@pushary/agent-hooks 0.77.0 → 0.78.0

package/CHANGELOG.md

@@ -1,5 +1,69 @@
 # Changelog
 
+## 0.78.0
+
+### Your agent can ask you several things at once, and reach your phone for all of them
+
+An agent that stops to ask you something often asks more than one thing in the
+same breath. Until this release the hook only recognised a single question, so
+two or more meant nothing arrived on your phone at all and the whole exchange
+waited at the terminal. That is exactly the moment this product exists for.
+
+Up to four questions now come through in turn. The notification says which one
+you are on, "(2 of 3)", so the first does not look like the last.
+
+If any question goes unanswered, whether you deferred it, it timed out, or no
+device was reachable, the entire exchange goes back to the terminal, including
+anything you already answered. A partly filled answer sheet would leave your
+agent guessing at questions it never put to you, and being asked twice is better
+than being answered wrongly.
+
+The whole exchange shares one wait budget. Four questions do not cost four times
+the wait you agreed to.
+
+Questions that let you tick several options at once still go to the terminal.
+Those answers travel as a single piece of text and the packing is not something
+this release can verify, so it is left alone rather than guessed at.
+
+## 0.77.0
+
+### Stop ends the process
+
+Until this release Stop was a gate verdict. Every pending and new tool call was
+denied, which is the guarantee and has not changed, but the agent kept running,
+kept thinking and kept spending tokens. For someone who hits Stop because
+something is going wrong, "it can no longer act" and "it stopped" are different
+promises.
+
+- every session event reports its own pid, so the server can name the process
+- the daemon advertises a `stop` capability, which is how the server knows a
+  machine can act on one at all
+- the daemon applies stops from the drain with SIGTERM, and refuses to signal
+  its own pid, since killing itself would take every other session's stop too
+
+Two additive wire changes, both safe in either direction: `pid` on the event
+payload, which an older server ignores, and `stops` on the drain response, which
+an older daemon ignores.
+
+## 0.76.1
+
+### Actually closing the spawn argv injection
+
+0.76.0 shipped under the message "closing the spawn argv injection" and did not.
+It sanitised `model` and `cwd` but not `prompt`, and `prompt` is the field the
+daemon passes as the token immediately after `-p`, so a flag-shaped prompt was
+read back as a flag:
+
+    ['claude','--remote','-p','--permission-mode=dontAsk'] -> {permissionMode:'dontAsk'}
+
+`dontAsk` is a full-defer mode, so the gate stopped asking about every tool for
+that session.
+
+The server-side rejection landed in production first and is what actually
+protects users, 0.76.0 included, with no upgrade required. This release carries
+the defence in depth: `buildSpawnLaunch` returns null for a flag-shaped prompt,
+so a daemon never builds that argv even if the server is bypassed.
+
 ## 0.76.0
 
 ### A phone-supplied field could switch your approval gate off

package/dist/bin/pushary-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handlePreToolUse
-} from "../chunk-MY4VJPWW.js";
+} from "../chunk-NN4GTN6Q.js";
 import "../chunk-3CBPY2G5.js";
 import {
   exitOnHelpFlag

package/dist/bin/pushary-permission-denied-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handlePermissionDenied
-} from "../chunk-MY4VJPWW.js";
+} from "../chunk-NN4GTN6Q.js";
 import "../chunk-3CBPY2G5.js";
 import "../chunk-FWWBEB6L.js";
 import "../chunk-HPDLDQC5.js";

package/dist/bin/pushary-permission-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handlePermissionRequest
-} from "../chunk-MY4VJPWW.js";
+} from "../chunk-NN4GTN6Q.js";
 import "../chunk-3CBPY2G5.js";
 import "../chunk-FWWBEB6L.js";
 import "../chunk-HPDLDQC5.js";

package/dist/{chunk-MY4VJPWW.js → chunk-NN4GTN6Q.js}

@@ -345,47 +345,66 @@ var shouldDeferToNativeMode = (permissionMode, toolName) => {
   }
   return false;
 };
-var parseSingleQuestion = (toolInput) => {
-  const questions = toolInput.questions;
-  if (!Array.isArray(questions) || questions.length !== 1) return void 0;
-  const q = questions[0];
+var MAX_PHONE_QUESTIONS = 4;
+var parseQuestion = (raw) => {
+  const q = raw;
   if (!q || typeof q.question !== "string" || q.multiSelect === true) return void 0;
   const labels = Array.isArray(q.options) ? q.options.map((o) => o && typeof o === "object" ? o.label : void 0).filter((l) => typeof l === "string" && l.length > 0) : [];
   if (labels.length < 2) return void 0;
   return { question: q.question, header: typeof q.header === "string" ? q.header : void 0, labels };
 };
+var parseQuestions = (toolInput) => {
+  const questions = toolInput.questions;
+  if (!Array.isArray(questions) || questions.length === 0) return void 0;
+  if (questions.length > MAX_PHONE_QUESTIONS) return void 0;
+  const parsed = [];
+  for (const raw of questions) {
+    const one = parseQuestion(raw);
+    if (!one) return void 0;
+    parsed.push(one);
+  }
+  return parsed;
+};
+var questionContext = (q, index, total, project) => {
+  const subject = q.header ? `${q.header}: your agent is asking in ${project}` : `Your agent is asking in ${project}`;
+  return total > 1 ? `${subject} (${index + 1} of ${total})` : subject;
+};
 var handleAskUserQuestion = async (apiKey, input) => {
-  const parsed = parseSingleQuestion(input.tool_input ?? {});
+  const parsed = parseQuestions(input.tool_input ?? {});
   if (!parsed) return void 0;
   const projectName = basename(input.cwd ?? process.cwd());
-  let result;
-  try {
-    result = await askUser(apiKey, {
-      question: parsed.question,
-      type: "select",
-      options: [...parsed.labels],
-      context: parsed.header ? `${parsed.header}: your agent is asking in ${projectName}` : `Your agent is asking in ${projectName}`,
-      agentName: `Claude Code - ${projectName}`,
-      sessionId: input.session_id,
-      machineId: getMachineId(),
-      toolName: "AskUserQuestion"
-    });
-  } catch {
-    return void 0;
-  }
-  if (result.suppressed || result.noDevices) {
-    await cancelQuestion(apiKey, result.correlationId).catch(() => {
-    });
-    return void 0;
-  }
   const deadline = hookWaitDeadline(START_MS, effectiveWaitSeconds("wait", 0, "claude"), "claude", Date.now());
-  const answer = await pollForAnswer(apiKey, result.correlationId, deadline);
-  const value = answer.answered ? (answer.value ?? "").trim() : "";
-  if (!value || isDeferAnswer(answer.value)) {
-    savePendingQuestion(input.session_id || DEFAULT_SESSION, result.correlationId);
-    return void 0;
+  const answers = {};
+  for (const [index, question] of parsed.entries()) {
+    let result;
+    try {
+      result = await askUser(apiKey, {
+        question: question.question,
+        type: "select",
+        options: [...question.labels],
+        context: questionContext(question, index, parsed.length, projectName),
+        agentName: `Claude Code - ${projectName}`,
+        sessionId: input.session_id,
+        machineId: getMachineId(),
+        toolName: "AskUserQuestion"
+      });
+    } catch {
+      return void 0;
+    }
+    if (result.suppressed || result.noDevices) {
+      await cancelQuestion(apiKey, result.correlationId).catch(() => {
+      });
+      return void 0;
+    }
+    const answer = await pollForAnswer(apiKey, result.correlationId, deadline);
+    const value = answer.answered ? (answer.value ?? "").trim() : "";
+    if (!value || isDeferAnswer(answer.value)) {
+      savePendingQuestion(input.session_id || DEFAULT_SESSION, result.correlationId);
+      return void 0;
+    }
+    answers[question.question] = value;
   }
-  return allowWithInput({ ...input.tool_input ?? {}, answers: { [parsed.question]: value } });
+  return allowWithInput({ ...input.tool_input ?? {}, answers });
 };
 var handleKeyless = (input) => {
   try {

package/dist/src/index.js

@@ -1,6 +1,6 @@
 import {
   handlePreToolUse
-} from "../chunk-MY4VJPWW.js";
+} from "../chunk-NN4GTN6Q.js";
 import "../chunk-3CBPY2G5.js";
 import "../chunk-FWWBEB6L.js";
 import {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.77.0",
+  "version": "0.78.0",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",