@pushary/agent-hooks 0.43.0 → 0.44.0

package/dist/bin/pushary-claude.js

@@ -10,9 +10,10 @@ import {
   fetchModeState,
   getMachineId,
   getPolicy,
+  reportEvent,
   resolvePolicy,
   waitForAnswer
-} from "../chunk-ETDXSKR5.js";
+} from "../chunk-VZNP4R5I.js";
 import "../chunk-DWED7BS3.js";
 import "../chunk-Z5PL3K7C.js";
 import {
@@ -932,6 +933,21 @@ var runRemoteMode = async (binary, args2) => {
   let sessionId;
   let killed = false;
   let totalCostUsd = 0;
+  const agentName = `Claude Code - ${projectName}`;
+  const announcePresence = (event, action) => {
+    if (!sessionId) return Promise.resolve();
+    return reportEvent(
+      { event, agentType: "claude_code", agentName, action, sessionId, machineId },
+      { maxAttempts: 2, timeoutMs: 4e3 }
+    ).then(() => {
+    }).catch(() => {
+    });
+  };
+  const presenceTimer = setInterval(
+    () => void announcePresence("stop", "Standing by for phone commands"),
+    5 * 6e4
+  );
+  presenceTimer.unref?.();
   const input = new BoundedInputQueue({
     cap: INPUT_QUEUE_CAP,
     onDrop: (_dropped, total) => process.stderr.write(`[pushary] input queue full; dropped ${total} stale instruction(s)
@@ -1009,6 +1025,7 @@ var runRemoteMode = async (binary, args2) => {
       onSessionId: (id) => {
         sessionId = id;
         relay?.reannounce();
+        void announcePresence("session_start", "Remote session ready \u2014 reachable from your phone");
       },
       onCost: (usd) => {
         totalCostUsd = usd;
@@ -1025,10 +1042,12 @@ var runRemoteMode = async (binary, args2) => {
     return { implemented: true, exitCode: result.exitCode };
   } finally {
     for (const signal of signals) process.off(signal, onSignal);
+    clearInterval(presenceTimer);
     relay?.stop();
     poller.stop();
     approver.teardown();
     input.close();
+    await announcePresence("session_closed", "Remote session ended");
     if (totalCostUsd > 0) {
       process.stderr.write(`[pushary] remote session cost: $${totalCostUsd.toFixed(4)}
 `);

package/dist/bin/pushary-codex-hook.js

@@ -6,10 +6,19 @@ import {
 import {
   CODEX_AGENT,
   DEFAULT_SESSION,
+  askUser,
+  cancelQuestion,
   codexAllow,
   codexDeny,
   codexPass,
+  deriveActionBody,
+  deriveBlocker,
+  deriveToolTarget,
   describeApplyPatch,
+  describeToolCall,
+  fetchModeState,
+  getMachineId,
+  getPolicy,
   handlePostToolUse,
   handleStop,
   handleUserPrompt,
@@ -17,24 +26,13 @@ import {
   preToolUseTimeoutDecision,
   readLastPrompt,
   reportEvent,
-  savePendingQuestion,
-  toCodexWire,
-  toPolicyLookup
-} from "../chunk-NRCQ5UUR.js";
-import {
-  askUser,
-  cancelQuestion,
-  deriveActionBody,
-  deriveBlocker,
-  deriveToolTarget,
-  describeToolCall,
-  fetchModeState,
-  getMachineId,
-  getPolicy,
   resolvePolicy,
+  savePendingQuestion,
   sendNotification,
+  toCodexWire,
+  toPolicyLookup,
   waitForAnswer
-} from "../chunk-ETDXSKR5.js";
+} from "../chunk-VZNP4R5I.js";
 import {
   isGatingMoment,
   recordKeylessMoment

package/dist/bin/pushary-codex.js

@@ -1,12 +1,10 @@
 #!/usr/bin/env node
-import {
-  reportEvent
-} from "../chunk-NRCQ5UUR.js";
 import {
   askUser,
   getMachineId,
+  reportEvent,
   waitForAnswer
-} from "../chunk-ETDXSKR5.js";
+} from "../chunk-VZNP4R5I.js";
 import "../chunk-DWED7BS3.js";
 import "../chunk-Z5PL3K7C.js";
 import {

package/dist/bin/pushary-gemini-hook.js

@@ -5,15 +5,6 @@ import {
 } from "../chunk-KQYIHZ5E.js";
 import {
   DEFAULT_SESSION,
-  handlePostToolUse,
-  handleStop,
-  handleUserPrompt,
-  readLastPrompt,
-  readLastUserPrompt,
-  reportEvent,
-  savePendingQuestion
-} from "../chunk-NRCQ5UUR.js";
-import {
   askUser,
   cancelQuestion,
   deriveActionBody,
@@ -23,10 +14,17 @@ import {
   fetchModeState,
   getMachineId,
   getPolicy,
+  handlePostToolUse,
+  handleStop,
+  handleUserPrompt,
+  readLastPrompt,
+  readLastUserPrompt,
+  reportEvent,
   resolvePolicy,
+  savePendingQuestion,
   sendNotification,
   waitForAnswer
-} from "../chunk-ETDXSKR5.js";
+} from "../chunk-VZNP4R5I.js";
 import {
   isGatingMoment,
   recordKeylessMoment

package/dist/bin/pushary-hook.js

@@ -1,11 +1,10 @@
 #!/usr/bin/env node
 import {
   handlePreToolUse
-} from "../chunk-V2TSLWTV.js";
+} from "../chunk-E3Q3KYZF.js";
 import "../chunk-7EW3USQF.js";
 import "../chunk-KQYIHZ5E.js";
-import "../chunk-NRCQ5UUR.js";
-import "../chunk-ETDXSKR5.js";
+import "../chunk-VZNP4R5I.js";
 import "../chunk-R5AJNXZS.js";
 import "../chunk-DWED7BS3.js";
 import "../chunk-Z5PL3K7C.js";

package/dist/bin/pushary-notification-hook.js

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import {
   handleNotification
-} from "../chunk-NRCQ5UUR.js";
-import "../chunk-ETDXSKR5.js";
+} from "../chunk-VZNP4R5I.js";
 import "../chunk-DWED7BS3.js";
 import "../chunk-Z5PL3K7C.js";
 import "../chunk-NKXSILEW.js";

package/dist/bin/pushary-permission-denied-hook.js

@@ -1,11 +1,10 @@
 #!/usr/bin/env node
 import {
   handlePermissionDenied
-} from "../chunk-V2TSLWTV.js";
+} from "../chunk-E3Q3KYZF.js";
 import "../chunk-7EW3USQF.js";
 import "../chunk-KQYIHZ5E.js";
-import "../chunk-NRCQ5UUR.js";
-import "../chunk-ETDXSKR5.js";
+import "../chunk-VZNP4R5I.js";
 import "../chunk-R5AJNXZS.js";
 import "../chunk-DWED7BS3.js";
 import "../chunk-Z5PL3K7C.js";

package/dist/bin/pushary-permission-hook.js

@@ -1,11 +1,10 @@
 #!/usr/bin/env node
 import {
   handlePermissionRequest
-} from "../chunk-V2TSLWTV.js";
+} from "../chunk-E3Q3KYZF.js";
 import "../chunk-7EW3USQF.js";
 import "../chunk-KQYIHZ5E.js";
-import "../chunk-NRCQ5UUR.js";
-import "../chunk-ETDXSKR5.js";
+import "../chunk-VZNP4R5I.js";
 import "../chunk-R5AJNXZS.js";
 import "../chunk-DWED7BS3.js";
 import "../chunk-Z5PL3K7C.js";

package/dist/bin/pushary-post-hook.js

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import {
   handlePostToolUse
-} from "../chunk-NRCQ5UUR.js";
-import "../chunk-ETDXSKR5.js";
+} from "../chunk-VZNP4R5I.js";
 import "../chunk-DWED7BS3.js";
 import "../chunk-Z5PL3K7C.js";
 import "../chunk-NKXSILEW.js";

package/dist/bin/pushary-prompt-hook.js

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import {
   handleUserPrompt
-} from "../chunk-NRCQ5UUR.js";
-import "../chunk-ETDXSKR5.js";
+} from "../chunk-VZNP4R5I.js";
 import "../chunk-DWED7BS3.js";
 import "../chunk-Z5PL3K7C.js";
 import "../chunk-NKXSILEW.js";

package/dist/bin/pushary-session-end-hook.js

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import {
   handleSessionEnd
-} from "../chunk-NRCQ5UUR.js";
-import "../chunk-ETDXSKR5.js";
+} from "../chunk-VZNP4R5I.js";
 import "../chunk-DWED7BS3.js";
 import "../chunk-Z5PL3K7C.js";
 import "../chunk-NKXSILEW.js";

package/dist/bin/pushary-session-start-hook.js

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import {
   handleSessionStart
-} from "../chunk-NRCQ5UUR.js";
-import "../chunk-ETDXSKR5.js";
+} from "../chunk-VZNP4R5I.js";
 import "../chunk-DWED7BS3.js";
 import "../chunk-Z5PL3K7C.js";
 import "../chunk-NKXSILEW.js";

package/dist/bin/pushary-setup.js

@@ -24,8 +24,7 @@ import {
 } from "../chunk-7EW3USQF.js";
 import {
   reportEvent
-} from "../chunk-NRCQ5UUR.js";
-import "../chunk-ETDXSKR5.js";
+} from "../chunk-VZNP4R5I.js";
 import "../chunk-DWED7BS3.js";
 import {
   isValidApiKey

package/dist/bin/pushary-stop-hook.js

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import {
   handleStop
-} from "../chunk-NRCQ5UUR.js";
-import "../chunk-ETDXSKR5.js";
+} from "../chunk-VZNP4R5I.js";
 import "../chunk-DWED7BS3.js";
 import "../chunk-Z5PL3K7C.js";
 import "../chunk-NKXSILEW.js";

package/dist/bin/pushary-stopfailure-hook.js

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import {
   handleStopFailure
-} from "../chunk-NRCQ5UUR.js";
-import "../chunk-ETDXSKR5.js";
+} from "../chunk-VZNP4R5I.js";
 import "../chunk-DWED7BS3.js";
 import "../chunk-Z5PL3K7C.js";
 import "../chunk-NKXSILEW.js";

package/dist/{chunk-V2TSLWTV.js → chunk-E3Q3KYZF.js}

@@ -7,12 +7,6 @@ import {
 } from "./chunk-KQYIHZ5E.js";
 import {
   DEFAULT_SESSION,
-  readLastPrompt,
-  readLastUserPrompt,
-  savePendingQuestion,
-  throttlePass
-} from "./chunk-NRCQ5UUR.js";
-import {
   askUser,
   cancelQuestion,
   deriveAction,
@@ -23,10 +17,14 @@ import {
   fetchModeState,
   getMachineId,
   getPolicy,
+  readLastPrompt,
+  readLastUserPrompt,
   resolvePolicy,
+  savePendingQuestion,
   sendNotification,
+  throttlePass,
   waitForAnswer
-} from "./chunk-ETDXSKR5.js";
+} from "./chunk-VZNP4R5I.js";
 import {
   isGatingMoment,
   recordKeylessMoment

package/dist/{chunk-NRCQ5UUR.js → chunk-VZNP4R5I.js}

@@ -1,39 +1,353 @@
 import {
-  cancelQuestion,
-  deriveReceiptMeta,
-  deriveToolTarget,
-  describeToolCall,
-  fetchModeState,
-  getMachineId,
-  isPolicyConfig,
-  isToolResultError,
-  resolveAutoResolveOrigin,
-  resolvePolicy,
-  sendNotification,
-  waitForAnswer
-} from "./chunk-ETDXSKR5.js";
-import {
+  callMcpTool,
   withRetry
 } from "./chunk-DWED7BS3.js";
+import {
+  ACTION_BODY_MAX,
+  DECISION_LINE_MAX,
+  extractPolicyArg,
+  isApprovalMode,
+  isSafeReadOnlyCommand,
+  matchRankWeight,
+  matchToolPattern,
+  redactSecrets,
+  redactSecretsDeep
+} from "./chunk-Z5PL3K7C.js";
 import {
   getApiKey,
   getBaseUrl
 } from "./chunk-NKXSILEW.js";
 
-// src/pending.ts
+// src/identity.ts
+import { createHash } from "crypto";
+import { hostname } from "os";
+var deriveMachineId = (host) => createHash("sha256").update(host).digest("hex").slice(0, 8);
+var getMachineId = () => deriveMachineId(hostname());
+
+// src/policy.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync, readFileSync, writeFileSync } from "fs";
 import { join } from "path";
 import { tmpdir } from "os";
-import { existsSync, mkdirSync, writeFileSync, readdirSync, unlinkSync, rmSync, statSync } from "fs";
-var PENDING_DIR = join(tmpdir(), "pushary-pending");
+
+// src/validate.ts
+var isPolicyConfig = (data) => {
+  if (!data || typeof data !== "object") return false;
+  const d = data;
+  return Array.isArray(d.policies) && typeof d.defaultTimeoutSeconds === "number" && typeof d.defaultTimeoutAction === "string";
+};
+var isAskUserResponse = (data) => {
+  if (!data || typeof data !== "object") return false;
+  const d = data;
+  return typeof d.correlationId === "string" && typeof d.status === "string";
+};
+var isWaitForAnswerResponse = (data) => {
+  if (!data || typeof data !== "object") return false;
+  const d = data;
+  return typeof d.answered === "boolean";
+};
+
+// src/policy.ts
+var CACHE_TTL_MS = 60 * 1e3;
+var cacheFile = (apiKey) => {
+  const hash = createHash2("sha256").update(apiKey).digest("hex").slice(0, 12);
+  return join(tmpdir(), `pushary-policy-${hash}.json`);
+};
+var fetchPolicy = async (apiKey) => {
+  return withRetry(async () => {
+    const baseUrl = getBaseUrl();
+    const response = await fetch(`${baseUrl}/api/mcp/policy`, {
+      headers: { "Authorization": `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!response.ok) {
+      throw new Error(`Failed to fetch policy: ${response.status}`);
+    }
+    const raw = await response.json();
+    if (!isPolicyConfig(raw)) throw new Error("Invalid policy response");
+    return raw;
+  }, { maxAttempts: 2 });
+};
+var getPolicy = async (apiKey, expectedVersion) => {
+  const path = cacheFile(apiKey);
+  let staleCache = null;
+  if (existsSync(path)) {
+    try {
+      const stat = readFileSync(path, "utf-8");
+      const cached = JSON.parse(stat);
+      if (!isPolicyConfig(cached)) throw new Error("Corrupted cache");
+      const versionStale = expectedVersion != null && (cached._policyVersion ?? null) !== expectedVersion;
+      const ttlFresh = !cached._cachedAt || Date.now() - cached._cachedAt < CACHE_TTL_MS;
+      if (ttlFresh && !versionStale) {
+        return cached;
+      }
+      staleCache = cached;
+    } catch {
+    }
+  }
+  try {
+    const policy = await fetchPolicy(apiKey);
+    try {
+      writeFileSync(path, JSON.stringify({ ...policy, _cachedAt: Date.now(), _policyVersion: expectedVersion ?? null }), "utf-8");
+    } catch {
+    }
+    return policy;
+  } catch {
+    if (staleCache) return staleCache;
+    throw new Error("Failed to fetch policy and no cached policy available");
+  }
+};
+var findBestMatch = (policies, toolName, arg) => {
+  let best;
+  let bestWeight = 0;
+  let bestLength = -1;
+  for (const candidate of policies) {
+    const rank = matchToolPattern(candidate.tool, toolName, arg);
+    if (rank === "none") continue;
+    const weight = matchRankWeight(rank);
+    const length = rank === "prefix" ? candidate.tool.length : -1;
+    if (weight > bestWeight || weight === bestWeight && length > bestLength) {
+      best = { policy: candidate, rank };
+      bestWeight = weight;
+      bestLength = length;
+    }
+  }
+  return best;
+};
+var autoApprove = (tool) => ({
+  tool,
+  timeoutSeconds: 0,
+  timeoutAction: "approve",
+  mode: "terminal_only",
+  pushFirstSeconds: 0
+});
+var resolveAutoResolveOrigin = (config, toolName, toolInput) => {
+  const arg = toolInput ? extractPolicyArg(toolName, toolInput) : void 0;
+  const match = findBestMatch(config.policies, toolName, arg);
+  const governedBySpecificRule = match?.rank === "exact" || match?.rank === "prefix";
+  if (!governedBySpecificRule && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg)) {
+    return "safe_readonly";
+  }
+  return "policy_timeout";
+};
+var resolvePolicy = (config, toolName, modeOverride, toolInput) => {
+  const arg = toolInput ? extractPolicyArg(toolName, toolInput) : void 0;
+  const match = findBestMatch(config.policies, toolName, arg);
+  let base = match?.policy ?? config.policies.find((p) => p.tool === "*") ?? {
+    tool: toolName,
+    timeoutSeconds: config.defaultTimeoutSeconds,
+    timeoutAction: config.defaultTimeoutAction,
+    mode: config.defaultMode ?? "push_first",
+    pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
+  };
+  const governedBySpecificRule = match?.rank === "exact" || match?.rank === "prefix";
+  if (!governedBySpecificRule && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg)) {
+    base = autoApprove(base.tool);
+  }
+  const effectiveOverride = modeOverride ?? config.modeOverride;
+  if (effectiveOverride) {
+    return { ...base, mode: effectiveOverride };
+  }
+  return base;
+};
+var toPolicyVersion = (value) => typeof value === "string" || typeof value === "number" ? String(value) : null;
+var fetchModeState = async (apiKey, sessionId) => {
+  try {
+    const baseUrl = getBaseUrl();
+    const url = sessionId ? `${baseUrl}/api/mcp/mode?session=${encodeURIComponent(sessionId)}` : `${baseUrl}/api/mcp/mode`;
+    const response = await fetch(url, {
+      headers: { "Authorization": `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(3e3)
+    });
+    if (!response.ok) return { mode: null, kill: false, policyVersion: null, relayUrl: null };
+    const data = await response.json();
+    const mode = data.override?.mode;
+    return {
+      mode: isApprovalMode(mode) ? mode : null,
+      kill: data.kill === true,
+      policyVersion: toPolicyVersion(data.policyVersion),
+      relayUrl: typeof data.relayUrl === "string" && data.relayUrl.length > 0 ? data.relayUrl : null
+    };
+  } catch {
+    return { mode: null, kill: false, policyVersion: null, relayUrl: null };
+  }
+};
+var fetchModeOverride = async (apiKey) => (await fetchModeState(apiKey)).mode;
+
+// src/api.ts
+var askUser = async (apiKey, params, timeoutMs = 15e3) => {
+  const result = await callMcpTool(apiKey, "ask_user", { ...params, wait: false }, { maxRetries: 3, timeoutMs });
+  if (!isAskUserResponse(result)) throw new Error("Invalid ask_user response");
+  return result;
+};
+var waitForAnswer = async (apiKey, correlationId, timeoutMs = 3e4) => {
+  const result = await callMcpTool(apiKey, "wait_for_answer", {
+    correlationId,
+    timeoutMs
+  }, { timeoutMs: timeoutMs + 1e4 });
+  if (!isWaitForAnswerResponse(result)) throw new Error("Invalid wait_for_answer response");
+  return result;
+};
+var cancelQuestion = async (apiKey, correlationId) => {
+  await callMcpTool(apiKey, "cancel_question", { correlationId });
+};
+var sendNotification = async (apiKey, params, timeoutMs = 15e3) => {
+  await callMcpTool(apiKey, "send_notification", { ...params }, { maxRetries: 3, timeoutMs });
+};
+
+// src/describe.ts
+import { isAbsolute, relative } from "path";
+var hookPrefixes = {
+  Bash: (input) => `bash: ${input.command ?? "(no command)"}`,
+  PowerShell: (input) => `powershell: ${input.command ?? "(no command)"}`,
+  Monitor: (input) => `monitor: ${input.command ?? "(no command)"}`,
+  Write: (input) => `write file: ${input.file_path ?? "(unknown path)"}`,
+  Edit: (input) => `edit file: ${input.file_path ?? "(unknown path)"}`,
+  MultiEdit: (input) => `edit file: ${input.file_path ?? "(unknown path)"}`,
+  Read: (input) => `read file: ${input.file_path ?? "(unknown path)"}`
+};
+var describeTodoProgress = (todos) => {
+  if (!Array.isArray(todos)) return "updated the plan";
+  const items = todos.filter((t) => !!t && typeof t === "object");
+  const total = items.length;
+  if (total === 0) return "updated the plan";
+  const done = items.filter((t) => t.status === "completed").length;
+  const current = items.find((t) => t.status === "in_progress");
+  const label = current ? [current.activeForm, current.content].find((v) => typeof v === "string" && v.trim().length > 0) : void 0;
+  if (done >= total) return `finished all ${total} tasks`;
+  if (label) return `${label.trim()} (${done}/${total} done)`;
+  return `${done}/${total} tasks done`;
+};
+var eventPrefixes = {
+  Bash: (input) => `ran: ${String(input.command ?? "")}`,
+  PowerShell: (input) => `ran: ${String(input.command ?? "")}`,
+  Monitor: (input) => `ran: ${String(input.command ?? "")}`,
+  Write: (input) => `wrote: ${input.file_path ?? "unknown"}`,
+  Edit: (input) => `edited: ${input.file_path ?? "unknown"}`,
+  MultiEdit: (input) => `edited: ${input.file_path ?? "unknown"}`,
+  Read: (input) => `read: ${input.file_path ?? "unknown"}`,
+  TodoWrite: (input) => describeTodoProgress(input.todos)
+};
+var EVENT_ACTION_MAX = 120;
+var HOOK_FALLBACK_MAX = 200;
+var describeToolCall = (toolName, toolInput, format = "hook") => {
+  const prefixes = format === "hook" ? hookPrefixes : eventPrefixes;
+  const builder = prefixes[toolName];
+  const raw = builder ? builder(toolInput) : format === "hook" ? `${toolName}: ${JSON.stringify(toolInput)}` : `${toolName}: done`;
+  const redacted = redactSecrets(raw);
+  if (format === "event") return redacted.slice(0, EVENT_ACTION_MAX);
+  return builder ? redacted : redacted.slice(0, HOOK_FALLBACK_MAX);
+};
+var TOOL_TARGET_MAX_LENGTH = 80;
+var deriveCommandHead = (command) => {
+  if (typeof command !== "string") return void 0;
+  const head = command.trim().split(/\s+/).slice(0, 2).join(" ");
+  return head ? head.slice(0, TOOL_TARGET_MAX_LENGTH) : void 0;
+};
+var deriveToolTarget = (toolName, toolInput) => {
+  if (toolName === "Bash" || toolName === "PowerShell" || toolName === "Monitor") {
+    return deriveCommandHead(toolInput.command);
+  }
+  if (toolName === "Edit" || toolName === "Write" || toolName === "MultiEdit") {
+    const filePath = toolInput.file_path;
+    if (typeof filePath !== "string") return void 0;
+    const separator = Math.max(filePath.lastIndexOf("/"), filePath.lastIndexOf("\\"));
+    const base = filePath.slice(separator + 1);
+    const dot = base.lastIndexOf(".");
+    if (dot <= 0) return void 0;
+    return base.slice(dot).slice(0, TOOL_TARGET_MAX_LENGTH);
+  }
+  return void 0;
+};
+var RECEIPT_TARGET_MAX_LENGTH = 256;
+var isToolResultError = (toolResult) => {
+  try {
+    return Boolean(toolResult && ("error" in toolResult || "is_error" in toolResult));
+  } catch {
+    return false;
+  }
+};
+var relativizeReceiptPath = (filePath, cwd) => {
+  if (!cwd || !isAbsolute(filePath)) return filePath;
+  return relative(cwd, filePath);
+};
+var deriveReceiptMeta = (toolName, toolInput, toolResult, cwd) => {
+  try {
+    const ok = !isToolResultError(toolResult);
+    if (toolName === "Edit" || toolName === "Write" || toolName === "MultiEdit") {
+      const filePath = toolInput.file_path;
+      if (typeof filePath !== "string" || !filePath) return void 0;
+      return {
+        kind: toolName === "Write" ? "write" : "edit",
+        target: relativizeReceiptPath(filePath, cwd).slice(0, RECEIPT_TARGET_MAX_LENGTH),
+        ok
+      };
+    }
+    if (toolName === "Bash" || toolName === "PowerShell" || toolName === "Monitor") {
+      const head = deriveCommandHead(toolInput.command);
+      if (!head) return void 0;
+      return {
+        kind: head === "git commit" ? "commit" : "bash",
+        target: head,
+        ok
+      };
+    }
+    return void 0;
+  } catch {
+    return void 0;
+  }
+};
+var firstString = (...values) => values.find((v) => typeof v === "string" && v.length > 0);
+var ACTION_BODY_TRUNCATION_MARKER = "\n\u2026 [truncated]";
+var capActionBody = (text) => text.length <= ACTION_BODY_MAX ? text : `${text.slice(0, ACTION_BODY_MAX - ACTION_BODY_TRUNCATION_MARKER.length)}${ACTION_BODY_TRUNCATION_MARKER}`;
+var rawActionBody = (toolName, toolInput) => {
+  if (toolName === "Edit" || toolName === "replace") {
+    const before = firstString(toolInput.old_string);
+    const after = firstString(toolInput.new_string);
+    if (before === void 0 && after === void 0) return void 0;
+    return `- ${before ?? ""}
++ ${after ?? ""}`;
+  }
+  if (toolName === "Write" || toolName === "write_file") return firstString(toolInput.content);
+  if (toolName === "Bash" || toolName === "PowerShell" || toolName === "Monitor" || toolName === "run_shell_command" || toolName === "shell" || toolName === "apply_patch") {
+    return firstString(toolInput.command);
+  }
+  return void 0;
+};
+var deriveActionBody = (toolName, toolInput) => {
+  try {
+    const raw = rawActionBody(toolName, toolInput);
+    if (!raw) return void 0;
+    return capActionBody(redactSecretsDeep(raw));
+  } catch {
+    return void 0;
+  }
+};
+var deriveAction = (toolName, toolInput) => describeToolCall(toolName, toolInput, "hook").slice(0, DECISION_LINE_MAX);
+var BLOCKER_BY_MODE = {
+  push_only: "Approval required before this runs",
+  push_first: "Paused for your approval before continuing",
+  escalate: "Escalated to you after the approval timeout"
+};
+var deriveBlocker = (mode, reason) => {
+  const text = reason?.replace(/\s+/g, " ").trim() || BLOCKER_BY_MODE[mode] || "Waiting for your approval";
+  return text.slice(0, DECISION_LINE_MAX);
+};
+
+// src/pending.ts
+import { join as join2 } from "path";
+import { tmpdir as tmpdir2 } from "os";
+import { existsSync as existsSync2, mkdirSync, writeFileSync as writeFileSync2, readdirSync, unlinkSync, rmSync, statSync } from "fs";
+var PENDING_DIR = join2(tmpdir2(), "pushary-pending");
 var DEFAULT_SESSION = "_no_session";
 var GRACE_MS = 10 * 60 * 1e3;
 var sanitize = (sessionId) => sessionId.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 128) || DEFAULT_SESSION;
-var dirFor = (sessionId) => join(PENDING_DIR, sanitize(sessionId));
+var dirFor = (sessionId) => join2(PENDING_DIR, sanitize(sessionId));
 var isDefaultSession = (sessionId) => sanitize(sessionId) === DEFAULT_SESSION;
 var savePendingQuestion = (sessionId, correlationId) => {
   const dir = dirFor(sessionId);
-  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-  writeFileSync(join(dir, correlationId), "", "utf-8");
+  if (!existsSync2(dir)) mkdirSync(dir, { recursive: true });
+  writeFileSync2(join2(dir, correlationId), "", "utf-8");
 };
 var listPendingQuestions = (sessionId) => {
   const dir = dirFor(sessionId);
@@ -47,7 +361,7 @@ var listPendingQuestions = (sessionId) => {
   const cutoff = Date.now() - GRACE_MS;
   return files.filter((name) => {
     try {
-      return statSync(join(dir, name)).mtimeMs < cutoff;
+      return statSync(join2(dir, name)).mtimeMs < cutoff;
     } catch {
       return false;
     }
@@ -55,7 +369,7 @@ var listPendingQuestions = (sessionId) => {
 };
 var removePendingQuestion = (sessionId, correlationId) => {
   try {
-    unlinkSync(join(dirFor(sessionId), correlationId));
+    unlinkSync(join2(dirFor(sessionId), correlationId));
   } catch {
   }
 };
@@ -67,9 +381,9 @@ var removePendingSession = (sessionId) => {
 };
 
 // src/usage.ts
-import { closeSync, mkdirSync as mkdirSync2, openSync, readFileSync, readSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join as join2 } from "path";
-import { tmpdir as tmpdir2 } from "os";
+import { closeSync, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync2, readSync, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
+import { join as join3 } from "path";
+import { tmpdir as tmpdir3 } from "os";
 var DEFAULT_PRICES = [
   { match: "opus-4-1", in: 15, out: 75 },
   { match: "opus-4-0", in: 15, out: 75 },
@@ -104,12 +418,12 @@ var estimateCostUsd = (usage, model) => {
   const perTokenOut = price.out / 1e6;
   return usage.inputTokens * perTokenIn + usage.outputTokens * perTokenOut + usage.cacheCreationTokens * perTokenIn * CACHE_WRITE_MULTIPLIER + usage.cacheReadTokens * perTokenIn * CACHE_READ_MULTIPLIER;
 };
-var stateDir = () => process.env.PUSHARY_USAGE_DIR?.trim() || join2(tmpdir2(), "pushary-usage");
-var stateFile = (sessionId) => join2(stateDir(), sessionId.replace(/[^a-zA-Z0-9_-]/g, "_"));
+var stateDir = () => process.env.PUSHARY_USAGE_DIR?.trim() || join3(tmpdir3(), "pushary-usage");
+var stateFile = (sessionId) => join3(stateDir(), sessionId.replace(/[^a-zA-Z0-9_-]/g, "_"));
 var emptyState = () => ({ offset: 0, tokensIn: 0, tokensOut: 0, costUsd: 0, recentIds: [] });
 var readState = (path) => {
   try {
-    const parsed = JSON.parse(readFileSync(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync2(path, "utf-8"));
     if (typeof parsed.offset === "number" && parsed.offset >= 0 && typeof parsed.tokensIn === "number" && typeof parsed.tokensOut === "number" && typeof parsed.costUsd === "number" && Array.isArray(parsed.recentIds)) {
       return {
         offset: parsed.offset,
@@ -224,7 +538,7 @@ var readNewUsage = (transcriptPath, sessionId) => {
       }
     }
     mkdirSync2(stateDir(), { recursive: true });
-    writeFileSync2(path, JSON.stringify(state), "utf-8");
+    writeFileSync3(path, JSON.stringify(state), "utf-8");
     if (state.tokensIn === 0 && state.tokensOut === 0) return null;
     return {
       tokensIn: state.tokensIn,
@@ -316,18 +630,18 @@ var permissionTimeoutDecision = (timeoutAction) => {
 var preToolUseTimeoutDecision = (timeoutAction, denyReason = "No response within timeout") => timeoutAction === "deny" ? codexDeny(denyReason) : codexPass();
 
 // src/throttle.ts
-import { join as join3 } from "path";
-import { tmpdir as tmpdir3 } from "os";
-import { createHash } from "crypto";
-import { existsSync as existsSync2, mkdirSync as mkdirSync3, statSync as statSync3, writeFileSync as writeFileSync3 } from "fs";
-var THROTTLE_DIR = join3(tmpdir3(), "pushary-throttle");
-var markerPath = (key) => join3(THROTTLE_DIR, createHash("sha256").update(key).digest("hex").slice(0, 16));
+import { join as join4 } from "path";
+import { tmpdir as tmpdir4 } from "os";
+import { createHash as createHash3 } from "crypto";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
+var THROTTLE_DIR = join4(tmpdir4(), "pushary-throttle");
+var markerPath = (key) => join4(THROTTLE_DIR, createHash3("sha256").update(key).digest("hex").slice(0, 16));
 var throttlePass = (key, windowMs) => {
   try {
     const path = markerPath(key);
-    if (existsSync2(path) && Date.now() - statSync3(path).mtimeMs < windowMs) return false;
+    if (existsSync3(path) && Date.now() - statSync3(path).mtimeMs < windowMs) return false;
     mkdirSync3(THROTTLE_DIR, { recursive: true });
-    writeFileSync3(path, "", "utf-8");
+    writeFileSync4(path, "", "utf-8");
     return true;
   } catch {
     return false;
@@ -335,21 +649,21 @@ var throttlePass = (key, windowMs) => {
 };
 
 // src/events.ts
-import { basename, join as join4 } from "path";
-import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync2, statSync as statSync4, writeFileSync as writeFileSync4 } from "fs";
-import { tmpdir as tmpdir4 } from "os";
-var INTENT_DIR = join4(tmpdir4(), "pushary-intent");
+import { basename, join as join5 } from "path";
+import { createHash as createHash4 } from "crypto";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync3, statSync as statSync4, writeFileSync as writeFileSync5 } from "fs";
+import { tmpdir as tmpdir5 } from "os";
+var INTENT_DIR = join5(tmpdir5(), "pushary-intent");
 var INTENT_MAX_BYTES = 2048;
 var INTENT_GRACE_MS = 10 * 60 * 1e3;
 var sanitizeSession = (sessionId) => sessionId.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 128) || DEFAULT_SESSION;
-var intentFile = (sessionId) => join4(INTENT_DIR, sanitizeSession(sessionId));
+var intentFile = (sessionId) => join5(INTENT_DIR, sanitizeSession(sessionId));
 var saveLastPrompt = (sessionId, prompt) => {
   try {
     const trimmed = prompt.replace(/\s+/g, " ").trim().slice(0, INTENT_MAX_BYTES);
     if (!trimmed) return;
     mkdirSync4(INTENT_DIR, { recursive: true });
-    writeFileSync4(intentFile(sessionId), trimmed, "utf-8");
+    writeFileSync5(intentFile(sessionId), trimmed, "utf-8");
   } catch {
   }
 };
@@ -357,7 +671,7 @@ var readLastPrompt = (sessionId) => {
   try {
     const path = intentFile(sessionId);
     if (isDefaultSession(sessionId) && statSync4(path).mtimeMs < Date.now() - INTENT_GRACE_MS) return void 0;
-    const value = readFileSync2(path, "utf-8").trim();
+    const value = readFileSync3(path, "utf-8").trim();
     return value.length > 0 ? value : void 0;
   } catch {
     return void 0;
@@ -413,10 +727,10 @@ var notifyLateAnswers = async (apiKey, late, agentName, sessionId) => {
 var CLAUDE_CODE_AGENT = { type: "claude_code", label: "Claude Code" };
 var POLICY_CACHE_TTL_MS = 5 * 60 * 1e3;
 var readFreshCachedPolicy = (apiKey) => {
-  const hash = createHash2("sha256").update(apiKey).digest("hex").slice(0, 12);
-  const path = join4(tmpdir4(), `pushary-policy-${hash}.json`);
-  if (!existsSync3(path)) return null;
-  const cached = JSON.parse(readFileSync2(path, "utf-8"));
+  const hash = createHash4("sha256").update(apiKey).digest("hex").slice(0, 12);
+  const path = join5(tmpdir5(), `pushary-policy-${hash}.json`);
+  if (!existsSync4(path)) return null;
+  const cached = JSON.parse(readFileSync3(path, "utf-8"));
   if (!isPolicyConfig(cached)) return null;
   if (!cached._cachedAt || Date.now() - cached._cachedAt >= POLICY_CACHE_TTL_MS) return null;
   return cached;
@@ -773,6 +1087,20 @@ var handleStopFailure = async (input, agent = CLAUDE_CODE_AGENT) => {
 };
 
 export {
+  getMachineId,
+  getPolicy,
+  resolvePolicy,
+  fetchModeState,
+  fetchModeOverride,
+  askUser,
+  waitForAnswer,
+  cancelQuestion,
+  sendNotification,
+  describeToolCall,
+  deriveToolTarget,
+  deriveActionBody,
+  deriveAction,
+  deriveBlocker,
   DEFAULT_SESSION,
   savePendingQuestion,
   throttlePass,

package/dist/src/index.js

@@ -1,23 +1,21 @@
 import {
   handlePreToolUse
-} from "../chunk-V2TSLWTV.js";
+} from "../chunk-E3Q3KYZF.js";
 import "../chunk-7EW3USQF.js";
 import "../chunk-KQYIHZ5E.js";
-import {
-  handleNotification,
-  handlePostToolUse,
-  handleStop,
-  reportEvent
-} from "../chunk-NRCQ5UUR.js";
 import {
   askUser,
   cancelQuestion,
   fetchModeOverride,
   fetchModeState,
   getPolicy,
+  handleNotification,
+  handlePostToolUse,
+  handleStop,
+  reportEvent,
   resolvePolicy,
   waitForAnswer
-} from "../chunk-ETDXSKR5.js";
+} from "../chunk-VZNP4R5I.js";
 import "../chunk-R5AJNXZS.js";
 import "../chunk-DWED7BS3.js";
 import "../chunk-Z5PL3K7C.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.43.0",
+  "version": "0.44.0",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",

package/dist/chunk-ETDXSKR5.js

@@ -1,355 +0,0 @@
-import {
-  callMcpTool,
-  withRetry
-} from "./chunk-DWED7BS3.js";
-import {
-  ACTION_BODY_MAX,
-  DECISION_LINE_MAX,
-  extractPolicyArg,
-  isApprovalMode,
-  isSafeReadOnlyCommand,
-  matchRankWeight,
-  matchToolPattern,
-  redactSecrets,
-  redactSecretsDeep
-} from "./chunk-Z5PL3K7C.js";
-import {
-  getBaseUrl
-} from "./chunk-NKXSILEW.js";
-
-// src/identity.ts
-import { createHash } from "crypto";
-import { hostname } from "os";
-var deriveMachineId = (host) => createHash("sha256").update(host).digest("hex").slice(0, 8);
-var getMachineId = () => deriveMachineId(hostname());
-
-// src/policy.ts
-import { createHash as createHash2 } from "crypto";
-import { existsSync, readFileSync, writeFileSync } from "fs";
-import { join } from "path";
-import { tmpdir } from "os";
-
-// src/validate.ts
-var isPolicyConfig = (data) => {
-  if (!data || typeof data !== "object") return false;
-  const d = data;
-  return Array.isArray(d.policies) && typeof d.defaultTimeoutSeconds === "number" && typeof d.defaultTimeoutAction === "string";
-};
-var isAskUserResponse = (data) => {
-  if (!data || typeof data !== "object") return false;
-  const d = data;
-  return typeof d.correlationId === "string" && typeof d.status === "string";
-};
-var isWaitForAnswerResponse = (data) => {
-  if (!data || typeof data !== "object") return false;
-  const d = data;
-  return typeof d.answered === "boolean";
-};
-
-// src/policy.ts
-var CACHE_TTL_MS = 60 * 1e3;
-var cacheFile = (apiKey) => {
-  const hash = createHash2("sha256").update(apiKey).digest("hex").slice(0, 12);
-  return join(tmpdir(), `pushary-policy-${hash}.json`);
-};
-var fetchPolicy = async (apiKey) => {
-  return withRetry(async () => {
-    const baseUrl = getBaseUrl();
-    const response = await fetch(`${baseUrl}/api/mcp/policy`, {
-      headers: { "Authorization": `Bearer ${apiKey}` },
-      signal: AbortSignal.timeout(1e4)
-    });
-    if (!response.ok) {
-      throw new Error(`Failed to fetch policy: ${response.status}`);
-    }
-    const raw = await response.json();
-    if (!isPolicyConfig(raw)) throw new Error("Invalid policy response");
-    return raw;
-  }, { maxAttempts: 2 });
-};
-var getPolicy = async (apiKey, expectedVersion) => {
-  const path = cacheFile(apiKey);
-  let staleCache = null;
-  if (existsSync(path)) {
-    try {
-      const stat = readFileSync(path, "utf-8");
-      const cached = JSON.parse(stat);
-      if (!isPolicyConfig(cached)) throw new Error("Corrupted cache");
-      const versionStale = expectedVersion != null && (cached._policyVersion ?? null) !== expectedVersion;
-      const ttlFresh = !cached._cachedAt || Date.now() - cached._cachedAt < CACHE_TTL_MS;
-      if (ttlFresh && !versionStale) {
-        return cached;
-      }
-      staleCache = cached;
-    } catch {
-    }
-  }
-  try {
-    const policy = await fetchPolicy(apiKey);
-    try {
-      writeFileSync(path, JSON.stringify({ ...policy, _cachedAt: Date.now(), _policyVersion: expectedVersion ?? null }), "utf-8");
-    } catch {
-    }
-    return policy;
-  } catch {
-    if (staleCache) return staleCache;
-    throw new Error("Failed to fetch policy and no cached policy available");
-  }
-};
-var findBestMatch = (policies, toolName, arg) => {
-  let best;
-  let bestWeight = 0;
-  let bestLength = -1;
-  for (const candidate of policies) {
-    const rank = matchToolPattern(candidate.tool, toolName, arg);
-    if (rank === "none") continue;
-    const weight = matchRankWeight(rank);
-    const length = rank === "prefix" ? candidate.tool.length : -1;
-    if (weight > bestWeight || weight === bestWeight && length > bestLength) {
-      best = { policy: candidate, rank };
-      bestWeight = weight;
-      bestLength = length;
-    }
-  }
-  return best;
-};
-var autoApprove = (tool) => ({
-  tool,
-  timeoutSeconds: 0,
-  timeoutAction: "approve",
-  mode: "terminal_only",
-  pushFirstSeconds: 0
-});
-var resolveAutoResolveOrigin = (config, toolName, toolInput) => {
-  const arg = toolInput ? extractPolicyArg(toolName, toolInput) : void 0;
-  const match = findBestMatch(config.policies, toolName, arg);
-  const governedBySpecificRule = match?.rank === "exact" || match?.rank === "prefix";
-  if (!governedBySpecificRule && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg)) {
-    return "safe_readonly";
-  }
-  return "policy_timeout";
-};
-var resolvePolicy = (config, toolName, modeOverride, toolInput) => {
-  const arg = toolInput ? extractPolicyArg(toolName, toolInput) : void 0;
-  const match = findBestMatch(config.policies, toolName, arg);
-  let base = match?.policy ?? config.policies.find((p) => p.tool === "*") ?? {
-    tool: toolName,
-    timeoutSeconds: config.defaultTimeoutSeconds,
-    timeoutAction: config.defaultTimeoutAction,
-    mode: config.defaultMode ?? "push_first",
-    pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
-  };
-  const governedBySpecificRule = match?.rank === "exact" || match?.rank === "prefix";
-  if (!governedBySpecificRule && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg)) {
-    base = autoApprove(base.tool);
-  }
-  const effectiveOverride = modeOverride ?? config.modeOverride;
-  if (effectiveOverride) {
-    return { ...base, mode: effectiveOverride };
-  }
-  return base;
-};
-var toPolicyVersion = (value) => typeof value === "string" || typeof value === "number" ? String(value) : null;
-var fetchModeState = async (apiKey, sessionId) => {
-  try {
-    const baseUrl = getBaseUrl();
-    const url = sessionId ? `${baseUrl}/api/mcp/mode?session=${encodeURIComponent(sessionId)}` : `${baseUrl}/api/mcp/mode`;
-    const response = await fetch(url, {
-      headers: { "Authorization": `Bearer ${apiKey}` },
-      signal: AbortSignal.timeout(3e3)
-    });
-    if (!response.ok) return { mode: null, kill: false, policyVersion: null, relayUrl: null };
-    const data = await response.json();
-    const mode = data.override?.mode;
-    return {
-      mode: isApprovalMode(mode) ? mode : null,
-      kill: data.kill === true,
-      policyVersion: toPolicyVersion(data.policyVersion),
-      relayUrl: typeof data.relayUrl === "string" && data.relayUrl.length > 0 ? data.relayUrl : null
-    };
-  } catch {
-    return { mode: null, kill: false, policyVersion: null, relayUrl: null };
-  }
-};
-var fetchModeOverride = async (apiKey) => (await fetchModeState(apiKey)).mode;
-
-// src/api.ts
-var askUser = async (apiKey, params, timeoutMs = 15e3) => {
-  const result = await callMcpTool(apiKey, "ask_user", { ...params, wait: false }, { maxRetries: 3, timeoutMs });
-  if (!isAskUserResponse(result)) throw new Error("Invalid ask_user response");
-  return result;
-};
-var waitForAnswer = async (apiKey, correlationId, timeoutMs = 3e4) => {
-  const result = await callMcpTool(apiKey, "wait_for_answer", {
-    correlationId,
-    timeoutMs
-  }, { timeoutMs: timeoutMs + 1e4 });
-  if (!isWaitForAnswerResponse(result)) throw new Error("Invalid wait_for_answer response");
-  return result;
-};
-var cancelQuestion = async (apiKey, correlationId) => {
-  await callMcpTool(apiKey, "cancel_question", { correlationId });
-};
-var sendNotification = async (apiKey, params, timeoutMs = 15e3) => {
-  await callMcpTool(apiKey, "send_notification", { ...params }, { maxRetries: 3, timeoutMs });
-};
-
-// src/describe.ts
-import { isAbsolute, relative } from "path";
-var hookPrefixes = {
-  Bash: (input) => `bash: ${input.command ?? "(no command)"}`,
-  PowerShell: (input) => `powershell: ${input.command ?? "(no command)"}`,
-  Monitor: (input) => `monitor: ${input.command ?? "(no command)"}`,
-  Write: (input) => `write file: ${input.file_path ?? "(unknown path)"}`,
-  Edit: (input) => `edit file: ${input.file_path ?? "(unknown path)"}`,
-  MultiEdit: (input) => `edit file: ${input.file_path ?? "(unknown path)"}`,
-  Read: (input) => `read file: ${input.file_path ?? "(unknown path)"}`
-};
-var describeTodoProgress = (todos) => {
-  if (!Array.isArray(todos)) return "updated the plan";
-  const items = todos.filter((t) => !!t && typeof t === "object");
-  const total = items.length;
-  if (total === 0) return "updated the plan";
-  const done = items.filter((t) => t.status === "completed").length;
-  const current = items.find((t) => t.status === "in_progress");
-  const label = current ? [current.activeForm, current.content].find((v) => typeof v === "string" && v.trim().length > 0) : void 0;
-  if (done >= total) return `finished all ${total} tasks`;
-  if (label) return `${label.trim()} (${done}/${total} done)`;
-  return `${done}/${total} tasks done`;
-};
-var eventPrefixes = {
-  Bash: (input) => `ran: ${String(input.command ?? "")}`,
-  PowerShell: (input) => `ran: ${String(input.command ?? "")}`,
-  Monitor: (input) => `ran: ${String(input.command ?? "")}`,
-  Write: (input) => `wrote: ${input.file_path ?? "unknown"}`,
-  Edit: (input) => `edited: ${input.file_path ?? "unknown"}`,
-  MultiEdit: (input) => `edited: ${input.file_path ?? "unknown"}`,
-  Read: (input) => `read: ${input.file_path ?? "unknown"}`,
-  TodoWrite: (input) => describeTodoProgress(input.todos)
-};
-var EVENT_ACTION_MAX = 120;
-var HOOK_FALLBACK_MAX = 200;
-var describeToolCall = (toolName, toolInput, format = "hook") => {
-  const prefixes = format === "hook" ? hookPrefixes : eventPrefixes;
-  const builder = prefixes[toolName];
-  const raw = builder ? builder(toolInput) : format === "hook" ? `${toolName}: ${JSON.stringify(toolInput)}` : `${toolName}: done`;
-  const redacted = redactSecrets(raw);
-  if (format === "event") return redacted.slice(0, EVENT_ACTION_MAX);
-  return builder ? redacted : redacted.slice(0, HOOK_FALLBACK_MAX);
-};
-var TOOL_TARGET_MAX_LENGTH = 80;
-var deriveCommandHead = (command) => {
-  if (typeof command !== "string") return void 0;
-  const head = command.trim().split(/\s+/).slice(0, 2).join(" ");
-  return head ? head.slice(0, TOOL_TARGET_MAX_LENGTH) : void 0;
-};
-var deriveToolTarget = (toolName, toolInput) => {
-  if (toolName === "Bash" || toolName === "PowerShell" || toolName === "Monitor") {
-    return deriveCommandHead(toolInput.command);
-  }
-  if (toolName === "Edit" || toolName === "Write" || toolName === "MultiEdit") {
-    const filePath = toolInput.file_path;
-    if (typeof filePath !== "string") return void 0;
-    const separator = Math.max(filePath.lastIndexOf("/"), filePath.lastIndexOf("\\"));
-    const base = filePath.slice(separator + 1);
-    const dot = base.lastIndexOf(".");
-    if (dot <= 0) return void 0;
-    return base.slice(dot).slice(0, TOOL_TARGET_MAX_LENGTH);
-  }
-  return void 0;
-};
-var RECEIPT_TARGET_MAX_LENGTH = 256;
-var isToolResultError = (toolResult) => {
-  try {
-    return Boolean(toolResult && ("error" in toolResult || "is_error" in toolResult));
-  } catch {
-    return false;
-  }
-};
-var relativizeReceiptPath = (filePath, cwd) => {
-  if (!cwd || !isAbsolute(filePath)) return filePath;
-  return relative(cwd, filePath);
-};
-var deriveReceiptMeta = (toolName, toolInput, toolResult, cwd) => {
-  try {
-    const ok = !isToolResultError(toolResult);
-    if (toolName === "Edit" || toolName === "Write" || toolName === "MultiEdit") {
-      const filePath = toolInput.file_path;
-      if (typeof filePath !== "string" || !filePath) return void 0;
-      return {
-        kind: toolName === "Write" ? "write" : "edit",
-        target: relativizeReceiptPath(filePath, cwd).slice(0, RECEIPT_TARGET_MAX_LENGTH),
-        ok
-      };
-    }
-    if (toolName === "Bash" || toolName === "PowerShell" || toolName === "Monitor") {
-      const head = deriveCommandHead(toolInput.command);
-      if (!head) return void 0;
-      return {
-        kind: head === "git commit" ? "commit" : "bash",
-        target: head,
-        ok
-      };
-    }
-    return void 0;
-  } catch {
-    return void 0;
-  }
-};
-var firstString = (...values) => values.find((v) => typeof v === "string" && v.length > 0);
-var ACTION_BODY_TRUNCATION_MARKER = "\n\u2026 [truncated]";
-var capActionBody = (text) => text.length <= ACTION_BODY_MAX ? text : `${text.slice(0, ACTION_BODY_MAX - ACTION_BODY_TRUNCATION_MARKER.length)}${ACTION_BODY_TRUNCATION_MARKER}`;
-var rawActionBody = (toolName, toolInput) => {
-  if (toolName === "Edit" || toolName === "replace") {
-    const before = firstString(toolInput.old_string);
-    const after = firstString(toolInput.new_string);
-    if (before === void 0 && after === void 0) return void 0;
-    return `- ${before ?? ""}
-+ ${after ?? ""}`;
-  }
-  if (toolName === "Write" || toolName === "write_file") return firstString(toolInput.content);
-  if (toolName === "Bash" || toolName === "PowerShell" || toolName === "Monitor" || toolName === "run_shell_command" || toolName === "shell" || toolName === "apply_patch") {
-    return firstString(toolInput.command);
-  }
-  return void 0;
-};
-var deriveActionBody = (toolName, toolInput) => {
-  try {
-    const raw = rawActionBody(toolName, toolInput);
-    if (!raw) return void 0;
-    return capActionBody(redactSecretsDeep(raw));
-  } catch {
-    return void 0;
-  }
-};
-var deriveAction = (toolName, toolInput) => describeToolCall(toolName, toolInput, "hook").slice(0, DECISION_LINE_MAX);
-var BLOCKER_BY_MODE = {
-  push_only: "Approval required before this runs",
-  push_first: "Paused for your approval before continuing",
-  escalate: "Escalated to you after the approval timeout"
-};
-var deriveBlocker = (mode, reason) => {
-  const text = reason?.replace(/\s+/g, " ").trim() || BLOCKER_BY_MODE[mode] || "Waiting for your approval";
-  return text.slice(0, DECISION_LINE_MAX);
-};
-
-export {
-  getMachineId,
-  isPolicyConfig,
-  getPolicy,
-  resolveAutoResolveOrigin,
-  resolvePolicy,
-  fetchModeState,
-  fetchModeOverride,
-  askUser,
-  waitForAnswer,
-  cancelQuestion,
-  sendNotification,
-  describeToolCall,
-  deriveToolTarget,
-  isToolResultError,
-  deriveReceiptMeta,
-  deriveActionBody,
-  deriveAction,
-  deriveBlocker
-};