@pushary/agent-hooks 0.38.0 → 0.40.0

package/dist/bin/pushary-claude.js

@@ -1,6 +1,23 @@
 #!/usr/bin/env node
 import {
-  getApiKey
+  isDeferAnswer
+} from "../chunk-KQYIHZ5E.js";
+import {
+  askUser,
+  cancelQuestion,
+  deriveToolTarget,
+  describeToolCall,
+  fetchModeState,
+  getMachineId,
+  getPolicy,
+  resolvePolicy,
+  waitForAnswer
+} from "../chunk-AUEPQATK.js";
+import "../chunk-DWED7BS3.js";
+import "../chunk-Z5PL3K7C.js";
+import {
+  getApiKey,
+  getBaseUrl
 } from "../chunk-NKXSILEW.js";
 
 // src/wrapper/claudeBinary.ts
@@ -74,57 +91,500 @@ var runLocalPassthrough = (binary, args2) => {
   });
 };
 
+// src/wrapper/remoteMode.ts
+import { basename } from "path";
+
+// src/wrapper/sdkLoader.ts
+var userMessage = (text) => ({
+  type: "user",
+  message: { role: "user", content: text },
+  parent_tool_use_id: null
+});
+var loadClaudeSdk = async () => {
+  const specifier = "@anthropic-ai/claude-agent-sdk";
+  try {
+    const mod = await import(specifier);
+    if (typeof mod.query === "function") return mod;
+    if (mod.default && typeof mod.default.query === "function") return mod.default;
+    return null;
+  } catch {
+    return null;
+  }
+};
+
+// src/wrapper/messageQueue.ts
+var BoundedInputQueue = class {
+  buffer = [];
+  waiter;
+  closed = false;
+  cap;
+  onDrop;
+  pushedCount = 0;
+  deliveredCount = 0;
+  droppedCount = 0;
+  constructor(options = {}) {
+    this.cap = Math.max(1, options.cap ?? 32);
+    this.onDrop = options.onDrop;
+  }
+  push(item) {
+    if (this.closed) return;
+    this.pushedCount++;
+    if (this.waiter) {
+      const resolve = this.waiter;
+      this.waiter = void 0;
+      this.deliveredCount++;
+      resolve({ value: item, done: false });
+      return;
+    }
+    this.buffer.push(item);
+    while (this.buffer.length > this.cap) {
+      const dropped = this.buffer.shift();
+      this.droppedCount++;
+      this.onDrop?.(dropped, this.droppedCount);
+    }
+  }
+  // Mark done. Any parked consumer completes; further push() is ignored. The
+  // buffer is cleared so nothing is retained after shutdown.
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    this.buffer.length = 0;
+    if (this.waiter) {
+      const resolve = this.waiter;
+      this.waiter = void 0;
+      resolve({ value: void 0, done: true });
+    }
+  }
+  // End the CURRENT consumer without closing the queue, so a fresh query can
+  // attach after a restart and keep draining the same buffered items. Resolving
+  // the parked waiter as done lets the abandoned query's for-await unwind cleanly
+  // instead of hanging on a promise that would otherwise never settle.
+  detachConsumer() {
+    if (this.waiter) {
+      const resolve = this.waiter;
+      this.waiter = void 0;
+      resolve({ value: void 0, done: true });
+    }
+  }
+  get isClosed() {
+    return this.closed;
+  }
+  get bufferedCount() {
+    return this.buffer.length;
+  }
+  get stats() {
+    return { pushed: this.pushedCount, delivered: this.deliveredCount, dropped: this.droppedCount };
+  }
+  [Symbol.asyncIterator]() {
+    return {
+      next: () => {
+        if (this.buffer.length > 0) {
+          const value = this.buffer.shift();
+          this.deliveredCount++;
+          return Promise.resolve({ value, done: false });
+        }
+        if (this.closed) {
+          return Promise.resolve({ value: void 0, done: true });
+        }
+        if (this.waiter) {
+          return Promise.reject(
+            new Error("BoundedInputQueue: concurrent consumers are not supported")
+          );
+        }
+        return new Promise((resolve) => {
+          this.waiter = resolve;
+        });
+      },
+      return: () => {
+        this.close();
+        return Promise.resolve({ value: void 0, done: true });
+      }
+    };
+  }
+};
+
+// src/wrapper/approver.ts
+var DEFAULT_MAX_CONCURRENT = 16;
+var DEFAULT_APPROVAL_WINDOW_MS = 5 * 6e4;
+var MAX_APPROVAL_WINDOW_MS = 30 * 6e4;
+var allow = (input) => ({
+  behavior: "allow",
+  updatedInput: input
+});
+var deny = (message) => ({ behavior: "deny", message });
+var createRemoteApprover = (deps) => {
+  const fetchModeState2 = deps.fetchModeState ?? fetchModeState;
+  const getPolicy2 = deps.getPolicy ?? getPolicy;
+  const resolvePolicy2 = deps.resolvePolicy ?? resolvePolicy;
+  const askUser2 = deps.askUser ?? askUser;
+  const waitForAnswer2 = deps.waitForAnswer ?? waitForAnswer;
+  const cancelQuestion2 = deps.cancelQuestion ?? cancelQuestion;
+  const now = deps.now ?? (() => Date.now());
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const maxConcurrent = Math.max(1, deps.maxConcurrent ?? DEFAULT_MAX_CONCURRENT);
+  const pending = /* @__PURE__ */ new Set();
+  let tornDown = false;
+  const windowFor = (policy) => {
+    const base = policy.timeoutSeconds > 0 ? policy.timeoutSeconds * 1e3 : deps.approvalWindowMs ?? DEFAULT_APPROVAL_WINDOW_MS;
+    const ceiling = policy.timeoutAction === "wait" ? MAX_APPROVAL_WINDOW_MS : base;
+    return Math.min(Math.max(base, 15e3), Math.max(ceiling, 15e3));
+  };
+  const applyTimeout = (policy, input) => policy.timeoutAction === "approve" ? allow(input) : deny("No approval received in time");
+  const waitForPhone = async (entry, correlationId, windowMs) => {
+    const deadline = now() + windowMs;
+    while (now() < deadline && !entry.controller.signal.aborted) {
+      const remaining = Math.min(Math.max(deadline - now(), 1e3), 3e4);
+      const abortPromise = new Promise((resolve) => {
+        entry.controller.signal.addEventListener("abort", () => resolve({ answered: false, aborted: true }), {
+          once: true
+        });
+      });
+      let outcome;
+      try {
+        outcome = await Promise.race([
+          waitForAnswer2(deps.apiKey, correlationId, remaining),
+          abortPromise
+        ]);
+      } catch {
+        if (now() + 1e3 >= deadline) break;
+        await sleep(1e3);
+        continue;
+      }
+      if ("aborted" in outcome) return { answered: false };
+      if (outcome.answered) return outcome;
+      if (now() + 500 >= deadline) break;
+      await sleep(500);
+    }
+    return { answered: false };
+  };
+  const canUseTool = async (toolName, input, options) => {
+    if (toolName.startsWith("mcp__pushary__")) return allow(input);
+    if (tornDown) return deny("Remote session is shutting down");
+    if (pending.size >= maxConcurrent) {
+      deps.log?.(`[pushary] too many concurrent approvals (${pending.size}); denying ${toolName}`);
+      return deny("Too many pending approvals; try again");
+    }
+    const controller = new AbortController();
+    const entry = { controller };
+    pending.add(entry);
+    const outerAbort = () => controller.abort();
+    if (options?.signal) {
+      if (options.signal.aborted) controller.abort();
+      else options.signal.addEventListener("abort", outerAbort, { once: true });
+    }
+    try {
+      const sessionId = deps.getSessionId?.();
+      const modeState = await fetchModeState2(deps.apiKey, sessionId);
+      if (modeState.kill) return deny("Stopped by user \u2014 this agent was halted from Pushary");
+      const policyConfig = await getPolicy2(deps.apiKey, modeState.policyVersion);
+      const policy = resolvePolicy2(policyConfig, toolName, modeState.mode, input);
+      if (policy.timeoutSeconds === 0 && policy.timeoutAction === "approve") return allow(input);
+      if (policy.timeoutSeconds === 0 && policy.timeoutAction === "deny") {
+        return deny(`Denied by policy for ${policy.tool}`);
+      }
+      const description = describeToolCall(toolName, input, "hook");
+      const toolTarget = deriveToolTarget(toolName, input);
+      let question;
+      try {
+        question = await askUser2(deps.apiKey, {
+          question: `Allow ${description}?`,
+          type: "confirm",
+          context: `Your agent wants to run this in ${deps.projectName} (you are away)`,
+          agentName: `Claude Code - ${deps.projectName}`,
+          sessionId,
+          machineId: deps.machineId,
+          toolName,
+          toolTarget
+        });
+      } catch {
+        return applyTimeout(policy, input);
+      }
+      entry.correlationId = question.correlationId;
+      if (question.noDevices) return applyTimeout(policy, input);
+      const answer = await waitForPhone(entry, question.correlationId, windowFor(policy));
+      if (answer.answered) {
+        if (isDeferAnswer(answer.value)) return deny("Deferred \u2014 handle it on the machine");
+        return answer.value === "yes" ? allow(input) : deny("Denied from your phone");
+      }
+      return applyTimeout(policy, input);
+    } catch {
+      return deny("Approval unavailable; denied by default");
+    } finally {
+      if (options?.signal) options.signal.removeEventListener("abort", outerAbort);
+      pending.delete(entry);
+    }
+  };
+  const teardown = () => {
+    tornDown = true;
+    for (const entry of pending) {
+      entry.controller.abort();
+      if (entry.correlationId) {
+        void cancelQuestion2(deps.apiKey, entry.correlationId).catch(() => {
+        });
+      }
+    }
+    pending.clear();
+  };
+  return {
+    canUseTool,
+    teardown,
+    pendingCount: () => pending.size
+  };
+};
+
+// src/wrapper/drainClient.ts
+var drainPendingCommand = async (apiKey, sessionId, signal, baseUrl = getBaseUrl()) => {
+  try {
+    const response = await fetch(`${baseUrl}/api/agent/command/drain`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${apiKey}`
+      },
+      body: JSON.stringify(sessionId ? { sessionId } : {}),
+      signal
+    });
+    if (!response.ok) return null;
+    const data = await response.json();
+    return typeof data.command === "string" && data.command.length > 0 ? data.command : null;
+  } catch {
+    return null;
+  }
+};
+
 // src/wrapper/commandPoller.ts
-var FAST_POLL_MS = 2e3;
 var SLOW_POLL_MS = 3e4;
-var isEnabled = () => {
-  const flag = process.env.PUSHARY_WRAPPER_POLL;
-  return flag === "1" || flag === "true";
-};
+var FAST_POLL_MS = 2e3;
+var FAST_DECAY_TICKS = 3;
+var MAX_ERROR_BACKOFF_MS = 12e4;
+var MAX_ERROR_STREAK = 6;
+var REQUEST_TIMEOUT_MS = 1e4;
 var startCommandPoller = (opts) => {
+  const drain = opts.drain ?? drainPendingCommand;
+  const slow = opts.slowPollMs ?? SLOW_POLL_MS;
+  const fast = opts.fastPollMs ?? FAST_POLL_MS;
+  const requestTimeout = opts.requestTimeoutMs ?? REQUEST_TIMEOUT_MS;
   let stopped = false;
   let timer;
-  if (!isEnabled()) return { stop() {
-  } };
-  try {
-    getApiKey();
-  } catch {
-    return { stop() {
-    } };
-  }
+  let inflight;
+  let idleTicks = 0;
+  let errorStreak = 0;
+  const jitter = (ms) => {
+    const r = opts.jitter ? opts.jitter() : Math.random();
+    return Math.max(1, Math.round(ms * (0.85 + r * 0.3)));
+  };
+  const nextDelay = () => {
+    if (errorStreak > 0) {
+      return Math.min(slow * 2 ** (errorStreak - 1), MAX_ERROR_BACKOFF_MS);
+    }
+    return idleTicks >= FAST_DECAY_TICKS ? slow : fast;
+  };
   const schedule = (delayMs) => {
     if (stopped) return;
-    timer = setTimeout(tick, delayMs);
+    timer = setTimeout(tick, jitter(delayMs));
   };
   const tick = async () => {
     if (stopped) return;
-    let next = SLOW_POLL_MS;
+    const controller = new AbortController();
+    inflight = controller;
+    const timeout = setTimeout(() => controller.abort(), requestTimeout);
     try {
-      const command = await drainPendingCommand(opts.sessionId);
+      const command = await drain(opts.apiKey, opts.getSessionId?.(), controller.signal);
+      errorStreak = 0;
       if (command) {
-        next = FAST_POLL_MS;
-        opts.onCommand(command);
+        idleTicks = 0;
+        try {
+          opts.onCommand(command);
+        } catch {
+        }
+      } else {
+        idleTicks++;
       }
     } catch {
+      errorStreak = Math.min(errorStreak + 1, MAX_ERROR_STREAK);
+    } finally {
+      clearTimeout(timeout);
+      inflight = void 0;
     }
-    schedule(next);
+    schedule(nextDelay());
   };
-  opts.log?.("[pushary] wrapper command poller enabled (experimental)");
-  schedule(SLOW_POLL_MS);
+  schedule(fast);
+  opts.log?.("[pushary] wrapper command poller active (experimental)");
   return {
     stop() {
       stopped = true;
       if (timer) clearTimeout(timer);
+      inflight?.abort();
+      inflight = void 0;
     }
   };
 };
-var drainPendingCommand = async (_sessionId) => {
-  return null;
+
+// src/wrapper/remoteLoop.ts
+var errMsg = (err) => err instanceof Error ? err.message : String(err);
+var DEFAULT_MAX_RESTARTS = 5;
+var runRemoteLoop = async (deps) => {
+  const maxRestarts = deps.maxRestarts ?? DEFAULT_MAX_RESTARTS;
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const backoff = deps.backoffMs ?? ((attempt) => Math.min(1e3 * 2 ** attempt, 15e3));
+  let resumeId = deps.initialResume;
+  let totalCost = 0;
+  let restarts = 0;
+  while (!deps.signal.aborted) {
+    deps.input.detachConsumer();
+    let query;
+    try {
+      query = deps.sdk.query({
+        prompt: deps.input,
+        options: {
+          resume: resumeId,
+          permissionMode: deps.permissionMode,
+          canUseTool: deps.canUseTool,
+          env: deps.env,
+          cwd: deps.cwd
+        }
+      });
+    } catch (err) {
+      deps.log?.(`[pushary] remote mode: query failed to start: ${errMsg(err)}`);
+      return { exitCode: 1, totalCostUsd: totalCost };
+    }
+    const onAbort = () => {
+      deps.input.close();
+      void query.interrupt?.().catch(() => {
+      });
+    };
+    if (deps.signal.aborted) onAbort();
+    else deps.signal.addEventListener("abort", onAbort, { once: true });
+    try {
+      for await (const message of query) {
+        if (message.type === "system" && message.subtype === "init" && typeof message.session_id === "string") {
+          resumeId = message.session_id;
+          deps.onSessionId?.(resumeId);
+        }
+        if (message.type === "result" && typeof message.total_cost_usd === "number") {
+          totalCost = message.total_cost_usd;
+          deps.onCost?.(totalCost);
+        }
+      }
+      deps.signal.removeEventListener("abort", onAbort);
+      return { exitCode: deps.signal.aborted ? 130 : 0, totalCostUsd: totalCost };
+    } catch (err) {
+      deps.signal.removeEventListener("abort", onAbort);
+      if (deps.signal.aborted) return { exitCode: 130, totalCostUsd: totalCost };
+      restarts++;
+      if (restarts > maxRestarts) {
+        deps.log?.(`[pushary] remote mode: too many restarts, giving up: ${errMsg(err)}`);
+        return { exitCode: 1, totalCostUsd: totalCost };
+      }
+      deps.log?.(
+        `[pushary] remote mode: transient error, resuming session (attempt ${restarts}/${maxRestarts}): ${errMsg(err)}`
+      );
+      await sleep(backoff(restarts));
+    }
+  }
+  return { exitCode: 130, totalCostUsd: totalCost };
+};
+
+// src/wrapper/args.ts
+var resolveClaudeArgs = (argv) => {
+  const rest = argv.slice(2);
+  return rest[0] === "claude" ? rest.slice(1) : rest;
+};
+var flagValue = (args2, index) => {
+  const inline = args2[index];
+  const eq = inline?.indexOf("=") ?? -1;
+  if (inline && eq > 0) return inline.slice(eq + 1);
+  const next = args2[index + 1];
+  return next && !next.startsWith("-") ? next : void 0;
+};
+var parseRemoteArgs = (args2) => {
+  let initialPrompt;
+  let resume;
+  let permissionMode;
+  for (let i = 0; i < args2.length; i++) {
+    const arg = args2[i];
+    if (arg === "-p" || arg === "--print" || arg?.startsWith("--print=")) {
+      initialPrompt = flagValue(args2, i);
+    } else if (arg === "-r" || arg === "--resume" || arg?.startsWith("--resume=")) {
+      resume = flagValue(args2, i);
+    } else if (arg === "--permission-mode" || arg?.startsWith("--permission-mode=")) {
+      permissionMode = flagValue(args2, i);
+    }
+  }
+  return { initialPrompt, resume, permissionMode };
 };
 
 // src/wrapper/remoteMode.ts
-var runRemoteMode = async (_binary, _args) => {
-  return { implemented: false };
+var INPUT_QUEUE_CAP = 32;
+var runRemoteMode = async (_binary, args2) => {
+  let apiKey;
+  try {
+    apiKey = getApiKey();
+  } catch {
+    process.stderr.write(
+      "[pushary] remote mode needs an API key. Run `npx @pushary/agent-hooks setup`. Running the normal passthrough for now.\n"
+    );
+    return { implemented: false };
+  }
+  const sdk = await loadClaudeSdk();
+  if (!sdk) {
+    process.stderr.write(
+      "[pushary] remote mode needs the Claude Agent SDK, which is not installed. Enable it with:\n  npm i -g @anthropic-ai/claude-agent-sdk@0.3.207\nRunning the normal passthrough for now.\n"
+    );
+    return { implemented: false };
+  }
+  const projectName = basename(process.cwd());
+  const machineId = getMachineId();
+  const controller = new AbortController();
+  let sessionId;
+  const input = new BoundedInputQueue({
+    cap: INPUT_QUEUE_CAP,
+    onDrop: (_dropped, total) => process.stderr.write(`[pushary] input queue full; dropped ${total} stale instruction(s)
+`)
+  });
+  const approver = createRemoteApprover({
+    apiKey,
+    machineId,
+    projectName,
+    getSessionId: () => sessionId
+  });
+  const poller = startCommandPoller({
+    apiKey,
+    getSessionId: () => sessionId,
+    onCommand: (command) => input.push(userMessage(command)),
+    log: (message) => process.stderr.write(`${message}
+`)
+  });
+  const signals = ["SIGINT", "SIGTERM", "SIGHUP"];
+  const onSignal = () => controller.abort();
+  for (const signal of signals) process.on(signal, onSignal);
+  const { initialPrompt, resume, permissionMode } = parseRemoteArgs(args2);
+  try {
+    if (initialPrompt) input.push(userMessage(initialPrompt));
+    const result = await runRemoteLoop({
+      sdk,
+      input,
+      canUseTool: approver.canUseTool,
+      signal: controller.signal,
+      permissionMode,
+      initialResume: resume,
+      // The SDK REPLACES the subprocess env, so spread process.env and set the
+      // recursion guard so a wrapper-spawned claude cannot re-enter the wrapper.
+      env: { ...process.env, [WRAPPER_ACTIVE_ENV]: "1" },
+      cwd: process.cwd(),
+      onSessionId: (id) => {
+        sessionId = id;
+      },
+      log: (message) => process.stderr.write(`${message}
+`)
+    });
+    return { implemented: true, exitCode: result.exitCode };
+  } finally {
+    for (const signal of signals) process.off(signal, onSignal);
+    poller.stop();
+    approver.teardown();
+    input.close();
+  }
 };
 
 // src/wrapper/runClaudeWrapper.ts
@@ -144,24 +604,7 @@ var runClaudeWrapper = async (args2) => {
     } catch {
     }
   }
-  const poller = nested ? { stop() {
-  } } : startCommandPoller({
-    onCommand: () => {
-    },
-    log: (m) => process.stderr.write(`${m}
-`)
-  });
-  try {
-    return await runLocalPassthrough(binary, args2);
-  } finally {
-    poller.stop();
-  }
-};
-
-// src/wrapper/args.ts
-var resolveClaudeArgs = (argv) => {
-  const rest = argv.slice(2);
-  return rest[0] === "claude" ? rest.slice(1) : rest;
+  return runLocalPassthrough(binary, args2);
 };
 
 // bin/pushary-claude.ts

package/dist/bin/pushary-codex-hook.js

@@ -6,19 +6,10 @@ import {
 import {
   CODEX_AGENT,
   DEFAULT_SESSION,
-  askUser,
-  cancelQuestion,
   codexAllow,
   codexDeny,
   codexPass,
-  deriveActionBody,
-  deriveBlocker,
-  deriveToolTarget,
   describeApplyPatch,
-  describeToolCall,
-  fetchModeState,
-  getMachineId,
-  getPolicy,
   handlePostToolUse,
   handleStop,
   handleUserPrompt,
@@ -26,13 +17,24 @@ import {
   preToolUseTimeoutDecision,
   readLastPrompt,
   reportEvent,
-  resolvePolicy,
   savePendingQuestion,
-  sendNotification,
   toCodexWire,
-  toPolicyLookup,
+  toPolicyLookup
+} from "../chunk-V2WKECMG.js";
+import {
+  askUser,
+  cancelQuestion,
+  deriveActionBody,
+  deriveBlocker,
+  deriveToolTarget,
+  describeToolCall,
+  fetchModeState,
+  getMachineId,
+  getPolicy,
+  resolvePolicy,
+  sendNotification,
   waitForAnswer
-} from "../chunk-JHN3H6LX.js";
+} from "../chunk-AUEPQATK.js";
 import {
   isGatingMoment,
   recordKeylessMoment

package/dist/bin/pushary-codex.js

@@ -1,10 +1,12 @@
 #!/usr/bin/env node
+import {
+  reportEvent
+} from "../chunk-V2WKECMG.js";
 import {
   askUser,
   getMachineId,
-  reportEvent,
   waitForAnswer
-} from "../chunk-JHN3H6LX.js";
+} from "../chunk-AUEPQATK.js";
 import "../chunk-DWED7BS3.js";
 import "../chunk-Z5PL3K7C.js";
 import {

package/dist/bin/pushary-doctor.js

@@ -148,14 +148,22 @@ var main = async () => {
   const settings = readJson(CLAUDE_SETTINGS);
   if (settings) {
     const hooks = settings.hooks;
-    const hasPreHook = JSON.stringify(hooks?.PreToolUse ?? []).includes("pushary-hook");
-    const hasPostHook = JSON.stringify(hooks?.PostToolUse ?? []).includes("pushary-post-hook");
-    const hasStopHook = JSON.stringify(hooks?.Stop ?? []).includes("pushary-stop-hook");
-    const hasPromptHook = JSON.stringify(hooks?.UserPromptSubmit ?? []).includes("pushary-prompt-hook");
-    check(hasPreHook, "Claude Code: PreToolUse hook");
-    check(hasPostHook, "Claude Code: PostToolUse hook");
-    check(hasStopHook, "Claude Code: Stop hook");
-    check(hasPromptHook, "Claude Code: UserPromptSubmit hook", hasPromptHook ? void 0 : "missing, re-run setup to register it");
+    const CLAUDE_HOOK_CHECKS = [
+      { event: "PreToolUse", needle: "pushary-hook", label: "PreToolUse hook" },
+      { event: "PostToolUse", needle: "pushary-post-hook", label: "PostToolUse hook" },
+      { event: "UserPromptSubmit", needle: "pushary-prompt-hook", label: "UserPromptSubmit hook" },
+      { event: "Stop", needle: "pushary-stop-hook", label: "Stop hook" },
+      { event: "StopFailure", needle: "pushary-stopfailure-hook", label: "StopFailure hook" },
+      { event: "Notification", needle: "pushary-notification-hook", label: "Notification hook" },
+      { event: "SessionStart", needle: "pushary-session-start-hook", label: "SessionStart hook" },
+      { event: "SessionEnd", needle: "pushary-session-end-hook", label: "SessionEnd hook" },
+      { event: "PermissionRequest", needle: "pushary-permission-hook", label: "PermissionRequest hook" },
+      { event: "PermissionDenied", needle: "pushary-permission-denied-hook", label: "PermissionDenied hook" }
+    ];
+    for (const { event, needle, label } of CLAUDE_HOOK_CHECKS) {
+      const present = JSON.stringify(hooks?.[event] ?? []).includes(needle);
+      check(present, `Claude Code: ${label}`, present ? void 0 : "missing \u2014 run npx @pushary/agent-hooks@latest upgrade");
+    }
     const preHookCommand = extractHookCommand(hooks?.PreToolUse, "pushary-hook");
     if (preHookCommand) {
       const resolves = commandResolves(preHookCommand);