@pushary/agent-hooks 0.50.0 → 0.52.0

package/dist/bin/pushary-session-end-hook.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   handleSessionEnd
-} from "../chunk-SCXPHMAS.js";
+} from "../chunk-5U3YC3BZ.js";
 import "../chunk-RN3NOEJF.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-WI3F6XNZ.js";
+import "../chunk-F4DGHFIW.js";
 import "../chunk-NKXSILEW.js";
 
 // bin/pushary-session-end-hook.ts

package/dist/bin/pushary-session-start-hook.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   handleSessionStart
-} from "../chunk-SCXPHMAS.js";
+} from "../chunk-5U3YC3BZ.js";
 import "../chunk-RN3NOEJF.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-WI3F6XNZ.js";
+import "../chunk-F4DGHFIW.js";
 import "../chunk-NKXSILEW.js";
 
 // bin/pushary-session-start-hook.ts

package/dist/bin/pushary-setup.js

@@ -13,7 +13,7 @@ import {
   renderAgentInstructions,
   renderProjectAgentInstructions,
   writeInstructionBlock
-} from "../chunk-FDRSMTJS.js";
+} from "../chunk-G3Y5HB4P.js";
 import {
   execNpm,
   npmErrorMessage,
@@ -25,15 +25,15 @@ import {
   addClaudeMcpServer,
   addPusharyHooks,
   addPusharyToolPermissions
-} from "../chunk-PUT2N5VA.js";
+} from "../chunk-YTW7BZUC.js";
 import {
   reportEvent
-} from "../chunk-SCXPHMAS.js";
+} from "../chunk-5U3YC3BZ.js";
 import "../chunk-RN3NOEJF.js";
 import "../chunk-DWED7BS3.js";
 import {
   isValidApiKey
-} from "../chunk-WI3F6XNZ.js";
+} from "../chunk-F4DGHFIW.js";
 import "../chunk-NKXSILEW.js";
 
 // bin/pushary-setup.ts

package/dist/bin/pushary-stats.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   readLedgerSummary
-} from "../chunk-V42K3XQI.js";
-import "../chunk-WI3F6XNZ.js";
+} from "../chunk-CANZPNGD.js";
+import "../chunk-F4DGHFIW.js";
 import {
   getApiKey
 } from "../chunk-NKXSILEW.js";

package/dist/bin/pushary-stop-hook.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   handleStop
-} from "../chunk-SCXPHMAS.js";
+} from "../chunk-5U3YC3BZ.js";
 import "../chunk-RN3NOEJF.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-WI3F6XNZ.js";
+import "../chunk-F4DGHFIW.js";
 import "../chunk-NKXSILEW.js";
 
 // bin/pushary-stop-hook.ts

package/dist/bin/pushary-stopfailure-hook.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   handleStopFailure
-} from "../chunk-SCXPHMAS.js";
+} from "../chunk-5U3YC3BZ.js";
 import "../chunk-RN3NOEJF.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-WI3F6XNZ.js";
+import "../chunk-F4DGHFIW.js";
 import "../chunk-NKXSILEW.js";
 
 // bin/pushary-stopfailure-hook.ts

package/dist/bin/pushary-upgrade.js

@@ -8,8 +8,8 @@ import {
   addClaudeMcpServer,
   addPusharyHooks,
   addPusharyToolPermissions
-} from "../chunk-PUT2N5VA.js";
-import "../chunk-WI3F6XNZ.js";
+} from "../chunk-YTW7BZUC.js";
+import "../chunk-F4DGHFIW.js";
 import {
   getApiKey
 } from "../chunk-NKXSILEW.js";

package/dist/{chunk-SCXPHMAS.js → chunk-5U3YC3BZ.js}

@@ -16,7 +16,7 @@ import {
   matchToolPattern,
   redactSecrets,
   redactSecretsDeep
-} from "./chunk-WI3F6XNZ.js";
+} from "./chunk-F4DGHFIW.js";
 import {
   getApiKey,
   getBaseUrl
@@ -168,17 +168,18 @@ var fetchModeState = async (apiKey, sessionId) => {
       headers: { "Authorization": `Bearer ${apiKey}` },
       signal: AbortSignal.timeout(3e3)
     });
-    if (!response.ok) return { mode: null, kill: false, policyVersion: null, relayUrl: null };
+    if (!response.ok) return { mode: null, kill: false, policyVersion: null, relayUrl: null, trainingConsent: false };
     const data = await response.json();
     const mode = data.override?.mode;
     return {
       mode: isApprovalMode(mode) ? mode : null,
       kill: data.kill === true,
       policyVersion: toPolicyVersion(data.policyVersion),
-      relayUrl: typeof data.relayUrl === "string" && data.relayUrl.length > 0 ? data.relayUrl : null
+      relayUrl: typeof data.relayUrl === "string" && data.relayUrl.length > 0 ? data.relayUrl : null,
+      trainingConsent: data.trainingConsent === true
     };
   } catch {
-    return { mode: null, kill: false, policyVersion: null, relayUrl: null };
+    return { mode: null, kill: false, policyVersion: null, relayUrl: null, trainingConsent: false };
   }
 };
 var fetchModeOverride = async (apiKey) => (await fetchModeState(apiKey)).mode;
@@ -807,6 +808,9 @@ var reportEvent = async (event, options = {}) => {
         ...event,
         machineId: event.machineId ?? getMachineId(),
         installMode: detectInstallMode(),
+        // Link-back for a phone-spawned session: forward the spawn id the daemon
+        // set in the environment so the server can map spawnId -> sessionId.
+        ...process.env.PUSHARY_SPAWN_ID ? { spawnId: process.env.PUSHARY_SPAWN_ID } : {},
         // Advertise that this client reads `pendingCommand` back off the
         // response, so the server may drain the phone-queued instruction on
         // activity events (tool_complete/tool_error/user_prompt), not only Stop.

package/dist/{chunk-V42K3XQI.js → chunk-CANZPNGD.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-WI3F6XNZ.js";
+} from "./chunk-F4DGHFIW.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-WI3F6XNZ.js → chunk-F4DGHFIW.js}

@@ -296,6 +296,19 @@ var APPROVAL_FATIGUE_FLAG_PATTERNS = [
   /\bterraform\s+(apply|destroy)\b/i,
   /\bdocker\s+system\s+prune\b/i
 ];
+var DELTA_STOPWORDS = /* @__PURE__ */ new Set([
+  "the",
+  "a",
+  "an",
+  "to",
+  "of",
+  "for",
+  "and",
+  "is",
+  "in",
+  "on",
+  "with"
+]);
 var HIGH_CONSEQUENCE_PATTERNS = [
   /(^|[\\/])\.env(\.|$|[\\/])/i,
   /secrets?/i,
@@ -304,6 +317,74 @@ var HIGH_CONSEQUENCE_PATTERNS = [
   /\.github[\\/]workflows/i,
   /package\.json/i
 ];
+var isCommandTool = (toolName) => {
+  const name = (toolName ?? "").toLowerCase();
+  return name === "bash" || name === "shell" || name === "run_shell_command" || name === "apply_patch" || name.includes("command");
+};
+var normalizeTarget = (toolName, toolTarget, actionBody) => {
+  const command = isCommandTool(toolName);
+  const target = toolTarget ?? "";
+  const body = actionBody ?? "";
+  const commandText = command ? body.length > 0 ? body : target : `${target}
+${body}`;
+  const path = command ? "" : target;
+  const scanText = command ? commandText : `${path}
+${body}`;
+  const highConsequence = HIGH_CONSEQUENCE_PATTERNS.some((re) => re.test(scanText));
+  return { isCommand: command, commandText, path, highConsequence };
+};
+var isDestructive = (toolName, commandText) => {
+  const haystack = `${toolName ?? ""}
+${commandText}`;
+  return APPROVAL_FATIGUE_FLAG_PATTERNS.some((re) => re.test(haystack));
+};
+var addAlnumTokens = (source, set) => {
+  for (const raw of source.toLowerCase().split(/[^a-z0-9]+/)) {
+    if (raw) set.add(raw);
+  }
+};
+var tokenize = (text) => {
+  const set = /* @__PURE__ */ new Set();
+  for (const raw of text.toLowerCase().split(/[^a-z0-9]+/)) {
+    if (raw && !DELTA_STOPWORDS.has(raw)) set.add(raw);
+  }
+  return set;
+};
+var targetTokenSet = (target) => {
+  const set = /* @__PURE__ */ new Set();
+  if (target.isCommand) {
+    const parts = target.commandText.trim().split(/\s+/).filter(Boolean);
+    if (parts[0]) addAlnumTokens(basenameOf(parts[0]), set);
+    if (parts[1]) addAlnumTokens(basenameOf(parts[1]), set);
+  } else {
+    addAlnumTokens(target.path, set);
+  }
+  return set;
+};
+var intersectionSize = (a, b) => {
+  const [small, large] = a.size <= b.size ? [a, b] : [b, a];
+  let count = 0;
+  for (const token of small) if (large.has(token)) count += 1;
+  return count;
+};
+var computeDeltaSignal = (input) => {
+  const target = normalizeTarget(input.toolName, input.toolTarget, input.actionBody);
+  const destructive = isDestructive(input.toolName, target.commandText);
+  if (!input.intent || input.intent.trim().length === 0) {
+    return { deltaSignal: "unclear", deltaScore: 0, remoteApprove: !destructive };
+  }
+  const intentTokens = tokenize(input.intent);
+  const targetTokens = targetTokenSet(target);
+  const overlap = intersectionSize(intentTokens, targetTokens);
+  const zeroOverlap = overlap === 0 && targetTokens.size > 0;
+  if (zeroOverlap && (destructive || target.highConsequence)) {
+    return { deltaSignal: "mismatch", deltaScore: 1, remoteApprove: false };
+  }
+  if (zeroOverlap) {
+    return { deltaSignal: "unclear", deltaScore: 0.5, remoteApprove: true };
+  }
+  return { deltaSignal: "match", deltaScore: 0, remoteApprove: !destructive };
+};
 var SECRET_REDACTION_RULES = [
   { pattern: /-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z0-9 ]*PRIVATE KEY-----/g, replacement: "[redacted key]" },
   { pattern: /\bsk-[A-Za-z0-9_-]{16,}\b/g, replacement: "[redacted]" },
@@ -335,6 +416,164 @@ var classifyDecisionRisk = (toolName, toolTarget) => {
   if (matchesAny(HIGH_CONSEQUENCE_PATTERNS)) return "elevated";
   return "standard";
 };
+var POLICY_CAPABILITIES = ["read", "edit", "shell", "network", "destructive"];
+var CAPABILITY_PATTERNS = {
+  read: ["Read", "Grep", "Glob", "LS", "NotebookRead"],
+  edit: ["Edit", "Write"],
+  shell: ["Bash"],
+  network: [
+    "WebFetch",
+    "Bash(curl:*)",
+    "Bash(wget:*)",
+    "Bash(nc:*)",
+    "Bash(ssh:*)",
+    "Bash(scp:*)",
+    "Bash(npm install:*)",
+    "Bash(npm i:*)",
+    "Bash(pnpm add:*)",
+    "Bash(yarn add:*)",
+    "Bash(bun add:*)",
+    "Bash(pip install:*)",
+    "Bash(brew install:*)",
+    "Bash(apt:*)",
+    "Bash(apt-get:*)"
+  ],
+  destructive: [
+    "Bash(rm:*)",
+    "Bash(rmdir:*)",
+    "Bash(sudo:*)",
+    "Bash(git push:*)",
+    "Bash(git reset --hard:*)",
+    "Bash(git clean:*)",
+    "Bash(npm publish:*)",
+    "Bash(kubectl delete:*)",
+    "Bash(terraform apply:*)",
+    "Bash(terraform destroy:*)",
+    "Bash(docker system prune:*)",
+    "Bash(dropdb:*)",
+    "Bash(mkfs:*)"
+  ]
+};
+var DECISION_EPISODE_SCHEMA_VERSION = 1;
+var DECISION_FEATURE_EXTRACTOR = `pushary-hooks/schema-${DECISION_EPISODE_SCHEMA_VERSION}`;
+var EPISODE_CAPABILITIES = [...POLICY_CAPABILITIES, "other"];
+var NETWORK_COMMAND_PATTERNS = [
+  /\bcurl\b/i,
+  /\bwget\b/i,
+  /\bnc\b/i,
+  /\bssh\b/i,
+  /\bscp\b/i,
+  /\b(?:npm|pnpm|yarn|bun)\s+(?:install|i|add)\b/i,
+  /\bpip\s+install\b/i,
+  /\bbrew\s+install\b/i,
+  /\bapt(?:-get)?\s+(?:install|update|upgrade)\b/i
+];
+var SECRET_TARGET_PATTERNS = [
+  /(^|[\\/])\.env(\.|$|[\\/])/i,
+  /secrets?/i,
+  /credentials?/i,
+  /private[_-]?key/i,
+  /\.pem$/i
+];
+var READ_TOOL_NAMES = new Set(CAPABILITY_PATTERNS.read);
+var EDIT_TOOL_NAMES = new Set(CAPABILITY_PATTERNS.edit);
+var deriveEpisodeCapability = (toolName, commandText) => {
+  if (READ_TOOL_NAMES.has(toolName)) return "read";
+  if (EDIT_TOOL_NAMES.has(toolName)) return "edit";
+  if (toolName === "WebFetch" || toolName === "WebSearch") return "network";
+  if (isCommandTool(toolName)) {
+    if (isDestructive(toolName, commandText)) return "destructive";
+    if (NETWORK_COMMAND_PATTERNS.some((re) => re.test(commandText))) return "network";
+    return "shell";
+  }
+  if (isDestructive(toolName, commandText)) return "destructive";
+  return "other";
+};
+var deriveTargetClass = (path) => {
+  const p = path.toLowerCase();
+  if (!p) return "other";
+  if (SECRET_TARGET_PATTERNS.some((re) => re.test(p))) return "secret";
+  if (/(^|[\\/])(?:tests?|__tests__|spec)([\\/]|$)|\.(?:test|spec)\.[a-z0-9]+$/i.test(p)) return "test";
+  if (/\.(?:md|mdx|txt|rst)$|(^|[\\/])docs?([\\/]|$)/i.test(p)) return "docs";
+  if (/(^|[\\/])(?:package\.json|tsconfig[^\\/]*\.json|\.[a-z]+rc)$|\.(?:json|ya?ml|toml|ini|conf|cfg)$/i.test(p)) return "config";
+  if (/\.(?:ts|tsx|js|jsx|mjs|cjs|py|go|rs|java|rb|php|c|cc|cpp|h|hpp|cs|swift|kt|scala|sh)$/i.test(p)) return "source";
+  return "other";
+};
+var bucketArgCount = (n) => n <= 0 ? "none" : n <= 3 ? "few" : "many";
+var bucketLength = (n) => n < 40 ? "short" : n < 200 ? "medium" : "long";
+var deriveArgShape = (isCommand, commandText, path) => {
+  const text = isCommand ? commandText : path;
+  const tokenCount = isCommand ? text.trim().split(/\s+/).filter(Boolean).length : 0;
+  return {
+    hasPipe: isCommand && /(?<!\|)\|(?!\|)/.test(text),
+    hasRedirect: isCommand && /(?<![0-9])[<>]/.test(text),
+    hasChain: isCommand && /&&|\|\||;/.test(text),
+    hasSudo: /\bsudo\b/i.test(text),
+    hasGlob: isCommand && /[*?]/.test(text),
+    hasSubshell: isCommand && /\$\(|`/.test(text),
+    touchesSecretPath: SECRET_TARGET_PATTERNS.some((re) => re.test(text)),
+    // The command word itself is not an argument, so subtract one.
+    argCountBucket: bucketArgCount(isCommand ? Math.max(0, tokenCount - 1) : 0),
+    lengthBucket: bucketLength(text.length)
+  };
+};
+var deriveReversibility = (capability, riskClass) => {
+  if (capability === "read") return "none";
+  if (capability === "destructive" || riskClass === "destructive") return "irreversible";
+  return "reversible";
+};
+var deriveBlastRadius = (capability, riskClass, targetClass) => {
+  if (capability === "read") return "low";
+  if (capability === "destructive" || riskClass === "destructive" || targetClass === "secret") return "high";
+  if (capability === "network" || capability === "shell" || riskClass === "elevated" || targetClass === "config") return "medium";
+  return "low";
+};
+var deriveLabelTier = (origin, decision) => {
+  if (origin === "autopilot") return "none";
+  if (origin === "human" && (decision === "approve" || decision === "deny")) return "bronze";
+  return "bronze";
+};
+var buildDecisionEpisodeFeatures = (input) => {
+  const isCommand = isCommandTool(input.toolName);
+  const raw = input.commandOrPath ?? input.toolTarget ?? "";
+  const commandText = isCommand ? raw : "";
+  const path = isCommand ? "" : raw;
+  const capability = deriveEpisodeCapability(input.toolName, commandText);
+  const riskClass = classifyDecisionRisk(input.toolName, input.toolTarget ?? raw);
+  const targetClass = isCommand ? SECRET_TARGET_PATTERNS.some((re) => re.test(commandText)) ? "secret" : "other" : deriveTargetClass(path);
+  const argShape = deriveArgShape(isCommand, commandText, path);
+  const { deltaSignal } = computeDeltaSignal({
+    intent: input.intent,
+    toolName: input.toolName,
+    toolTarget: input.toolTarget,
+    actionBody: input.commandOrPath
+  });
+  return {
+    schemaVersion: DECISION_EPISODE_SCHEMA_VERSION,
+    extractorVersion: DECISION_FEATURE_EXTRACTOR,
+    capability,
+    toolFamily: input.toolName.trim().slice(0, 40),
+    riskClass,
+    targetClass,
+    argShape,
+    reversibility: deriveReversibility(capability, riskClass),
+    blastRadius: deriveBlastRadius(capability, riskClass, targetClass),
+    deltaSignal,
+    preset: input.preset,
+    // A policy artifact (usually canonical like `Bash(rm:*)`), but a user could
+    // author a custom pattern, so scrub secrets defensively before it is stored.
+    matchedPattern: input.matchedPattern ? redactSecretsDeep(input.matchedPattern).slice(0, 120) : void 0,
+    policyMode: input.policyMode,
+    requestedGate: input.requestedGate,
+    timeoutSeconds: input.timeoutSeconds,
+    timeoutAction: input.timeoutAction,
+    decision: input.decision,
+    origin: input.origin,
+    latencyMs: input.latencyMs,
+    labelTier: deriveLabelTier(input.origin, input.decision),
+    agentType: input.agentType
+  };
+};
 
 export {
   isApprovalMode,
@@ -351,5 +590,6 @@ export {
   DECISION_LINE_MAX,
   redactSecrets,
   redactSecretsDeep,
-  classifyDecisionRisk
+  classifyDecisionRisk,
+  buildDecisionEpisodeFeatures
 };

package/dist/{chunk-FDRSMTJS.js → chunk-G3Y5HB4P.js}

@@ -1,6 +1,6 @@
 import {
   HOOK_BUDGETS
-} from "./chunk-WI3F6XNZ.js";
+} from "./chunk-F4DGHFIW.js";
 
 // src/codex-config.ts
 import { createHash } from "crypto";

package/dist/{chunk-M24KUFLW.js → chunk-JKSSDN2O.js}

@@ -1,6 +1,6 @@
 import {
   PRETOOLUSE_HANDLED_TOOLS
-} from "./chunk-PUT2N5VA.js";
+} from "./chunk-YTW7BZUC.js";
 import {
   denyReasonFrom,
   isDeferAnswer
@@ -23,23 +23,47 @@ import {
   sendNotification,
   throttlePass,
   waitForAnswer
-} from "./chunk-SCXPHMAS.js";
+} from "./chunk-5U3YC3BZ.js";
 import {
   getMachineId
 } from "./chunk-RN3NOEJF.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-V42K3XQI.js";
+} from "./chunk-CANZPNGD.js";
 import {
+  buildDecisionEpisodeFeatures,
   effectiveWaitSeconds,
   hookWaitClamped,
   hookWaitDeadline
-} from "./chunk-WI3F6XNZ.js";
+} from "./chunk-F4DGHFIW.js";
 import {
-  getApiKey
+  getApiKey,
+  getBaseUrl
 } from "./chunk-NKXSILEW.js";
 
+// src/decision-episode.ts
+var EPISODE_PATH = "/api/agent/decision-episode";
+var EMIT_TIMEOUT_MS = 3e3;
+var buildEpisodeBody = (input) => ({
+  sessionId: input.sessionId,
+  machineId: input.machineId,
+  agentType: input.agentType,
+  features: buildDecisionEpisodeFeatures(input)
+});
+var reportDecisionEpisode = async (apiKey, input) => {
+  try {
+    const baseUrl = getBaseUrl();
+    await fetch(`${baseUrl}${EPISODE_PATH}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify(buildEpisodeBody(input)),
+      signal: AbortSignal.timeout(EMIT_TIMEOUT_MS)
+    });
+  } catch {
+  }
+};
+
 // src/hook.ts
 import { basename, join } from "path";
 import { tmpdir } from "os";
@@ -90,7 +114,7 @@ var pollForAnswer = async (apiKey, correlationId, deadlineMs, pollInterval = 2e3
   }
   return { answered: false };
 };
-var handlePushOnly = async (apiKey, description, projectName, timeoutSeconds, timeoutAction, sessionId, machineId, toolName, toolTarget, decision) => {
+var handlePushOnly = async (apiKey, description, projectName, timeoutSeconds, timeoutAction, sessionId, machineId, toolName, toolTarget, decision, signals) => {
   let result;
   try {
     result = await askUser(apiKey, {
@@ -136,6 +160,7 @@ var handlePushOnly = async (apiKey, description, projectName, timeoutSeconds, ti
   const answer = await pollForAnswer(apiKey, result.correlationId, deadline);
   if (answer.answered) {
     if (isDeferAnswer(answer.value)) return ask("Handling on your machine");
+    signals.humanDecision = true;
     return answer.value === "yes" ? allow() : deny(denyReasonFrom(answer.value));
   }
   if (timeoutAction === "wait" || clampCut) {
@@ -154,7 +179,7 @@ var handlePushOnly = async (apiKey, description, projectName, timeoutSeconds, ti
 var handleTerminalOnly = () => {
   return ask();
 };
-var handlePushFirst = async (apiKey, description, projectName, pushFirstSeconds, sessionId, machineId, toolName, toolTarget, decision) => {
+var handlePushFirst = async (apiKey, description, projectName, pushFirstSeconds, sessionId, machineId, toolName, toolTarget, decision, signals) => {
   let result;
   try {
     result = await askUser(apiKey, {
@@ -183,6 +208,7 @@ var handlePushFirst = async (apiKey, description, projectName, pushFirstSeconds,
   const answer = await pollForAnswer(apiKey, result.correlationId, deadline, 1500);
   if (answer.answered) {
     if (isDeferAnswer(answer.value)) return ask("Handling on your machine");
+    signals.humanDecision = true;
     return answer.value === "yes" ? allow() : deny(denyReasonFrom(answer.value));
   }
   savePendingQuestion(sessionId || DEFAULT_SESSION, result.correlationId);
@@ -201,7 +227,36 @@ var handleNotifyOnly = async (apiKey, description, projectName, sessionId, machi
   }
   return ask();
 };
-var dispatchModeHandler = async (apiKey, input, toolPolicy, machineId) => {
+var CLAUDE_AGENT_TYPE = "claude_code";
+var emitDecisionEpisode = (apiKey, input, toolPolicy, machineId, toolTarget, decision, result) => {
+  const verdict = result?.hookSpecificOutput?.permissionDecision;
+  const outcome = verdict === "allow" ? "approve" : verdict === "deny" ? "deny" : null;
+  if (!outcome) return;
+  const ti = input.tool_input ?? {};
+  const commandOrPath = typeof ti.command === "string" ? ti.command : typeof ti.file_path === "string" ? ti.file_path : typeof ti.path === "string" ? ti.path : void 0;
+  void reportDecisionEpisode(apiKey, {
+    toolName: input.tool_name,
+    commandOrPath,
+    intent: decision.intent,
+    toolTarget,
+    agentType: CLAUDE_AGENT_TYPE,
+    matchedPattern: toolPolicy.tool,
+    policyMode: toolPolicy.mode,
+    timeoutSeconds: toolPolicy.timeoutSeconds,
+    timeoutAction: toolPolicy.timeoutAction,
+    // Reaching a handler means a human gate was requested (auto-allow/deny
+    // returned earlier in the caller before dispatch).
+    requestedGate: "ask",
+    decision: outcome,
+    // Truthfully human: the caller only emits when signals.humanDecision is set
+    // (a real phone answer). Bronze label until reason + execution-outcome land.
+    origin: "human",
+    latencyMs: Date.now() - START_MS,
+    sessionId: input.session_id,
+    machineId
+  });
+};
+var dispatchModeHandler = async (apiKey, input, toolPolicy, machineId, trainingConsent = false) => {
   const description = describeToolCall(input.tool_name, input.tool_input, "hook");
   const projectName = basename(input.cwd ?? process.cwd());
   const sessionId = input.session_id;
@@ -213,18 +268,26 @@ var dispatchModeHandler = async (apiKey, input, toolPolicy, machineId) => {
     blocker: deriveBlocker(toolPolicy.mode),
     actionBody: deriveActionBody(input.tool_name, input.tool_input)
   };
-  switch (toolPolicy.mode) {
-    case "push_only":
-      return handlePushOnly(apiKey, description, projectName, toolPolicy.timeoutSeconds, toolPolicy.timeoutAction, sessionId, machineId, input.tool_name, toolTarget, decision);
-    case "terminal_only":
-      return handleTerminalOnly();
-    case "push_first":
-      return handlePushFirst(apiKey, description, projectName, toolPolicy.pushFirstSeconds, sessionId, machineId, input.tool_name, toolTarget, decision);
-    case "notify_only":
-      return handleNotifyOnly(apiKey, description, projectName, sessionId, machineId);
-    default:
-      return handlePushFirst(apiKey, description, projectName, toolPolicy.pushFirstSeconds, sessionId, machineId, input.tool_name, toolTarget, decision);
+  const signals = {};
+  const runHandler = () => {
+    switch (toolPolicy.mode) {
+      case "push_only":
+        return handlePushOnly(apiKey, description, projectName, toolPolicy.timeoutSeconds, toolPolicy.timeoutAction, sessionId, machineId, input.tool_name, toolTarget, decision, signals);
+      case "terminal_only":
+        return Promise.resolve(handleTerminalOnly());
+      case "push_first":
+        return handlePushFirst(apiKey, description, projectName, toolPolicy.pushFirstSeconds, sessionId, machineId, input.tool_name, toolTarget, decision, signals);
+      case "notify_only":
+        return handleNotifyOnly(apiKey, description, projectName, sessionId, machineId);
+      default:
+        return handlePushFirst(apiKey, description, projectName, toolPolicy.pushFirstSeconds, sessionId, machineId, input.tool_name, toolTarget, decision, signals);
+    }
+  };
+  const result = await runHandler();
+  if (trainingConsent && signals.humanDecision) {
+    emitDecisionEpisode(apiKey, input, toolPolicy, machineId, toolTarget, decision, result);
   }
+  return result;
 };
 var KEYLESS_NOTICE = "[pushary] Not connected (no API key), so your agent runs untouched. Approval moments are counted locally; see them with: npx @pushary/agent-hooks@latest stats. Connect: https://pushary.com/sign-up?utm_source=cli&utm_medium=keyless-hook";
 var keylessNoticeOnce = (sessionId) => {
@@ -339,7 +402,7 @@ var handlePreToolUse = async (input) => {
     if (toolPolicy.timeoutSeconds === 0 && toolPolicy.timeoutAction === "deny") {
       return deny(`Denied by policy for ${toolPolicy.tool}`);
     }
-    return dispatchModeHandler(apiKey, input, toolPolicy, getMachineId());
+    return dispatchModeHandler(apiKey, input, toolPolicy, getMachineId(), modeState.trainingConsent);
   } catch {
     return void 0;
   }
@@ -364,7 +427,10 @@ var toPermissionRequestOutput = (hookOutput) => {
   return void 0;
 };
 var handlePermissionRequest = async (input) => {
-  if (PRETOOLUSE_HANDLED_TOOLS.has(input.tool_name)) return void 0;
+  if (PRETOOLUSE_HANDLED_TOOLS.has(input.tool_name)) {
+    const reclaimDeferredExec = input.tool_name !== "AskUserQuestion" && shouldDeferToNativeMode(input.permission_mode, input.tool_name);
+    if (!reclaimDeferredExec) return void 0;
+  }
   if (input.tool_name.startsWith("mcp__pushary__")) return void 0;
   let apiKey;
   try {
@@ -381,7 +447,7 @@ var handlePermissionRequest = async (input) => {
     if (toolPolicy.timeoutSeconds === 0 && toolPolicy.timeoutAction === "deny") {
       return permReqDeny(`Denied by policy for ${toolPolicy.tool}`);
     }
-    return toPermissionRequestOutput(await dispatchModeHandler(apiKey, input, toolPolicy, getMachineId()));
+    return toPermissionRequestOutput(await dispatchModeHandler(apiKey, input, toolPolicy, getMachineId(), modeState.trainingConsent));
   } catch {
     return void 0;
   }

package/dist/{chunk-PUT2N5VA.js → chunk-YTW7BZUC.js}

@@ -1,6 +1,6 @@
 import {
   HOOK_BUDGETS
-} from "./chunk-WI3F6XNZ.js";
+} from "./chunk-F4DGHFIW.js";
 
 // src/claude-config.ts
 import { join } from "path";

package/dist/src/index.d.ts

@@ -34,6 +34,7 @@ interface ModeState {
     readonly kill: boolean;
     readonly policyVersion: string | null;
     readonly relayUrl: string | null;
+    readonly trainingConsent?: boolean;
 }
 declare const fetchModeState: (apiKey: string, sessionId?: string) => Promise<ModeState>;
 declare const fetchModeOverride: (apiKey: string) => Promise<ApprovalMode | null>;

package/dist/src/index.js

@@ -1,7 +1,7 @@
 import {
   handlePreToolUse
-} from "../chunk-M24KUFLW.js";
-import "../chunk-PUT2N5VA.js";
+} from "../chunk-JKSSDN2O.js";
+import "../chunk-YTW7BZUC.js";
 import "../chunk-KQYIHZ5E.js";
 import {
   askUser,
@@ -15,11 +15,11 @@ import {
   reportEvent,
   resolvePolicy,
   waitForAnswer
-} from "../chunk-SCXPHMAS.js";
+} from "../chunk-5U3YC3BZ.js";
 import "../chunk-RN3NOEJF.js";
-import "../chunk-V42K3XQI.js";
+import "../chunk-CANZPNGD.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-WI3F6XNZ.js";
+import "../chunk-F4DGHFIW.js";
 import {
   getApiKey,
   getBaseUrl