@pushary/agent-hooks 0.68.0 → 0.70.0

package/CHANGELOG.md

@@ -1,5 +1,143 @@
 # Changelog
 
+## 0.70.0
+
+### A key you name is the key you get
+
+Passing `--key` with a malformed value did not fail. Setup read it as no key at
+all, went looking elsewhere, and used whichever key it found: one already stored
+on the machine, one in your environment, or a brand new one it created by pairing.
+You named a credential and quietly got a different one. It now stops and says the
+key is not valid.
+
+### setup --json no longer stops to ask a question nobody can see
+
+Asking for machine-readable output says plainly that no human is watching, but
+setup could still reach an agent-selection prompt. Piped into a script it waited
+for a keypress that was never coming, and the prompt drew itself onto the same
+output a program was trying to read as JSON. It now selects the agents it detects,
+which is exactly what pressing Enter on that prompt would have chosen.
+
+`--json` also promises a single object of output, and every failing exit used to
+print nothing at all. A refused key, a cancelled pairing and a crash were
+indistinguishable to anything reading the output. Each now says which it was.
+
+### Setup checks its own work
+
+An agent installer that finished without an error was reported as configured,
+even if nothing had been written. Doctor would then contradict setup minutes
+later. Setup now confirms the configuration is really there, using the same check
+doctor uses, so the two cannot disagree.
+
+### connect points at the fix that matches your situation
+
+`pushary connect --app` gave one answer for every way a phone can be out of
+reach: open the app and allow notifications. That is right when the app is signed
+in and the permission was declined, and wrong otherwise. A terminal that was
+never paired needs setup. A phone signed in to a colleague's account needs your
+account, not a permission toggle. It now says which applies, and when it cannot
+tell the two apart it says both rather than sounding certain about the wrong one.
+
+### The editor gates say when a proxy is in the way
+
+The Cursor and VS Code gates cannot route through a corporate proxy. They still
+hand the decision safely to the editor's own prompt, so nothing is blocked, but
+every approval quietly stopped reaching your phone with no explanation. When a
+proxy is configured they now name it as the likely cause, and on Node 24 or newer
+they name the setting that fixes it.
+
+VS Code is also now listed among the supported agents, which it has been since
+its plugin shipped.
+
+## 0.69.0
+
+### An approval is never granted on a state Pushary could not confirm
+
+When the hook could not reach Pushary, it read that as "you have not been
+stopped, and you are under no agreed scope". Those are answers, and not reaching
+the server is not an answer. A rule you had set to approve automatically could
+therefore fire during an outage on exactly the kind of call a live scope would
+have held back.
+
+It now tells the two apart. If the last successful check was under a minute ago,
+that answer still stands, so a brief network blip changes nothing, and a stop you
+issued moments earlier still stops the agent. Past that, an automatic approval is
+withheld and the decision goes to your agent's own prompt instead. Read only
+shell commands are unaffected, because that list is decided on your machine and
+needs no server at all.
+
+A rejected key is treated as a real answer rather than a blip, so a key you
+revoked stops being honoured at once.
+
+### A scope you agreed to is now honoured everywhere, not just in one place
+
+Scope was checked when Claude Code asked before running a tool, and skipped on
+four other paths that could reach the same decision: Claude's permission dialog,
+Codex, Gemini CLI, and the remote wrapper. Each of them fetched the scope you had
+agreed to and then ignored it, so the same edit could be waved through depending
+only on which route it arrived by. All five now run the same check in the same
+order.
+
+### Codex patches are judged on every file they touch
+
+A Codex patch that changes several files at once was judged on the patch as a
+whole, so a rule you wrote for one file did not apply when that file was part of
+a larger change. Every file is looked at now, and the strictest rule wins. Rules
+written as paths also work for Codex and Gemini, which they quietly did not
+before.
+
+### Command details that could contain a secret no longer leave your machine
+
+A command like `GH_TOKEN=... gh pr create` carries its credential in the first
+few words, and those words were being sent and stored as the label for what the
+agent wanted to do. Notification text was not being cleaned at all. Both are
+cleaned now, on your machine and again on arrival, and the Cursor and VS Code
+gates clean the command before it is sent rather than after.
+
+### setup --dry-run really does change nothing
+
+On a machine with no key, a dry run reached the pairing step, drew a QR code,
+waited for your phone, created a real API key, and then said nothing had been
+written. It now stops before anything is created and tells you a real run would
+connect a key first.
+
+### clean can no longer leave Cursor blocking your commands
+
+Cursor is told to block a matched command if the Pushary gate cannot answer, and
+that list includes ordinary work like rebase, migrate, deploy and publish. Clean
+removed the gate's files before removing that instruction, so if the second step
+failed, Cursor was left blocking all of them on a file that no longer existed,
+under a message saying clean had finished. The order is reversed and checked, and
+if the instruction cannot be removed the files stay put, clean says so, and it
+exits with an error.
+
+### Pairing survives a dropped reply
+
+If the reply carrying your key was lost in transit, the terminal reported that
+pairing had expired and you started again, while the key it never received stayed
+on your account. The key is now held until your terminal confirms it has it, so
+retrying finishes the pairing you already started. A terminal that cannot reach
+Pushary at all now says so instead of sitting under a QR code for fifteen
+minutes.
+
+### doctor reports on the agents you actually use
+
+Doctor checked Claude Code whether or not you had it, so setting Pushary up for
+Codex alone produced a column of failures about software you had never installed.
+It now reports on the agents Pushary is set up for, and says plainly when it is
+set up for none.
+
+Three things it used to call healthy, it no longer does. A key that lives only in
+a shell profile cannot be read by any hook, so an install where nothing could
+work was passing every check. A key saved inside Claude, Cursor or VS Code that
+no longer matches the one in use, which happens whenever pairing issues a new
+one, went unmentioned. And when doctor could not reach Pushary at all, it said
+everything was fine.
+
+Its exit codes now distinguish a broken setup from having no phone connected from
+not being able to reach Pushary, so a script can tell what went wrong. A test
+question nobody answers is now withdrawn instead of sitting on your phone.
+
 ## 0.67.0
 
 ### The VS Code agent can now ask for approval on your phone

package/README.md

@@ -4,7 +4,7 @@
 [![npm downloads](https://img.shields.io/npm/dm/@pushary/agent-hooks.svg)](https://www.npmjs.com/package/@pushary/agent-hooks)
 [![license](https://img.shields.io/npm/l/@pushary/agent-hooks.svg)](./LICENSE)
 
-Push notifications, questions, and permission approvals for AI coding agents. Get a push when your agent finishes work, answer its questions from your phone, and approve risky commands before they run. Works with Claude Code, Codex, Cursor, Gemini CLI, and Hermes.
+Push notifications, questions, and permission approvals for AI coding agents. Get a push when your agent finishes work, answer its questions from your phone, and approve risky commands before they run. Works with Claude Code, Codex, Cursor, VS Code, Gemini CLI, and Hermes.
 
 Your agent froze waiting for a yes. This is how it reaches you.
 
@@ -53,6 +53,7 @@ npx @pushary/agent-hooks@latest doctor
 | Cursor | yes | yes | yes |
 | Gemini CLI | yes | yes | yes |
 | Hermes | yes | yes | yes |
+| VS Code | yes | yes | yes |
 
 Any other MCP client can use notify and ask by pointing at the Pushary MCP endpoint directly.
 
@@ -62,7 +63,7 @@ Any other MCP client can use notify and ask by pointing at the Pushary MCP endpo
      asserts this list matches it. Do not edit one without the other. -->
 
 ```
-setup        Configure Claude Code, Codex, Gemini CLI, Hermes, or Cursor with Pushary
+setup        Configure Claude Code, Codex, Gemini CLI, Hermes, Cursor, or VS Code with Pushary
 claude       Run Claude Code through Pushary, reachable from your phone even when idle
 daemon       Keep this machine reachable so your phone can START a new session
 status       One screen: which key is in force, whether the server accepts it, what can receive an approval

package/data/cursor-plugin/scripts/pushary-gate.mjs

@@ -32,7 +32,10 @@ import { existsSync, readFileSync, writeFileSync } from 'node:fs'
 import { basename, dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
-const BASE_URL = 'https://pushary.com'
+// Overridable like every other Pushary client (the VS Code gate already was).
+// Hardcoded, this gate could not be pointed at a staging or self-hosted server,
+// so there was no way to exercise it anywhere but production.
+const BASE_URL = process.env.PUSHARY_BASE_URL?.trim() || process.env.PUSHARY_API_URL?.trim() || 'https://pushary.com'
 const MCP_URL = `${BASE_URL}/api/mcp/mcp`
 const POLICY_CACHE_TTL_MS = 5 * 60 * 1000
 const MAX_BLOCK_MS = 45_000 // longest we can wait before Cursor's hook timeout
@@ -235,24 +238,72 @@ const fetchModeState = async (apiKey, sessionId) => {
 // dependency-free hook cannot import the workspace) ──────────────────────────────
 const ACTION_BODY_MAX = 4000
 const ACTION_BODY_TRUNCATION_MARKER = '\n… [truncated]'
+// Two tiers, mirroring SECRET_REDACTION_RULES in @pushary/contracts. The precise
+// rules only match real credential shapes, so they are safe on a line a human
+// reads: a git SHA, a path and prose all survive. The high-entropy catch-all
+// over-redacts by design and is therefore only ever applied to a full body dump.
+//
+// One combined list used to serve both, which meant the only text this gate
+// scrubbed was the action body. The question and the notification body carried
+// the raw command.
 const REDACTION_RULES = [
-  [/\bsk-[A-Za-z0-9]{20,}\b/g, '[redacted]'],
-  [/\bpk_(?:live|test)_[A-Za-z0-9]+\b/g, '[redacted]'],
-  [/\brk_[A-Za-z0-9]+\b/g, '[redacted]'],
+  [/-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z0-9 ]*PRIVATE KEY-----/g, '[redacted key]'],
+  [/\bsk-[A-Za-z0-9_-]{16,}\b/g, '[redacted]'],
+  [/\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, '[redacted]'],
+  [/\bwhsec_[A-Za-z0-9]{16,}\b/g, '[redacted]'],
+  [/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, '[redacted]'],
+  [/\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, '[redacted]'],
+  [/\bglpat-[A-Za-z0-9_-]{20,}\b/g, '[redacted]'],
+  [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, '[redacted]'],
+  [/\bAIza[A-Za-z0-9_-]{35}\b/g, '[redacted]'],
   [/\bAKIA[0-9A-Z]{16}\b/g, '[redacted]'],
-  [/\bbearer\s+[A-Za-z0-9._-]+/gi, 'bearer [redacted]'],
+  [/\bnpm_[A-Za-z0-9]{36}\b/g, '[redacted]'],
+  [/\bxai-[A-Za-z0-9]{16,}\b/g, '[redacted]'],
+  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, '[redacted]'],
+  [/\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, 'bearer [redacted]'],
   [/\bauthorization:\s*\S+/gi, 'authorization: [redacted]'],
-  [/((?:secret|token|password|passwd|api[_-]?key|private[_-]?key)\s*[=:]\s*)(\S+)/gi, '$1[redacted]'],
-  [/[A-Za-z0-9+/]{40,}={0,2}/g, '[redacted]'],
+  [/((?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[=:]\s*)("[^"]*"|'[^']*'|\S+)/gi, '$1[redacted]'],
 ]
+const HIGH_ENTROPY_RULE = [/[A-Za-z0-9+/]{40,}={0,2}/g, '[redacted]']
 const redactSecrets = (text) => REDACTION_RULES.reduce((acc, [pattern, replacement]) => acc.replace(pattern, replacement), text)
+const redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE[0], HIGH_ENTROPY_RULE[1])
 const capActionBody = (text) =>
   text.length <= ACTION_BODY_MAX ? text : `${text.slice(0, ACTION_BODY_MAX - ACTION_BODY_TRUNCATION_MARKER.length)}${ACTION_BODY_TRUNCATION_MARKER}`
-const deriveActionBody = (command) => capActionBody(redactSecrets(command))
+const deriveActionBody = (command) => capActionBody(redactSecretsDeep(command))
+
+// ── network diagnosis ────────────────────────────────────────────────────────
+//
+// This gate is a dependency-free .mjs, so unlike the CLI it cannot install
+// undici's EnvHttpProxyAgent and its fetch ignores HTTP_PROXY entirely. Node
+// gained a native equivalent in 24 (NODE_USE_ENV_PROXY), but that is read at
+// startup, so a script cannot switch it on for itself.
+//
+// The gate already fails safe: any error here hands the decision to the editor's
+// own prompt. The cost is therefore not a blocked command, it is SILENCE. On a
+// corporate network every approval quietly stops reaching the phone and the only
+// trace is one stderr line nobody reads. So when a proxy is configured and the
+// network call fails, say which of those two it is.
+export const PROXY_VARS = ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy']
+
+export const proxyConfigured = (env = process.env) =>
+  PROXY_VARS.some(name => (env[name] ?? '').trim() !== '')
+
+export const describeNetworkFailure = (error, env = process.env) => {
+  const detail = error?.message ?? String(error)
+  if (!proxyConfigured(env)) return detail
+  const enabled = (env.NODE_USE_ENV_PROXY ?? '').trim() !== ''
+  if (enabled) return detail
+  return `${detail} (a proxy is set in HTTP_PROXY/HTTPS_PROXY and this hook cannot use it; on Node 24+ set NODE_USE_ENV_PROXY=1 in the editor's environment)`
+}
 
 // ── ask / wait ───────────────────────────────────────────────────────────────
+// Redacted, not raw. This is the text a human reads on a lock screen and in
+// Slack, and it used to be the command verbatim: `curl -H "Authorization:
+// Bearer ..."` left the machine and landed in the question. The server scrubs
+// this field too, but a credential should never travel to be scrubbed on
+// arrival, and the notify body below was scrubbed nowhere at all.
 const askArgs = (command, project, ident) => ({
-  question: `Allow this command?\n\n${command}`,
+  question: `Allow this command?\n\n${redactSecrets(command)}`,
   type: 'confirm',
   context: `Cursor agent wants to run this in ${project}`,
   agentName: ident.agentName,
@@ -353,7 +404,7 @@ const handleNotifyOnly = async (apiKey, command, project, ident) => {
   try {
     await callTool(apiKey, 'send_notification', {
       title: 'Agent needs approval',
-      body: command.slice(0, 180),
+      body: redactSecrets(command).slice(0, 180),
       agentName: ident.agentName,
       sessionId: ident.sessionId,
       machineId: ident.machineId,
@@ -421,12 +472,16 @@ const main = async () => {
         return respond(await handlePushFirst(apiKey, command, project, ident, tool.pushFirstSeconds))
     }
   } catch (error) {
-    process.stderr.write(`[pushary-gate] ${error?.message ?? error}\n`)
+    process.stderr.write(`[pushary-gate] ${describeNetworkFailure(error)}\n`)
     return respond(ask())
   }
 }
 
-main().catch((error) => {
-  process.stderr.write(`[pushary-gate] fatal: ${error?.message ?? error}\n`)
-  respond(ask())
-})
+// Guarded like the VS Code gate: importing this file to unit-test its pure
+// helpers must not start a hook run that reads stdin and writes a decision.
+if (!process.env.PUSHARY_GATE_IMPORT) {
+  main().catch((error) => {
+    process.stderr.write(`[pushary-gate] fatal: ${describeNetworkFailure(error)}\n`)
+    respond(ask())
+  })
+}

package/data/vscode-plugin/scripts/pushary-gate.mjs

@@ -291,20 +291,38 @@ const fetchModeState = async (apiKey, sessionId) => {
 // dependency-free hook cannot import the workspace) ───────────────────────────
 const ACTION_BODY_MAX = 4000
 const ACTION_BODY_TRUNCATION_MARKER = '\n… [truncated]'
+// Two tiers, mirroring SECRET_REDACTION_RULES in @pushary/contracts. The precise
+// rules only match real credential shapes, so they are safe on a line a human
+// reads: a git SHA, a path and prose all survive. The high-entropy catch-all
+// over-redacts by design and is therefore only ever applied to a full body dump.
+//
+// One combined list used to serve both, which meant the only text this gate
+// scrubbed was the action body. The question and the notification body carried
+// the raw command.
 const REDACTION_RULES = [
-  [/\bsk-[A-Za-z0-9]{20,}\b/g, '[redacted]'],
-  [/\bpk_(?:live|test)_[A-Za-z0-9]+\b/g, '[redacted]'],
-  [/\brk_[A-Za-z0-9]+\b/g, '[redacted]'],
+  [/-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z0-9 ]*PRIVATE KEY-----/g, '[redacted key]'],
+  [/\bsk-[A-Za-z0-9_-]{16,}\b/g, '[redacted]'],
+  [/\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, '[redacted]'],
+  [/\bwhsec_[A-Za-z0-9]{16,}\b/g, '[redacted]'],
+  [/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, '[redacted]'],
+  [/\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, '[redacted]'],
+  [/\bglpat-[A-Za-z0-9_-]{20,}\b/g, '[redacted]'],
+  [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, '[redacted]'],
+  [/\bAIza[A-Za-z0-9_-]{35}\b/g, '[redacted]'],
   [/\bAKIA[0-9A-Z]{16}\b/g, '[redacted]'],
-  [/\bbearer\s+[A-Za-z0-9._-]+/gi, 'bearer [redacted]'],
+  [/\bnpm_[A-Za-z0-9]{36}\b/g, '[redacted]'],
+  [/\bxai-[A-Za-z0-9]{16,}\b/g, '[redacted]'],
+  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, '[redacted]'],
+  [/\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, 'bearer [redacted]'],
   [/\bauthorization:\s*\S+/gi, 'authorization: [redacted]'],
-  [/((?:secret|token|password|passwd|api[_-]?key|private[_-]?key)\s*[=:]\s*)(\S+)/gi, '$1[redacted]'],
-  [/[A-Za-z0-9+/]{40,}={0,2}/g, '[redacted]'],
+  [/((?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[=:]\s*)("[^"]*"|'[^']*'|\S+)/gi, '$1[redacted]'],
 ]
+const HIGH_ENTROPY_RULE = [/[A-Za-z0-9+/]{40,}={0,2}/g, '[redacted]']
 const redactSecrets = (text) => REDACTION_RULES.reduce((acc, [pattern, replacement]) => acc.replace(pattern, replacement), text)
+const redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE[0], HIGH_ENTROPY_RULE[1])
 const capActionBody = (text) =>
   text.length <= ACTION_BODY_MAX ? text : `${text.slice(0, ACTION_BODY_MAX - ACTION_BODY_TRUNCATION_MARKER.length)}${ACTION_BODY_TRUNCATION_MARKER}`
-const deriveActionBody = (command) => capActionBody(redactSecrets(command))
+const deriveActionBody = (command) => capActionBody(redactSecretsDeep(command))
 
 // VS Code's terminal tool has used more than one field name for the command, and
 // a plain `tool_input` object is not guaranteed. Read the known spellings and
@@ -327,9 +345,39 @@ export const shouldGate = (toolName, toolInput) => {
   return command
 }
 
+// ── network diagnosis ────────────────────────────────────────────────────────
+//
+// This gate is a dependency-free .mjs, so unlike the CLI it cannot install
+// undici's EnvHttpProxyAgent and its fetch ignores HTTP_PROXY entirely. Node
+// gained a native equivalent in 24 (NODE_USE_ENV_PROXY), but that is read at
+// startup, so a script cannot switch it on for itself.
+//
+// The gate already fails safe: any error here hands the decision to the editor's
+// own prompt. The cost is therefore not a blocked command, it is SILENCE. On a
+// corporate network every approval quietly stops reaching the phone and the only
+// trace is one stderr line nobody reads. So when a proxy is configured and the
+// network call fails, say which of those two it is.
+export const PROXY_VARS = ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy']
+
+export const proxyConfigured = (env = process.env) =>
+  PROXY_VARS.some(name => (env[name] ?? '').trim() !== '')
+
+export const describeNetworkFailure = (error, env = process.env) => {
+  const detail = error?.message ?? String(error)
+  if (!proxyConfigured(env)) return detail
+  const enabled = (env.NODE_USE_ENV_PROXY ?? '').trim() !== ''
+  if (enabled) return detail
+  return `${detail} (a proxy is set in HTTP_PROXY/HTTPS_PROXY and this hook cannot use it; on Node 24+ set NODE_USE_ENV_PROXY=1 in the editor's environment)`
+}
+
 // ── ask / wait ────────────────────────────────────────────────────────────────
+// Redacted, not raw. This is the text a human reads on a lock screen and in
+// Slack, and it used to be the command verbatim: `curl -H "Authorization:
+// Bearer ..."` left the machine and landed in the question. The server scrubs
+// this field too, but a credential should never travel to be scrubbed on
+// arrival, and the notify body below was scrubbed nowhere at all.
 const askArgs = (command, project, ident) => ({
-  question: `Allow this command?\n\n${command}`,
+  question: `Allow this command?\n\n${redactSecrets(command)}`,
   type: 'confirm',
   context: `VS Code agent wants to run this in ${project}`,
   agentName: ident.agentName,
@@ -426,7 +474,7 @@ const handleNotifyOnly = async (apiKey, command, project, ident) => {
   try {
     await callTool(apiKey, 'send_notification', {
       title: 'Agent needs approval',
-      body: command.slice(0, 180),
+      body: redactSecrets(command).slice(0, 180),
       agentName: ident.agentName,
       sessionId: ident.sessionId,
       machineId: ident.machineId,
@@ -494,7 +542,7 @@ const main = async () => {
         return respond(await handlePushFirst(apiKey, command, project, ident, tool.pushFirstSeconds))
     }
   } catch (error) {
-    diag(String(error?.message ?? error))
+    diag(describeNetworkFailure(error))
     return respond(ask())
   }
 }
@@ -502,7 +550,7 @@ const main = async () => {
 // Importing this file for its testable helpers must not consume stdin or exit.
 if (!process.env.PUSHARY_GATE_IMPORT) {
   main().catch((error) => {
-    diag(`fatal: ${error?.message ?? error}`)
+    diag(`fatal: ${describeNetworkFailure(error)}`)
     respond(ask())
   })
 }

package/dist/bin/pushary-claude.js

@@ -4,8 +4,10 @@ import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import {
-  isDeferAnswer
-} from "../chunk-YHG74UFF.js";
+  KILL_REASON,
+  isDeferAnswer,
+  resolveGate
+} from "../chunk-GD275GEX.js";
 import {
   askUser,
   cancelQuestion,
@@ -15,9 +17,9 @@ import {
   getPolicy,
   repoKeyFor,
   reportEvent,
-  resolvePolicy,
+  scopePathFor,
   waitForAnswer
-} from "../chunk-XOUYM27W.js";
+} from "../chunk-FZIQSDTQ.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
@@ -470,7 +472,6 @@ var deny = (message) => ({ behavior: "deny", message });
 var createRemoteApprover = (deps) => {
   const fetchModeState2 = deps.fetchModeState ?? fetchModeState;
   const getPolicy2 = deps.getPolicy ?? getPolicy;
-  const resolvePolicy2 = deps.resolvePolicy ?? resolvePolicy;
   const askUser2 = deps.askUser ?? askUser;
   const waitForAnswer2 = deps.waitForAnswer ?? waitForAnswer;
   const cancelQuestion2 = deps.cancelQuestion ?? cancelQuestion;
@@ -531,13 +532,22 @@ var createRemoteApprover = (deps) => {
     try {
       const sessionId = deps.getSessionId?.();
       const modeState = await fetchModeState2(deps.apiKey, sessionId);
-      if (modeState.kill) return deny("Stopped by user \u2014 this agent was halted from Pushary");
       const policyConfig = await getPolicy2(deps.apiKey, modeState.policyVersion, "claude_code", true);
-      const policy = resolvePolicy2(policyConfig, toolName, modeState.mode, input, deps.cwd, repoKeyFor(deps.cwd));
-      if (policy.timeoutSeconds === 0 && policy.timeoutAction === "approve") return allow(input);
-      if (policy.timeoutSeconds === 0 && policy.timeoutAction === "deny") {
-        return deny(`Denied by policy for ${policy.tool}`);
-      }
+      const scopePath = modeState.scope ? scopePathFor(toolName, input, deps.cwd) : void 0;
+      const verdict = resolveGate({
+        modeState,
+        config: policyConfig,
+        toolName,
+        toolInputs: [input],
+        scopePaths: scopePath ? [scopePath] : [],
+        cwd: deps.cwd,
+        repoKey: repoKeyFor(deps.cwd)
+      });
+      if (verdict.kind === "kill") return deny(KILL_REASON);
+      if (verdict.kind === "allow") return allow(input);
+      if (verdict.kind === "deny") return deny(verdict.reason);
+      if (verdict.kind === "defer") return deny("Approval state unavailable; denied by default");
+      const policy = verdict.policy;
       const description = describeToolCall(toolName, input, "hook");
       const toolTarget = deriveToolTarget(toolName, input);
       let question;

package/dist/bin/pushary-clean.js

@@ -8,7 +8,7 @@ import {
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-KB4ODLGB.js";
+} from "../chunk-I4BYZIX4.js";
 import {
   removeGeminiSettings
 } from "../chunk-E2U35RLD.js";
@@ -41,8 +41,8 @@ import {
 } from "../chunk-MUEW424A.js";
 import {
   exitOnHelpFlag
-} from "../chunk-ATP6UQPH.js";
-import "../chunk-JGH37QRB.js";
+} from "../chunk-BBK3TTU2.js";
+import "../chunk-7OYGFJYZ.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-DQAN3JQP.js";
 import {
@@ -81,8 +81,11 @@ var dim = (s) => `\x1B[2m${s}\x1B[0m`;
 var bold = (s) => `\x1B[1m${s}\x1B[0m`;
 var green = (s) => `\x1B[32m${s}\x1B[0m`;
 var yellow = (s) => `\x1B[33m${s}\x1B[0m`;
+var red = (s) => `\x1B[31m${s}\x1B[0m`;
 var check = green("\u2713");
 var skip = yellow("\u2013");
+var cross = red("\u2717");
+var incompleteClean = false;
 var CLAUDE_SETTINGS = claudeSettings();
 var CLAUDE_SETTINGS_LOCAL = claudeSettingsLocal();
 var CLAUDE_JSON = claudeJson();
@@ -141,6 +144,39 @@ var guardedAliasRemoval = () => {
 var writeJson = (path, data) => {
   guardedWrite(path, JSON.stringify(data, null, 2) + "\n");
 };
+var removeCursorUserHook = () => {
+  if (!existsSync(CURSOR_USER_HOOKS)) return "absent";
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(CURSOR_USER_HOOKS, "utf-8"));
+  } catch {
+    return "failed";
+  }
+  if (!parsed || typeof parsed !== "object") return "failed";
+  const hooks = parsed.hooks ?? {};
+  const existing = Array.isArray(hooks.beforeShellExecution) ? hooks.beforeShellExecution : [];
+  const others = existing.filter((h) => !String(h.command ?? "").includes("pushary-gate"));
+  if (others.length === existing.length) return "absent";
+  if (others.length === 0) delete hooks.beforeShellExecution;
+  else hooks.beforeShellExecution = others;
+  parsed.hooks = hooks;
+  try {
+    writeJson(CURSOR_USER_HOOKS, parsed);
+  } catch {
+    return "failed";
+  }
+  if (dryRun) return "removed";
+  try {
+    const after = JSON.parse(readFileSync(CURSOR_USER_HOOKS, "utf-8"));
+    const stillThere = after?.hooks?.beforeShellExecution ?? [];
+    if (Array.isArray(stillThere) && stillThere.some((h) => String(h.command ?? "").includes("pushary-gate"))) {
+      return "failed";
+    }
+  } catch {
+    return "failed";
+  }
+  return "removed";
+};
 var cleanSettingsFile = (path, label) => {
   const data = readJson(path);
   if (!data) {
@@ -212,29 +248,25 @@ var main = async () => {
   } else {
     console.log(`  ${skip} Cursor MCP config ${dim("(not found)")}`);
   }
-  if (existsSync(CURSOR_PLUGIN_DIR)) {
+  const cursorGate = removeCursorUserHook();
+  if (cursorGate === "removed") {
+    console.log(`  ${check} Cursor gate ${dim("(removed from ~/.cursor/hooks.json)")}`);
+  } else if (cursorGate === "absent") {
+    console.log(`  ${skip} Cursor gate ${dim("(not registered)")}`);
+  } else {
+    incompleteClean = true;
+    console.log(`  ${cross} Cursor gate ${dim("(could not read or write ~/.cursor/hooks.json)")}`);
+    console.log(`    ${yellow("!")} The gate is registered failClosed, so matched commands would be blocked.`);
+    console.log(`    ${dim("Keeping the plugin in place so Cursor keeps working. Fix the file, then re-run clean.")}`);
+  }
+  if (cursorGate === "failed") {
+    console.log(`  ${skip} Cursor plugin ${dim("(kept: removing it now would block matched commands)")}`);
+  } else if (existsSync(CURSOR_PLUGIN_DIR)) {
     guardedRemove(CURSOR_PLUGIN_DIR);
     console.log(`  ${check} Cursor plugin ${dim("(removed from ~/.cursor/plugins/local)")}`);
   } else {
     console.log(`  ${skip} Cursor plugin ${dim("(not installed)")}`);
   }
-  const cursorHooks = readJson(CURSOR_USER_HOOKS);
-  if (cursorHooks) {
-    const hooks = cursorHooks.hooks ?? {};
-    const existing = Array.isArray(hooks.beforeShellExecution) ? hooks.beforeShellExecution : [];
-    const others = existing.filter((h) => !String(h.command ?? "").includes("pushary-gate"));
-    if (others.length !== existing.length) {
-      if (others.length === 0) delete hooks.beforeShellExecution;
-      else hooks.beforeShellExecution = others;
-      cursorHooks.hooks = hooks;
-      writeJson(CURSOR_USER_HOOKS, cursorHooks);
-      console.log(`  ${check} Cursor gate ${dim("(removed from ~/.cursor/hooks.json)")}`);
-    } else {
-      console.log(`  ${skip} Cursor gate ${dim("(no pushary entries)")}`);
-    }
-  } else {
-    console.log(`  ${skip} Cursor gate ${dim("(no hooks.json)")}`);
-  }
   for (const settingsPath of vscodeSettingsTargets(existsSync)) {
     const label = `VS Code plugin ${dim(`(${shortenHome(settingsPath)})`)}`;
     if (!existsSync(settingsPath)) {
@@ -401,7 +433,12 @@ var main = async () => {
     console.log(`  ${skip} Global package ${dim("(not installed)")}`);
   }
   console.log();
-  console.log(`  ${green(bold("Clean complete."))}`);
+  if (incompleteClean) {
+    console.log(`  ${yellow(bold("Clean finished with something left behind."))}`);
+    console.log(`  ${dim("See the \u2717 above. Fix it, then re-run")} npx @pushary/agent-hooks@latest clean`);
+  } else {
+    console.log(`  ${green(bold("Clean complete."))}`);
+  }
   console.log(`  ${dim("Run")} npx @pushary/agent-hooks@latest setup ${dim("to reinstall.")}`);
   if (aliasRemovedFrom.length > 0) {
     console.log();
@@ -411,5 +448,6 @@ var main = async () => {
   }
   console.log(`  ${dim("If a")} ${bold("pushary claude")} ${dim("or")} ${bold("pushary daemon")} ${dim("is still running anywhere, stop it (Ctrl-C).")}`);
   console.log();
+  if (incompleteClean) process.exit(EXIT.FAILED);
 };
 main();