from "../chunk-I5IJRMNV.js";
+} from "../chunk-5RGA636G.js";
 
 // bin/pushary-setup.ts
 import { existsSync, readFileSync, writeFileSync, mkdirSync, cpSync, rmSync, renameSync, realpathSync, statSync, openSync, readSync, closeSync } from "fs";
@@ -644,6 +642,24 @@ var pickAppKey = (candidates) => candidates.fromAgents.find(
   (candidate) => typeof candidate === "string" && candidate !== candidates.storedKey && candidate !== candidates.envKey && isValidApiKey(candidate)
 ) ?? null;
 
+// src/vscode-gate-hooks.ts
+var isRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var runsTheGate = (entry) => typeof entry.command === "string" && (pusharyHookExecutable(entry.command)?.endsWith(CURSOR_GATE_SCRIPT) ?? false);
+var guardedEntry = (entry, command) => isRecord(entry) && runsTheGate(entry) ? { ...entry, command } : entry;
+var guardVsCodeGateHooks = (document, gateScript) => {
+  if (!isRecord(document) || !isRecord(document.hooks)) {
+    return { kind: "invalid", reason: "bundled VS Code hooks.json has no hooks map" };
+  }
+  const hooks = document.hooks;
+  const preToolUse = hooks.PreToolUse;
+  if (!Array.isArray(preToolUse) || preToolUse.length === 0) {
+    return { kind: "invalid", reason: "bundled VS Code hooks.json is missing a PreToolUse entry" };
+  }
+  const command = guardNodeScript(gateScript);
+  const guarded = Object.fromEntries(Object.entries(hooks).map(([event, entries]) => [event, Array.isArray(entries) ? entries.map((entry) => guardedEntry(entry, command)) : entries]));
+  return { kind: "guarded", document: { ...document, hooks: guarded } };
+};
+
 // src/setup/pairing-computer.ts
 var LOCAL_NETWORK_SUFFIX = /\.local$/i;
 var computerNameOfHost = (host) => host.replace(LOCAL_NETWORK_SUFFIX, "").trim() || null;
@@ -1308,16 +1324,11 @@ var resolveBundledVsCodePlugin = () => {
   ];
   return candidates.find((p) => existsSync(join3(p, ".claude-plugin", "plugin.json"))) ?? null;
 };
-var pinVsCodeGatePath = (pluginDir) => {
+var pinGuardedVsCodeGate = (pluginDir) => {
   const hooksPath = join3(pluginDir, "hooks", "hooks.json");
-  const data = readJson(hooksPath);
-  const entries = data.hooks?.PreToolUse;
-  if (!Array.isArray(entries) || entries.length === 0) {
-    throw new Error("bundled VS Code hooks.json is missing a PreToolUse entry");
-  }
-  const gate = join3(pluginDir, "scripts", "pushary-gate.mjs");
-  data.hooks.PreToolUse = entries.map((entry) => ({ ...entry, command: `node "${gate}"` }));
-  writeJson(hooksPath, data);
+  const guarded = guardVsCodeGateHooks(readJson(hooksPath), join3(pluginDir, "scripts", CURSOR_GATE_SCRIPT));
+  if (guarded.kind === "invalid") throw new Error(guarded.reason);
+  writeJson(hooksPath, guarded.document);
 };
 var registerVsCodePlugin = (pluginDir) => {
   const written = [];
@@ -1379,7 +1390,7 @@ var setupVsCode = async (apiKey) => {
       mcp.mcpServers = servers;
       writeJsonAtomic(mcpPath, mcp, KEY_FILE_MODE);
     }
-    pinVsCodeGatePath(VSCODE_PLUGIN_DIR);
+    pinGuardedVsCodeGate(VSCODE_PLUGIN_DIR);
   });
   let registration = { written: [], manual: [] };
   await spinner("Registering the plugin with VS Code", async () => {
@@ -1417,7 +1428,7 @@ var saveApiKey = async (apiKey, controlMode, transcriptSync) => {
   let result;
   await spinner("Saving your API key", async () => {
     result = writeKey(apiKey, {
-      ...controlMode === null ? {} : { controlMode },
+      controlMode,
       transcriptsEnabled: transcriptSync
     });
   });
@@ -1633,13 +1644,20 @@ var clearSetupChoiceDecline = (agent) => {
   const declined = declinedAgentForSetupChoice(agent);
   if (declined) clearDeclinedAgent(declined);
 };
+var APP_MCP_ENTRIES = {
+  claude_code: { file: () => CLAUDE_JSON, container: "mcpServers" },
+  gemini_cli: { file: () => GEMINI_SETTINGS, container: "mcpServers" },
+  cursor: { file: cursorUserMcp, container: "mcpServers" },
+  vscode: { file: () => VSCODE_PLUGIN_MCP, container: "mcpServers" },
+  opencode: { file: openCodeConfigFile, container: "mcp" }
+};
 var appMcpKeyFor = (agent) => {
   if (agent === "codex") {
     const auth = readCodexMcpAuth(readAgentToml(codexConfigToml()));
     return auth?.method === "embedded" ? auth.key : null;
   }
-  const file = agent === "claude_code" ? CLAUDE_JSON : agent === "gemini_cli" ? GEMINI_SETTINGS : agent === "cursor" ? cursorUserMcp() : agent === "vscode" ? VSCODE_PLUGIN_MCP : null;
-  return file ? mcpBearerKey(readAgentJson(file), "mcpServers", "headers") : null;
+  const entry = APP_MCP_ENTRIES[agent];
+  return entry ? mcpBearerKey(readAgentJson(entry.file()), entry.container, "headers") : null;
 };
 var appMcpKeyIfReadable = (agent) => {
   try {
@@ -2006,7 +2024,7 @@ var reportDryRun = (apiKey, agents, keyCheck, controlMode) => {
     apiKey ? `  ${dim("Key:")}        ${dim(`${apiKey.slice(0, 8)}...${apiKey.slice(-4)}`)} ${dim(`(${keyCheck?.kind ?? "not verified"})`)}` : `  ${dim("Key:")}        ${dim("none on this machine \u2014 a real run would acquire one")}`
   );
   console.log(`  ${dim("Key store:")}  ${PUSHARY_CONFIG_FILE}`);
-  console.log(`  ${dim("Control:")}    ${controlMode ?? "unchanged (legacy install)"}`);
+  console.log(`  ${dim("Control:")}    ${controlMode}`);
   const rc = resolveShellRc();
   console.log(`  ${dim("Shell rc:")}   ${rc ? rc.path : dim("none for this shell; the key would stay in Pushary's config only")}`);
   console.log();
@@ -2060,7 +2078,7 @@ var main = async () => {
 `);
     process.exit(EXIT.OK);
   }
-  const controlMode = effectiveControlMode(options, readControlMode(), existsSync(PUSHARY_CONFIG_FILE));
+  const controlMode = effectiveControlMode(options, readControlMode());
   recordSetupOptions(options);
   if (options.json) {
     jsonMode = true;