@pushary/agent-hooks 0.74.0 → 0.76.0

package/data/cursor-plugin/scripts/pushary-gate.mjs

@@ -32,10 +32,7 @@ import { existsSync, readFileSync, writeFileSync } from 'node:fs'
 import { basename, dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
-// Overridable like every other Pushary client (the VS Code gate already was).
-// Hardcoded, this gate could not be pointed at a staging or self-hosted server,
-// so there was no way to exercise it anywhere but production.
-const BASE_URL = process.env.PUSHARY_BASE_URL?.trim() || process.env.PUSHARY_API_URL?.trim() || 'https://pushary.com'
+const BASE_URL = 'https://pushary.com'
 const MCP_URL = `${BASE_URL}/api/mcp/mcp`
 const POLICY_CACHE_TTL_MS = 5 * 60 * 1000
 const MAX_BLOCK_MS = 45_000 // longest we can wait before Cursor's hook timeout
@@ -59,14 +56,6 @@ const respond = (decision) => {
   process.exit(0)
 }
 
-// Always surfaced in Cursor's hooks output channel, so a silent fall-through to
-// "ask" is explainable instead of a mystery.
-const diag = (message) => {
-  try {
-    process.stderr.write(`[pushary-gate] ${message}\n`)
-  } catch {}
-}
-
 // Backstop: if anything hangs, return "ask" rather than letting the hook time out
 // (which, with failClosed, would block the command).
 setTimeout(() => respond(ask()), HARD_GUARD_MS).unref()
@@ -87,27 +76,103 @@ const withRetry = async (fn, attempts) => {
   throw lastError
 }
 
-// Cursor's Windows launcher can fail to pipe stdin to a hook (a documented Cursor
-// bug: the async stream yields nothing and the hook falls through to "ask"). A
-// synchronous read of fd 0 survives several of those cases where the stream does
-// not, so try it first and only stream as a fallback.
 const readStdin = async () => {
+  let raw = ''
+  for await (const chunk of process.stdin) raw += chunk
+  return raw
+}
+
+const getMachineId = () => createHash('sha256').update(hostname()).digest('hex').slice(0, 8)
+
+// ── Repository identity (ported from packages/agent-hooks/src/repo.ts) ───────
+// A rule can be scoped to one repository, so the gate has to know which one it
+// is in or those rules are withheld. Read as files: a `git` subprocess here would
+// cost more than the rest of the decision and fail where git is absent.
+const REPO_KEY_MAX_LENGTH = 200
+const MAX_PARENT_WALK = 64
+
+const normalizeRepoRemote = (remoteUrl) => {
+  const raw = (remoteUrl || '').trim()
+  if (!raw) return undefined
+  let hostAndPath
+  const scp = /^[A-Za-z0-9._-]+@([A-Za-z0-9._-]+):(.+)$/.exec(raw)
+  if (scp) {
+    hostAndPath = `${scp[1]}/${scp[2]}`
+  } else {
+    const url = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/(.+)$/.exec(raw)
+    if (!url || /^file:/i.test(raw)) return undefined
+    hostAndPath = url[1]
+  }
+  const slash = hostAndPath.indexOf('/')
+  if (slash <= 0) return undefined
+  const at = hostAndPath.slice(0, slash).lastIndexOf('@')
+  // Credentials must never survive: a remote can carry a token and this value is
+  // sent to the server and persisted.
+  const host = (at === -1 ? hostAndPath.slice(0, slash) : hostAndPath.slice(at + 1, slash)).replace(/:\d+$/, '')
+  const path = hostAndPath.slice(slash + 1).split('/').filter(Boolean).join('/')
+  if (!host || !path) return undefined
+  return `${host}/${path}`.replace(/\.git$/i, '').toLowerCase().slice(0, REPO_KEY_MAX_LENGTH)
+}
+
+const findGitDir = (startDir) => {
+  let current = startDir
+  for (let depth = 0; depth < MAX_PARENT_WALK; depth += 1) {
+    const candidate = join(current, '.git')
+    try {
+      if (existsSync(candidate)) {
+        const pointer = readFileSync(candidate, 'utf-8').trim()
+        // A directory read throws EISDIR, which is the ordinary-clone case.
+        if (pointer.startsWith('gitdir:')) {
+          const target = pointer.slice('gitdir:'.length).trim()
+          return target.startsWith('/') ? target : join(current, target)
+        }
+      }
+    } catch (error) {
+      if (error?.code === 'EISDIR') return candidate
+    }
+    const parent = dirname(current)
+    if (parent === current) return undefined
+    current = parent
+  }
+  return undefined
+}
+
+const deriveRepoKey = (cwd) => {
+  const override = process.env.PUSHARY_REPO_KEY
+  if (typeof override === 'string') {
+    const trimmed = override.trim()
+    if (trimmed.toLowerCase() === 'off') return undefined
+    if (trimmed) return trimmed.toLowerCase()
+  }
+  const dir = cwd || process.cwd()
   try {
-    const sync = readFileSync(0, 'utf-8')
-    if (sync && sync.trim()) return sync
-  } catch {}
-  try {
-    let raw = ''
-    process.stdin.setEncoding('utf-8')
-    for await (const chunk of process.stdin) raw += chunk
-    return raw
+    const gitDir = findGitDir(dir)
+    if (gitDir) {
+      // A worktree's config lives in the main git directory.
+      const wt = gitDir.replace(/\\/g, '/').indexOf('/worktrees/')
+      const configPath = wt === -1 ? join(gitDir, 'config') : join(gitDir.slice(0, wt), 'config')
+      if (existsSync(configPath)) {
+        let inOrigin = false
+        for (const rawLine of readFileSync(configPath, 'utf-8').split('\n')) {
+          const line = rawLine.trim()
+          if (line.startsWith('[')) { inOrigin = /^\[remote "origin"\]/.test(line); continue }
+          if (!inOrigin) continue
+          const url = /^url\s*=\s*(.+)$/.exec(line)
+          if (url) {
+            const normalized = normalizeRepoRemote(url[1].trim())
+            if (normalized) return normalized
+          }
+        }
+      }
+      const root = gitDir.endsWith('.git') ? dirname(gitDir) : dir
+      return `local/${basename(root).toLowerCase()}`.slice(0, REPO_KEY_MAX_LENGTH)
+    }
+    return `local/${basename(dir).toLowerCase()}`.slice(0, REPO_KEY_MAX_LENGTH)
   } catch {
-    return ''
+    return undefined
   }
 }
 
-const getMachineId = () => createHash('sha256').update(hostname()).digest('hex').slice(0, 8)
-
 // Env first. CLI installs inject the key into the sibling mcp.json, so fall back to
 // that. This lets the gate work even when Cursor's GUI does not pass the shell env.
 const resolveApiKey = () => {
@@ -177,7 +242,11 @@ const getJson = async (path, apiKey, timeoutMs) => {
 const isPolicyConfig = (d) =>
   !!d && typeof d === 'object' && Array.isArray(d.policies) && typeof d.defaultTimeoutSeconds === 'number' && typeof d.defaultTimeoutAction === 'string'
 
-const policyCacheFile = (apiKey) => join(tmpdir(), `pushary-policy-${createHash('sha256').update(apiKey).digest('hex').slice(0, 12)}.json`)
+// Keyed by the capability as well as the key: the server returns a different rule
+// set to a client that did not ask for repo-scoped rules, so one key for both
+// would serve the wrong policy across an upgrade.
+const policyCacheFile = (apiKey) =>
+  join(tmpdir(), `pushary-policy-${createHash('sha256').update(`${apiKey}:cursor:repoAware`).digest('hex').slice(0, 12)}.json`)
 
 const getPolicy = async (apiKey) => {
   const path = policyCacheFile(apiKey)
@@ -193,7 +262,7 @@ const getPolicy = async (apiKey) => {
   }
   try {
     const fresh = await withRetry(async () => {
-      const raw = await getJson('/api/mcp/policy', apiKey, POLICY_TIMEOUT_MS)
+      const raw = await getJson('/api/mcp/policy?repoAware=1', apiKey, POLICY_TIMEOUT_MS)
       if (!isPolicyConfig(raw)) throw new Error('invalid policy')
       return raw
     }, 2)
@@ -207,9 +276,140 @@ const getPolicy = async (apiKey) => {
   }
 }
 
-const resolvePolicy = (config, toolName, modeOverride) => {
-  const base =
-    config.policies.find((p) => p.tool === toolName) ??
+// ── Rule matching ────────────────────────────────────────────────────────────
+// Ported from @pushary/contracts (agent-hooks 0.56.0). This file cannot take a
+// dependency — a Cursor plugin is cloned, not installed — so the logic is
+// vendored. Keep it in step with packages/contracts/src/index.ts; the cases in
+// scripts/pushary-gate.test.mjs mirror the ones in policy.test.ts.
+//
+// Previously this matched on tool NAME alone, which meant every argument rule was
+// invisible here: a user's own `Bash(rm:*)` deny did nothing and `rm -rf` was
+// auto-approved by a broad `Bash` allow. Cursor was strictly less safe than
+// Claude Code for the same policy.
+
+const MATCH_RANKS = ['none', 'tool', 'prefix', 'exact']
+const matchRankWeight = (rank) => MATCH_RANKS.indexOf(rank)
+
+const GLOB_MAX_WILDCARDS = 8
+const GLOB_MAX_ARG_LENGTH = 4096
+
+// Offset propagation rather than a compiled regex: several `**` render as `.*`
+// and backtrack catastrophically on a long non-matching argument, which would
+// hang this gate and, with failClosed, block the command.
+const globMatches = (glob, text) => {
+  let stars = 0
+  for (const ch of glob) if (ch === '*') stars += 1
+  if (stars > GLOB_MAX_WILDCARDS) return false
+
+  const tokens = []
+  let literal = ''
+  const flush = () => { if (literal) { tokens.push({ literal }); literal = '' } }
+  for (let i = 0; i < glob.length; i += 1) {
+    if (glob[i] !== '*') { literal += glob[i]; continue }
+    flush()
+    if (glob[i + 1] === '*') { tokens.push({ any: true }); i += 1 } else { tokens.push({ any: false }) }
+  }
+  flush()
+
+  const n = text.length
+  let reach = new Uint8Array(n + 1)
+  reach[0] = 1
+  for (const token of tokens) {
+    const next = new Uint8Array(n + 1)
+    if (token.literal !== undefined) {
+      for (let p = 0; p <= n - token.literal.length; p += 1) {
+        if (reach[p] && text.startsWith(token.literal, p)) next[p + token.literal.length] = 1
+      }
+    } else {
+      let open = 0
+      for (let p = 0; p <= n; p += 1) {
+        if (!token.any && p > 0 && text.charCodeAt(p - 1) === 47) open = 0
+        if (reach[p]) open = 1
+        if (open) next[p] = 1
+      }
+    }
+    reach = next
+  }
+  return reach[n] === 1
+}
+
+const matchToolPattern = (pattern, toolName, arg) => {
+  const open = pattern.indexOf('(')
+  if (open === -1 || !pattern.endsWith(')')) return pattern === toolName ? 'tool' : 'none'
+  if (pattern.slice(0, open) !== toolName || arg === undefined) return 'none'
+  const inner = pattern.slice(open + 1, -1)
+  if (inner.endsWith(':*')) return arg.startsWith(inner.slice(0, -2)) ? 'prefix' : 'none'
+  if (inner.includes('*')) {
+    if (arg.length > GLOB_MAX_ARG_LENGTH) return 'none'
+    return globMatches(inner, arg) ? 'prefix' : 'none'
+  }
+  return arg === inner ? 'exact' : 'none'
+}
+
+// A rule with no repoKey applies everywhere; a scoped one only in its own repo,
+// and never when the repo could not be established.
+const repoMatches = (ruleRepoKey, currentRepoKey) => !ruleRepoKey || ruleRepoKey === currentRepoKey
+
+// Rank first, then a repo-scoped rule over a workspace-wide one, then the longer
+// pattern — the same precedence the hook applies.
+const findBestMatch = (policies, toolName, arg, repoKey) => {
+  let best
+  let bestWeight = 0
+  let bestScoped = -1
+  let bestLength = -1
+  for (const candidate of policies) {
+    if (!repoMatches(candidate.repoKey, repoKey)) continue
+    const rank = matchToolPattern(candidate.tool, toolName, arg)
+    if (rank === 'none') continue
+    const weight = matchRankWeight(rank)
+    const scoped = candidate.repoKey ? 1 : 0
+    const length = rank === 'prefix' ? candidate.tool.length : -1
+    if (
+      weight > bestWeight ||
+      (weight === bestWeight && scoped > bestScoped) ||
+      (weight === bestWeight && scoped === bestScoped && length > bestLength)
+    ) {
+      best = { policy: candidate, rank }
+      bestWeight = weight
+      bestScoped = scoped
+      bestLength = length
+    }
+  }
+  return best
+}
+
+// The destructive ceiling. A call the classifier flags must never auto-approve
+// through a general bare-tool or wildcard rule, so the "destructive always asks"
+// guarantee holds for wrapped or unlisted commands too. An explicit rule the user
+// wrote still wins. Mirrors APPROVAL_FATIGUE_FLAG_PATTERNS in contracts.
+const DESTRUCTIVE_PATTERNS = [
+  /\brm\s+-[a-z]*r/i,
+  /\brmdir\b/i,
+  /git\s+push[^\n]*(--force|--force-with-lease|\s-f\b)/i,
+  /git\s+reset\s+--hard/i,
+  /git\s+clean\s+-[a-z]*f/i,
+  /\bdrop\s+(table|database|schema)\b/i,
+  /\bdelete\s+from\b/i,
+  /\btruncate\b/i,
+  /\b(deploy|publish|release)\b/i,
+  /\bnpm\s+publish\b/i,
+  /\bsudo\b/i,
+  /chmod\s+-?R?\s*777/i,
+  /\bkubectl\s+delete\b/i,
+  /\bterraform\s+(apply|destroy)\b/i,
+  /\bdocker\s+system\s+prune\b/i,
+]
+
+const isDestructive = (command) => DESTRUCTIVE_PATTERNS.some((re) => re.test(command))
+
+// The safe-read-only floor is deliberately NOT ported. It only ever loosens a
+// decision, and hooks.json already routes just the risky commands here, so
+// omitting it can cost an extra prompt but can never approve something unsafe.
+
+const resolvePolicy = (config, toolName, modeOverride, command, repoKey) => {
+  const match = findBestMatch(config.policies, toolName, command, repoKey)
+  let base =
+    match?.policy ??
     config.policies.find((p) => p.tool === '*') ??
     {
       tool: toolName,
@@ -218,6 +418,19 @@ const resolvePolicy = (config, toolName, modeOverride) => {
       mode: config.defaultMode ?? 'push_first',
       pushFirstSeconds: config.defaultPushFirstSeconds ?? 20,
     }
+
+  const governedBySpecificRule = match?.rank === 'exact' || match?.rank === 'prefix'
+  const wouldAutoApprove = base.timeoutSeconds === 0 && base.timeoutAction === 'approve'
+  if (!governedBySpecificRule && wouldAutoApprove && typeof command === 'string' && isDestructive(command)) {
+    base = {
+      tool: base.tool,
+      timeoutSeconds: config.defaultTimeoutSeconds,
+      timeoutAction: 'wait',
+      mode: 'push_first',
+      pushFirstSeconds: config.defaultPushFirstSeconds ?? 20,
+    }
+  }
+
   const effective = modeOverride ?? config.modeOverride
   return effective ? { ...base, mode: effective } : base
 }
@@ -234,43 +447,6 @@ const fetchModeState = async (apiKey, sessionId) => {
   }
 }
 
-// ── action body capture + redaction (inlined mirror of describe.ts, since this
-// dependency-free hook cannot import the workspace) ──────────────────────────────
-const ACTION_BODY_MAX = 4000
-const ACTION_BODY_TRUNCATION_MARKER = '\n… [truncated]'
-// Two tiers, mirroring SECRET_REDACTION_RULES in @pushary/contracts. The precise
-// rules only match real credential shapes, so they are safe on a line a human
-// reads: a git SHA, a path and prose all survive. The high-entropy catch-all
-// over-redacts by design and is therefore only ever applied to a full body dump.
-//
-// One combined list used to serve both, which meant the only text this gate
-// scrubbed was the action body. The question and the notification body carried
-// the raw command.
-const REDACTION_RULES = [
-  [/-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z0-9 ]*PRIVATE KEY-----/g, '[redacted key]'],
-  [/\bsk-[A-Za-z0-9_-]{16,}\b/g, '[redacted]'],
-  [/\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, '[redacted]'],
-  [/\bwhsec_[A-Za-z0-9]{16,}\b/g, '[redacted]'],
-  [/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, '[redacted]'],
-  [/\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, '[redacted]'],
-  [/\bglpat-[A-Za-z0-9_-]{20,}\b/g, '[redacted]'],
-  [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, '[redacted]'],
-  [/\bAIza[A-Za-z0-9_-]{35}\b/g, '[redacted]'],
-  [/\bAKIA[0-9A-Z]{16}\b/g, '[redacted]'],
-  [/\bnpm_[A-Za-z0-9]{36}\b/g, '[redacted]'],
-  [/\bxai-[A-Za-z0-9]{16,}\b/g, '[redacted]'],
-  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, '[redacted]'],
-  [/\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, 'bearer [redacted]'],
-  [/\bauthorization:\s*\S+/gi, 'authorization: [redacted]'],
-  [/((?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[=:]\s*)("[^"]*"|'[^']*'|\S+)/gi, '$1[redacted]'],
-]
-const HIGH_ENTROPY_RULE = [/[A-Za-z0-9+/]{40,}={0,2}/g, '[redacted]']
-const redactSecrets = (text) => REDACTION_RULES.reduce((acc, [pattern, replacement]) => acc.replace(pattern, replacement), text)
-const redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE[0], HIGH_ENTROPY_RULE[1])
-const capActionBody = (text) =>
-  text.length <= ACTION_BODY_MAX ? text : `${text.slice(0, ACTION_BODY_MAX - ACTION_BODY_TRUNCATION_MARKER.length)}${ACTION_BODY_TRUNCATION_MARKER}`
-const deriveActionBody = (command) => capActionBody(redactSecretsDeep(command))
-
 // ── network diagnosis ────────────────────────────────────────────────────────
 //
 // This gate is a dependency-free .mjs, so unlike the CLI it cannot install
@@ -296,12 +472,48 @@ export const describeNetworkFailure = (error, env = process.env) => {
   return `${detail} (a proxy is set in HTTP_PROXY/HTTPS_PROXY and this hook cannot use it; on Node 24+ set NODE_USE_ENV_PROXY=1 in the editor's environment)`
 }
 
+// Secret redaction, two tiers, mirroring SECRET_REDACTION_RULES in @pushary/contracts.
+// The precise rules only match real credential shapes, so they are safe on a line a
+// human reads: a git SHA, a path and prose all survive. The high-entropy catch-all
+// over-redacts by design and is therefore only ever applied to a full body dump.
+//
+// This gate previously did no redaction at all, so the raw command went out in the
+// question, the notification body and the action body alike. A key on the command
+// line reached the lock screen verbatim.
+const ACTION_BODY_MAX = 4000
+const ACTION_BODY_TRUNCATION_MARKER = '\n… [truncated]'
+const REDACTION_RULES = [
+  [/-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z0-9 ]*PRIVATE KEY-----/g, '[redacted key]'],
+  [/\bsk-[A-Za-z0-9_-]{16,}\b/g, '[redacted]'],
+  [/\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, '[redacted]'],
+  [/\bwhsec_[A-Za-z0-9]{16,}\b/g, '[redacted]'],
+  [/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, '[redacted]'],
+  [/\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, '[redacted]'],
+  [/\bglpat-[A-Za-z0-9_-]{20,}\b/g, '[redacted]'],
+  [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, '[redacted]'],
+  [/\bAIza[A-Za-z0-9_-]{35}\b/g, '[redacted]'],
+  [/\bAKIA[0-9A-Z]{16}\b/g, '[redacted]'],
+  [/\bnpm_[A-Za-z0-9]{36}\b/g, '[redacted]'],
+  [/\bxai-[A-Za-z0-9]{16,}\b/g, '[redacted]'],
+  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, '[redacted]'],
+  [/\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, 'bearer [redacted]'],
+  [/\bauthorization:\s*\S+/gi, 'authorization: [redacted]'],
+  [/((?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[=:]\s*)(\"[^\"]*\"|'[^']*'|\S+)/gi, '$1[redacted]'],
+]
+const HIGH_ENTROPY_RULE = [/[A-Za-z0-9+/]{40,}={0,2}/g, '[redacted]']
+export const redactSecrets = (text) => REDACTION_RULES.reduce((acc, [pattern, replacement]) => acc.replace(pattern, replacement), text)
+const redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE[0], HIGH_ENTROPY_RULE[1])
+const capActionBody = (text) =>
+  text.length <= ACTION_BODY_MAX ? text : `${text.slice(0, ACTION_BODY_MAX - ACTION_BODY_TRUNCATION_MARKER.length)}${ACTION_BODY_TRUNCATION_MARKER}`
+const deriveActionBody = (command) => capActionBody(redactSecretsDeep(command))
+
 // ── ask / wait ───────────────────────────────────────────────────────────────
-// Redacted, not raw. This is the text a human reads on a lock screen and in
-// Slack, and it used to be the command verbatim: `curl -H "Authorization:
-// Bearer ..."` left the machine and landed in the question. The server scrubs
-// this field too, but a credential should never travel to be scrubbed on
-// arrival, and the notify body below was scrubbed nowhere at all.
+// toolTarget and actionBody are what let the server classify risk, drop the
+// one-tap Approve on a dangerous call, and record a decision at the same grain as
+// every other agent. Without them a destructive Cursor command arrived on the
+// lock screen ungated.
+const commandHead = (command) => command.trim().split(/\s+/).slice(0, 2).join(' ').slice(0, 120)
+
 const askArgs = (command, project, ident) => ({
   question: `Allow this command?\n\n${redactSecrets(command)}`,
   type: 'confirm',
@@ -310,6 +522,7 @@ const askArgs = (command, project, ident) => ({
   sessionId: ident.sessionId,
   machineId: ident.machineId,
   toolName: 'Bash',
+  toolTarget: commandHead(command),
   actionBody: deriveActionBody(command),
   wait: false,
 })
@@ -346,25 +559,10 @@ const handlePushOnly = async (apiKey, command, project, ident, timeoutSeconds, t
   }
   if (!asked?.correlationId) return ask()
 
-  // Keyboard bypass: at the keyboard, so Cursor's own prompt handles it now.
-  if (asked.suppressed) {
-    await callTool(apiKey, 'cancel_question', { correlationId: asked.correlationId }).catch(() => {})
-    return ask('You are at the keyboard — approve here.')
-  }
-  // No reachable device: apply the configured fallback immediately.
-  if (asked.noDevices) {
-    return fromTimeoutAction(timeoutAction, 'No device connected to approve on; denied per your Pushary policy.')
-  }
-
-  // `wait` holds the full block window for the phone (fromTimeoutAction maps it
-  // to ask, so on timeout it hands to Cursor's prompt, never auto-denies).
-  const realMs = timeoutAction === 'wait' ? MAX_BLOCK_MS : Math.max(timeoutSeconds, 1) * 1000
+  const realMs = Math.max(timeoutSeconds, 1) * 1000
   const cap = Math.min(realMs, MAX_BLOCK_MS)
   const answer = await pollForAnswer(apiKey, asked.correlationId, Date.now() + cap)
-  if (answer.answered) {
-    if (answer.value === 'defer') return ask()
-    return answer.value === 'yes' ? ALLOW : deny(DENIED)
-  }
+  if (answer.answered) return answer.value === 'yes' ? ALLOW : deny(DENIED)
 
   // If Cursor's hook limit cut us off before the configured timeout, hand off to
   // Cursor's own prompt rather than misapplying the policy's timeout action.
@@ -382,20 +580,9 @@ const handlePushFirst = async (apiKey, command, project, ident, pushFirstSeconds
   }
   if (!asked?.correlationId) return ask()
 
-  // Keyboard bypass / no reachable device: push_first already falls to Cursor's
-  // prompt, so do it now rather than racing a push nobody will see.
-  if (asked.suppressed) {
-    await callTool(apiKey, 'cancel_question', { correlationId: asked.correlationId }).catch(() => {})
-    return ask('You are at the keyboard — approve here.')
-  }
-  if (asked.noDevices) return ask('No device connected — approve here.')
-
   const cap = Math.min(Math.max(pushFirstSeconds, 1) * 1000, MAX_BLOCK_MS)
   const answer = await pollForAnswer(apiKey, asked.correlationId, Date.now() + cap)
-  if (answer.answered) {
-    if (answer.value === 'defer') return ask()
-    return answer.value === 'yes' ? ALLOW : deny(DENIED)
-  }
+  if (answer.answered) return answer.value === 'yes' ? ALLOW : deny(DENIED)
   return ask('Sent to your phone via Pushary — you can also approve here.')
 }
 
@@ -417,32 +604,16 @@ const main = async () => {
   let input
   try {
     const raw = await readStdin()
-    if (!raw.trim()) {
-      diag('no input on stdin. Cursor did not pipe the command to this hook (a known Cursor issue on Windows). Handing off to Cursor\'s own prompt; the push approval cannot run without the command.')
-      return respond(ask())
-    }
-    // Windows: Cursor prepends a BOM/encoding prefix to the hook's stdin, so raw
-    // arrives as e.g. "���{...}" and a bare JSON.parse throws,
-    // silently dropping us to "ask" with no push (the script works when run
-    // manually because there is no BOM). The payload is always a JSON object, so
-    // parse from the first "{" — robust to a BOM or whatever prefix bytes Cursor
-    // emits. Verified on Windows + Cursor 3.8.11.
-    const jsonStart = raw.indexOf('{')
-    input = JSON.parse(jsonStart > 0 ? raw.slice(jsonStart) : raw)
+    input = raw.trim() ? JSON.parse(raw) : {}
   } catch {
-    diag('stdin was not valid JSON (often empty or corrupted, a known Cursor Windows stdin issue). Handing off to Cursor\'s own prompt.')
     return respond(ask())
   }
 
   const command = typeof input.command === 'string' ? input.command.trim() : ''
-  if (!command) {
-    diag('input had no command field. Handing off to Cursor\'s own prompt.')
-    return respond(ask())
-  }
+  if (!command) return respond(ask())
 
   const apiKey = resolveApiKey()
   if (!apiKey) {
-    diag('no API key found (PUSHARY_API_KEY env var or embedded in the plugin mcp.json). Run: npx @pushary/agent-hooks setup --key <your key>')
     return respond(
       ask('Pushary is not configured: set the PUSHARY_API_KEY environment variable (get a key at https://pushary.com) to route this approval to your phone.')
     )
@@ -457,7 +628,7 @@ const main = async () => {
 
     if (modeState.kill) return respond(deny('Stopped by user — this agent was halted from Pushary. Do not run this command.'))
 
-    const tool = resolvePolicy(policy, 'Bash', modeState.mode)
+    const tool = resolvePolicy(policy, 'Bash', modeState.mode, command, deriveRepoKey(input.cwd))
     if (tool.timeoutSeconds === 0 && tool.timeoutAction === 'approve') return respond(ALLOW)
 
     switch (tool.mode) {
@@ -472,16 +643,19 @@ const main = async () => {
         return respond(await handlePushFirst(apiKey, command, project, ident, tool.pushFirstSeconds))
     }
   } catch (error) {
-    process.stderr.write(`[pushary-gate] ${describeNetworkFailure(error)}\n`)
+    process.stderr.write(`[pushary-gate] ${error?.message ?? error}\n`)
     return respond(ask())
   }
 }
 
-// Guarded like the VS Code gate: importing this file to unit-test its pure
-// helpers must not start a hook run that reads stdin and writes a decision.
-if (!process.env.PUSHARY_GATE_IMPORT) {
-  main().catch((error) => {
-    process.stderr.write(`[pushary-gate] fatal: ${describeNetworkFailure(error)}\n`)
-    respond(ask())
-  })
-}
+// Exported for scripts/pushary-gate.test.mjs. main() only runs when the gate is
+// executed directly, so importing this file for a test does not read stdin.
+export { matchToolPattern, resolvePolicy, isDestructive, normalizeRepoRemote, deriveRepoKey }
+
+const isDirectRun = process.argv[1] && import.meta.url === `file://${process.argv[1]}`
+if (!isDirectRun) {
+  // imported for tests
+} else main().catch((error) => {
+  process.stderr.write(`[pushary-gate] fatal: ${error?.message ?? error}\n`)
+  respond(ask())
+})