@pushary/agent-hooks 0.76.1 → 0.78.0

package/CHANGELOG.md

@@ -1,5 +1,69 @@
 # Changelog
 
+## 0.78.0
+
+### Your agent can ask you several things at once, and reach your phone for all of them
+
+An agent that stops to ask you something often asks more than one thing in the
+same breath. Until this release the hook only recognised a single question, so
+two or more meant nothing arrived on your phone at all and the whole exchange
+waited at the terminal. That is exactly the moment this product exists for.
+
+Up to four questions now come through in turn. The notification says which one
+you are on, "(2 of 3)", so the first does not look like the last.
+
+If any question goes unanswered, whether you deferred it, it timed out, or no
+device was reachable, the entire exchange goes back to the terminal, including
+anything you already answered. A partly filled answer sheet would leave your
+agent guessing at questions it never put to you, and being asked twice is better
+than being answered wrongly.
+
+The whole exchange shares one wait budget. Four questions do not cost four times
+the wait you agreed to.
+
+Questions that let you tick several options at once still go to the terminal.
+Those answers travel as a single piece of text and the packing is not something
+this release can verify, so it is left alone rather than guessed at.
+
+## 0.77.0
+
+### Stop ends the process
+
+Until this release Stop was a gate verdict. Every pending and new tool call was
+denied, which is the guarantee and has not changed, but the agent kept running,
+kept thinking and kept spending tokens. For someone who hits Stop because
+something is going wrong, "it can no longer act" and "it stopped" are different
+promises.
+
+- every session event reports its own pid, so the server can name the process
+- the daemon advertises a `stop` capability, which is how the server knows a
+  machine can act on one at all
+- the daemon applies stops from the drain with SIGTERM, and refuses to signal
+  its own pid, since killing itself would take every other session's stop too
+
+Two additive wire changes, both safe in either direction: `pid` on the event
+payload, which an older server ignores, and `stops` on the drain response, which
+an older daemon ignores.
+
+## 0.76.1
+
+### Actually closing the spawn argv injection
+
+0.76.0 shipped under the message "closing the spawn argv injection" and did not.
+It sanitised `model` and `cwd` but not `prompt`, and `prompt` is the field the
+daemon passes as the token immediately after `-p`, so a flag-shaped prompt was
+read back as a flag:
+
+    ['claude','--remote','-p','--permission-mode=dontAsk'] -> {permissionMode:'dontAsk'}
+
+`dontAsk` is a full-defer mode, so the gate stopped asking about every tool for
+that session.
+
+The server-side rejection landed in production first and is what actually
+protects users, 0.76.0 included, with no upgrade required. This release carries
+the defence in depth: `buildSpawnLaunch` returns null for a flag-shaped prompt,
+so a daemon never builds that argv even if the server is bypassed.
+
 ## 0.76.0
 
 ### A phone-supplied field could switch your approval gate off

package/dist/bin/pushary-claude.js

@@ -7,7 +7,7 @@ import {
   KILL_REASON,
   isDeferAnswer,
   resolveGate
-} from "../chunk-UPPHYOIZ.js";
+} from "../chunk-FWWBEB6L.js";
 import {
   askUser,
   cancelQuestion,
@@ -19,7 +19,7 @@ import {
   reportEvent,
   scopePathFor,
   waitForAnswer
-} from "../chunk-7L57N7WN.js";
+} from "../chunk-HPDLDQC5.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-codex-hook.js

@@ -4,7 +4,7 @@ import {
   denyReasonFrom,
   isDeferAnswer,
   resolveGate
-} from "../chunk-UPPHYOIZ.js";
+} from "../chunk-FWWBEB6L.js";
 import {
   CODEX_AGENT,
   DEFAULT_SESSION,
@@ -35,7 +35,7 @@ import {
   toPolicyLookup,
   toPolicyLookups,
   waitForAnswer
-} from "../chunk-7L57N7WN.js";
+} from "../chunk-HPDLDQC5.js";
 import {
   isGatingMoment,
   recordKeylessMoment

package/dist/bin/pushary-codex.js

@@ -3,7 +3,7 @@ import {
   askUser,
   reportEvent,
   waitForAnswer
-} from "../chunk-7L57N7WN.js";
+} from "../chunk-HPDLDQC5.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-daemon.js

@@ -28,6 +28,27 @@ import {
 import { spawn } from "child_process";
 import { existsSync } from "fs";
 import { basename, dirname, join } from "path";
+
+// src/stop-requests.ts
+var STOP_CAPABILITY = "stop";
+var isStopRequest = (value) => {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value;
+  return typeof candidate.sessionId === "string" && candidate.sessionId.length > 0 && typeof candidate.pid === "number" && Number.isInteger(candidate.pid) && candidate.pid > 1;
+};
+var parseStopRequests = (value) => Array.isArray(value) ? value.filter(isStopRequest) : [];
+var applyStop = (request, deps) => {
+  if (request.pid === deps.selfPid) return "skipped_self";
+  try {
+    deps.kill(request.pid, "SIGTERM");
+    return "stopped";
+  } catch (err) {
+    const code = err?.code;
+    return code === "ESRCH" ? "already_gone" : "refused";
+  }
+};
+
+// src/spawn-daemon.ts
 var DRAIN_PATH = "/api/agent/spawn/drain";
 var FAST_POLL_MS = 3e3;
 var SLOW_POLL_MS = 3e4;
@@ -121,6 +142,17 @@ var runSpawnDaemon = async () => {
 `);
     }
   };
+  const runStop = (stop) => {
+    const outcome = applyStop(stop, { kill: process.kill.bind(process), selfPid: process.pid });
+    const said = {
+      stopped: `stopped session ${stop.sessionId}`,
+      already_gone: `session ${stop.sessionId} had already exited`,
+      refused: `could not stop session ${stop.sessionId}, the system refused the signal`,
+      skipped_self: `refused to stop session ${stop.sessionId}: that pid is this daemon`
+    };
+    stderr(`[pushary] ${said[outcome]}
+`);
+  };
   const drain = async (signal) => {
     const res = await fetch(`${baseUrl}${DRAIN_PATH}`, {
       method: "POST",
@@ -130,6 +162,7 @@ var runSpawnDaemon = async () => {
     });
     if (!res.ok) throw new DrainError(res.status);
     const data = await res.json();
+    for (const stop of parseStopRequests(data.stops)) runStop(stop);
     const spawn2 = data.spawn;
     return spawn2 && typeof spawn2.prompt === "string" && typeof spawn2.id === "string" ? spawn2 : null;
   };
@@ -182,7 +215,10 @@ var runSpawnDaemon = async () => {
   };
   const beat = async () => {
     if (stopped) return;
-    const result = await sendHeartbeat(apiKey, { repoKey: basename(process.cwd()) });
+    const result = await sendHeartbeat(apiKey, {
+      repoKey: basename(process.cwd()),
+      capabilities: ["spawn", STOP_CAPABILITY]
+    });
     if (result.kind === "unauthorized" && !stopped) {
       fatalCode = EXIT.UNAUTHENTICATED;
       stderr("[pushary] daemon stopping: this machine's key was rejected. Run `pushary login` to sign in again.\n");

package/dist/bin/pushary-gemini-hook.js

@@ -4,7 +4,7 @@ import {
   denyReasonFrom,
   isDeferAnswer,
   resolveGate
-} from "../chunk-UPPHYOIZ.js";
+} from "../chunk-FWWBEB6L.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -26,7 +26,7 @@ import {
   scopePathFor,
   sendNotification,
   waitForAnswer
-} from "../chunk-7L57N7WN.js";
+} from "../chunk-HPDLDQC5.js";
 import {
   isGatingMoment,
   recordKeylessMoment

package/dist/bin/pushary-hook.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import {
   handlePreToolUse
-} from "../chunk-DJHWBNM3.js";
+} from "../chunk-NN4GTN6Q.js";
 import "../chunk-3CBPY2G5.js";
 import {
   exitOnHelpFlag
 } from "../chunk-BBK3TTU2.js";
 import "../chunk-7OYGFJYZ.js";
-import "../chunk-UPPHYOIZ.js";
-import "../chunk-7L57N7WN.js";
+import "../chunk-FWWBEB6L.js";
+import "../chunk-HPDLDQC5.js";
 import "../chunk-IA5GBKNL.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";

package/dist/bin/pushary-notification-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handleNotification
-} from "../chunk-7L57N7WN.js";
+} from "../chunk-HPDLDQC5.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-permission-denied-hook.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   handlePermissionDenied
-} from "../chunk-DJHWBNM3.js";
+} from "../chunk-NN4GTN6Q.js";
 import "../chunk-3CBPY2G5.js";
-import "../chunk-UPPHYOIZ.js";
-import "../chunk-7L57N7WN.js";
+import "../chunk-FWWBEB6L.js";
+import "../chunk-HPDLDQC5.js";
 import "../chunk-IA5GBKNL.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";

package/dist/bin/pushary-permission-hook.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   handlePermissionRequest
-} from "../chunk-DJHWBNM3.js";
+} from "../chunk-NN4GTN6Q.js";
 import "../chunk-3CBPY2G5.js";
-import "../chunk-UPPHYOIZ.js";
-import "../chunk-7L57N7WN.js";
+import "../chunk-FWWBEB6L.js";
+import "../chunk-HPDLDQC5.js";
 import "../chunk-IA5GBKNL.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";

package/dist/bin/pushary-post-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handlePostToolUse
-} from "../chunk-7L57N7WN.js";
+} from "../chunk-HPDLDQC5.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-prompt-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handleUserPrompt
-} from "../chunk-7L57N7WN.js";
+} from "../chunk-HPDLDQC5.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-session-end-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handleSessionEnd
-} from "../chunk-7L57N7WN.js";
+} from "../chunk-HPDLDQC5.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-session-start-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handleSessionStart
-} from "../chunk-7L57N7WN.js";
+} from "../chunk-HPDLDQC5.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-setup.js

@@ -94,7 +94,7 @@ import {
 } from "../chunk-7OYGFJYZ.js";
 import {
   reportEvent
-} from "../chunk-7L57N7WN.js";
+} from "../chunk-HPDLDQC5.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import {

package/dist/bin/pushary-stop-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handleStop
-} from "../chunk-7L57N7WN.js";
+} from "../chunk-HPDLDQC5.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-stopfailure-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handleStopFailure
-} from "../chunk-7L57N7WN.js";
+} from "../chunk-HPDLDQC5.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/{chunk-UPPHYOIZ.js → chunk-FWWBEB6L.js}

@@ -4,7 +4,7 @@ import {
   isModeStateDegraded,
   resolveAutoResolveOrigin,
   resolvePolicyAcross
-} from "./chunk-7L57N7WN.js";
+} from "./chunk-HPDLDQC5.js";
 import {
   evaluateScope,
   scopeChangeReason,

package/dist/{chunk-7L57N7WN.js → chunk-HPDLDQC5.js}

@@ -1028,6 +1028,9 @@ var reportEvent = async (event, options = {}) => {
       body: JSON.stringify({
         ...event,
         machineId: event.machineId ?? getMachineId(),
+        // Lets the phone's Stop end this process instead of only denying its next
+        // tool call. Ours alone: never another process, never a parent.
+        pid: event.pid ?? process.pid,
         repoKey: event.repoKey ?? repoKeyFor(),
         installMode: detectInstallMode(),
         // Link-back for a phone-spawned session: forward the spawn id the daemon

package/dist/{chunk-DJHWBNM3.js → chunk-NN4GTN6Q.js}

@@ -5,7 +5,7 @@ import {
   denyReasonFrom,
   isDeferAnswer,
   resolveGate
-} from "./chunk-UPPHYOIZ.js";
+} from "./chunk-FWWBEB6L.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -25,7 +25,7 @@ import {
   sendNotification,
   throttlePass,
   waitForAnswer
-} from "./chunk-7L57N7WN.js";
+} from "./chunk-HPDLDQC5.js";
 import {
   isGatingMoment,
   recordKeylessMoment
@@ -345,47 +345,66 @@ var shouldDeferToNativeMode = (permissionMode, toolName) => {
   }
   return false;
 };
-var parseSingleQuestion = (toolInput) => {
-  const questions = toolInput.questions;
-  if (!Array.isArray(questions) || questions.length !== 1) return void 0;
-  const q = questions[0];
+var MAX_PHONE_QUESTIONS = 4;
+var parseQuestion = (raw) => {
+  const q = raw;
   if (!q || typeof q.question !== "string" || q.multiSelect === true) return void 0;
   const labels = Array.isArray(q.options) ? q.options.map((o) => o && typeof o === "object" ? o.label : void 0).filter((l) => typeof l === "string" && l.length > 0) : [];
   if (labels.length < 2) return void 0;
   return { question: q.question, header: typeof q.header === "string" ? q.header : void 0, labels };
 };
+var parseQuestions = (toolInput) => {
+  const questions = toolInput.questions;
+  if (!Array.isArray(questions) || questions.length === 0) return void 0;
+  if (questions.length > MAX_PHONE_QUESTIONS) return void 0;
+  const parsed = [];
+  for (const raw of questions) {
+    const one = parseQuestion(raw);
+    if (!one) return void 0;
+    parsed.push(one);
+  }
+  return parsed;
+};
+var questionContext = (q, index, total, project) => {
+  const subject = q.header ? `${q.header}: your agent is asking in ${project}` : `Your agent is asking in ${project}`;
+  return total > 1 ? `${subject} (${index + 1} of ${total})` : subject;
+};
 var handleAskUserQuestion = async (apiKey, input) => {
-  const parsed = parseSingleQuestion(input.tool_input ?? {});
+  const parsed = parseQuestions(input.tool_input ?? {});
   if (!parsed) return void 0;
   const projectName = basename(input.cwd ?? process.cwd());
-  let result;
-  try {
-    result = await askUser(apiKey, {
-      question: parsed.question,
-      type: "select",
-      options: [...parsed.labels],
-      context: parsed.header ? `${parsed.header}: your agent is asking in ${projectName}` : `Your agent is asking in ${projectName}`,
-      agentName: `Claude Code - ${projectName}`,
-      sessionId: input.session_id,
-      machineId: getMachineId(),
-      toolName: "AskUserQuestion"
-    });
-  } catch {
-    return void 0;
-  }
-  if (result.suppressed || result.noDevices) {
-    await cancelQuestion(apiKey, result.correlationId).catch(() => {
-    });
-    return void 0;
-  }
   const deadline = hookWaitDeadline(START_MS, effectiveWaitSeconds("wait", 0, "claude"), "claude", Date.now());
-  const answer = await pollForAnswer(apiKey, result.correlationId, deadline);
-  const value = answer.answered ? (answer.value ?? "").trim() : "";
-  if (!value || isDeferAnswer(answer.value)) {
-    savePendingQuestion(input.session_id || DEFAULT_SESSION, result.correlationId);
-    return void 0;
+  const answers = {};
+  for (const [index, question] of parsed.entries()) {
+    let result;
+    try {
+      result = await askUser(apiKey, {
+        question: question.question,
+        type: "select",
+        options: [...question.labels],
+        context: questionContext(question, index, parsed.length, projectName),
+        agentName: `Claude Code - ${projectName}`,
+        sessionId: input.session_id,
+        machineId: getMachineId(),
+        toolName: "AskUserQuestion"
+      });
+    } catch {
+      return void 0;
+    }
+    if (result.suppressed || result.noDevices) {
+      await cancelQuestion(apiKey, result.correlationId).catch(() => {
+      });
+      return void 0;
+    }
+    const answer = await pollForAnswer(apiKey, result.correlationId, deadline);
+    const value = answer.answered ? (answer.value ?? "").trim() : "";
+    if (!value || isDeferAnswer(answer.value)) {
+      savePendingQuestion(input.session_id || DEFAULT_SESSION, result.correlationId);
+      return void 0;
+    }
+    answers[question.question] = value;
   }
-  return allowWithInput({ ...input.tool_input ?? {}, answers: { [parsed.question]: value } });
+  return allowWithInput({ ...input.tool_input ?? {}, answers });
 };
 var handleKeyless = (input) => {
   try {

package/dist/src/index.d.ts

@@ -70,6 +70,7 @@ interface AgentEvent {
     agents?: readonly string[];
     meta?: ReceiptMeta;
     usage?: UsageReport;
+    pid?: number;
 }
 interface ReportEventOptions {
     maxAttempts?: number;

package/dist/src/index.js

@@ -1,8 +1,8 @@
 import {
   handlePreToolUse
-} from "../chunk-DJHWBNM3.js";
+} from "../chunk-NN4GTN6Q.js";
 import "../chunk-3CBPY2G5.js";
-import "../chunk-UPPHYOIZ.js";
+import "../chunk-FWWBEB6L.js";
 import {
   askUser,
   cancelQuestion,
@@ -15,7 +15,7 @@ import {
   reportEvent,
   resolvePolicy,
   waitForAnswer
-} from "../chunk-7L57N7WN.js";
+} from "../chunk-HPDLDQC5.js";
 import "../chunk-IA5GBKNL.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.76.1",
+  "version": "0.78.0",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",