@pushary/agent-hooks 0.69.0 → 0.71.0

package/dist/bin/pushary-setup.js

@@ -7,6 +7,11 @@ import {
   addPusharyHooks,
   addPusharyToolPermissions
 } from "../chunk-CAJZAFVS.js";
+import {
+  claudeWired,
+  codexWired,
+  geminiWired
+} from "../chunk-B7R4YSAB.js";
 import {
   describeDetection,
   detectAllAgents,
@@ -48,7 +53,7 @@ import {
   connectViaAppPairing,
   printConnectInstructions,
   setHumanStream
-} from "../chunk-P7VBAYQO.js";
+} from "../chunk-MGFZXUUR.js";
 import "../chunk-3EGEA4KH.js";
 import {
   KEY_FILE_MODE,
@@ -86,10 +91,10 @@ import {
   getPackageVersion,
   isNewerVersion,
   renderCommandHelp
-} from "../chunk-JGH37QRB.js";
+} from "../chunk-7OYGFJYZ.js";
 import {
   reportEvent
-} from "../chunk-H46LSQRT.js";
+} from "../chunk-FZIQSDTQ.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import {
@@ -105,7 +110,7 @@ import {
 } from "../chunk-KZERVKTD.js";
 
 // bin/pushary-setup.ts
-import { existsSync, readFileSync, writeFileSync, mkdirSync, cpSync, rmSync, renameSync } from "fs";
+import { existsSync, readFileSync, writeFileSync, mkdirSync, cpSync, rmSync, renameSync, realpathSync } from "fs";
 import { join, dirname, basename } from "path";
 import { homedir, tmpdir } from "os";
 import { execSync as execSync2 } from "child_process";
@@ -193,6 +198,53 @@ var describeClosing = (facts) => {
   };
 };
 
+// src/setup/codex-version.ts
+var parseCodexVersion = (raw) => {
+  const match = raw.match(/(\d+)\.(\d+)\.(\d+)/);
+  if (!match) return null;
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+};
+var compareCodexVersion = (a, b) => {
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] < b[i] ? -1 : 1;
+  }
+  return 0;
+};
+var versionFromPackageManifest = (probe, binPath) => {
+  let dir = probe.dirname(binPath);
+  for (let depth = 0; depth < 4; depth++) {
+    const raw = probe.readFile(probe.join(dir, "package.json"));
+    if (raw) {
+      try {
+        const manifest = JSON.parse(raw);
+        if (typeof manifest.version === "string") {
+          const parsed = parseCodexVersion(manifest.version);
+          if (parsed) return parsed;
+        }
+      } catch {
+      }
+    }
+    const parent = probe.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+};
+var readCodexVersion = (probe) => {
+  const onPath = probe.resolveOnPath();
+  if (onPath) {
+    const real = probe.realpath(onPath) ?? onPath;
+    const fromManifest = versionFromPackageManifest(probe, real);
+    if (fromManifest) return { kind: "known", version: fromManifest, source: "package manifest" };
+  }
+  const brew = probe.brewVersions();
+  if (brew) {
+    const parsed = parseCodexVersion(brew);
+    if (parsed) return { kind: "known", version: parsed, source: "homebrew" };
+  }
+  return { kind: "unknown" };
+};
+
 // src/skills-cli.ts
 import { execSync } from "child_process";
 var installSkillViaSkillsCli = (agent) => {
@@ -318,6 +370,9 @@ var parseSetupOptions = (input2) => {
   if (key && keyStdin) {
     throw new UsageError("Pass either --key or --key-stdin, not both");
   }
+  if (key && !isValidApiKey(key)) {
+    throw new UsageError("--key is not a valid API key. Expected the pk_xxx.xxx shape from pushary.com/dashboard/agent/settings");
+  }
   return {
     connectMode,
     connectExplicit: connectRaw !== void 0,
@@ -328,7 +383,14 @@ var parseSetupOptions = (input2) => {
     // Anything that means "there is nobody to answer a prompt". A non-TTY stdin
     // is included because that is the case that used to hang: it is better to
     // take the defaults and say so than to wait forever for a keypress.
-    nonInteractive: yes || agentsFlag !== void 0 || !input2.stdinIsTty,
+    //
+    // --json counts. Under it stdout carries exactly one object and every human
+    // line is redirected to stderr, so a prompt has nowhere to render: the
+    // question goes to stderr while the run blocks on a keypress the caller
+    // cannot see it is waiting for, and whatever is reading stdout waits forever
+    // for an object that never arrives. Asking for machine-readable output is
+    // itself a statement that no human is watching.
+    nonInteractive: yes || agentsFlag !== void 0 || flags.bools.has("json") || !input2.stdinIsTty,
     json: flags.bools.has("json"),
     dryRun: flags.bools.has("dry-run"),
     help,
@@ -359,6 +421,7 @@ var humanStream = process.stdout;
 var writeHuman = (text) => {
   humanStream.write(text);
 };
+var jsonMode = false;
 var dim = (s) => `\x1B[2m${s}\x1B[0m`;
 var bold = (s) => `\x1B[1m${s}\x1B[0m`;
 var green = (s) => `\x1B[32m${s}\x1B[0m`;
@@ -367,6 +430,10 @@ var yellow = (s) => `\x1B[33m${s}\x1B[0m`;
 var check = green("\u2713");
 var abortWith = async (reason, code, keyCheck) => {
   await reportSetupAbort(reason, code, keyCheck);
+  if (jsonMode) {
+    process.stdout.write(`${JSON.stringify({ ok: false, reason, exitCode: code, ...keyCheck ? { keyCheck } : {} }, null, 2)}
+`);
+  }
   return code;
 };
 var readKeyFromStdin = async (options) => {
@@ -621,26 +688,46 @@ var setupHermes = async (_apiKey) => {
 var CODEX_HOOKS_JSON = join(CODEX_HOME, "hooks.json");
 var CODEX_HOOKS_MIN_VERSION = [0, 122, 0];
 var CODEX_TRUST_VERIFIED_MAX = [0, 142, 2];
-var parseCodexVersion = (raw) => {
-  const match = raw.match(/(\d+)\.(\d+)\.(\d+)/);
-  if (!match) return null;
-  return [Number(match[1]), Number(match[2]), Number(match[3])];
-};
-var compareCodexVersion = (a, b) => {
-  for (let i = 0; i < 3; i++) {
-    if (a[i] !== b[i]) return a[i] < b[i] ? -1 : 1;
-  }
-  return 0;
-};
-var readCodexVersion = () => {
-  try {
-    return parseCodexVersion(execSync2("codex --version", { encoding: "utf-8", stdio: "pipe", timeout: 1e4 }));
-  } catch {
-    return null;
-  }
-};
-var codexSupportsHooks = (version) => version !== null && compareCodexVersion(version, CODEX_HOOKS_MIN_VERSION) >= 0;
-var codexTrustAutoSupported = (version) => version !== null && codexSupportsHooks(version) && compareCodexVersion(version, CODEX_TRUST_VERIFIED_MAX) <= 0;
+var detectCodexVersion = () => readCodexVersion({
+  resolveOnPath: () => {
+    const whichCmd = IS_WINDOWS ? "where" : "which";
+    try {
+      const found = execSync2(`${whichCmd} codex`, { encoding: "utf-8", stdio: "pipe", timeout: 5e3 }).split("\n")[0].trim();
+      return found || null;
+    } catch {
+      return null;
+    }
+  },
+  realpath: (path) => {
+    try {
+      return realpathSync(path);
+    } catch {
+      return null;
+    }
+  },
+  readFile: (path) => {
+    try {
+      return readFileSync(path, "utf-8");
+    } catch {
+      return null;
+    }
+  },
+  brewVersions: () => {
+    try {
+      return execSync2("brew list --versions codex", {
+        encoding: "utf-8",
+        stdio: "pipe",
+        timeout: 1e4
+      }).trim() || null;
+    } catch {
+      return null;
+    }
+  },
+  join,
+  dirname
+});
+var codexSupportsHooks = (result) => result.kind === "known" && compareCodexVersion(result.version, CODEX_HOOKS_MIN_VERSION) >= 0;
+var codexTrustAutoSupported = (result) => result.kind === "known" && codexSupportsHooks(result) && compareCodexVersion(result.version, CODEX_TRUST_VERIFIED_MAX) <= 0;
 var removeCodexNotifyEntry = (codexConfig) => {
   let raw = "";
   try {
@@ -691,7 +778,7 @@ var setupCodex = async (apiKey) => {
     addCodexMcpServer(config, apiKey);
     writeFileAtomic(codexConfig, stringifyTOML(config), KEY_FILE_MODE);
   });
-  const codexVersion = readCodexVersion();
+  const codexVersion = detectCodexVersion();
   const hooksSupported = codexSupportsHooks(codexVersion);
   const trustAuto = codexTrustAutoSupported(codexVersion);
   let trusted = false;
@@ -719,9 +806,16 @@ var setupCodex = async (apiKey) => {
       removeCodexNotifyEntry(codexConfig);
     });
   } else {
-    console.log(`  ${yellow("!")} This Codex version predates native hooks (needs ${CODEX_HOOKS_MIN_VERSION.join(".")}+).`);
-    console.log(`  ${dim("Installing the deprecated notify handler instead. Upgrade Codex and re-run setup")}`);
-    console.log(`  ${dim("to get policy enforcement, phone approvals, and session tracking.")}`);
+    if (codexVersion.kind === "known") {
+      console.log(`  ${yellow("!")} This Codex version predates native hooks (needs ${CODEX_HOOKS_MIN_VERSION.join(".")}+).`);
+      console.log(`  ${dim("Installing the deprecated notify handler instead. Upgrade Codex and re-run setup")}`);
+      console.log(`  ${dim("to get policy enforcement, phone approvals, and session tracking.")}`);
+    } else {
+      console.log(`  ${yellow("!")} Could not read your Codex version from its install, so hooks were skipped.`);
+      console.log(`  ${dim("Deliberately not run: asking the binary its version is what macOS quarantines.")}`);
+      console.log(`  ${dim(`Installing the notify handler, which works on every version. If Codex is ${CODEX_HOOKS_MIN_VERSION.join(".")}+,`)}`);
+      console.log(`  ${dim("re-run setup after installing it through npm or Homebrew to get native hooks.")}`);
+    }
     await spinner("Adding notify handler for Codex events (deprecated)", async () => {
       addCodexNotifyEntry(codexConfig);
     });
@@ -1053,6 +1147,44 @@ var setupGemini = async (apiKey) => {
   console.log(`  ${dim("Restart Gemini CLI to load the new config.")}`);
   noteManual("Restart Gemini CLI to load the new config.");
 };
+var agentIsWired = (agent) => {
+  const readJson2 = (path) => {
+    try {
+      return JSON.parse(readFileSync(path, "utf-8"));
+    } catch {
+      return null;
+    }
+  };
+  switch (agent) {
+    case "claude_code":
+      return claudeWired({
+        claudeJson: readJson2(CLAUDE_JSON),
+        settings: readJson2(CLAUDE_SETTINGS),
+        skillExists: existsSync(join(CLAUDE_SKILL_DIR, "SKILL.md"))
+      });
+    case "codex": {
+      let config = null;
+      try {
+        config = parseTOML(readFileSync(join(CODEX_HOME, "config.toml"), "utf-8"));
+      } catch {
+        config = null;
+      }
+      return codexWired({
+        config,
+        hooks: readJson2(CODEX_HOOKS_JSON),
+        skillExists: existsSync(join(CODEX_SKILL_DIR, "SKILL.md"))
+      });
+    }
+    case "gemini_cli":
+      return geminiWired({ settings: readJson2(GEMINI_SETTINGS) });
+    case "cursor":
+      return existsSync(join(CURSOR_PLUGIN_DIR, "mcp.json"));
+    case "vscode":
+      return existsSync(join(VSCODE_PLUGIN_DIR, ".mcp.json"));
+    default:
+      return true;
+  }
+};
 var AGENT_SETUP = {
   claude_code: setupClaudeCode,
   codex: setupCodex,
@@ -1201,7 +1333,8 @@ var resolveAgents = async (options) => {
     return options.agents.agents;
   }
   const detected = detectAgents();
-  if (options.agents.kind === "auto") {
+  const wantsAuto = options.agents.kind === "auto" || options.nonInteractive;
+  if (wantsAuto) {
     const picked = Object.keys(detected).filter((agent) => detected[agent].found);
     if (picked.length === 0) {
       console.log(`  ${yellow("!")} No agents detected, so nothing was configured. Your key is saved.`);
@@ -1283,6 +1416,7 @@ var main = async () => {
   }
   recordSetupOptions(options);
   if (options.json) {
+    jsonMode = true;
     humanStream = process.stderr;
     setHumanStream(process.stderr);
     console.log = (...args) => {
@@ -1304,12 +1438,12 @@ var main = async () => {
   let keyFromPairing = false;
   const storedKey = readConfigFileKey();
   const pairingRequested = connectMode === "app" && options.connectExplicit && !options.skipPhone;
-  const ambientEligible = !(flagKey && isValidApiKey(flagKey)) && !pairingRequested;
+  const ambientEligible = flagKey === void 0 && !pairingRequested;
   const envCheck = ambientEligible && envKey && isValidApiKey(envKey) ? await usableStoredKey(envKey) : null;
   const storedCheck = ambientEligible && envCheck === null && storedKey !== null && isValidApiKey(storedKey) && // login writes both, so without this the same key is probed twice.
   storedKey !== envKey ? await usableStoredKey(storedKey) : null;
   let storedKeyCheck = null;
-  if (flagKey && isValidApiKey(flagKey)) {
+  if (flagKey) {
     const masked = `${flagKey.slice(0, 8)}...${flagKey.slice(-4)}`;
     console.log(`  ${check} Using API key: ${dim(masked)}`);
     console.log();
@@ -1445,8 +1579,15 @@ var main = async () => {
       markStep(`configure:${agent}`);
       try {
         const outcome = await AGENT_SETUP[agent](trimmedKey, context);
-        if (outcome === "skipped") skipped.push(agent);
-        else completed.push(agent);
+        if (outcome === "skipped") {
+          skipped.push(agent);
+        } else if (agentIsWired(agent)) {
+          completed.push(agent);
+        } else {
+          failed.push(agent.replace("_", " "));
+          console.log(`  ${yellow("!")} ${agent.replace("_", " ")} reported success but its config is not there.`);
+          console.log(`  ${dim("Re-run setup, then")} ${cyan("npx @pushary/agent-hooks@latest doctor")} ${dim("to see what is missing.")}`);
+        }
       } catch (err) {
         failed.push(agent.replace("_", " "));
         console.log(`  ${yellow("!")} ${agent.replace("_", " ")} setup failed: ${formatError(err)}`);

package/dist/bin/pushary-stats.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   exitOnHelpFlag
-} from "../chunk-ATP6UQPH.js";
-import "../chunk-JGH37QRB.js";
+} from "../chunk-BBK3TTU2.js";
+import "../chunk-7OYGFJYZ.js";
 import {
   readLedgerSummary
 } from "../chunk-WLGEY4UX.js";

package/dist/bin/pushary-status.js

@@ -2,12 +2,12 @@
 import {
   describeLastSeen,
   listMachines
-} from "../chunk-YZT2CBC3.js";
+} from "../chunk-NQTRA7H5.js";
 import {
   describeReach,
   fetchChannels,
   reachVerdict
-} from "../chunk-P7VBAYQO.js";
+} from "../chunk-MGFZXUUR.js";
 import "../chunk-3EGEA4KH.js";
 import {
   readKeySource
@@ -26,8 +26,8 @@ import {
 } from "../chunk-GMXKITVA.js";
 import {
   exitOnHelpFlag
-} from "../chunk-ATP6UQPH.js";
-import "../chunk-JGH37QRB.js";
+} from "../chunk-BBK3TTU2.js";
+import "../chunk-7OYGFJYZ.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import {

package/dist/bin/pushary-stop-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handleStop
-} from "../chunk-H46LSQRT.js";
+} from "../chunk-FZIQSDTQ.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-stopfailure-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handleStopFailure
-} from "../chunk-H46LSQRT.js";
+} from "../chunk-FZIQSDTQ.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-suggestions.js

@@ -7,8 +7,8 @@ import {
 } from "../chunk-GMXKITVA.js";
 import {
   exitOnHelpFlag
-} from "../chunk-ATP6UQPH.js";
-import "../chunk-JGH37QRB.js";
+} from "../chunk-BBK3TTU2.js";
+import "../chunk-7OYGFJYZ.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-upgrade.js

@@ -36,10 +36,10 @@ import {
 } from "../chunk-MUEW424A.js";
 import {
   exitOnHelpFlag
-} from "../chunk-ATP6UQPH.js";
+} from "../chunk-BBK3TTU2.js";
 import {
   isNewerVersion
-} from "../chunk-JGH37QRB.js";
+} from "../chunk-7OYGFJYZ.js";
 import "../chunk-DQAN3JQP.js";
 import {
   getApiKey

package/dist/bin/pushary-wait.js

@@ -14,8 +14,8 @@ import {
 } from "../chunk-GMXKITVA.js";
 import {
   exitOnHelpFlag
-} from "../chunk-ATP6UQPH.js";
-import "../chunk-JGH37QRB.js";
+} from "../chunk-BBK3TTU2.js";
+import "../chunk-7OYGFJYZ.js";
 import "../chunk-SAF6HGAA.js";
 import {
   UsageError

package/dist/bin/pushary.js

@@ -4,7 +4,7 @@ import {
   getPackageVersion,
   isCommandName,
   renderHelp
-} from "../chunk-JGH37QRB.js";
+} from "../chunk-7OYGFJYZ.js";
 import {
   installProxyDispatcher
 } from "../chunk-SAF6HGAA.js";

package/dist/{chunk-JGH37QRB.js → chunk-7OYGFJYZ.js}

@@ -3,7 +3,7 @@ var COMMAND_LIST = [
   {
     name: "setup",
     module: "pushary-setup",
-    summary: "Configure Claude Code, Codex, Gemini CLI, Hermes, or Cursor with Pushary"
+    summary: "Configure Claude Code, Codex, Gemini CLI, Hermes, Cursor, or VS Code with Pushary"
   },
   {
     name: "claude",

package/dist/chunk-B7R4YSAB.js

@@ -0,0 +1,38 @@
+import {
+  hasGeminiHooks
+} from "./chunk-E2U35RLD.js";
+import {
+  hasCodexHooks
+} from "./chunk-7HG4WUIE.js";
+
+// src/diagnostics/wiring.ts
+var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var CLAUDE_HOOK_BINARY = /pushary-[a-z-]*hook/;
+var claudeWired = ({ claudeJson, settings, skillExists }) => {
+  if (record(record(claudeJson)?.mcpServers)?.pushary) return true;
+  const s = record(settings);
+  if (s) {
+    if (CLAUDE_HOOK_BINARY.test(JSON.stringify(s.hooks ?? {}))) return true;
+    const allow = record(s.permissions)?.allow;
+    if (Array.isArray(allow) && allow.some((rule) => String(rule).includes("mcp__pushary__"))) return true;
+  }
+  return skillExists;
+};
+var codexWired = ({ config, hooks, skillExists }) => {
+  if (record(record(config)?.mcp_servers)?.pushary) return true;
+  const h = record(hooks);
+  if (h && hasCodexHooks(h)) return true;
+  return skillExists;
+};
+var geminiWired = ({ settings }) => {
+  const s = record(settings);
+  if (!s) return false;
+  if (record(s.mcpServers)?.pushary) return true;
+  return hasGeminiHooks(s);
+};
+
+export {
+  claudeWired,
+  codexWired,
+  geminiWired
+};

package/dist/{chunk-ATP6UQPH.js → chunk-BBK3TTU2.js}

@@ -1,7 +1,7 @@
 import {
   getPackageVersion,
   renderCommandHelp
-} from "./chunk-JGH37QRB.js";
+} from "./chunk-7OYGFJYZ.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";

package/dist/{chunk-H46LSQRT.js → chunk-FZIQSDTQ.js}

@@ -55,6 +55,10 @@ var isWaitForAnswerResponse = (data) => {
 // src/policy.ts
 var CACHE_TTL_MS = 60 * 1e3;
 var STALE_CACHE_MAX_MS = 12 * 60 * 60 * 1e3;
+var policyRequestFor = (agentType) => ({
+  agent: agentType,
+  repoAware: agentType === "claude_code"
+});
 var policyCacheFile = (apiKey, agent, repoAware = false) => {
   const parts = [apiKey, agent, repoAware ? "repoAware" : void 0].filter(Boolean);
   const hash = createHash("sha256").update(parts.join(":")).digest("hex").slice(0, 12);
@@ -132,6 +136,8 @@ var findBestMatch = (policies, toolName, args, repoKey) => {
   }
   return best;
 };
+var isAutoApprove = (policy) => policy.timeoutSeconds === 0 && policy.timeoutAction === "approve";
+var isAutoDeny = (policy) => policy.timeoutSeconds === 0 && policy.timeoutAction === "deny";
 var autoApprove = (tool) => ({
   tool,
   timeoutSeconds: 0,
@@ -164,7 +170,7 @@ var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey) =>
   if (!governedBySpecificRule && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg)) {
     base = autoApprove(base.tool);
   }
-  const wouldAutoApprove = base.timeoutSeconds === 0 && base.timeoutAction === "approve";
+  const wouldAutoApprove = isAutoApprove(base);
   if (!governedBySpecificRule && wouldAutoApprove && toolName === "Bash" && typeof arg === "string" && classifyDecisionRisk(toolName, arg) === "destructive") {
     base = {
       tool: base.tool,
@@ -181,8 +187,8 @@ var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey) =>
   return base;
 };
 var restraintRank = (policy) => {
-  if (policy.timeoutSeconds === 0 && policy.timeoutAction === "deny") return 4;
-  if (policy.timeoutSeconds === 0 && policy.timeoutAction === "approve") return 0;
+  if (isAutoDeny(policy)) return 4;
+  if (isAutoApprove(policy)) return 0;
   if (policy.mode === "push_only") return 3;
   return policy.mode === "terminal_only" || policy.mode === "notify_only" ? 1 : 2;
 };
@@ -945,31 +951,38 @@ var notifyLateAnswers = async (apiKey, late, agentName, sessionId) => {
 };
 var CLAUDE_CODE_AGENT = { type: "claude_code", label: "Claude Code" };
 var POLICY_CACHE_TTL_MS = 5 * 60 * 1e3;
-var readFreshCachedPolicy = (apiKey) => {
-  const path = policyCacheFile(apiKey);
+var readFreshCachedPolicy = (apiKey, agentType) => {
+  const request = policyRequestFor(agentType);
+  const path = policyCacheFile(apiKey, request.agent, request.repoAware);
   if (!existsSync5(path)) return null;
   const cached = JSON.parse(readFileSync4(path, "utf-8"));
   if (!isPolicyConfig(cached)) return null;
   if (!cached._cachedAt || Date.now() - cached._cachedAt >= POLICY_CACHE_TTL_MS) return null;
   return cached;
 };
-var deriveDecisionSource = (toolName, toolInput, liveMode, cwd) => {
+var autoDecisionEnabled = () => {
+  const flag = process.env.PUSHARY_AUTO_DECISION_BEACON;
+  return flag === "1" || flag === "true";
+};
+var deriveDecisionSource = (toolName, toolInput, liveMode, agentType, cwd) => {
   try {
     if (liveMode.kill) return "terminal";
-    const policy = readFreshCachedPolicy(getApiKey());
+    if (!autoDecisionEnabled()) return void 0;
+    const policy = readFreshCachedPolicy(getApiKey(), agentType);
     if (!policy) return void 0;
     const resolved = resolvePolicy(policy, toolName, liveMode.mode, toolInput, cwd, repoKeyFor(cwd));
-    if (resolved.timeoutSeconds === 0 && resolved.timeoutAction === "approve") return "policy_auto";
+    if (isAutoApprove(resolved)) return "policy_auto";
     if (resolved.mode === "push_only" || resolved.mode === "push_first") return "human";
     return "terminal";
   } catch {
     return void 0;
   }
 };
-var deriveAutoDecisionBeacon = (toolName, toolInput, liveMode, cwd) => {
+var deriveAutoDecisionBeacon = (toolName, toolInput, liveMode, agentType, cwd) => {
   try {
     if (liveMode.kill) return void 0;
-    const policy = readFreshCachedPolicy(getApiKey());
+    if (!autoDecisionEnabled()) return void 0;
+    const policy = readFreshCachedPolicy(getApiKey(), agentType);
     if (!policy) return void 0;
     const resolved = resolvePolicy(policy, toolName, liveMode.mode, toolInput, cwd, repoKeyFor(cwd));
     if (resolved.timeoutSeconds !== 0 || resolved.timeoutAction !== "approve") return void 0;
@@ -1055,8 +1068,8 @@ var handlePostToolUse = async (input, agent = CLAUDE_CODE_AGENT) => {
       for (const l of late) removePendingQuestion(sessionKey, l.correlationId);
     }
     const isMirrorOnly = NON_GATED_MIRROR_TOOLS.has(input.tool_name);
-    const decisionSource = isMirrorOnly ? void 0 : deriveDecisionSource(lookup.tool, lookup.input, liveMode, input.cwd);
-    const beacon = !isMirrorOnly && decisionSource === "policy_auto" && throttlePass(`autodecision:${sessionKey}:${lookup.tool}`, AUTO_DECISION_WINDOW_MS) ? deriveAutoDecisionBeacon(lookup.tool, lookup.input, liveMode, input.cwd) : void 0;
+    const decisionSource = isMirrorOnly ? void 0 : deriveDecisionSource(lookup.tool, lookup.input, liveMode, agent.type, input.cwd);
+    const beacon = !isMirrorOnly && decisionSource === "policy_auto" && throttlePass(`autodecision:${sessionKey}:${lookup.tool}`, AUTO_DECISION_WINDOW_MS) ? deriveAutoDecisionBeacon(lookup.tool, lookup.input, liveMode, agent.type, input.cwd) : void 0;
     const toolReport = reportEvent({
       event: isError ? "tool_error" : "tool_complete",
       agentType: agent.type,
@@ -1310,6 +1323,8 @@ var handleStopFailure = async (input, agent = CLAUDE_CODE_AGENT) => {
 
 export {
   getPolicy,
+  isAutoApprove,
+  isAutoDeny,
   resolveAutoResolveOrigin,
   resolvePolicy,
   resolvePolicyAcross,

package/dist/{chunk-3USMXNVB.js → chunk-GD275GEX.js}

@@ -1,8 +1,10 @@
 import {
+  isAutoApprove,
+  isAutoDeny,
   isModeStateDegraded,
   resolveAutoResolveOrigin,
   resolvePolicyAcross
-} from "./chunk-H46LSQRT.js";
+} from "./chunk-FZIQSDTQ.js";
 import {
   evaluateScope,
   scopeChangeReason,
@@ -34,8 +36,8 @@ var resolveGate = (input) => {
   const { modeState, config, toolName, toolInputs, cwd, repoKey } = input;
   if (modeState.kill) return { kind: "kill", reason: KILL_REASON };
   const policy = resolvePolicyAcross(config, toolName, modeState.mode, toolInputs, cwd, repoKey);
-  const autoApproves = policy.timeoutSeconds === 0 && policy.timeoutAction === "approve";
-  const autoDenies = policy.timeoutSeconds === 0 && policy.timeoutAction === "deny";
+  const autoApproves = isAutoApprove(policy);
+  const autoDenies = isAutoDeny(policy);
   if (autoDenies) return { kind: "deny", policy, reason: `Denied by policy for ${policy.tool}` };
   if (isModeStateDegraded(modeState)) {
     if (autoApproves) {

package/dist/{chunk-C5I2RAMT.js → chunk-HU43EZ5Q.js}

@@ -5,7 +5,7 @@ import {
   denyReasonFrom,
   isDeferAnswer,
   resolveGate
-} from "./chunk-3USMXNVB.js";
+} from "./chunk-GD275GEX.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -25,7 +25,7 @@ import {
   sendNotification,
   throttlePass,
   waitForAnswer
-} from "./chunk-H46LSQRT.js";
+} from "./chunk-FZIQSDTQ.js";
 import {
   isGatingMoment,
   recordKeylessMoment