@pushary/agent-hooks 0.83.1 → 0.84.0

package/dist/{chunk-QA5HP7CR.js → chunk-MQMPG5X4.js}

@@ -1,6 +1,30 @@
 // ../contracts/src/index.ts
 var APPROVAL_MODES = ["push_only", "terminal_only", "push_first", "notify_only"];
 var isApprovalMode = (value) => typeof value === "string" && APPROVAL_MODES.includes(value);
+var parseAgentQuestionAnswers = (questions, value) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  const answers = parsed;
+  if (Object.keys(answers).length !== questions.length) return null;
+  for (const question of questions) {
+    const answer = answers[question.question];
+    if (typeof answer !== "string" || answer.trim().length === 0) return null;
+    if (!question.multiSelect) continue;
+    try {
+      const selected = JSON.parse(answer);
+      if (!Array.isArray(selected)) continue;
+      const labels = new Set(question.options.map((option) => option.label));
+      if (selected.length === 0 || new Set(selected).size !== selected.length || !selected.every((label) => typeof label === "string" && labels.has(label))) return null;
+    } catch {
+    }
+  }
+  return answers;
+};
 var INSTALL_SOURCES = [
   /** `npx @pushary/agent-hooks@latest ...`, the documented one-liner. */
   "npx",
@@ -447,6 +471,36 @@ var isSafeReadOnlyCommand = (command) => {
   }
   return true;
 };
+var isAutoApprove = (policy) => policy.timeoutSeconds === 0 && policy.timeoutAction === "approve";
+var isAutoDeny = (policy) => policy.timeoutSeconds === 0 && policy.timeoutAction === "deny";
+var verdictForPolicy = (policy) => {
+  if (isAutoDeny(policy)) return "deny";
+  if (isAutoApprove(policy)) return "allow";
+  return "requires_human";
+};
+var selectGoverningRule = (policies, toolName, args, repoKey, sessionId) => {
+  let best;
+  let bestWeight = 0;
+  let bestScoped = -1;
+  let bestLength = -1;
+  for (const candidate of policies) {
+    if (!isRepoKeyMatch(candidate.repoKey, repoKey)) continue;
+    if (candidate.sessionId && candidate.sessionId !== sessionId) continue;
+    const rank = matchToolPatternAny(candidate.tool, toolName, args);
+    if (rank === "none") continue;
+    const weight = matchRankWeight(rank);
+    const scoped = candidate.sessionId ? 2 : candidate.repoKey ? 1 : 0;
+    const length = rank === "prefix" ? candidate.tool.length : -1;
+    const better = weight > bestWeight || weight === bestWeight && scoped > bestScoped || weight === bestWeight && scoped === bestScoped && length > bestLength;
+    if (better) {
+      best = { policy: candidate, rank };
+      bestWeight = weight;
+      bestScoped = scoped;
+      bestLength = length;
+    }
+  }
+  return best;
+};
 var API_KEY_PATTERN = /^pk_[a-f0-9]+\.[a-f0-9]+$/;
 var isValidApiKey = (value) => API_KEY_PATTERN.test(value);
 var ACTION_BODY_MAX = 4e3;
@@ -782,18 +836,20 @@ var isScopeContract = (value) => {
 
 export {
   isApprovalMode,
+  parseAgentQuestionAnswers,
   normalizeInstallSource,
   HOOK_BUDGETS,
   hookWaitDeadline,
   hookWaitClamped,
   effectiveWaitSeconds,
-  isRepoKeyMatch,
   normalizeRepoRemote,
   localRepoKey,
-  matchRankWeight,
   policyArgForms,
-  matchToolPatternAny,
   isSafeReadOnlyCommand,
+  isAutoApprove,
+  isAutoDeny,
+  verdictForPolicy,
+  selectGoverningRule,
   isValidApiKey,
   ACTION_BODY_MAX,
   DECISION_LINE_MAX,

package/dist/{chunk-2R63XKLG.js → chunk-NJ7JT26G.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-QA5HP7CR.js";
+} from "./chunk-MQMPG5X4.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/chunk-NRGRUOAR.js

@@ -0,0 +1,25 @@
+// src/live-capabilities.ts
+var CODEX_BRIDGE_CAPABILITY = "codex-bridge";
+var CODEX_RESUME_CAPABILITY = "codex-resume";
+var GEMINI_BRIDGE_CAPABILITY = "gemini-bridge";
+var GEMINI_RESUME_CAPABILITY = "gemini-resume";
+var GEMINI_BRIDGE_MIN_VERSION = [0, 40, 0];
+var version = (raw) => {
+  const match = raw?.match(/^(\d+)\.(\d+)\.(\d+)/);
+  return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
+};
+var geminiLiveCapabilities = (rawVersion) => {
+  const installed = version(rawVersion);
+  if (!installed) return [];
+  for (let index = 0; index < GEMINI_BRIDGE_MIN_VERSION.length; index++) {
+    if (installed[index] > GEMINI_BRIDGE_MIN_VERSION[index]) break;
+    if (installed[index] < GEMINI_BRIDGE_MIN_VERSION[index]) return [];
+  }
+  return [GEMINI_BRIDGE_CAPABILITY, GEMINI_RESUME_CAPABILITY];
+};
+
+export {
+  CODEX_BRIDGE_CAPABILITY,
+  CODEX_RESUME_CAPABILITY,
+  geminiLiveCapabilities
+};

package/dist/chunk-NWYGW7HY.js

@@ -0,0 +1,117 @@
+import {
+  getBaseUrl
+} from "./chunk-2UMNXADU.js";
+import {
+  redactSecrets
+} from "./chunk-MQMPG5X4.js";
+
+// src/crypto.ts
+import nacl from "tweetnacl";
+var EPH_PUB_LEN = nacl.box.publicKeyLength;
+var BOX_NONCE_LEN = nacl.box.nonceLength;
+var SECRETBOX_NONCE_LEN = nacl.secretbox.nonceLength;
+var SESSION_KEY_LEN = nacl.secretbox.keyLength;
+var toBase64 = (bytes) => Buffer.from(bytes).toString("base64");
+var fromBase64 = (value) => new Uint8Array(Buffer.from(value, "base64"));
+var utf8Encode = (text) => new Uint8Array(Buffer.from(text, "utf-8"));
+var decodePublicKey = (value) => fromBase64(value);
+var generateSessionKey = () => nacl.randomBytes(SESSION_KEY_LEN);
+var wrapSessionKey = (sessionKey, accountPublicKey) => {
+  const ephemeral = nacl.box.keyPair();
+  const nonce = nacl.randomBytes(BOX_NONCE_LEN);
+  const box = nacl.box(sessionKey, nonce, accountPublicKey, ephemeral.secretKey);
+  const bundle = new Uint8Array(EPH_PUB_LEN + BOX_NONCE_LEN + box.length);
+  bundle.set(ephemeral.publicKey, 0);
+  bundle.set(nonce, EPH_PUB_LEN);
+  bundle.set(box, EPH_PUB_LEN + BOX_NONCE_LEN);
+  return toBase64(bundle);
+};
+var encryptRecord = (plaintext, sessionKey) => {
+  const nonce = nacl.randomBytes(SECRETBOX_NONCE_LEN);
+  const box = nacl.secretbox(utf8Encode(plaintext), nonce, sessionKey);
+  const bundle = new Uint8Array(SECRETBOX_NONCE_LEN + box.length);
+  bundle.set(nonce, 0);
+  bundle.set(box, SECRETBOX_NONCE_LEN);
+  return toBase64(bundle);
+};
+
+// src/transcript-capture.ts
+import { createHash } from "crypto";
+var INTERNAL_TYPES = /* @__PURE__ */ new Set([
+  "file-history-snapshot",
+  "change",
+  "queue-operation",
+  "summary"
+]);
+var redactDeep = (value) => {
+  if (typeof value === "string") return redactSecrets(value);
+  if (Array.isArray(value)) return value.map(redactDeep);
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [key, inner] of Object.entries(value)) {
+      out[key] = redactDeep(inner);
+    }
+    return out;
+  }
+  return value;
+};
+var localIdFor = (parsed, rawLine) => typeof parsed.uuid === "string" && parsed.uuid.length > 0 ? parsed.uuid : createHash("sha256").update(rawLine).digest("hex").slice(0, 32);
+var buildTranscriptRecords = (lines, sessionKey, seen = /* @__PURE__ */ new Set()) => {
+  const records = [];
+  const nextSeen = new Set(seen);
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    const type = typeof parsed.type === "string" ? parsed.type : "";
+    if (INTERNAL_TYPES.has(type)) continue;
+    const localId = localIdFor(parsed, trimmed);
+    if (nextSeen.has(localId)) continue;
+    nextSeen.add(localId);
+    const content = encryptRecord(JSON.stringify(redactDeep(parsed)), sessionKey);
+    records.push({ localId, content });
+  }
+  return { records, seen: nextSeen };
+};
+
+// src/transcript-api.ts
+var fetchAccountPublicKey = async (apiKey, baseUrl = getBaseUrl()) => {
+  try {
+    const res = await fetch(`${baseUrl}/api/agent/encryption-account`, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(5e3)
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return typeof data.publicKey === "string" && data.publicKey.length > 0 ? data.publicKey : null;
+  } catch {
+    return null;
+  }
+};
+var uploadTranscriptRecords = async (apiKey, params, baseUrl = getBaseUrl()) => {
+  try {
+    const res = await fetch(`${baseUrl}/api/agent/transcript`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
+      body: JSON.stringify(params),
+      signal: AbortSignal.timeout(15e3)
+    });
+    return res.ok;
+  } catch {
+    return false;
+  }
+};
+
+export {
+  decodePublicKey,
+  generateSessionKey,
+  wrapSessionKey,
+  buildTranscriptRecords,
+  fetchAccountPublicKey,
+  uploadTranscriptRecords
+};

package/dist/{chunk-C4SQY777.js → chunk-OPMSMF5R.js}

@@ -1,3 +1,6 @@
+import {
+  getMachineId
+} from "./chunk-RN3NOEJF.js";
 import {
   callMcpTool,
   withRetry
@@ -7,30 +10,27 @@ import {
 } from "./chunk-SAF6HGAA.js";
 import {
   reportedInstallSource
-} from "./chunk-BT7NTTIW.js";
+} from "./chunk-437T77TY.js";
+import {
+  getApiKey,
+  getBaseUrl
+} from "./chunk-2UMNXADU.js";
 import {
   ACTION_BODY_MAX,
   DECISION_LINE_MAX,
   classifyDecisionRisk,
   isApprovalMode,
-  isRepoKeyMatch,
+  isAutoApprove,
+  isAutoDeny,
   isSafeReadOnlyCommand,
   isScopeContract,
   localRepoKey,
-  matchRankWeight,
-  matchToolPatternAny,
   normalizeRepoRemote,
   policyArgForms,
   redactSecrets,
-  redactSecretsDeep
-} from "./chunk-QA5HP7CR.js";
-import {
-  getMachineId
-} from "./chunk-RN3NOEJF.js";
-import {
-  getApiKey,
-  getBaseUrl
-} from "./chunk-2UMNXADU.js";
+  redactSecretsDeep,
+  selectGoverningRule
+} from "./chunk-MQMPG5X4.js";
 
 // src/policy.ts
 import { createHash } from "crypto";
@@ -67,12 +67,14 @@ var policyCacheFile = (apiKey, agent, repoAware = false) => {
   const hash = createHash("sha256").update(parts.join(":")).digest("hex").slice(0, 12);
   return join(tmpdir(), `pushary-policy-${hash}.json`);
 };
-var fetchPolicy = async (apiKey, agent, repoAware = false) => {
+var fetchPolicy = async (apiKey, agent, repoAware = false, sessionId) => {
   return withRetry(async () => {
     const baseUrl = getBaseUrl();
     const params = new URLSearchParams();
     if (agent) params.set("agent", agent);
     if (repoAware) params.set("repoAware", "1");
+    params.set("scopeAware", "1");
+    if (sessionId) params.set("sessionId", sessionId);
     const query = params.toString();
     const url = query ? `${baseUrl}/api/mcp/policy?${query}` : `${baseUrl}/api/mcp/policy`;
     const response = await fetch(url, {
@@ -87,7 +89,7 @@ var fetchPolicy = async (apiKey, agent, repoAware = false) => {
     return raw;
   }, { maxAttempts: 2 });
 };
-var getPolicy = async (apiKey, expectedVersion, agent, repoAware = false) => {
+var getPolicy = async (apiKey, expectedVersion, agent, repoAware = false, sessionId) => {
   const path = policyCacheFile(apiKey, agent, repoAware);
   let staleCache = null;
   if (existsSync(path)) {
@@ -96,19 +98,20 @@ var getPolicy = async (apiKey, expectedVersion, agent, repoAware = false) => {
       const cached = JSON.parse(stat);
       if (!isPolicyConfig(cached)) throw new Error("Corrupted cache");
       const versionStale = expectedVersion != null && (cached._policyVersion ?? null) !== expectedVersion;
+      const sessionStale = (cached._sessionId ?? null) !== (sessionId ?? null);
       const age = cached._cachedAt ? Date.now() - cached._cachedAt : 0;
       const ttlFresh = !cached._cachedAt || age < CACHE_TTL_MS;
-      if (ttlFresh && !versionStale) {
+      if (ttlFresh && !versionStale && !sessionStale) {
         return cached;
       }
-      if (age < STALE_CACHE_MAX_MS) staleCache = cached;
+      if (!sessionStale && age < STALE_CACHE_MAX_MS) staleCache = cached;
     } catch {
     }
   }
   try {
-    const policy = await fetchPolicy(apiKey, agent, repoAware);
+    const policy = await fetchPolicy(apiKey, agent, repoAware, sessionId);
     try {
-      writeFileSync(path, JSON.stringify({ ...policy, _cachedAt: Date.now(), _policyVersion: expectedVersion ?? null }), { encoding: "utf-8", mode: 384 });
+      writeFileSync(path, JSON.stringify({ ...policy, _cachedAt: Date.now(), _policyVersion: expectedVersion ?? null, _sessionId: sessionId ?? null }), { encoding: "utf-8", mode: 384 });
     } catch {
     }
     return policy;
@@ -117,30 +120,6 @@ var getPolicy = async (apiKey, expectedVersion, agent, repoAware = false) => {
     throw new Error("Failed to fetch policy and no cached policy available");
   }
 };
-var findBestMatch = (policies, toolName, args, repoKey) => {
-  let best;
-  let bestWeight = 0;
-  let bestScoped = -1;
-  let bestLength = -1;
-  for (const candidate of policies) {
-    if (!isRepoKeyMatch(candidate.repoKey, repoKey)) continue;
-    const rank = matchToolPatternAny(candidate.tool, toolName, args);
-    if (rank === "none") continue;
-    const weight = matchRankWeight(rank);
-    const scoped = candidate.repoKey ? 1 : 0;
-    const length = rank === "prefix" ? candidate.tool.length : -1;
-    const better = weight > bestWeight || weight === bestWeight && scoped > bestScoped || weight === bestWeight && scoped === bestScoped && length > bestLength;
-    if (better) {
-      best = { policy: candidate, rank };
-      bestWeight = weight;
-      bestScoped = scoped;
-      bestLength = length;
-    }
-  }
-  return best;
-};
-var isAutoApprove = (policy) => policy.timeoutSeconds === 0 && policy.timeoutAction === "approve";
-var isAutoDeny = (policy) => policy.timeoutSeconds === 0 && policy.timeoutAction === "deny";
 var autoApprove = (tool) => ({
   tool,
   timeoutSeconds: 0,
@@ -148,20 +127,20 @@ var autoApprove = (tool) => ({
   mode: "terminal_only",
   pushFirstSeconds: 0
 });
-var resolveAutoResolveOrigin = (config, toolName, toolInput, cwd, repoKey) => {
+var resolveAutoResolveOrigin = (config, toolName, toolInput, cwd, repoKey, sessionId) => {
   const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
   const arg = args[0];
-  const match = findBestMatch(config.policies, toolName, args, repoKey);
+  const match = selectGoverningRule(config.policies, toolName, args, repoKey, sessionId);
   const governedBySpecificRule = match?.rank === "exact" || match?.rank === "prefix";
   if (!governedBySpecificRule && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg)) {
     return "safe_readonly";
   }
   return "policy_timeout";
 };
-var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey) => {
+var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
   const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
   const arg = args[0];
-  const match = findBestMatch(config.policies, toolName, args, repoKey);
+  const match = selectGoverningRule(config.policies, toolName, args, repoKey, sessionId);
   let base = match?.policy ?? config.policies.find((p) => p.tool === "*") ?? {
     tool: toolName,
     timeoutSeconds: config.defaultTimeoutSeconds,
@@ -196,9 +175,9 @@ var restraintRank = (policy) => {
   return policy.mode === "terminal_only" || policy.mode === "notify_only" ? 1 : 2;
 };
 var strictestPolicy = (a, b) => restraintRank(b) > restraintRank(a) ? b : a;
-var resolvePolicyAcross = (config, toolName, modeOverride, toolInputs, cwd, repoKey) => {
-  if (toolInputs.length === 0) return resolvePolicy(config, toolName, modeOverride, void 0, cwd, repoKey);
-  return toolInputs.map((input) => resolvePolicy(config, toolName, modeOverride, input, cwd, repoKey)).reduce(strictestPolicy);
+var resolvePolicyAcross = (config, toolName, modeOverride, toolInputs, cwd, repoKey, sessionId) => {
+  if (toolInputs.length === 0) return resolvePolicy(config, toolName, modeOverride, void 0, cwd, repoKey, sessionId);
+  return toolInputs.map((input) => resolvePolicy(config, toolName, modeOverride, input, cwd, repoKey, sessionId)).reduce(strictestPolicy);
 };
 var isModeStateDegraded = (state) => state?.degraded === true;
 var MODE_GRACE_MS = 60 * 1e3;
@@ -954,12 +933,13 @@ var notifyLateAnswers = async (apiKey, late, agentName, sessionId) => {
 };
 var CLAUDE_CODE_AGENT = { type: "claude_code", label: "Claude Code" };
 var POLICY_CACHE_TTL_MS = 5 * 60 * 1e3;
-var readFreshCachedPolicy = (apiKey, agentType) => {
+var readFreshCachedPolicy = (apiKey, agentType, sessionId) => {
   const request = policyRequestFor(agentType);
   const path = policyCacheFile(apiKey, request.agent, request.repoAware);
   if (!existsSync5(path)) return null;
   const cached = JSON.parse(readFileSync4(path, "utf-8"));
   if (!isPolicyConfig(cached)) return null;
+  if ((cached._sessionId ?? null) !== (sessionId ?? null)) return null;
   if (!cached._cachedAt || Date.now() - cached._cachedAt >= POLICY_CACHE_TTL_MS) return null;
   return cached;
 };
@@ -967,13 +947,13 @@ var autoDecisionEnabled = () => {
   const flag = process.env.PUSHARY_AUTO_DECISION_BEACON;
   return flag === "1" || flag === "true";
 };
-var deriveDecisionSource = (toolName, toolInput, liveMode, agentType, cwd) => {
+var deriveDecisionSource = (toolName, toolInput, liveMode, agentType, cwd, sessionId) => {
   try {
     if (liveMode.kill) return "terminal";
     if (!autoDecisionEnabled()) return void 0;
-    const policy = readFreshCachedPolicy(getApiKey(), agentType);
+    const policy = readFreshCachedPolicy(getApiKey(), agentType, sessionId);
     if (!policy) return void 0;
-    const resolved = resolvePolicy(policy, toolName, liveMode.mode, toolInput, cwd, repoKeyFor(cwd));
+    const resolved = resolvePolicy(policy, toolName, liveMode.mode, toolInput, cwd, repoKeyFor(cwd), sessionId);
     if (isAutoApprove(resolved)) return "policy_auto";
     if (resolved.mode === "push_only" || resolved.mode === "push_first") return "human";
     return "terminal";
@@ -981,16 +961,16 @@ var deriveDecisionSource = (toolName, toolInput, liveMode, agentType, cwd) => {
     return void 0;
   }
 };
-var deriveAutoDecisionBeacon = (toolName, toolInput, liveMode, agentType, cwd) => {
+var deriveAutoDecisionBeacon = (toolName, toolInput, liveMode, agentType, cwd, sessionId) => {
   try {
     if (liveMode.kill) return void 0;
     if (!autoDecisionEnabled()) return void 0;
-    const policy = readFreshCachedPolicy(getApiKey(), agentType);
+    const policy = readFreshCachedPolicy(getApiKey(), agentType, sessionId);
     if (!policy) return void 0;
-    const resolved = resolvePolicy(policy, toolName, liveMode.mode, toolInput, cwd, repoKeyFor(cwd));
+    const resolved = resolvePolicy(policy, toolName, liveMode.mode, toolInput, cwd, repoKeyFor(cwd), sessionId);
     if (resolved.timeoutSeconds !== 0 || resolved.timeoutAction !== "approve") return void 0;
     return {
-      decisionOrigin: resolveAutoResolveOrigin(policy, toolName, toolInput, cwd, repoKeyFor(cwd)),
+      decisionOrigin: resolveAutoResolveOrigin(policy, toolName, toolInput, cwd, repoKeyFor(cwd), sessionId),
       toolName,
       toolTarget: deriveToolTarget(toolName, toolInput)
     };
@@ -1033,7 +1013,7 @@ var reportEvent = async (event, options = {}) => {
         machineId: event.machineId ?? getMachineId(),
         // Lets the phone's Stop end this process instead of only denying its next
         // tool call. Ours alone: never another process, never a parent.
-        pid: event.pid ?? process.pid,
+        pid: event.pid,
         repoKey: event.repoKey ?? repoKeyFor(),
         installMode: detectInstallMode(),
         // How the binary was INVOKED this time and which front door produced the
@@ -1055,6 +1035,7 @@ var reportEvent = async (event, options = {}) => {
       }),
       signal: AbortSignal.timeout(options.timeoutMs ?? 1e4)
     });
+    if (options.requireOk && !res.ok) throw new Error(`/api/agent/event rejected (${res.status})`);
     try {
       return await res.json();
     } catch {
@@ -1080,8 +1061,8 @@ var handlePostToolUse = async (input, agent = CLAUDE_CODE_AGENT) => {
       for (const l of late) removePendingQuestion(sessionKey, l.correlationId);
     }
     const isMirrorOnly = NON_GATED_MIRROR_TOOLS.has(input.tool_name);
-    const decisionSource = isMirrorOnly ? void 0 : deriveDecisionSource(lookup.tool, lookup.input, liveMode, agent.type, input.cwd);
-    const beacon = !isMirrorOnly && decisionSource === "policy_auto" && throttlePass(`autodecision:${sessionKey}:${lookup.tool}`, AUTO_DECISION_WINDOW_MS) ? deriveAutoDecisionBeacon(lookup.tool, lookup.input, liveMode, agent.type, input.cwd) : void 0;
+    const decisionSource = isMirrorOnly ? void 0 : deriveDecisionSource(lookup.tool, lookup.input, liveMode, agent.type, input.cwd, input.session_id);
+    const beacon = !isMirrorOnly && decisionSource === "policy_auto" && throttlePass(`autodecision:${sessionKey}:${lookup.tool}`, AUTO_DECISION_WINDOW_MS) ? deriveAutoDecisionBeacon(lookup.tool, lookup.input, liveMode, agent.type, input.cwd, input.session_id) : void 0;
     const toolReport = reportEvent({
       event: isError ? "tool_error" : "tool_complete",
       agentType: agent.type,
@@ -1338,8 +1319,6 @@ var handleStopFailure = async (input, agent = CLAUDE_CODE_AGENT) => {
 
 export {
   getPolicy,
-  isAutoApprove,
-  isAutoDeny,
   resolveAutoResolveOrigin,
   resolvePolicy,
   resolvePolicyAcross,