@pushary/agent-hooks 0.57.0 → 0.59.0

package/dist/bin/pushary-claude.js

@@ -17,14 +17,14 @@ import {
   reportEvent,
   resolvePolicy,
   waitForAnswer
-} from "../chunk-LEWSYLHL.js";
+} from "../chunk-WNRYRN2R.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
 import "../chunk-DWED7BS3.js";
 import {
   redactSecrets
-} from "../chunk-SYAAGYLZ.js";
+} from "../chunk-DQAN3JQP.js";
 import {
   getApiKey,
   getBaseUrl

package/dist/bin/pushary-clean.js

@@ -6,15 +6,15 @@ import {
   removeCodexHooks,
   removeGeminiSettings,
   removeInstructionBlock
-} from "../chunk-GSERIC6Q.js";
+} from "../chunk-BVAWO6RE.js";
 import {
   execNpm
 } from "../chunk-J7JWI3KU.js";
 import {
   removeClaudeMcpServers,
   removePusharySettings
-} from "../chunk-QYQO6RHJ.js";
-import "../chunk-SYAAGYLZ.js";
+} from "../chunk-CAJZAFVS.js";
+import "../chunk-DQAN3JQP.js";
 
 // bin/pushary-clean.ts
 import { existsSync, readFileSync, writeFileSync, rmSync, readdirSync } from "fs";

package/dist/bin/pushary-codex-hook.js

@@ -31,21 +31,21 @@ import {
   toCodexWire,
   toPolicyLookup,
   waitForAnswer
-} from "../chunk-LEWSYLHL.js";
+} from "../chunk-WNRYRN2R.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-5TECIV6T.js";
+} from "../chunk-WLGEY4UX.js";
 import "../chunk-DWED7BS3.js";
 import {
   DECISION_LINE_MAX,
   effectiveWaitSeconds,
   hookWaitClamped,
   hookWaitDeadline
-} from "../chunk-SYAAGYLZ.js";
+} from "../chunk-DQAN3JQP.js";
 import {
   getApiKey
 } from "../chunk-NKXSILEW.js";

package/dist/bin/pushary-codex.js

@@ -3,12 +3,12 @@ import {
   askUser,
   reportEvent,
   waitForAnswer
-} from "../chunk-LEWSYLHL.js";
+} from "../chunk-WNRYRN2R.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-SYAAGYLZ.js";
+import "../chunk-DQAN3JQP.js";
 import {
   getApiKey
 } from "../chunk-NKXSILEW.js";

package/dist/bin/pushary-doctor.js

@@ -11,18 +11,18 @@ import {
   missingGeminiHookEvents,
   readCodexMcpAuth,
   untrustedCodexHookEvents
-} from "../chunk-GSERIC6Q.js";
+} from "../chunk-BVAWO6RE.js";
 import {
   execNpm
 } from "../chunk-J7JWI3KU.js";
 import {
   readLedgerSummary
-} from "../chunk-5TECIV6T.js";
+} from "../chunk-WLGEY4UX.js";
 import {
   callMcpTool,
   sendMcpRequest
 } from "../chunk-DWED7BS3.js";
-import "../chunk-SYAAGYLZ.js";
+import "../chunk-DQAN3JQP.js";
 import {
   getBaseUrl
 } from "../chunk-NKXSILEW.js";

package/dist/bin/pushary-gemini-hook.js

@@ -23,21 +23,21 @@ import {
   savePendingQuestion,
   sendNotification,
   waitForAnswer
-} from "../chunk-LEWSYLHL.js";
+} from "../chunk-WNRYRN2R.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-5TECIV6T.js";
+} from "../chunk-WLGEY4UX.js";
 import "../chunk-DWED7BS3.js";
 import {
   DECISION_LINE_MAX,
   effectiveWaitSeconds,
   hookWaitClamped,
   hookWaitDeadline
-} from "../chunk-SYAAGYLZ.js";
+} from "../chunk-DQAN3JQP.js";
 import {
   getApiKey
 } from "../chunk-NKXSILEW.js";

package/dist/bin/pushary-hook.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import {
   handlePreToolUse
-} from "../chunk-NPYANTRC.js";
-import "../chunk-QYQO6RHJ.js";
+} from "../chunk-BE5X3WXL.js";
+import "../chunk-CAJZAFVS.js";
 import "../chunk-YHG74UFF.js";
-import "../chunk-LEWSYLHL.js";
+import "../chunk-WNRYRN2R.js";
 import "../chunk-RN3NOEJF.js";
-import "../chunk-5TECIV6T.js";
+import "../chunk-WLGEY4UX.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-SYAAGYLZ.js";
+import "../chunk-DQAN3JQP.js";
 import "../chunk-NKXSILEW.js";
 
 // bin/pushary-hook.ts

package/dist/bin/pushary-notification-hook.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   handleNotification
-} from "../chunk-LEWSYLHL.js";
+} from "../chunk-WNRYRN2R.js";
 import "../chunk-RN3NOEJF.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-SYAAGYLZ.js";
+import "../chunk-DQAN3JQP.js";
 import "../chunk-NKXSILEW.js";
 
 // bin/pushary-notification-hook.ts

package/dist/bin/pushary-permission-denied-hook.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import {
   handlePermissionDenied
-} from "../chunk-NPYANTRC.js";
-import "../chunk-QYQO6RHJ.js";
+} from "../chunk-BE5X3WXL.js";
+import "../chunk-CAJZAFVS.js";
 import "../chunk-YHG74UFF.js";
-import "../chunk-LEWSYLHL.js";
+import "../chunk-WNRYRN2R.js";
 import "../chunk-RN3NOEJF.js";
-import "../chunk-5TECIV6T.js";
+import "../chunk-WLGEY4UX.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-SYAAGYLZ.js";
+import "../chunk-DQAN3JQP.js";
 import "../chunk-NKXSILEW.js";
 
 // bin/pushary-permission-denied-hook.ts

package/dist/bin/pushary-permission-hook.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import {
   handlePermissionRequest
-} from "../chunk-NPYANTRC.js";
-import "../chunk-QYQO6RHJ.js";
+} from "../chunk-BE5X3WXL.js";
+import "../chunk-CAJZAFVS.js";
 import "../chunk-YHG74UFF.js";
-import "../chunk-LEWSYLHL.js";
+import "../chunk-WNRYRN2R.js";
 import "../chunk-RN3NOEJF.js";
-import "../chunk-5TECIV6T.js";
+import "../chunk-WLGEY4UX.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-SYAAGYLZ.js";
+import "../chunk-DQAN3JQP.js";
 import "../chunk-NKXSILEW.js";
 
 // bin/pushary-permission-hook.ts

package/dist/bin/pushary-post-hook.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   handlePostToolUse
-} from "../chunk-LEWSYLHL.js";
+} from "../chunk-WNRYRN2R.js";
 import "../chunk-RN3NOEJF.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-SYAAGYLZ.js";
+import "../chunk-DQAN3JQP.js";
 import "../chunk-NKXSILEW.js";
 
 // bin/pushary-post-hook.ts

package/dist/bin/pushary-prompt-hook.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   handleUserPrompt
-} from "../chunk-LEWSYLHL.js";
+} from "../chunk-WNRYRN2R.js";
 import "../chunk-RN3NOEJF.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-SYAAGYLZ.js";
+import "../chunk-DQAN3JQP.js";
 import "../chunk-NKXSILEW.js";
 
 // bin/pushary-prompt-hook.ts

package/dist/bin/pushary-session-end-hook.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   handleSessionEnd
-} from "../chunk-LEWSYLHL.js";
+} from "../chunk-WNRYRN2R.js";
 import "../chunk-RN3NOEJF.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-SYAAGYLZ.js";
+import "../chunk-DQAN3JQP.js";
 import "../chunk-NKXSILEW.js";
 
 // bin/pushary-session-end-hook.ts

package/dist/bin/pushary-session-start-hook.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   handleSessionStart
-} from "../chunk-LEWSYLHL.js";
+} from "../chunk-WNRYRN2R.js";
 import "../chunk-RN3NOEJF.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-SYAAGYLZ.js";
+import "../chunk-DQAN3JQP.js";
 import "../chunk-NKXSILEW.js";
 
 // bin/pushary-session-start-hook.ts

package/dist/bin/pushary-setup.js

@@ -13,7 +13,7 @@ import {
   renderAgentInstructions,
   renderProjectAgentInstructions,
   writeInstructionBlock
-} from "../chunk-GSERIC6Q.js";
+} from "../chunk-BVAWO6RE.js";
 import {
   execNpm,
   npmErrorMessage,
@@ -25,15 +25,15 @@ import {
   addClaudeMcpServer,
   addPusharyHooks,
   addPusharyToolPermissions
-} from "../chunk-QYQO6RHJ.js";
+} from "../chunk-CAJZAFVS.js";
 import {
   reportEvent
-} from "../chunk-LEWSYLHL.js";
+} from "../chunk-WNRYRN2R.js";
 import "../chunk-RN3NOEJF.js";
 import "../chunk-DWED7BS3.js";
 import {
   isValidApiKey
-} from "../chunk-SYAAGYLZ.js";
+} from "../chunk-DQAN3JQP.js";
 import "../chunk-NKXSILEW.js";
 
 // bin/pushary-setup.ts

package/dist/bin/pushary-stats.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   readLedgerSummary
-} from "../chunk-5TECIV6T.js";
-import "../chunk-SYAAGYLZ.js";
+} from "../chunk-WLGEY4UX.js";
+import "../chunk-DQAN3JQP.js";
 import {
   getApiKey
 } from "../chunk-NKXSILEW.js";

package/dist/bin/pushary-stop-hook.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   handleStop
-} from "../chunk-LEWSYLHL.js";
+} from "../chunk-WNRYRN2R.js";
 import "../chunk-RN3NOEJF.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-SYAAGYLZ.js";
+import "../chunk-DQAN3JQP.js";
 import "../chunk-NKXSILEW.js";
 
 // bin/pushary-stop-hook.ts

package/dist/bin/pushary-stopfailure-hook.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   handleStopFailure
-} from "../chunk-LEWSYLHL.js";
+} from "../chunk-WNRYRN2R.js";
 import "../chunk-RN3NOEJF.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-SYAAGYLZ.js";
+import "../chunk-DQAN3JQP.js";
 import "../chunk-NKXSILEW.js";
 
 // bin/pushary-stopfailure-hook.ts

package/dist/bin/pushary-upgrade.js

@@ -8,8 +8,8 @@ import {
   addClaudeMcpServer,
   addPusharyHooks,
   addPusharyToolPermissions
-} from "../chunk-QYQO6RHJ.js";
-import "../chunk-SYAAGYLZ.js";
+} from "../chunk-CAJZAFVS.js";
+import "../chunk-DQAN3JQP.js";
 import {
   getApiKey
 } from "../chunk-NKXSILEW.js";

package/dist/{chunk-NPYANTRC.js → chunk-BE5X3WXL.js}

@@ -1,6 +1,6 @@
 import {
   PRETOOLUSE_HANDLED_TOOLS
-} from "./chunk-QYQO6RHJ.js";
+} from "./chunk-CAJZAFVS.js";
 import {
   denyReasonFrom,
   isDeferAnswer
@@ -21,23 +21,27 @@ import {
   repoKeyFor,
   resolvePolicy,
   savePendingQuestion,
+  scopePathFor,
   sendNotification,
   throttlePass,
   waitForAnswer
-} from "./chunk-LEWSYLHL.js";
+} from "./chunk-WNRYRN2R.js";
 import {
   getMachineId
 } from "./chunk-RN3NOEJF.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-5TECIV6T.js";
+} from "./chunk-WLGEY4UX.js";
 import {
   buildDecisionEpisodeFeatures,
   effectiveWaitSeconds,
+  evaluateScope,
   hookWaitClamped,
-  hookWaitDeadline
-} from "./chunk-SYAAGYLZ.js";
+  hookWaitDeadline,
+  scopeChangeReason,
+  scopeRequiresHuman
+} from "./chunk-DQAN3JQP.js";
 import {
   getApiKey,
   getBaseUrl
@@ -257,7 +261,7 @@ var emitDecisionEpisode = (apiKey, input, toolPolicy, machineId, toolTarget, dec
     machineId
   });
 };
-var dispatchModeHandler = async (apiKey, input, toolPolicy, machineId, trainingConsent = false) => {
+var dispatchModeHandler = async (apiKey, input, toolPolicy, machineId, trainingConsent = false, scopeReason, scopePath) => {
   const description = describeToolCall(input.tool_name, input.tool_input, "hook");
   const projectName = basename(input.cwd ?? process.cwd());
   const sessionId = input.session_id;
@@ -266,8 +270,11 @@ var dispatchModeHandler = async (apiKey, input, toolPolicy, machineId, trainingC
   const decision = {
     intent,
     action: deriveAction(input.tool_name, input.tool_input),
-    blocker: deriveBlocker(toolPolicy.mode),
-    actionBody: deriveActionBody(input.tool_name, input.tool_input)
+    blocker: scopeReason ?? deriveBlocker(toolPolicy.mode),
+    actionBody: deriveActionBody(input.tool_name, input.tool_input),
+    // Only when the breach is what caused the question, so an ordinary approval
+    // can never silently widen a scope.
+    scopePath: scopeReason ? scopePath : void 0
   };
   const signals = {};
   const runHandler = () => {
@@ -397,13 +404,16 @@ var handlePreToolUse = async (input) => {
       return void 0;
     }
     const toolPolicy = resolvePolicy(policy, input.tool_name, modeState.mode, input.tool_input, input.cwd, repoKeyFor(input.cwd));
+    const scopePath = modeState.scope ? scopePathFor(input.tool_name, input.tool_input, input.cwd) : void 0;
+    const scopeVerdict = evaluateScope(modeState.scope, scopePath);
+    const scopeReason = scopeChangeReason(scopeVerdict);
     if (toolPolicy.timeoutSeconds === 0 && toolPolicy.timeoutAction === "approve") {
-      return allow();
+      if (!scopeRequiresHuman(scopeVerdict)) return allow();
     }
     if (toolPolicy.timeoutSeconds === 0 && toolPolicy.timeoutAction === "deny") {
       return deny(`Denied by policy for ${toolPolicy.tool}`);
     }
-    return dispatchModeHandler(apiKey, input, toolPolicy, getMachineId(), modeState.trainingConsent);
+    return dispatchModeHandler(apiKey, input, toolPolicy, getMachineId(), modeState.trainingConsent, scopeReason, scopePath);
   } catch {
     return void 0;
   }

package/dist/{chunk-GSERIC6Q.js → chunk-BVAWO6RE.js}

@@ -1,6 +1,6 @@
 import {
   HOOK_BUDGETS
-} from "./chunk-SYAAGYLZ.js";
+} from "./chunk-DQAN3JQP.js";
 
 // src/codex-config.ts
 import { createHash } from "crypto";

package/dist/{chunk-QYQO6RHJ.js → chunk-CAJZAFVS.js}

@@ -1,6 +1,6 @@
 import {
   HOOK_BUDGETS
-} from "./chunk-SYAAGYLZ.js";
+} from "./chunk-DQAN3JQP.js";
 
 // src/claude-config.ts
 import { join } from "path";

package/dist/{chunk-SYAAGYLZ.js → chunk-DQAN3JQP.js}

@@ -724,6 +724,39 @@ var buildDecisionEpisodeFeatures = (input) => {
     agentType: input.agentType
   };
 };
+var matchesGlobPath = (glob, path) => {
+  if (glob === path) return true;
+  const compiled = compiledGlob(glob);
+  return compiled ? matchGlobTokens(compiled, path) : false;
+};
+var evaluateScope = (contract, path) => {
+  if (!contract) return { outcome: "no_contract" };
+  if (typeof path !== "string" || path.length === 0) return { outcome: "in_scope" };
+  for (const rule of contract.offLimitsPaths) {
+    if (matchesGlobPath(rule, path)) return { outcome: "off_limits", path, rule };
+  }
+  if (contract.allowedPaths.length === 0) return { outcome: "in_scope" };
+  for (const rule of contract.allowedPaths) {
+    if (matchesGlobPath(rule, path)) return { outcome: "in_scope" };
+  }
+  return { outcome: "out_of_scope", path };
+};
+var scopeRequiresHuman = (verdict) => verdict.outcome === "out_of_scope" || verdict.outcome === "off_limits";
+var scopeChangeReason = (verdict) => {
+  if (verdict.outcome === "out_of_scope") {
+    return `Outside the scope you approved: ${verdict.path}`;
+  }
+  if (verdict.outcome === "off_limits") {
+    return `You marked this off limits: ${verdict.path} (${verdict.rule})`;
+  }
+  return void 0;
+};
+var isScopeContract = (value) => {
+  if (!value || typeof value !== "object") return false;
+  const c = value;
+  const strings = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
+  return strings(c.allowedPaths) && strings(c.offLimitsPaths) && typeof c.doneWhen === "string";
+};
 
 export {
   isApprovalMode,
@@ -744,5 +777,9 @@ export {
   redactSecrets,
   redactSecretsDeep,
   classifyDecisionRisk,
-  buildDecisionEpisodeFeatures
+  buildDecisionEpisodeFeatures,
+  evaluateScope,
+  scopeRequiresHuman,
+  scopeChangeReason,
+  isScopeContract
 };

package/dist/{chunk-5TECIV6T.js → chunk-WLGEY4UX.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-SYAAGYLZ.js";
+} from "./chunk-DQAN3JQP.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-LEWSYLHL.js → chunk-WNRYRN2R.js}

@@ -12,6 +12,7 @@ import {
   isApprovalMode,
   isRepoKeyMatch,
   isSafeReadOnlyCommand,
+  isScopeContract,
   localRepoKey,
   matchRankWeight,
   matchToolPatternAny,
@@ -19,7 +20,7 @@ import {
   policyArgForms,
   redactSecrets,
   redactSecretsDeep
-} from "./chunk-SYAAGYLZ.js";
+} from "./chunk-DQAN3JQP.js";
 import {
   getApiKey,
   getBaseUrl
@@ -183,7 +184,7 @@ var fetchModeState = async (apiKey, sessionId) => {
       headers: { "Authorization": `Bearer ${apiKey}` },
       signal: AbortSignal.timeout(3e3)
     });
-    if (!response.ok) return { mode: null, kill: false, policyVersion: null, relayUrl: null, trainingConsent: false };
+    if (!response.ok) return { mode: null, kill: false, policyVersion: null, relayUrl: null, trainingConsent: false, scope: null };
     const data = await response.json();
     const mode = data.override?.mode;
     return {
@@ -191,10 +192,13 @@ var fetchModeState = async (apiKey, sessionId) => {
       kill: data.kill === true,
       policyVersion: toPolicyVersion(data.policyVersion),
       relayUrl: typeof data.relayUrl === "string" && data.relayUrl.length > 0 ? data.relayUrl : null,
-      trainingConsent: data.trainingConsent === true
+      trainingConsent: data.trainingConsent === true,
+      // Validated rather than cast: a malformed contract must read as no contract,
+      // never as one that silently matches nothing.
+      scope: isScopeContract(data.scope) ? data.scope : null
     };
   } catch {
-    return { mode: null, kill: false, policyVersion: null, relayUrl: null, trainingConsent: false };
+    return { mode: null, kill: false, policyVersion: null, relayUrl: null, trainingConsent: false, scope: null };
   }
 };
 var fetchModeOverride = async (apiKey) => (await fetchModeState(apiKey)).mode;
@@ -295,13 +299,26 @@ var deriveReceiptCommandHead = (command) => {
   return head ? head.slice(0, TOOL_TARGET_MAX_LENGTH) : void 0;
 };
 var RECEIPT_TARGET_MAX_LENGTH = 256;
+var EXIT_CODE_FAILURE = /^Error: Exit code \d+/;
 var isToolResultError = (toolResult) => {
   try {
-    return Boolean(toolResult && ("error" in toolResult || "is_error" in toolResult));
+    if (typeof toolResult === "string") return EXIT_CODE_FAILURE.test(toolResult);
+    if (!toolResult || typeof toolResult !== "object") return false;
+    return "error" in toolResult || "is_error" in toolResult;
   } catch {
     return false;
   }
 };
+var toolResultErrorText = (toolResult) => {
+  try {
+    const raw = typeof toolResult === "string" ? toolResult : toolResult && typeof toolResult === "object" ? String(
+      toolResult.error ?? toolResult.stderr ?? ""
+    ) : "";
+    return redactSecrets(raw);
+  } catch {
+    return "";
+  }
+};
 var relativizeReceiptPath = (filePath, cwd) => {
   if (!cwd || !isAbsolute(filePath)) return filePath;
   return relative(cwd, filePath);
@@ -332,6 +349,11 @@ var deriveReceiptMeta = (toolName, toolInput, toolResult, cwd) => {
     return void 0;
   }
 };
+var scopePathFor = (toolName, toolInput, cwd) => {
+  const meta = deriveReceiptMeta(toolName, toolInput, void 0, cwd);
+  if (!meta) return void 0;
+  return meta.kind === "edit" || meta.kind === "write" ? meta.target : void 0;
+};
 var firstString = (...values) => values.find((v) => typeof v === "string" && v.length > 0);
 var ACTION_BODY_TRUNCATION_MARKER = "\n\u2026 [truncated]";
 var capActionBody = (text) => text.length <= ACTION_BODY_MAX ? text : `${text.slice(0, ACTION_BODY_MAX - ACTION_BODY_TRUNCATION_MARKER.length)}${ACTION_BODY_TRUNCATION_MARKER}`;
@@ -962,7 +984,7 @@ var handlePostToolUse = async (input, agent = CLAUDE_CODE_AGENT) => {
       agentName: `${agent.label} - ${projectName}`,
       action,
       sessionId: input.session_id,
-      error: isError ? String(toolResult?.error ?? toolResult?.stderr ?? "").slice(0, 500) : void 0,
+      error: isError ? toolResultErrorText(toolResult).slice(0, 500) : void 0,
       decisionSource,
       ...beacon ? { decisionOrigin: beacon.decisionOrigin, toolName: beacon.toolName, toolTarget: beacon.toolTarget } : {},
       meta: receiptsEnabled ? deriveReceiptMeta(lookup.tool, lookup.input, toolResult, input.cwd ?? process.cwd()) : void 0,
@@ -1218,6 +1240,7 @@ export {
   sendNotification,
   describeToolCall,
   deriveToolTarget,
+  scopePathFor,
   deriveActionBody,
   deriveAction,
   deriveBlocker,

package/dist/src/index.d.ts

@@ -1,4 +1,4 @@
-import { PolicyConfig, ApprovalMode, ToolPolicy } from '@pushary/contracts';
+import { PolicyConfig, ApprovalMode, ToolPolicy, ScopeContract } from '@pushary/contracts';
 export { ApprovalMode, PolicyConfig, ToolPolicy } from '@pushary/contracts';
 
 interface ToolInput {
@@ -35,6 +35,7 @@ interface ModeState {
     readonly policyVersion: string | null;
     readonly relayUrl: string | null;
     readonly trainingConsent?: boolean;
+    readonly scope?: ScopeContract | null;
 }
 declare const fetchModeState: (apiKey: string, sessionId?: string) => Promise<ModeState>;
 declare const fetchModeOverride: (apiKey: string) => Promise<ApprovalMode | null>;
@@ -81,8 +82,8 @@ declare const reportEvent: (event: AgentEvent, options?: ReportEventOptions) =>
 declare const handlePostToolUse: (input: {
     tool_name: string;
     tool_input: Record<string, unknown>;
-    tool_response?: Record<string, unknown>;
-    tool_result?: Record<string, unknown>;
+    tool_response?: unknown;
+    tool_result?: unknown;
     cwd?: string;
     session_id?: string;
     transcript_path?: string;
@@ -123,6 +124,7 @@ interface AskUserParams {
     action?: string;
     blocker?: string;
     actionBody?: string;
+    scopePath?: string;
 }
 interface AskUserResponse {
     correlationId: string;

package/dist/src/index.js

@@ -1,7 +1,7 @@
 import {
   handlePreToolUse
-} from "../chunk-NPYANTRC.js";
-import "../chunk-QYQO6RHJ.js";
+} from "../chunk-BE5X3WXL.js";
+import "../chunk-CAJZAFVS.js";
 import "../chunk-YHG74UFF.js";
 import {
   askUser,
@@ -15,11 +15,11 @@ import {
   reportEvent,
   resolvePolicy,
   waitForAnswer
-} from "../chunk-LEWSYLHL.js";
+} from "../chunk-WNRYRN2R.js";
 import "../chunk-RN3NOEJF.js";
-import "../chunk-5TECIV6T.js";
+import "../chunk-WLGEY4UX.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-SYAAGYLZ.js";
+import "../chunk-DQAN3JQP.js";
 import {
   getApiKey,
   getBaseUrl

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.57.0",
+  "version": "0.59.0",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",