@pushary/agent-hooks 0.68.0 → 0.70.0

package/dist/{chunk-SONXGCZY.js → chunk-HU43EZ5Q.js}

@@ -3,8 +3,9 @@ import {
 } from "./chunk-CAJZAFVS.js";
 import {
   denyReasonFrom,
-  isDeferAnswer
-} from "./chunk-YHG74UFF.js";
+  isDeferAnswer,
+  resolveGate
+} from "./chunk-GD275GEX.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -19,13 +20,12 @@ import {
   readLastPrompt,
   readLastUserPrompt,
   repoKeyFor,
-  resolvePolicy,
   savePendingQuestion,
   scopePathFor,
   sendNotification,
   throttlePass,
   waitForAnswer
-} from "./chunk-XOUYM27W.js";
+} from "./chunk-FZIQSDTQ.js";
 import {
   isGatingMoment,
   recordKeylessMoment
@@ -33,11 +33,8 @@ import {
 import {
   buildDecisionEpisodeFeatures,
   effectiveWaitSeconds,
-  evaluateScope,
   hookWaitClamped,
-  hookWaitDeadline,
-  scopeChangeReason,
-  scopeRequiresHuman
+  hookWaitDeadline
 } from "./chunk-DQAN3JQP.js";
 import {
   getMachineId
@@ -383,6 +380,18 @@ var handleKeyless = (input) => {
   }
   return void 0;
 };
+var claudeGateInput = (modeState, config, input) => {
+  const scopePath = modeState.scope ? scopePathFor(input.tool_name, input.tool_input, input.cwd) : void 0;
+  return {
+    modeState,
+    config,
+    toolName: input.tool_name,
+    toolInputs: [input.tool_input ?? {}],
+    scopePaths: scopePath ? [scopePath] : [],
+    cwd: input.cwd,
+    repoKey: repoKeyFor(input.cwd)
+  };
+};
 var handlePreToolUse = async (input) => {
   if (input.tool_name.startsWith("mcp__pushary__")) return void 0;
   let apiKey;
@@ -394,26 +403,26 @@ var handlePreToolUse = async (input) => {
   try {
     const modeState = await fetchModeState(apiKey, input.session_id);
     const policy = await getPolicy(apiKey, modeState.policyVersion, "claude_code", true);
-    if (modeState.kill) {
-      return deny("Stopped by user, this agent was halted from Pushary");
-    }
+    const verdict = resolveGate(claudeGateInput(modeState, policy, input));
+    if (verdict.kind === "kill") return deny(verdict.reason);
     if (input.tool_name === "AskUserQuestion") {
       return handleAskUserQuestion(apiKey, input);
     }
     if (shouldDeferToNativeMode(input.permission_mode, input.tool_name)) {
       return void 0;
     }
-    const toolPolicy = resolvePolicy(policy, input.tool_name, modeState.mode, input.tool_input, input.cwd, repoKeyFor(input.cwd));
-    const scopePath = modeState.scope ? scopePathFor(input.tool_name, input.tool_input, input.cwd) : void 0;
-    const scopeVerdict = evaluateScope(modeState.scope, scopePath);
-    const scopeReason = scopeChangeReason(scopeVerdict);
-    if (toolPolicy.timeoutSeconds === 0 && toolPolicy.timeoutAction === "approve") {
-      if (!scopeRequiresHuman(scopeVerdict)) return allow();
-    }
-    if (toolPolicy.timeoutSeconds === 0 && toolPolicy.timeoutAction === "deny") {
-      return deny(`Denied by policy for ${toolPolicy.tool}`);
+    switch (verdict.kind) {
+      case "allow":
+        return allow();
+      case "deny":
+        return deny(verdict.reason);
+      // State we could not establish, with an auto-approve on the table. No
+      // opinion, so Claude Code's own flow runs as if the hook were absent.
+      case "defer":
+        return void 0;
+      default:
+        return dispatchModeHandler(apiKey, input, verdict.policy, getMachineId(), modeState.trainingConsent, verdict.scopeReason, verdict.scopePath);
     }
-    return dispatchModeHandler(apiKey, input, toolPolicy, getMachineId(), modeState.trainingConsent, scopeReason, scopePath);
   } catch {
     return void 0;
   }
@@ -452,13 +461,22 @@ var handlePermissionRequest = async (input) => {
   try {
     const modeState = await fetchModeState(apiKey, input.session_id);
     const policy = await getPolicy(apiKey, modeState.policyVersion, "claude_code", true);
-    if (modeState.kill) return permReqDeny("Stopped by user \u2014 this agent was halted from Pushary");
-    const toolPolicy = resolvePolicy(policy, input.tool_name, modeState.mode, input.tool_input, input.cwd, repoKeyFor(input.cwd));
-    if (toolPolicy.timeoutSeconds === 0 && toolPolicy.timeoutAction === "approve") return permReqAllow();
-    if (toolPolicy.timeoutSeconds === 0 && toolPolicy.timeoutAction === "deny") {
-      return permReqDeny(`Denied by policy for ${toolPolicy.tool}`);
+    const verdict = resolveGate(claudeGateInput(modeState, policy, input));
+    switch (verdict.kind) {
+      case "kill":
+        return permReqDeny(verdict.reason);
+      case "allow":
+        return permReqAllow();
+      case "deny":
+        return permReqDeny(verdict.reason);
+      // No opinion, so Claude Code's own dialog shows.
+      case "defer":
+        return void 0;
+      default:
+        return toPermissionRequestOutput(
+          await dispatchModeHandler(apiKey, input, verdict.policy, getMachineId(), modeState.trainingConsent, verdict.scopeReason, verdict.scopePath)
+        );
     }
-    return toPermissionRequestOutput(await dispatchModeHandler(apiKey, input, toolPolicy, getMachineId(), modeState.trainingConsent));
   } catch {
     return void 0;
   }

package/dist/{chunk-KB4ODLGB.js → chunk-I4BYZIX4.js}

@@ -320,6 +320,8 @@ export {
   isPluginRegistered,
   pluginLocationSnippet,
   vscodeSettingsTargets,
+  detectAgent,
+  agentProbes,
   detectAllAgents,
   isDetected,
   shortenHome,

package/dist/{chunk-YMFZUXL5.js → chunk-MGFZXUUR.js}

@@ -45,6 +45,27 @@ var describeReach = (channels) => {
   if (verdict.kind === "unattributable") return `${summary}, and no way to tell whose`;
   return summary;
 };
+var describeAppRepair = (verdict) => {
+  switch (verdict.kind) {
+    case "yours":
+      return null;
+    case "nobody":
+      return [
+        "Open the Pushary app, sign in, and allow notifications.",
+        "If this terminal was never paired with your phone, run: npx @pushary/agent-hooks@latest setup --connect app"
+      ];
+    case "others":
+      return [
+        `Reachable devices belong to other members of this workspace (${verdict.otherMembers}).`,
+        "Sign in on the Pushary app with your own account so approvals can reach you."
+      ];
+    case "unattributable":
+      return [
+        "Something is reachable here, but not identifiably yours.",
+        "Sign in on the Pushary app so your approvals are routed to your device."
+      ];
+  }
+};
 
 // src/cli/human.ts
 var stream = process.stdout;
@@ -324,7 +345,12 @@ var printQr = (url) => new Promise((resolve, reject) => {
     reject(err);
   }
 });
-var phoneFailure = (detail) => ({ reachesYou: false, outcome: null, detail });
+var phoneFailure = (detail, repair) => ({
+  reachesYou: false,
+  outcome: null,
+  detail,
+  ...repair ? { repair } : {}
+});
 var waitForDevice = async (apiKey, baseline) => {
   const deadline = Date.now() + CONNECT_TIMEOUT_MS;
   let consecutiveFailures = 0;
@@ -469,9 +495,11 @@ var confirmAppConnection = async (apiKey) => {
   const channels = probe.status;
   const ownedApp = channels.yours?.appDevices ?? channels.appDevices;
   if (channels.precise && ownedApp === 0) {
-    console.log(`  ${yellow("!")} Paired, but the app hasn't registered for notifications yet.`);
-    console.log(`  ${dim("Open the Pushary app and allow notifications, then run")} ${cyan("pushary doctor")}${dim(".")}`);
-    return phoneFailure("app_not_registered");
+    const repair = describeAppRepair(reachVerdict(channels)) ?? [];
+    console.log(`  ${yellow("!")} No device of yours is registered for notifications yet.`);
+    for (const line of repair) console.log(`  ${dim(line)}`);
+    console.log(`  ${dim("Then run")} ${cyan("pushary doctor")}${dim(".")}`);
+    return phoneFailure("app_not_registered", repair);
   }
   return sendAndConfirm(apiKey, channels);
 };
@@ -533,6 +561,7 @@ var cancelPairing = async (pairId) => {
   } catch {
   }
 };
+var PAIR_MAX_CONSECUTIVE_FAILURES = 8;
 var claimPairing = async (pairId) => {
   try {
     const res = await fetch(`${apiBase()}/api/mobile/pair/claim?id=${encodeURIComponent(pairId)}`, {
@@ -544,6 +573,17 @@ var claimPairing = async (pairId) => {
     return null;
   }
 };
+var ackPairing = async (pairId) => {
+  try {
+    await fetch(`${apiBase()}/api/mobile/pair/ack`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ pairId }),
+      signal: AbortSignal.timeout(5e3)
+    });
+  } catch {
+  }
+};
 var buildPairLinks = (pairId, publicKeyB64, baseUrl = apiBase()) => {
   const id = encodeURIComponent(pairId);
   const pk = encodeURIComponent(publicKeyB64);
@@ -593,10 +633,22 @@ var connectViaAppPairing = async (options = {}) => {
     void Promise.allSettled([Promise.resolve(flushed), cancelPairing(pairId)]).finally(() => process.exit(EXIT_ABORTED));
   };
   process.once("SIGINT", onInterrupt);
+  let consecutiveFailures = 0;
   try {
     while (Date.now() < deadline) {
       if (cancelled) return null;
       const claim = await claimPairing(pairId);
+      if (claim === null) {
+        consecutiveFailures += 1;
+        if (consecutiveFailures >= PAIR_MAX_CONSECUTIVE_FAILURES) {
+          stop(yellow("!"), "Can't reach pushary.com to finish pairing. Check your connection, then re-run setup.");
+          await cancelPairing(pairId);
+          return null;
+        }
+        await sleep(PAIR_POLL_INTERVAL_MS);
+        continue;
+      }
+      consecutiveFailures = 0;
       if (claim?.status === "authorized") {
         let apiKey;
         try {
@@ -606,6 +658,7 @@ var connectViaAppPairing = async (options = {}) => {
           await cancelPairing(pairId);
           return null;
         }
+        await ackPairing(pairId);
         stop(check, "App connected");
         return { apiKey, handle: claim.siteSlug };
       }

package/dist/{chunk-YZT2CBC3.js → chunk-NQTRA7H5.js}

@@ -1,6 +1,6 @@
 import {
   getPackageVersion
-} from "./chunk-JGH37QRB.js";
+} from "./chunk-7OYGFJYZ.js";
 import {
   getMachineId
 } from "./chunk-RN3NOEJF.js";

package/dist/src/index.d.ts

@@ -36,6 +36,7 @@ interface ModeState {
     readonly relayUrl: string | null;
     readonly trainingConsent?: boolean;
     readonly scope?: ScopeContract | null;
+    readonly degraded?: boolean;
 }
 declare const fetchModeState: (apiKey: string, sessionId?: string) => Promise<ModeState>;
 declare const fetchModeOverride: (apiKey: string) => Promise<ApprovalMode | null>;

package/dist/src/index.js

@@ -1,8 +1,8 @@
 import {
   handlePreToolUse
-} from "../chunk-SONXGCZY.js";
+} from "../chunk-HU43EZ5Q.js";
 import "../chunk-CAJZAFVS.js";
-import "../chunk-YHG74UFF.js";
+import "../chunk-GD275GEX.js";
 import {
   askUser,
   cancelQuestion,
@@ -15,7 +15,7 @@ import {
   reportEvent,
   resolvePolicy,
   waitForAnswer
-} from "../chunk-XOUYM27W.js";
+} from "../chunk-FZIQSDTQ.js";
 import "../chunk-WLGEY4UX.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.68.0",
+  "version": "0.70.0",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",

package/dist/chunk-YHG74UFF.js

@@ -1,12 +0,0 @@
-// src/answer.ts
-var denyReasonFrom = (value, note) => {
-  const trimmed = note?.trim();
-  if (trimmed) return `Denied from your phone: ${trimmed}`;
-  return value && value !== "no" && value !== "yes" ? `Denied from your phone: ${value}` : "Denied via push notification";
-};
-var isDeferAnswer = (value) => value === "defer";
-
-export {
-  denyReasonFrom,
-  isDeferAnswer
-};