@pushary/agent-hooks 0.68.0 → 0.69.0

package/CHANGELOG.md

@@ -1,5 +1,94 @@
 # Changelog
 
+## 0.69.0
+
+### An approval is never granted on a state Pushary could not confirm
+
+When the hook could not reach Pushary, it read that as "you have not been
+stopped, and you are under no agreed scope". Those are answers, and not reaching
+the server is not an answer. A rule you had set to approve automatically could
+therefore fire during an outage on exactly the kind of call a live scope would
+have held back.
+
+It now tells the two apart. If the last successful check was under a minute ago,
+that answer still stands, so a brief network blip changes nothing, and a stop you
+issued moments earlier still stops the agent. Past that, an automatic approval is
+withheld and the decision goes to your agent's own prompt instead. Read only
+shell commands are unaffected, because that list is decided on your machine and
+needs no server at all.
+
+A rejected key is treated as a real answer rather than a blip, so a key you
+revoked stops being honoured at once.
+
+### A scope you agreed to is now honoured everywhere, not just in one place
+
+Scope was checked when Claude Code asked before running a tool, and skipped on
+four other paths that could reach the same decision: Claude's permission dialog,
+Codex, Gemini CLI, and the remote wrapper. Each of them fetched the scope you had
+agreed to and then ignored it, so the same edit could be waved through depending
+only on which route it arrived by. All five now run the same check in the same
+order.
+
+### Codex patches are judged on every file they touch
+
+A Codex patch that changes several files at once was judged on the patch as a
+whole, so a rule you wrote for one file did not apply when that file was part of
+a larger change. Every file is looked at now, and the strictest rule wins. Rules
+written as paths also work for Codex and Gemini, which they quietly did not
+before.
+
+### Command details that could contain a secret no longer leave your machine
+
+A command like `GH_TOKEN=... gh pr create` carries its credential in the first
+few words, and those words were being sent and stored as the label for what the
+agent wanted to do. Notification text was not being cleaned at all. Both are
+cleaned now, on your machine and again on arrival, and the Cursor and VS Code
+gates clean the command before it is sent rather than after.
+
+### setup --dry-run really does change nothing
+
+On a machine with no key, a dry run reached the pairing step, drew a QR code,
+waited for your phone, created a real API key, and then said nothing had been
+written. It now stops before anything is created and tells you a real run would
+connect a key first.
+
+### clean can no longer leave Cursor blocking your commands
+
+Cursor is told to block a matched command if the Pushary gate cannot answer, and
+that list includes ordinary work like rebase, migrate, deploy and publish. Clean
+removed the gate's files before removing that instruction, so if the second step
+failed, Cursor was left blocking all of them on a file that no longer existed,
+under a message saying clean had finished. The order is reversed and checked, and
+if the instruction cannot be removed the files stay put, clean says so, and it
+exits with an error.
+
+### Pairing survives a dropped reply
+
+If the reply carrying your key was lost in transit, the terminal reported that
+pairing had expired and you started again, while the key it never received stayed
+on your account. The key is now held until your terminal confirms it has it, so
+retrying finishes the pairing you already started. A terminal that cannot reach
+Pushary at all now says so instead of sitting under a QR code for fifteen
+minutes.
+
+### doctor reports on the agents you actually use
+
+Doctor checked Claude Code whether or not you had it, so setting Pushary up for
+Codex alone produced a column of failures about software you had never installed.
+It now reports on the agents Pushary is set up for, and says plainly when it is
+set up for none.
+
+Three things it used to call healthy, it no longer does. A key that lives only in
+a shell profile cannot be read by any hook, so an install where nothing could
+work was passing every check. A key saved inside Claude, Cursor or VS Code that
+no longer matches the one in use, which happens whenever pairing issues a new
+one, went unmentioned. And when doctor could not reach Pushary at all, it said
+everything was fine.
+
+Its exit codes now distinguish a broken setup from having no phone connected from
+not being able to reach Pushary, so a script can tell what went wrong. A test
+question nobody answers is now withdrawn instead of sitting on your phone.
+
 ## 0.67.0
 
 ### The VS Code agent can now ask for approval on your phone

package/data/cursor-plugin/scripts/pushary-gate.mjs

@@ -32,7 +32,10 @@ import { existsSync, readFileSync, writeFileSync } from 'node:fs'
 import { basename, dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
-const BASE_URL = 'https://pushary.com'
+// Overridable like every other Pushary client (the VS Code gate already was).
+// Hardcoded, this gate could not be pointed at a staging or self-hosted server,
+// so there was no way to exercise it anywhere but production.
+const BASE_URL = process.env.PUSHARY_BASE_URL?.trim() || process.env.PUSHARY_API_URL?.trim() || 'https://pushary.com'
 const MCP_URL = `${BASE_URL}/api/mcp/mcp`
 const POLICY_CACHE_TTL_MS = 5 * 60 * 1000
 const MAX_BLOCK_MS = 45_000 // longest we can wait before Cursor's hook timeout
@@ -235,24 +238,47 @@ const fetchModeState = async (apiKey, sessionId) => {
 // dependency-free hook cannot import the workspace) ──────────────────────────────
 const ACTION_BODY_MAX = 4000
 const ACTION_BODY_TRUNCATION_MARKER = '\n… [truncated]'
+// Two tiers, mirroring SECRET_REDACTION_RULES in @pushary/contracts. The precise
+// rules only match real credential shapes, so they are safe on a line a human
+// reads: a git SHA, a path and prose all survive. The high-entropy catch-all
+// over-redacts by design and is therefore only ever applied to a full body dump.
+//
+// One combined list used to serve both, which meant the only text this gate
+// scrubbed was the action body. The question and the notification body carried
+// the raw command.
 const REDACTION_RULES = [
-  [/\bsk-[A-Za-z0-9]{20,}\b/g, '[redacted]'],
-  [/\bpk_(?:live|test)_[A-Za-z0-9]+\b/g, '[redacted]'],
-  [/\brk_[A-Za-z0-9]+\b/g, '[redacted]'],
+  [/-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z0-9 ]*PRIVATE KEY-----/g, '[redacted key]'],
+  [/\bsk-[A-Za-z0-9_-]{16,}\b/g, '[redacted]'],
+  [/\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, '[redacted]'],
+  [/\bwhsec_[A-Za-z0-9]{16,}\b/g, '[redacted]'],
+  [/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, '[redacted]'],
+  [/\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, '[redacted]'],
+  [/\bglpat-[A-Za-z0-9_-]{20,}\b/g, '[redacted]'],
+  [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, '[redacted]'],
+  [/\bAIza[A-Za-z0-9_-]{35}\b/g, '[redacted]'],
   [/\bAKIA[0-9A-Z]{16}\b/g, '[redacted]'],
-  [/\bbearer\s+[A-Za-z0-9._-]+/gi, 'bearer [redacted]'],
+  [/\bnpm_[A-Za-z0-9]{36}\b/g, '[redacted]'],
+  [/\bxai-[A-Za-z0-9]{16,}\b/g, '[redacted]'],
+  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, '[redacted]'],
+  [/\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, 'bearer [redacted]'],
   [/\bauthorization:\s*\S+/gi, 'authorization: [redacted]'],
-  [/((?:secret|token|password|passwd|api[_-]?key|private[_-]?key)\s*[=:]\s*)(\S+)/gi, '$1[redacted]'],
-  [/[A-Za-z0-9+/]{40,}={0,2}/g, '[redacted]'],
+  [/((?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[=:]\s*)("[^"]*"|'[^']*'|\S+)/gi, '$1[redacted]'],
 ]
+const HIGH_ENTROPY_RULE = [/[A-Za-z0-9+/]{40,}={0,2}/g, '[redacted]']
 const redactSecrets = (text) => REDACTION_RULES.reduce((acc, [pattern, replacement]) => acc.replace(pattern, replacement), text)
+const redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE[0], HIGH_ENTROPY_RULE[1])
 const capActionBody = (text) =>
   text.length <= ACTION_BODY_MAX ? text : `${text.slice(0, ACTION_BODY_MAX - ACTION_BODY_TRUNCATION_MARKER.length)}${ACTION_BODY_TRUNCATION_MARKER}`
-const deriveActionBody = (command) => capActionBody(redactSecrets(command))
+const deriveActionBody = (command) => capActionBody(redactSecretsDeep(command))
 
 // ── ask / wait ───────────────────────────────────────────────────────────────
+// Redacted, not raw. This is the text a human reads on a lock screen and in
+// Slack, and it used to be the command verbatim: `curl -H "Authorization:
+// Bearer ..."` left the machine and landed in the question. The server scrubs
+// this field too, but a credential should never travel to be scrubbed on
+// arrival, and the notify body below was scrubbed nowhere at all.
 const askArgs = (command, project, ident) => ({
-  question: `Allow this command?\n\n${command}`,
+  question: `Allow this command?\n\n${redactSecrets(command)}`,
   type: 'confirm',
   context: `Cursor agent wants to run this in ${project}`,
   agentName: ident.agentName,
@@ -353,7 +379,7 @@ const handleNotifyOnly = async (apiKey, command, project, ident) => {
   try {
     await callTool(apiKey, 'send_notification', {
       title: 'Agent needs approval',
-      body: command.slice(0, 180),
+      body: redactSecrets(command).slice(0, 180),
       agentName: ident.agentName,
       sessionId: ident.sessionId,
       machineId: ident.machineId,

package/data/vscode-plugin/scripts/pushary-gate.mjs

@@ -291,20 +291,38 @@ const fetchModeState = async (apiKey, sessionId) => {
 // dependency-free hook cannot import the workspace) ───────────────────────────
 const ACTION_BODY_MAX = 4000
 const ACTION_BODY_TRUNCATION_MARKER = '\n… [truncated]'
+// Two tiers, mirroring SECRET_REDACTION_RULES in @pushary/contracts. The precise
+// rules only match real credential shapes, so they are safe on a line a human
+// reads: a git SHA, a path and prose all survive. The high-entropy catch-all
+// over-redacts by design and is therefore only ever applied to a full body dump.
+//
+// One combined list used to serve both, which meant the only text this gate
+// scrubbed was the action body. The question and the notification body carried
+// the raw command.
 const REDACTION_RULES = [
-  [/\bsk-[A-Za-z0-9]{20,}\b/g, '[redacted]'],
-  [/\bpk_(?:live|test)_[A-Za-z0-9]+\b/g, '[redacted]'],
-  [/\brk_[A-Za-z0-9]+\b/g, '[redacted]'],
+  [/-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z0-9 ]*PRIVATE KEY-----/g, '[redacted key]'],
+  [/\bsk-[A-Za-z0-9_-]{16,}\b/g, '[redacted]'],
+  [/\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, '[redacted]'],
+  [/\bwhsec_[A-Za-z0-9]{16,}\b/g, '[redacted]'],
+  [/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, '[redacted]'],
+  [/\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, '[redacted]'],
+  [/\bglpat-[A-Za-z0-9_-]{20,}\b/g, '[redacted]'],
+  [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, '[redacted]'],
+  [/\bAIza[A-Za-z0-9_-]{35}\b/g, '[redacted]'],
   [/\bAKIA[0-9A-Z]{16}\b/g, '[redacted]'],
-  [/\bbearer\s+[A-Za-z0-9._-]+/gi, 'bearer [redacted]'],
+  [/\bnpm_[A-Za-z0-9]{36}\b/g, '[redacted]'],
+  [/\bxai-[A-Za-z0-9]{16,}\b/g, '[redacted]'],
+  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, '[redacted]'],
+  [/\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, 'bearer [redacted]'],
   [/\bauthorization:\s*\S+/gi, 'authorization: [redacted]'],
-  [/((?:secret|token|password|passwd|api[_-]?key|private[_-]?key)\s*[=:]\s*)(\S+)/gi, '$1[redacted]'],
-  [/[A-Za-z0-9+/]{40,}={0,2}/g, '[redacted]'],
+  [/((?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[=:]\s*)("[^"]*"|'[^']*'|\S+)/gi, '$1[redacted]'],
 ]
+const HIGH_ENTROPY_RULE = [/[A-Za-z0-9+/]{40,}={0,2}/g, '[redacted]']
 const redactSecrets = (text) => REDACTION_RULES.reduce((acc, [pattern, replacement]) => acc.replace(pattern, replacement), text)
+const redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE[0], HIGH_ENTROPY_RULE[1])
 const capActionBody = (text) =>
   text.length <= ACTION_BODY_MAX ? text : `${text.slice(0, ACTION_BODY_MAX - ACTION_BODY_TRUNCATION_MARKER.length)}${ACTION_BODY_TRUNCATION_MARKER}`
-const deriveActionBody = (command) => capActionBody(redactSecrets(command))
+const deriveActionBody = (command) => capActionBody(redactSecretsDeep(command))
 
 // VS Code's terminal tool has used more than one field name for the command, and
 // a plain `tool_input` object is not guaranteed. Read the known spellings and
@@ -328,8 +346,13 @@ export const shouldGate = (toolName, toolInput) => {
 }
 
 // ── ask / wait ────────────────────────────────────────────────────────────────
+// Redacted, not raw. This is the text a human reads on a lock screen and in
+// Slack, and it used to be the command verbatim: `curl -H "Authorization:
+// Bearer ..."` left the machine and landed in the question. The server scrubs
+// this field too, but a credential should never travel to be scrubbed on
+// arrival, and the notify body below was scrubbed nowhere at all.
 const askArgs = (command, project, ident) => ({
-  question: `Allow this command?\n\n${command}`,
+  question: `Allow this command?\n\n${redactSecrets(command)}`,
   type: 'confirm',
   context: `VS Code agent wants to run this in ${project}`,
   agentName: ident.agentName,
@@ -426,7 +449,7 @@ const handleNotifyOnly = async (apiKey, command, project, ident) => {
   try {
     await callTool(apiKey, 'send_notification', {
       title: 'Agent needs approval',
-      body: command.slice(0, 180),
+      body: redactSecrets(command).slice(0, 180),
       agentName: ident.agentName,
       sessionId: ident.sessionId,
       machineId: ident.machineId,

package/dist/bin/pushary-claude.js

@@ -4,8 +4,10 @@ import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import {
-  isDeferAnswer
-} from "../chunk-YHG74UFF.js";
+  KILL_REASON,
+  isDeferAnswer,
+  resolveGate
+} from "../chunk-3USMXNVB.js";
 import {
   askUser,
   cancelQuestion,
@@ -15,9 +17,9 @@ import {
   getPolicy,
   repoKeyFor,
   reportEvent,
-  resolvePolicy,
+  scopePathFor,
   waitForAnswer
-} from "../chunk-XOUYM27W.js";
+} from "../chunk-H46LSQRT.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
@@ -470,7 +472,6 @@ var deny = (message) => ({ behavior: "deny", message });
 var createRemoteApprover = (deps) => {
   const fetchModeState2 = deps.fetchModeState ?? fetchModeState;
   const getPolicy2 = deps.getPolicy ?? getPolicy;
-  const resolvePolicy2 = deps.resolvePolicy ?? resolvePolicy;
   const askUser2 = deps.askUser ?? askUser;
   const waitForAnswer2 = deps.waitForAnswer ?? waitForAnswer;
   const cancelQuestion2 = deps.cancelQuestion ?? cancelQuestion;
@@ -531,13 +532,22 @@ var createRemoteApprover = (deps) => {
     try {
       const sessionId = deps.getSessionId?.();
       const modeState = await fetchModeState2(deps.apiKey, sessionId);
-      if (modeState.kill) return deny("Stopped by user \u2014 this agent was halted from Pushary");
       const policyConfig = await getPolicy2(deps.apiKey, modeState.policyVersion, "claude_code", true);
-      const policy = resolvePolicy2(policyConfig, toolName, modeState.mode, input, deps.cwd, repoKeyFor(deps.cwd));
-      if (policy.timeoutSeconds === 0 && policy.timeoutAction === "approve") return allow(input);
-      if (policy.timeoutSeconds === 0 && policy.timeoutAction === "deny") {
-        return deny(`Denied by policy for ${policy.tool}`);
-      }
+      const scopePath = modeState.scope ? scopePathFor(toolName, input, deps.cwd) : void 0;
+      const verdict = resolveGate({
+        modeState,
+        config: policyConfig,
+        toolName,
+        toolInputs: [input],
+        scopePaths: scopePath ? [scopePath] : [],
+        cwd: deps.cwd,
+        repoKey: repoKeyFor(deps.cwd)
+      });
+      if (verdict.kind === "kill") return deny(KILL_REASON);
+      if (verdict.kind === "allow") return allow(input);
+      if (verdict.kind === "deny") return deny(verdict.reason);
+      if (verdict.kind === "defer") return deny("Approval state unavailable; denied by default");
+      const policy = verdict.policy;
       const description = describeToolCall(toolName, input, "hook");
       const toolTarget = deriveToolTarget(toolName, input);
       let question;

package/dist/bin/pushary-clean.js

@@ -8,7 +8,7 @@ import {
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-KB4ODLGB.js";
+} from "../chunk-I4BYZIX4.js";
 import {
   removeGeminiSettings
 } from "../chunk-E2U35RLD.js";
@@ -81,8 +81,11 @@ var dim = (s) => `\x1B[2m${s}\x1B[0m`;
 var bold = (s) => `\x1B[1m${s}\x1B[0m`;
 var green = (s) => `\x1B[32m${s}\x1B[0m`;
 var yellow = (s) => `\x1B[33m${s}\x1B[0m`;
+var red = (s) => `\x1B[31m${s}\x1B[0m`;
 var check = green("\u2713");
 var skip = yellow("\u2013");
+var cross = red("\u2717");
+var incompleteClean = false;
 var CLAUDE_SETTINGS = claudeSettings();
 var CLAUDE_SETTINGS_LOCAL = claudeSettingsLocal();
 var CLAUDE_JSON = claudeJson();
@@ -141,6 +144,39 @@ var guardedAliasRemoval = () => {
 var writeJson = (path, data) => {
   guardedWrite(path, JSON.stringify(data, null, 2) + "\n");
 };
+var removeCursorUserHook = () => {
+  if (!existsSync(CURSOR_USER_HOOKS)) return "absent";
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(CURSOR_USER_HOOKS, "utf-8"));
+  } catch {
+    return "failed";
+  }
+  if (!parsed || typeof parsed !== "object") return "failed";
+  const hooks = parsed.hooks ?? {};
+  const existing = Array.isArray(hooks.beforeShellExecution) ? hooks.beforeShellExecution : [];
+  const others = existing.filter((h) => !String(h.command ?? "").includes("pushary-gate"));
+  if (others.length === existing.length) return "absent";
+  if (others.length === 0) delete hooks.beforeShellExecution;
+  else hooks.beforeShellExecution = others;
+  parsed.hooks = hooks;
+  try {
+    writeJson(CURSOR_USER_HOOKS, parsed);
+  } catch {
+    return "failed";
+  }
+  if (dryRun) return "removed";
+  try {
+    const after = JSON.parse(readFileSync(CURSOR_USER_HOOKS, "utf-8"));
+    const stillThere = after?.hooks?.beforeShellExecution ?? [];
+    if (Array.isArray(stillThere) && stillThere.some((h) => String(h.command ?? "").includes("pushary-gate"))) {
+      return "failed";
+    }
+  } catch {
+    return "failed";
+  }
+  return "removed";
+};
 var cleanSettingsFile = (path, label) => {
   const data = readJson(path);
   if (!data) {
@@ -212,29 +248,25 @@ var main = async () => {
   } else {
     console.log(`  ${skip} Cursor MCP config ${dim("(not found)")}`);
   }
-  if (existsSync(CURSOR_PLUGIN_DIR)) {
+  const cursorGate = removeCursorUserHook();
+  if (cursorGate === "removed") {
+    console.log(`  ${check} Cursor gate ${dim("(removed from ~/.cursor/hooks.json)")}`);
+  } else if (cursorGate === "absent") {
+    console.log(`  ${skip} Cursor gate ${dim("(not registered)")}`);
+  } else {
+    incompleteClean = true;
+    console.log(`  ${cross} Cursor gate ${dim("(could not read or write ~/.cursor/hooks.json)")}`);
+    console.log(`    ${yellow("!")} The gate is registered failClosed, so matched commands would be blocked.`);
+    console.log(`    ${dim("Keeping the plugin in place so Cursor keeps working. Fix the file, then re-run clean.")}`);
+  }
+  if (cursorGate === "failed") {
+    console.log(`  ${skip} Cursor plugin ${dim("(kept: removing it now would block matched commands)")}`);
+  } else if (existsSync(CURSOR_PLUGIN_DIR)) {
     guardedRemove(CURSOR_PLUGIN_DIR);
     console.log(`  ${check} Cursor plugin ${dim("(removed from ~/.cursor/plugins/local)")}`);
   } else {
     console.log(`  ${skip} Cursor plugin ${dim("(not installed)")}`);
   }
-  const cursorHooks = readJson(CURSOR_USER_HOOKS);
-  if (cursorHooks) {
-    const hooks = cursorHooks.hooks ?? {};
-    const existing = Array.isArray(hooks.beforeShellExecution) ? hooks.beforeShellExecution : [];
-    const others = existing.filter((h) => !String(h.command ?? "").includes("pushary-gate"));
-    if (others.length !== existing.length) {
-      if (others.length === 0) delete hooks.beforeShellExecution;
-      else hooks.beforeShellExecution = others;
-      cursorHooks.hooks = hooks;
-      writeJson(CURSOR_USER_HOOKS, cursorHooks);
-      console.log(`  ${check} Cursor gate ${dim("(removed from ~/.cursor/hooks.json)")}`);
-    } else {
-      console.log(`  ${skip} Cursor gate ${dim("(no pushary entries)")}`);
-    }
-  } else {
-    console.log(`  ${skip} Cursor gate ${dim("(no hooks.json)")}`);
-  }
   for (const settingsPath of vscodeSettingsTargets(existsSync)) {
     const label = `VS Code plugin ${dim(`(${shortenHome(settingsPath)})`)}`;
     if (!existsSync(settingsPath)) {
@@ -401,7 +433,12 @@ var main = async () => {
     console.log(`  ${skip} Global package ${dim("(not installed)")}`);
   }
   console.log();
-  console.log(`  ${green(bold("Clean complete."))}`);
+  if (incompleteClean) {
+    console.log(`  ${yellow(bold("Clean finished with something left behind."))}`);
+    console.log(`  ${dim("See the \u2717 above. Fix it, then re-run")} npx @pushary/agent-hooks@latest clean`);
+  } else {
+    console.log(`  ${green(bold("Clean complete."))}`);
+  }
   console.log(`  ${dim("Run")} npx @pushary/agent-hooks@latest setup ${dim("to reinstall.")}`);
   if (aliasRemovedFrom.length > 0) {
     console.log();
@@ -411,5 +448,6 @@ var main = async () => {
   }
   console.log(`  ${dim("If a")} ${bold("pushary claude")} ${dim("or")} ${bold("pushary daemon")} ${dim("is still running anywhere, stop it (Ctrl-C).")}`);
   console.log();
+  if (incompleteClean) process.exit(EXIT.FAILED);
 };
 main();

package/dist/bin/pushary-codex-hook.js

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
 import {
+  KILL_REASON,
   denyReasonFrom,
-  isDeferAnswer
-} from "../chunk-YHG74UFF.js";
+  isDeferAnswer,
+  resolveGate
+} from "../chunk-3USMXNVB.js";
 import {
   CODEX_AGENT,
   DEFAULT_SESSION,
@@ -24,14 +26,16 @@ import {
   permissionTimeoutDecision,
   preToolUseTimeoutDecision,
   readLastPrompt,
+  repoKeyFor,
   reportEvent,
-  resolvePolicy,
   savePendingQuestion,
+  scopePathFor,
   sendNotification,
   toCodexWire,
   toPolicyLookup,
+  toPolicyLookups,
   waitForAnswer
-} from "../chunk-XOUYM27W.js";
+} from "../chunk-H46LSQRT.js";
 import {
   isGatingMoment,
   recordKeylessMoment
@@ -57,7 +61,6 @@ import "../chunk-KZERVKTD.js";
 import { basename, join } from "path";
 import { tmpdir, userInfo } from "os";
 import { existsSync, mkdirSync, statSync, unlinkSync, writeFileSync } from "fs";
-var KILL_REASON = "Stopped by user: this agent was halted from Pushary";
 var START_MS = Date.now();
 var APPROVAL_TTL_MS = 10 * 60 * 1e3;
 var sanitizeId = (value) => value.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 128);
@@ -167,18 +170,33 @@ var notifyApprovalNeeded = async (apiKey, input, lookup) => {
   } catch {
   }
 };
+var codexGate = async (apiKey, input) => {
+  const modeState = await fetchModeState(apiKey, input.session_id);
+  const lookup = toPolicyLookup(input.tool_name ?? "", input.tool_input ?? {}, input.cwd);
+  const lookups = toPolicyLookups(input.tool_name ?? "", input.tool_input ?? {}, input.cwd);
+  const config = await getPolicy(apiKey, modeState.policyVersion, "codex");
+  const verdict = resolveGate({
+    modeState,
+    config,
+    toolName: lookups.tool,
+    toolInputs: lookups.inputs,
+    // Skipped entirely without a contract, which is the state of nearly every
+    // session. A multi-file patch contributes one path per file.
+    scopePaths: modeState.scope ? lookups.inputs.map((entry) => scopePathFor(lookups.tool, entry, input.cwd)).filter((path) => typeof path === "string") : [],
+    cwd: input.cwd,
+    repoKey: repoKeyFor(input.cwd)
+  });
+  return { verdict, lookup };
+};
 var decidePermissionRequest = async (input) => {
   try {
     const apiKey = getApiKey();
-    const modeState = await fetchModeState(apiKey, input.session_id);
-    if (modeState.kill) return codexDeny(KILL_REASON);
-    const lookup = toPolicyLookup(input.tool_name ?? "", input.tool_input ?? {}, input.cwd);
-    const policy = await getPolicy(apiKey, modeState.policyVersion, "codex");
-    const toolPolicy = resolvePolicy(policy, lookup.tool, modeState.mode, lookup.input);
-    if (toolPolicy.timeoutSeconds === 0 && toolPolicy.timeoutAction === "approve") return codexAllow();
-    if (toolPolicy.timeoutSeconds === 0 && toolPolicy.timeoutAction === "deny") {
-      return codexDeny(`Denied by policy for ${toolPolicy.tool}`);
-    }
+    const { verdict, lookup } = await codexGate(apiKey, input);
+    if (verdict.kind === "kill") return codexDeny(KILL_REASON);
+    if (verdict.kind === "allow") return codexAllow();
+    if (verdict.kind === "deny") return codexDeny(verdict.reason);
+    if (verdict.kind === "defer") return codexPass();
+    const toolPolicy = verdict.policy;
     if (toolPolicy.mode === "terminal_only") return codexPass();
     if (toolPolicy.mode === "notify_only") {
       if (claimNotify(input.tool_use_id)) await notifyApprovalNeeded(apiKey, input, lookup);
@@ -229,15 +247,12 @@ var decidePreToolUse = async (input) => {
     return codexPass();
   }
   try {
-    const modeState = await fetchModeState(apiKey, input.session_id);
-    if (modeState.kill) return codexDeny(KILL_REASON);
-    const lookup = toPolicyLookup(input.tool_name ?? "", input.tool_input ?? {}, input.cwd);
-    const policy = await getPolicy(apiKey, modeState.policyVersion, "codex");
-    const toolPolicy = resolvePolicy(policy, lookup.tool, modeState.mode, lookup.input);
-    if (toolPolicy.timeoutSeconds === 0 && toolPolicy.timeoutAction === "approve") return codexPass();
-    if (toolPolicy.timeoutSeconds === 0 && toolPolicy.timeoutAction === "deny") {
-      return codexDeny(`Denied by policy for ${toolPolicy.tool}`);
-    }
+    const { verdict, lookup } = await codexGate(apiKey, input);
+    if (verdict.kind === "kill") return codexDeny(KILL_REASON);
+    if (verdict.kind === "allow") return codexPass();
+    if (verdict.kind === "deny") return codexDeny(verdict.reason);
+    if (verdict.kind === "defer") return codexPass();
+    const toolPolicy = verdict.policy;
     if (toolPolicy.mode === "push_only") {
       if (consumeApproval(input.tool_use_id)) return codexPass();
       let pushed;

package/dist/bin/pushary-codex.js

@@ -3,7 +3,7 @@ import {
   askUser,
   reportEvent,
   waitForAnswer
-} from "../chunk-XOUYM27W.js";
+} from "../chunk-H46LSQRT.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-connect.js

@@ -6,7 +6,7 @@ import {
   confirmAppConnection,
   connectDevice,
   printConnectInstructions
-} from "../chunk-YMFZUXL5.js";
+} from "../chunk-P7VBAYQO.js";
 import "../chunk-3EGEA4KH.js";
 import {
   readKeySource