@pushary/agent-hooks 0.5.0 → 0.6.0

package/dist/bin/pushary-clean.js

@@ -10,6 +10,7 @@ import { join } from "path";
 import { homedir } from "os";
 import { execSync } from "child_process";
 import { confirm } from "@inquirer/prompts";
+import { parse as parseTOML, stringify as stringifyTOML } from "smol-toml";
 var dim = (s) => `\x1B[2m${s}\x1B[0m`;
 var bold = (s) => `\x1B[1m${s}\x1B[0m`;
 var green = (s) => `\x1B[32m${s}\x1B[0m`;
@@ -21,7 +22,7 @@ var CLAUDE_SETTINGS_LOCAL = join(homedir(), ".claude", "settings.local.json");
 var CLAUDE_JSON = join(homedir(), ".claude.json");
 var SKILL_DIR = join(homedir(), ".claude", "skills", "pushary");
 var CURSOR_MCP = join(".cursor", "mcp.json");
-var SHELL_FILES = [".zshrc", ".bashrc"].map((f) => join(homedir(), f));
+var SHELL_FILES = [".zshrc", ".zprofile", ".bashrc", ".bash_profile"].map((f) => join(homedir(), f));
 var readJson = (path) => {
   try {
     return JSON.parse(readFileSync(path, "utf-8"));
@@ -91,26 +92,19 @@ var main = async () => {
   }
   const codexConfig = join(homedir(), ".codex", "config.toml");
   try {
-    let config = readFileSync(codexConfig, "utf-8");
+    const config = readFileSync(codexConfig, "utf-8");
     const hadPushary = config.includes("pushary");
     if (hadPushary) {
-      const lines = config.split("\n");
-      const cleaned = [];
-      let skipping = false;
-      for (const line of lines) {
-        if (line.trim() === "[mcp_servers.pushary]") {
-          skipping = true;
-          continue;
-        }
-        if (skipping && (line.startsWith("[") || line.trim() === "")) {
-          skipping = false;
-        }
-        if (skipping) continue;
-        if (line.includes("pushary-codex")) continue;
-        cleaned.push(line);
+      const parsed = parseTOML(config);
+      const mcpServers = parsed.mcp_servers ?? {};
+      delete mcpServers.pushary;
+      if (Object.keys(mcpServers).length === 0) delete parsed.mcp_servers;
+      else parsed.mcp_servers = mcpServers;
+      if (Array.isArray(parsed.notify)) {
+        parsed.notify = parsed.notify.filter((n) => typeof n !== "string" || !n.includes("pushary-codex"));
+        if (parsed.notify.length === 0) delete parsed.notify;
       }
-      config = cleaned.join("\n").replace(/\n{3,}/g, "\n\n");
-      writeFileSync(codexConfig, config, "utf-8");
+      writeFileSync(codexConfig, stringifyTOML(parsed), "utf-8");
       console.log(`  ${check} Codex config ${dim("(cleaned)")}`);
     } else {
       console.log(`  ${skip} Codex config ${dim("(no pushary entries)")}`);
@@ -130,7 +124,7 @@ var main = async () => {
     }
   }
   try {
-    execSync("npm uninstall -g @pushary/agent-hooks", { stdio: "ignore" });
+    execSync("npm uninstall -g @pushary/agent-hooks", { stdio: "ignore", timeout: 3e4 });
     console.log(`  ${check} Global package ${dim("(uninstalled)")}`);
   } catch {
     console.log(`  ${skip} Global package ${dim("(not installed)")}`);

package/dist/bin/pushary-codex.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import {
   reportEvent
-} from "../chunk-P4JH2Q7Z.js";
+} from "../chunk-KYARP7KP.js";
 import {
   askUser,
   waitForAnswer
-} from "../chunk-KTP2EPVB.js";
+} from "../chunk-4Z4MB37G.js";
 import {
   getApiKey
-} from "../chunk-VIST7ACL.js";
+} from "../chunk-O6A5RHWY.js";
 
 // bin/pushary-codex.ts
 import { hostname } from "os";

package/dist/bin/pushary-doctor.js

@@ -2,7 +2,7 @@
 import {
   callMcpTool,
   sendMcpRequest
-} from "../chunk-VIST7ACL.js";
+} from "../chunk-O6A5RHWY.js";
 
 // bin/pushary-doctor.ts
 import { existsSync, readFileSync } from "fs";
@@ -68,11 +68,28 @@ var main = async () => {
   } else {
     check(false, "Claude Code: settings.json", "not found");
   }
+  const codexConfigPath = join(homedir(), ".codex", "config.toml");
+  if (existsSync(codexConfigPath)) {
+    const codexConfig = readFileSync(codexConfigPath, "utf-8");
+    const hasPusharyMcp = codexConfig.includes("[mcp_servers.pushary]");
+    check(hasPusharyMcp, "Codex: MCP server configured");
+    if (hasPusharyMcp) {
+      const hasAutoApprove = codexConfig.includes('default_tools_approval_mode = "approve"');
+      check(hasAutoApprove, "Codex: tools auto-allowed", hasAutoApprove ? 'default_tools_approval_mode = "approve"' : "missing \u2014 MCP calls will prompt for approval");
+      const hasPerToolOverrides = /\[mcp_servers\.pushary\.tools\./.test(codexConfig);
+      if (hasPerToolOverrides) {
+        console.log(`  ${warn} Codex: per-tool approval overrides detected ${dim("(redundant with default_tools_approval_mode)")}`);
+      }
+    }
+    check(codexConfig.includes("pushary-codex"), "Codex: notify handler configured");
+    const codexSkillPath = join(homedir(), ".codex", "skills", "pushary", "SKILL.md");
+    check(existsSync(codexSkillPath), "Codex: skill installed");
+  }
   check(existsSync(SKILL_PATH), "Skill installed", existsSync(SKILL_PATH) ? SKILL_PATH : "not found");
   let globalVersion = "";
   try {
     const { execSync } = await import("child_process");
-    globalVersion = execSync("npm list -g @pushary/agent-hooks --depth=0 2>/dev/null", { encoding: "utf-8" }).match(/@pushary\/agent-hooks@([\d.]+)/)?.[1] ?? "";
+    globalVersion = execSync("npm list -g @pushary/agent-hooks --depth=0 2>/dev/null", { encoding: "utf-8", timeout: 1e4 }).match(/@pushary\/agent-hooks@([\d.]+)/)?.[1] ?? "";
   } catch {
   }
   check(!!globalVersion, "Global package installed", globalVersion || "not found");

package/dist/bin/pushary-hook.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   handlePreToolUse
-} from "../chunk-DF3BM6BF.js";
-import "../chunk-KTP2EPVB.js";
-import "../chunk-VIST7ACL.js";
+} from "../chunk-WNXGIEX7.js";
+import "../chunk-4Z4MB37G.js";
+import "../chunk-O6A5RHWY.js";
 
 // bin/pushary-hook.ts
 var main = async () => {
@@ -25,14 +25,19 @@ var main = async () => {
   }
   try {
     const output = await handlePreToolUse(input);
-    if (output) {
-      process.stdout.write(JSON.stringify(output));
-    }
+    process.stdout.write(JSON.stringify(output));
   } catch (err) {
     process.stderr.write(
       `[pushary-hook] Error: ${err instanceof Error ? err.message : String(err)}
 `
     );
+    process.stdout.write(JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "ask",
+        permissionDecisionReason: "Pushary hook error, falling back to terminal"
+      }
+    }));
   }
 };
 main();

package/dist/bin/pushary-post-hook.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   handlePostToolUse
-} from "../chunk-P4JH2Q7Z.js";
-import "../chunk-KTP2EPVB.js";
-import "../chunk-VIST7ACL.js";
+} from "../chunk-KYARP7KP.js";
+import "../chunk-4Z4MB37G.js";
+import "../chunk-O6A5RHWY.js";
 
 // bin/pushary-post-hook.ts
 var main = async () => {

package/dist/bin/pushary-setup.js

@@ -12,13 +12,14 @@ import { homedir } from "os";
 import { execSync } from "child_process";
 import { checkbox, input, confirm } from "@inquirer/prompts";
 import { fileURLToPath } from "url";
+import { parse as parseTOML, stringify as stringifyTOML } from "smol-toml";
 var CLAUDE_SETTINGS = join(homedir(), ".claude", "settings.json");
 var CLAUDE_JSON = join(homedir(), ".claude.json");
 var CURSOR_MCP = join(".cursor", "mcp.json");
 var CURSOR_RULES_DIR = join(".cursor", "rules");
 var CLAUDE_SKILL_DIR = join(homedir(), ".claude", "skills", "pushary");
 var CODEX_SKILL_DIR = join(homedir(), ".codex", "skills", "pushary");
-var SHELL_FILES = [".zshrc", ".bashrc"].map((f) => join(homedir(), f));
+var SHELL_FILES = [".zshrc", ".zprofile", ".bashrc", ".bash_profile"].map((f) => join(homedir(), f));
 var dim = (s) => `\x1B[2m${s}\x1B[0m`;
 var bold = (s) => `\x1B[1m${s}\x1B[0m`;
 var green = (s) => `\x1B[32m${s}\x1B[0m`;
@@ -37,7 +38,16 @@ var writeJson = (path, data) => {
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
   writeFileSync(path, JSON.stringify(data, null, 2) + "\n", "utf-8");
 };
-var formatError = (err) => err instanceof Error ? err.message : String(err);
+var formatError = (err) => {
+  if (err instanceof Error) {
+    const errWithSignal = err;
+    if (errWithSignal.killed && errWithSignal.signal === "SIGTERM") {
+      return "timed out \u2014 check your network connection";
+    }
+    return err.message;
+  }
+  return String(err);
+};
 var spinner = async (label, fn, options = {}) => {
   const frames = ["   ", ".  ", ".. ", "..."];
   let i = 0;
@@ -82,7 +92,7 @@ var checkForUpdates = async (current) => {
 };
 var installGlobally = async () => {
   await spinner("Installing pushary-hook globally", async () => {
-    execSync("npm install -g @pushary/agent-hooks@latest", { stdio: "ignore" });
+    execSync("npm install -g @pushary/agent-hooks@latest", { stdio: "ignore", timeout: 12e4 });
   });
 };
 var _cachedSkillContent = null;
@@ -146,31 +156,88 @@ var setupClaudeCode = async (apiKey) => {
   console.log(`  ${dim("\u2022")} Hooks: route permission approvals through push notifications`);
   console.log(`  ${dim("\u2022")} Auto-allowed tools: no permission prompts for Pushary MCP calls`);
 };
+var findPython310Plus = () => {
+  const candidates = ["python3.13", "python3.12", "python3.11", "python3.10", "python3", "python"];
+  for (const py of candidates) {
+    try {
+      const version = execSync(`${py} --version 2>&1`, { encoding: "utf-8", stdio: "pipe", timeout: 5e3 }).trim();
+      const match = version.match(/Python (\d+)\.(\d+)/);
+      if (match && (Number(match[1]) > 3 || Number(match[1]) === 3 && Number(match[2]) >= 10)) {
+        return py;
+      }
+    } catch {
+    }
+  }
+  return null;
+};
+var installPythonPlugin = (pythonBin) => {
+  execSync(`${pythonBin} -m pip install --upgrade hermes-plugin-pushary`, { stdio: "pipe", timeout: 12e4 });
+};
 var setupHermes = async (_apiKey) => {
   console.log(`
   ${bold("Setting up Hermes Agent")}
 `);
-  let pipInstalled = false;
+  const whichCmd = process.platform === "win32" ? "where" : "which";
+  const hasHermes = (() => {
+    try {
+      execSync(`${whichCmd} hermes`, { stdio: "ignore", timeout: 5e3 });
+      return true;
+    } catch {
+      return false;
+    }
+  })();
+  if (!hasHermes) {
+    console.log(`  ${yellow("!")} Hermes CLI not found. Skipping.`);
+    console.log(`  ${dim("Install Hermes and re-run setup to configure.")}`);
+    return;
+  }
   await spinner("Installing hermes-plugin-pushary", async () => {
+    try {
+      execSync("uv pip install hermes-plugin-pushary", { stdio: "pipe", timeout: 12e4 });
+      return;
+    } catch {
+    }
+    let python = findPython310Plus();
+    if (!python) {
+      if (process.platform === "darwin") {
+        try {
+          execSync("which brew", { stdio: "ignore", timeout: 5e3 });
+          execSync("brew install python@3.12", { stdio: "pipe", timeout: 3e5 });
+          python = findPython310Plus();
+        } catch {
+        }
+      } else if (process.platform === "linux") {
+        for (const [check2, install] of [
+          ["which apt-get", "sudo apt-get update -qq && sudo apt-get install -y -qq python3 python3-pip"],
+          ["which dnf", "sudo dnf install -y -q python3 python3-pip"],
+          ["which yum", "sudo yum install -y -q python3 python3-pip"],
+          ["which pacman", "sudo pacman -S --noconfirm python python-pip"]
+        ]) {
+          try {
+            execSync(check2, { stdio: "ignore", timeout: 5e3 });
+            execSync(install, { stdio: "pipe", timeout: 3e5 });
+            python = findPython310Plus();
+            if (python) break;
+          } catch {
+          }
+        }
+      }
+    }
+    if (python) {
+      installPythonPlugin(python);
+      return;
+    }
     for (const pip of ["pip3", "pip"]) {
       try {
-        execSync(`${pip} install hermes-plugin-pushary`, { stdio: "pipe" });
-        pipInstalled = true;
+        execSync(`${pip} install hermes-plugin-pushary`, { stdio: "pipe", timeout: 12e4 });
         return;
-      } catch (err) {
-        const msg = err instanceof Error ? err.stderr?.toString() ?? "" : "";
-        if (msg.includes("No matching distribution")) {
-          throw new Error("requires Python 3.10+ (your pip uses an older version)");
-        }
+      } catch {
       }
     }
-    throw new Error("pip not found");
+    throw new Error("Python 3.10+ not found and could not be installed");
   });
-  if (!pipInstalled) {
-    console.log(`  ${dim("  Install Python 3.10+ and re-run setup to fix.")}`);
-  }
   await spinner("Enabling plugin", async () => {
-    execSync("hermes plugins enable pushary", { stdio: "ignore" });
+    execSync("hermes plugins enable pushary", { stdio: "ignore", timeout: 1e4 });
   });
   console.log();
   console.log(`  ${dim("What this configured:")}`);
@@ -181,9 +248,10 @@ var setupCodex = async (_apiKey) => {
   console.log(`
   ${bold("Setting up Codex")}
 `);
+  const whichCmd = process.platform === "win32" ? "where" : "which";
   const hasCodex = (() => {
     try {
-      execSync("which codex", { stdio: "ignore" });
+      execSync(`${whichCmd} codex`, { stdio: "ignore", timeout: 5e3 });
       return true;
     } catch {
       return false;
@@ -195,36 +263,53 @@ var setupCodex = async (_apiKey) => {
     return;
   }
   await installGlobally();
+  const codexConfig = join(homedir(), ".codex", "config.toml");
   await spinner("Adding Pushary MCP server to Codex", async () => {
     try {
       execSync(
         "codex mcp add pushary --url https://pushary.com/api/mcp/mcp --bearer-token-env-var PUSHARY_API_KEY",
-        { stdio: "ignore" }
+        { stdio: "ignore", timeout: 15e3 }
       );
     } catch {
     }
   });
-  const codexConfig = join(homedir(), ".codex", "config.toml");
+  await spinner("Auto-allowing all Pushary tools", async () => {
+    let raw = "";
+    try {
+      raw = readFileSync(codexConfig, "utf-8");
+    } catch {
+    }
+    const config = raw ? parseTOML(raw) : {};
+    const mcpServers = config.mcp_servers ?? {};
+    const pushary = mcpServers.pushary ?? {};
+    pushary.default_tools_approval_mode = "approve";
+    delete pushary.tools;
+    mcpServers.pushary = pushary;
+    config.mcp_servers = mcpServers;
+    writeFileSync(codexConfig, stringifyTOML(config), "utf-8");
+  });
   await spinner("Adding notify handler for Codex events", async () => {
-    const globalPrefix = execSync("npm prefix -g", { encoding: "utf-8" }).trim();
+    const globalPrefix = execSync("npm prefix -g", { encoding: "utf-8", timeout: 5e3 }).trim();
     const pusharyCodexPath = join(globalPrefix, "bin", "pushary-codex");
     if (!existsSync(pusharyCodexPath)) throw new Error("pushary-codex not found at " + pusharyCodexPath);
-    let config = "";
+    let raw = "";
     try {
-      config = readFileSync(codexConfig, "utf-8");
+      raw = readFileSync(codexConfig, "utf-8");
     } catch {
     }
-    if (!config.includes("pushary-codex")) {
-      const notifyLine = `
-notify = ["${pusharyCodexPath}"]
-`;
-      appendFileSync(codexConfig, notifyLine, "utf-8");
+    const config = raw ? parseTOML(raw) : {};
+    const notify = Array.isArray(config.notify) ? config.notify : [];
+    if (!notify.some((n) => typeof n === "string" && n.includes("pushary-codex"))) {
+      notify.push(pusharyCodexPath);
+      config.notify = notify;
+      writeFileSync(codexConfig, stringifyTOML(config), "utf-8");
     }
   });
   await installSkillToDir(CODEX_SKILL_DIR, "Installing Pushary skill");
   console.log();
   console.log(`  ${dim("What this configured:")}`);
   console.log(`  ${dim("\u2022")} MCP server: Codex can send notifications and ask questions`);
+  console.log(`  ${dim("\u2022")} Auto-allowed tools: no permission prompts for Pushary MCP calls`);
   console.log(`  ${dim("\u2022")} Notify handler: captures turn completions and approval requests`);
 };
 var setupCursor = async (apiKey) => {
@@ -324,7 +409,7 @@ var main = async () => {
     message: "Which agents do you use? " + dim("(space = toggle, enter = confirm)"),
     choices: [
       { name: `Claude Code  ${dim("MCP + hooks + auto-allowed tools")}`, value: "claude_code" },
-      { name: `Codex        ${dim("MCP server via codex mcp add")}`, value: "codex" },
+      { name: `Codex        ${dim("MCP + notify handler + auto-allowed tools")}`, value: "codex" },
       { name: `Hermes       ${dim("native plugin + auto-error notifications")}`, value: "hermes" },
       { name: `Cursor       ${dim("MCP server")}`, value: "cursor" }
     ]
@@ -334,8 +419,19 @@ var main = async () => {
     console.log(`
   ${dim("No agents selected. API key saved.")}`);
   } else {
+    const failed = [];
     for (const agent of agents) {
-      await AGENT_SETUP[agent](trimmedKey);
+      try {
+        await AGENT_SETUP[agent](trimmedKey);
+      } catch (err) {
+        failed.push(agent.replace("_", " "));
+        console.log(`  ${yellow("!")} ${agent.replace("_", " ")} setup failed: ${formatError(err)}`);
+        console.log(`  ${dim("Other agents will continue. Re-run setup to retry.")}`);
+      }
+    }
+    if (failed.length > 0) {
+      console.log();
+      console.log(`  ${yellow("!")} Failed: ${failed.join(", ")} ${dim("(others completed successfully)")}`);
     }
   }
   const sendTest = await confirm({ message: "Send a test notification?", default: true });

package/dist/bin/pushary-stop-hook.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   handleStop
-} from "../chunk-P4JH2Q7Z.js";
-import "../chunk-KTP2EPVB.js";
-import "../chunk-VIST7ACL.js";
+} from "../chunk-KYARP7KP.js";
+import "../chunk-4Z4MB37G.js";
+import "../chunk-O6A5RHWY.js";
 
 // bin/pushary-stop-hook.ts
 var main = async () => {

package/dist/chunk-4Z4MB37G.js

@@ -0,0 +1,96 @@
+import {
+  callMcpTool
+} from "./chunk-O6A5RHWY.js";
+
+// src/validate.ts
+var isPolicyConfig = (data) => {
+  if (!data || typeof data !== "object") return false;
+  const d = data;
+  return Array.isArray(d.policies) && typeof d.defaultTimeoutSeconds === "number" && typeof d.defaultTimeoutAction === "string";
+};
+var isAskUserResponse = (data) => {
+  if (!data || typeof data !== "object") return false;
+  const d = data;
+  return typeof d.correlationId === "string" && typeof d.status === "string";
+};
+var isWaitForAnswerResponse = (data) => {
+  if (!data || typeof data !== "object") return false;
+  const d = data;
+  return typeof d.answered === "boolean";
+};
+
+// src/api.ts
+var askUser = async (apiKey, params) => {
+  const result = await callMcpTool(apiKey, "ask_user", { ...params });
+  if (!isAskUserResponse(result)) throw new Error("Invalid ask_user response");
+  return result;
+};
+var waitForAnswer = async (apiKey, correlationId, timeoutMs = 3e4) => {
+  const result = await callMcpTool(apiKey, "wait_for_answer", {
+    correlationId,
+    timeoutMs
+  });
+  if (!isWaitForAnswerResponse(result)) throw new Error("Invalid wait_for_answer response");
+  return result;
+};
+var cancelQuestion = async (apiKey, correlationId) => {
+  await callMcpTool(apiKey, "cancel_question", { correlationId });
+};
+var sendNotification = async (apiKey, params) => {
+  await callMcpTool(apiKey, "send_notification", { ...params });
+};
+
+// src/describe.ts
+var hookPrefixes = {
+  Bash: (input) => `bash: ${input.command ?? "(no command)"}`,
+  Write: (input) => `write file: ${input.file_path ?? "(unknown path)"}`,
+  Edit: (input) => `edit file: ${input.file_path ?? "(unknown path)"}`,
+  Read: (input) => `read file: ${input.file_path ?? "(unknown path)"}`
+};
+var eventPrefixes = {
+  Bash: (input) => `ran: ${String(input.command ?? "").slice(0, 120)}`,
+  Write: (input) => `wrote: ${input.file_path ?? "unknown"}`,
+  Edit: (input) => `edited: ${input.file_path ?? "unknown"}`,
+  Read: (input) => `read: ${input.file_path ?? "unknown"}`
+};
+var describeToolCall = (toolName, toolInput, format = "hook") => {
+  const prefixes = format === "hook" ? hookPrefixes : eventPrefixes;
+  const builder = prefixes[toolName];
+  if (builder) return builder(toolInput);
+  return format === "hook" ? `${toolName}: ${JSON.stringify(toolInput).slice(0, 200)}` : `${toolName}: done`;
+};
+
+// src/pending.ts
+import { join } from "path";
+import { tmpdir } from "os";
+import { existsSync, mkdirSync, writeFileSync, readdirSync, unlinkSync } from "fs";
+var PENDING_DIR = join(tmpdir(), "pushary-pending");
+var savePendingQuestion = (correlationId) => {
+  if (!existsSync(PENDING_DIR)) mkdirSync(PENDING_DIR, { recursive: true });
+  writeFileSync(join(PENDING_DIR, correlationId), "", "utf-8");
+};
+var listPendingQuestions = () => {
+  try {
+    return readdirSync(PENDING_DIR);
+  } catch {
+    return [];
+  }
+};
+var removePendingQuestion = (correlationId) => {
+  try {
+    unlinkSync(join(PENDING_DIR, correlationId));
+  } catch {
+  }
+};
+
+export {
+  isPolicyConfig,
+  askUser,
+  waitForAnswer,
+  cancelQuestion,
+  sendNotification,
+  describeToolCall,
+  savePendingQuestion,
+  listPendingQuestions,
+  removePendingQuestion
+};

package/dist/chunk-KYARP7KP.js

@@ -0,0 +1,97 @@
+import {
+  cancelQuestion,
+  describeToolCall,
+  listPendingQuestions,
+  removePendingQuestion
+} from "./chunk-4Z4MB37G.js";
+import {
+  getApiKey,
+  getBaseUrl,
+  withRetry
+} from "./chunk-O6A5RHWY.js";
+
+// src/events.ts
+import { hostname } from "os";
+import { basename } from "path";
+var cleanupPendingQuestions = async () => {
+  try {
+    const files = listPendingQuestions();
+    const apiKey = getApiKey();
+    for (const correlationId of files) {
+      try {
+        await cancelQuestion(apiKey, correlationId);
+      } catch {
+      }
+      removePendingQuestion(correlationId);
+    }
+  } catch {
+  }
+};
+var reportEvent = async (event) => {
+  const apiKey = getApiKey();
+  const baseUrl = getBaseUrl();
+  await withRetry(async () => {
+    await fetch(`${baseUrl}/api/agent/event`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Authorization": `Bearer ${apiKey}`
+      },
+      body: JSON.stringify({
+        ...event,
+        machineId: event.machineId ?? hostname()
+      }),
+      signal: AbortSignal.timeout(1e4)
+    });
+  }, { maxAttempts: 2, baseDelayMs: 300 });
+};
+var handlePostToolUse = async (input) => {
+  try {
+    const projectName = basename(input.cwd ?? process.cwd());
+    const action = describeToolCall(input.tool_name, input.tool_input, "event");
+    const isError = input.tool_result && ("error" in input.tool_result || "is_error" in input.tool_result);
+    await Promise.allSettled([
+      cleanupPendingQuestions(),
+      reportEvent({
+        event: isError ? "tool_error" : "tool_complete",
+        agentType: "claude_code",
+        agentName: `Claude Code - ${projectName}`,
+        action,
+        error: isError ? String(input.tool_result?.error ?? input.tool_result?.stderr ?? "").slice(0, 500) : void 0
+      })
+    ]);
+  } catch {
+  }
+};
+var handleStop = async (input) => {
+  try {
+    const projectName = basename(input.cwd ?? process.cwd());
+    await reportEvent({
+      event: "session_end",
+      agentType: "claude_code",
+      agentName: `Claude Code - ${projectName}`,
+      action: "Session ended"
+    });
+  } catch {
+  }
+};
+var handleNotification = async (input) => {
+  try {
+    const projectName = basename(input.cwd ?? process.cwd());
+    await reportEvent({
+      event: input.type === "error" ? "error" : "notification",
+      agentType: "claude_code",
+      agentName: `Claude Code - ${projectName}`,
+      action: input.title ?? input.message ?? "Notification",
+      error: input.type === "error" ? input.message : void 0
+    });
+  } catch {
+  }
+};
+
+export {
+  reportEvent,
+  handlePostToolUse,
+  handleStop,
+  handleNotification
+};

package/dist/chunk-O6A5RHWY.js

@@ -0,0 +1,122 @@
+// src/config.ts
+var getApiKey = () => {
+  const key = process.env.PUSHARY_API_KEY;
+  if (!key) {
+    throw new Error(
+      "PUSHARY_API_KEY environment variable is not set. Get your API key at https://pushary.com/sign-up?from=ai-coding"
+    );
+  }
+  return key;
+};
+var getBaseUrl = () => process.env.PUSHARY_BASE_URL ?? "https://pushary.com";
+
+// src/retry.ts
+var isRetryable = (err) => {
+  if (!(err instanceof Error)) return false;
+  const msg = err.message;
+  return /\b(502|503|429)\b/.test(msg) || /ECONNRESET|ECONNREFUSED|ETIMEDOUT|UND_ERR_CONNECT_TIMEOUT|fetch failed/i.test(msg) || msg.includes("AbortError");
+};
+var withRetry = async (fn, options = {}) => {
+  const {
+    maxAttempts = 3,
+    baseDelayMs = 500,
+    maxDelayMs = 5e3,
+    shouldRetry = isRetryable
+  } = options;
+  let lastError;
+  for (let attempt = 0; attempt < maxAttempts; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      lastError = err;
+      if (attempt + 1 >= maxAttempts || !shouldRetry(err)) throw err;
+      const jitter = Math.random() * 0.3 + 0.85;
+      const delay = Math.min(baseDelayMs * 2 ** attempt * jitter, maxDelayMs);
+      await new Promise((r) => setTimeout(r, delay));
+    }
+  }
+  throw lastError;
+};
+
+// src/mcp-http.ts
+var parseSseJson = (body) => {
+  const messages = [];
+  for (const event of body.split(/\r?\n\r?\n/)) {
+    const data = event.split(/\r?\n/).filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trimStart()).join("\n").trim();
+    if (!data) continue;
+    try {
+      messages.push(JSON.parse(data));
+    } catch {
+    }
+  }
+  const message = messages.at(-1);
+  if (!message) throw new Error("Empty response from Pushary");
+  return message;
+};
+var parseMcpResponse = (body, contentType) => {
+  if (contentType?.includes("text/event-stream")) {
+    return parseSseJson(body);
+  }
+  return JSON.parse(body);
+};
+var sendMcpRequest = async (apiKey, message, options = {}) => {
+  return withRetry(async () => {
+    const baseUrl = options.baseUrl ?? getBaseUrl();
+    const fetchFn = options.fetchFn ?? fetch;
+    const headers = {
+      "Content-Type": "application/json",
+      "Accept": "application/json, text/event-stream",
+      "Authorization": `Bearer ${apiKey}`
+    };
+    if (options.sessionId) {
+      headers["Mcp-Session-Id"] = options.sessionId;
+    }
+    const response = await fetchFn(`${baseUrl}/api/mcp/mcp`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(message),
+      signal: options.timeoutMs ? AbortSignal.timeout(options.timeoutMs) : void 0
+    });
+    const body = await response.text();
+    const contentType = response.headers.get("content-type");
+    let data = null;
+    if (body.trim()) {
+      try {
+        data = parseMcpResponse(body, contentType);
+      } catch (err) {
+        if (response.ok) throw err;
+      }
+    }
+    if (!response.ok) {
+      const msg = data?.error?.message ?? (body.trim() || response.statusText);
+      throw new Error(`Pushary MCP error: ${response.status} ${msg}`);
+    }
+    if (!data) throw new Error("Empty response from Pushary");
+    if (data.error) throw new Error(data.error.message ?? "Pushary MCP error");
+    return {
+      data,
+      sessionId: response.headers.get("mcp-session-id") ?? "",
+      status: response.status,
+      statusText: response.statusText
+    };
+  }, { maxAttempts: options.maxRetries ?? 1 });
+};
+var callMcpTool = async (apiKey, toolName, params, options = {}) => {
+  const { data } = await sendMcpRequest(apiKey, {
+    jsonrpc: "2.0",
+    id: options.id ?? Date.now(),
+    method: "tools/call",
+    params: { name: toolName, arguments: params }
+  }, options);
+  const text = data.result?.content?.[0]?.text;
+  if (!text) throw new Error("Empty response from Pushary");
+  return JSON.parse(text);
+};
+
+export {
+  getApiKey,
+  getBaseUrl,
+  withRetry,
+  sendMcpRequest,
+  callMcpTool
+};

package/dist/chunk-WNXGIEX7.js

@@ -0,0 +1,219 @@
+import {
+  askUser,
+  describeToolCall,
+  isPolicyConfig,
+  savePendingQuestion,
+  sendNotification,
+  waitForAnswer
+} from "./chunk-4Z4MB37G.js";
+import {
+  getApiKey,
+  getBaseUrl,
+  withRetry
+} from "./chunk-O6A5RHWY.js";
+
+// src/policy.ts
+import { createHash } from "crypto";
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+var CACHE_TTL_MS = 5 * 60 * 1e3;
+var cacheFile = (apiKey) => {
+  const hash = createHash("sha256").update(apiKey).digest("hex").slice(0, 12);
+  return join(tmpdir(), `pushary-policy-${hash}.json`);
+};
+var fetchPolicy = async (apiKey) => {
+  return withRetry(async () => {
+    const baseUrl = getBaseUrl();
+    const response = await fetch(`${baseUrl}/api/mcp/policy`, {
+      headers: { "Authorization": `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!response.ok) {
+      throw new Error(`Failed to fetch policy: ${response.status}`);
+    }
+    const raw = await response.json();
+    if (!isPolicyConfig(raw)) throw new Error("Invalid policy response");
+    return raw;
+  }, { maxAttempts: 2 });
+};
+var getPolicy = async (apiKey) => {
+  const path = cacheFile(apiKey);
+  let staleCache = null;
+  if (existsSync(path)) {
+    try {
+      const stat = readFileSync(path, "utf-8");
+      const cached = JSON.parse(stat);
+      if (!isPolicyConfig(cached)) throw new Error("Corrupted cache");
+      if (!cached._cachedAt || Date.now() - cached._cachedAt < CACHE_TTL_MS) {
+        return cached;
+      }
+      staleCache = cached;
+    } catch {
+    }
+  }
+  try {
+    const policy = await fetchPolicy(apiKey);
+    try {
+      writeFileSync(path, JSON.stringify({ ...policy, _cachedAt: Date.now() }), "utf-8");
+    } catch {
+    }
+    return policy;
+  } catch {
+    if (staleCache) return staleCache;
+    throw new Error("Failed to fetch policy and no cached policy available");
+  }
+};
+var resolvePolicy = (config, toolName) => {
+  const exact = config.policies.find((p) => p.tool === toolName);
+  if (exact) return exact;
+  const wildcard = config.policies.find((p) => p.tool === "*");
+  if (wildcard) return wildcard;
+  return {
+    tool: toolName,
+    timeoutSeconds: config.defaultTimeoutSeconds,
+    timeoutAction: config.defaultTimeoutAction,
+    mode: config.defaultMode ?? "push_first",
+    pushFirstSeconds: config.defaultPushFirstSeconds ?? 10
+  };
+};
+
+// src/hook.ts
+import { basename } from "path";
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var allow = () => ({
+  hookSpecificOutput: {
+    hookEventName: "PreToolUse",
+    permissionDecision: "allow"
+  }
+});
+var deny = (reason) => ({
+  hookSpecificOutput: {
+    hookEventName: "PreToolUse",
+    permissionDecision: "deny",
+    permissionDecisionReason: reason
+  }
+});
+var ask = (reason) => ({
+  hookSpecificOutput: {
+    hookEventName: "PreToolUse",
+    permissionDecision: "ask",
+    ...reason ? { permissionDecisionReason: reason } : {}
+  }
+});
+var pollForAnswer = async (apiKey, correlationId, deadlineMs, pollInterval = 2e3) => {
+  while (Date.now() < deadlineMs) {
+    const remaining = Math.min(Math.max(deadlineMs - Date.now(), 1e3), 3e4);
+    let answer;
+    try {
+      answer = await waitForAnswer(apiKey, correlationId, remaining);
+    } catch {
+      if (Date.now() + pollInterval >= deadlineMs) break;
+      await sleep(pollInterval);
+      continue;
+    }
+    if (answer.answered) return answer;
+    if (Date.now() + pollInterval >= deadlineMs) break;
+    await sleep(pollInterval);
+  }
+  return { answered: false };
+};
+var handlePushOnly = async (apiKey, description, projectName, timeoutSeconds, timeoutAction) => {
+  let result;
+  try {
+    result = await askUser(apiKey, {
+      question: `Allow ${description}?`,
+      type: "confirm",
+      context: `Agent wants to run this in ${projectName}`,
+      agentName: `Claude Code - ${projectName}`
+    });
+  } catch {
+    switch (timeoutAction) {
+      case "approve":
+        return allow();
+      case "deny":
+        return deny("Push notification failed, denying per policy");
+      default:
+        return ask("Push notification failed, asking in terminal");
+    }
+  }
+  const deadline = Date.now() + timeoutSeconds * 1e3;
+  const answer = await pollForAnswer(apiKey, result.correlationId, deadline);
+  if (answer.answered) {
+    return answer.value === "yes" ? allow() : deny("Denied via push notification");
+  }
+  switch (timeoutAction) {
+    case "approve":
+      return allow();
+    case "deny":
+      return deny("No response within timeout");
+    default:
+      return ask("No push response, asking in terminal");
+  }
+};
+var handleTerminalOnly = () => {
+  return ask();
+};
+var handlePushFirst = async (apiKey, description, projectName, pushFirstSeconds) => {
+  let result;
+  try {
+    result = await askUser(apiKey, {
+      question: `Allow ${description}?`,
+      type: "confirm",
+      context: `Agent wants to run this in ${projectName}`,
+      agentName: `Claude Code - ${projectName}`
+    });
+  } catch {
+    return ask("Push notification failed, asking in terminal");
+  }
+  const deadline = Date.now() + pushFirstSeconds * 1e3;
+  const answer = await pollForAnswer(apiKey, result.correlationId, deadline, 1500);
+  if (answer.answered) {
+    return answer.value === "yes" ? allow() : deny("Denied via push notification");
+  }
+  savePendingQuestion(result.correlationId);
+  return ask("Sent as push notification. You can also approve here.");
+};
+var handleNotifyOnly = async (apiKey, description, projectName) => {
+  try {
+    await sendNotification(apiKey, {
+      title: "Agent needs approval",
+      body: description,
+      agentName: `Claude Code - ${projectName}`
+    });
+  } catch {
+  }
+  return ask();
+};
+var handlePreToolUse = async (input) => {
+  try {
+    const apiKey = getApiKey();
+    const policy = await getPolicy(apiKey);
+    const toolPolicy = resolvePolicy(policy, input.tool_name);
+    if (toolPolicy.timeoutSeconds === 0 && toolPolicy.timeoutAction === "approve") {
+      return allow();
+    }
+    const description = describeToolCall(input.tool_name, input.tool_input, "hook");
+    const projectName = basename(input.cwd ?? process.cwd());
+    switch (toolPolicy.mode) {
+      case "push_only":
+        return handlePushOnly(apiKey, description, projectName, toolPolicy.timeoutSeconds, toolPolicy.timeoutAction);
+      case "terminal_only":
+        return handleTerminalOnly();
+      case "push_first":
+        return handlePushFirst(apiKey, description, projectName, toolPolicy.pushFirstSeconds);
+      case "notify_only":
+        return handleNotifyOnly(apiKey, description, projectName);
+      default:
+        return handlePushFirst(apiKey, description, projectName, toolPolicy.pushFirstSeconds);
+    }
+  } catch {
+    return ask("Pushary unavailable, falling back to terminal approval");
+  }
+};
+
+export {
+  getPolicy,
+  resolvePolicy,
+  handlePreToolUse
+};

package/dist/src/index.d.ts

@@ -11,7 +11,7 @@ interface HookOutput {
         permissionDecisionReason?: string;
     };
 }
-declare const handlePreToolUse: (input: ToolInput) => Promise<HookOutput | null>;
+declare const handlePreToolUse: (input: ToolInput) => Promise<HookOutput>;
 
 interface AgentEvent {
     event: string;

package/dist/src/index.js

@@ -2,22 +2,22 @@ import {
   getPolicy,
   handlePreToolUse,
   resolvePolicy
-} from "../chunk-DF3BM6BF.js";
+} from "../chunk-WNXGIEX7.js";
 import {
   handleNotification,
   handlePostToolUse,
   handleStop,
   reportEvent
-} from "../chunk-P4JH2Q7Z.js";
+} from "../chunk-KYARP7KP.js";
 import {
   askUser,
   cancelQuestion,
   waitForAnswer
-} from "../chunk-KTP2EPVB.js";
+} from "../chunk-4Z4MB37G.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-VIST7ACL.js";
+} from "../chunk-O6A5RHWY.js";
 export {
   askUser,
   cancelQuestion,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "author": "Pushary <business@pushary.com>",
   "homepage": "https://pushary.com",
@@ -31,10 +31,11 @@
   "scripts": {
     "build": "tsup src/index.ts bin/pushary.ts bin/pushary-hook.ts bin/pushary-post-hook.ts bin/pushary-stop-hook.ts bin/pushary-codex.ts bin/pushary-setup.ts bin/pushary-clean.ts bin/pushary-doctor.ts --format esm --dts --outDir dist",
     "dev": "tsup src/index.ts bin/pushary.ts bin/pushary-hook.ts bin/pushary-post-hook.ts bin/pushary-stop-hook.ts bin/pushary-codex.ts bin/pushary-setup.ts bin/pushary-clean.ts bin/pushary-doctor.ts --format esm --watch",
-    "test": "bun test src/api.test.ts && bun test src/claude-config.test.ts && bun test src/mcp-http.test.ts"
+    "test": "bun test src/api.test.ts && bun test src/claude-config.test.ts && bun test src/mcp-http.test.ts && bun test src/retry.test.ts && bun test src/validate.test.ts && bun test src/policy.test.ts && bun test src/events.test.ts && bun test src/hook.test.ts"
   },
   "dependencies": {
-    "@inquirer/prompts": "^8.4.2"
+    "@inquirer/prompts": "^8.4.2",
+    "smol-toml": "^1.6.1"
   },
   "devDependencies": {
     "tsup": "^8.0.0",