@pushary/agent-hooks 0.83.2 → 0.84.1

package/dist/bin/pushary-codex-bridge.js

@@ -0,0 +1,349 @@
+#!/usr/bin/env node
+import "../chunk-NRGRUOAR.js";
+import {
+  LiveTranscriptRelay,
+  liveSessionSleep,
+  postLiveSession,
+  postLiveSessionUntilAccepted,
+  startLiveSessionHeartbeat
+} from "../chunk-ERYKGH4J.js";
+import "../chunk-GCKAWHFP.js";
+import {
+  startProcessOwnership,
+  withSpawnProcessOwnership
+} from "../chunk-ILB6UOAF.js";
+import {
+  spawnClaude
+} from "../chunk-XHKBHWLX.js";
+import {
+  resolveBinary
+} from "../chunk-VT4IVERX.js";
+import "../chunk-SEAHGHCE.js";
+import {
+  getMachineId
+} from "../chunk-RN3NOEJF.js";
+import "../chunk-6MTNS63X.js";
+import {
+  getApiKey,
+  getBaseUrl
+} from "../chunk-2UMNXADU.js";
+import "../chunk-MQMPG5X4.js";
+
+// bin/pushary-codex-bridge.ts
+import { existsSync } from "fs";
+
+// src/codex-bridge.ts
+import { spawn } from "child_process";
+import { basename } from "path";
+var MAX_RPC_LINE = 1024 * 1024;
+var MAX_PENDING_RPC = 8;
+var MAX_TRANSCRIPT_TEXT = 32 * 1024;
+var MAX_MESSAGE_BUFFERS = 16;
+var JsonRpcClient = class {
+  child;
+  pending = /* @__PURE__ */ new Map();
+  notifications = /* @__PURE__ */ new Set();
+  nextId = 1;
+  buffer = "";
+  closed = false;
+  constructor(command, cwd, timeoutMs) {
+    const options = { cwd, env: process.env, stdio: ["pipe", "pipe", "pipe"] };
+    this.child = process.platform === "win32" ? spawnClaude(command.command, command.args ?? [], options) : spawn(command.command, command.args ?? [], options);
+    this.child.stdout?.setEncoding("utf8");
+    this.child.stdout?.on("data", (chunk) => this.read(String(chunk)));
+    this.child.stderr?.resume();
+    this.child.once("error", (error) => this.fail(error));
+    this.child.once("exit", () => this.fail(new Error("Codex app-server exited")));
+    this.timeoutMs = timeoutMs;
+  }
+  timeoutMs;
+  get isClosed() {
+    return this.closed;
+  }
+  onNotification(listener) {
+    this.notifications.add(listener);
+    return () => this.notifications.delete(listener);
+  }
+  notify(method) {
+    this.write({ method });
+  }
+  request(method, params) {
+    if (this.closed) return Promise.reject(new Error("Codex app-server is closed"));
+    if (this.pending.size >= MAX_PENDING_RPC) return Promise.reject(new Error("Codex app-server request limit reached"));
+    const id = this.nextId++;
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        this.pending.delete(id);
+        reject(new Error(`${method} timed out`));
+      }, this.timeoutMs);
+      this.pending.set(id, { resolve, reject, timer });
+      this.write({ id, method, params });
+    });
+  }
+  async close() {
+    if (this.closed) return;
+    this.closed = true;
+    this.child.stdin?.end();
+    if (this.child.exitCode != null) return;
+    await Promise.race([
+      new Promise((resolve) => this.child.once("exit", () => resolve())),
+      new Promise((resolve) => setTimeout(resolve, 1e3))
+    ]);
+    if (this.child.exitCode == null) this.child.kill();
+    this.rejectPending(new Error("Codex app-server closed"));
+  }
+  write(value) {
+    this.child.stdin?.write(`${JSON.stringify(value)}
+`);
+  }
+  read(chunk) {
+    this.buffer += chunk;
+    if (this.buffer.length > MAX_RPC_LINE && !this.buffer.includes("\n")) {
+      this.fail(new Error("Codex app-server sent an oversized message"));
+      return;
+    }
+    let newline = this.buffer.indexOf("\n");
+    while (newline >= 0) {
+      const line = this.buffer.slice(0, newline);
+      this.buffer = this.buffer.slice(newline + 1);
+      if (line.length > MAX_RPC_LINE) {
+        this.fail(new Error("Codex app-server sent an oversized message"));
+        return;
+      }
+      this.handle(line);
+      newline = this.buffer.indexOf("\n");
+    }
+  }
+  handle(line) {
+    let message;
+    try {
+      message = JSON.parse(line);
+    } catch {
+      return;
+    }
+    if (typeof message.id === "number" && message.method) {
+      const result = message.method === "item/commandExecution/requestApproval" || message.method === "item/fileChange/requestApproval" ? { decision: "decline" } : message.method === "applyPatchApproval" || message.method === "execCommandApproval" ? { decision: { denied: { rejection: "No interactive Codex client is attached" } } } : message.method === "item/tool/requestUserInput" ? { answers: {} } : null;
+      this.write(result ? { id: message.id, result } : { id: message.id, error: { code: -32601, message: "Unsupported server request" } });
+      return;
+    }
+    if (typeof message.id === "number") {
+      const pending = this.pending.get(message.id);
+      if (!pending) return;
+      this.pending.delete(message.id);
+      clearTimeout(pending.timer);
+      if (message.error) pending.reject(new Error(message.error.message ?? "Codex app-server request failed"));
+      else pending.resolve(message.result);
+      return;
+    }
+    if (message.method) {
+      for (const listener of this.notifications) listener(message);
+    }
+  }
+  fail(error) {
+    if (this.closed) return;
+    this.closed = true;
+    this.rejectPending(error);
+    if (this.child.exitCode == null) this.child.kill();
+  }
+  rejectPending(error) {
+    for (const pending of this.pending.values()) {
+      clearTimeout(pending.timer);
+      pending.reject(error);
+    }
+    this.pending.clear();
+  }
+};
+var object = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var string = (value) => typeof value === "string" && value.length > 0 ? value : null;
+var input = (text) => [{ type: "text", text, text_elements: [] }];
+var rpcThreadId = (result) => string(object(object(result)?.thread)?.id);
+var rpcTurnId = (result) => {
+  const response = object(result);
+  return string(object(response?.turn)?.id) ?? string(response?.turnId);
+};
+var runCodexBridge = async (options) => {
+  const timeoutMs = options.requestTimeoutMs ?? 1e4;
+  const rpc = new JsonRpcClient(options.appServer, options.cwd, timeoutMs);
+  let threadId = options.resumeThreadId ?? null;
+  let activeTurnId = null;
+  let relay = null;
+  let linked = false;
+  let stopHeartbeat = () => {
+  };
+  let ownership = null;
+  const messages = /* @__PURE__ */ new Map();
+  const reportBody = (event, action) => ({
+    event,
+    action,
+    agentType: "codex",
+    agentName: `Codex - ${basename(options.cwd)}`,
+    sessionId: threadId,
+    codexThreadId: threadId,
+    spawnId: options.spawnId,
+    machineId: options.machineId,
+    pid: process.pid,
+    cwd: options.cwd
+  });
+  const report = (event, action) => postLiveSession(options, "/api/agent/event", reportBody(event, action));
+  const removeNotification = rpc.onNotification((message) => {
+    const params = message.params ?? {};
+    if (message.method === "turn/started") activeTurnId = string(object(params.turn)?.id);
+    if (message.method === "turn/completed") {
+      activeTurnId = null;
+      void report("stop", "Turn completed").catch(() => {
+      });
+    }
+    if (message.method === "item/agentMessage/delta") {
+      const itemId = string(params.itemId);
+      const delta = string(params.delta);
+      if (!itemId || !delta) return;
+      if (!messages.has(itemId) && messages.size === MAX_MESSAGE_BUFFERS) {
+        const oldest = messages.keys().next().value;
+        if (typeof oldest === "string") messages.delete(oldest);
+      }
+      messages.set(itemId, `${messages.get(itemId) ?? ""}${delta}`.slice(0, MAX_TRANSCRIPT_TEXT));
+    }
+    if (message.method === "item/completed") {
+      const itemId = string(object(params.item)?.id);
+      const text = itemId ? messages.get(itemId) : null;
+      if (!itemId || !text) return;
+      messages.delete(itemId);
+      relay?.add({ type: "assistant", uuid: itemId, message: { role: "assistant", content: text } });
+    }
+  });
+  try {
+    await rpc.request("initialize", {
+      clientInfo: { name: "pushary", title: "Pushary", version: "1" },
+      capabilities: { experimentalApi: false, requestAttestation: false }
+    });
+    rpc.notify("initialized");
+    const thread = options.resumeThreadId ? await rpc.request("thread/resume", { threadId: options.resumeThreadId, cwd: options.cwd, excludeTurns: true }) : await rpc.request("thread/start", { cwd: options.cwd, model: options.model ?? null });
+    threadId = rpcThreadId(thread);
+    if (!threadId) throw new Error("Codex app-server did not return a thread id");
+    ownership = startProcessOwnership({ sessionId: threadId, pid: process.pid, spawnId: options.spawnId });
+    await ownership.ready;
+    relay = options.transcripts === false ? null : new LiveTranscriptRelay(options, threadId);
+    await postLiveSessionUntilAccepted(
+      options,
+      "/api/agent/event",
+      reportBody("session_start", options.resumeThreadId ? "Session resumed" : "Session started")
+    );
+    linked = true;
+    stopHeartbeat = startLiveSessionHeartbeat(options, reportBody("heartbeat", "Session online"));
+    const startTurn = async (text, commandId) => {
+      relay?.add({ type: "user", uuid: commandId, message: { role: "user", content: text } });
+      const result = activeTurnId ? await rpc.request("turn/steer", {
+        threadId,
+        expectedTurnId: activeTurnId,
+        input: input(text),
+        clientUserMessageId: commandId
+      }) : await rpc.request("turn/start", {
+        threadId,
+        input: input(text),
+        cwd: options.cwd,
+        model: options.model ?? null,
+        clientUserMessageId: commandId
+      });
+      activeTurnId = rpcTurnId(result) ?? activeTurnId;
+    };
+    if (options.prompt) await startTurn(options.prompt, `spawn-${options.spawnId}`);
+    let pendingAck = null;
+    while (!options.signal.aborted && !rpc.isClosed) {
+      try {
+        if (pendingAck) {
+          const acknowledged = await postLiveSession(options, "/api/agent/command/ack", pendingAck);
+          if (acknowledged.ok) pendingAck = null;
+        }
+        if (pendingAck) {
+          await liveSessionSleep(options.pollIntervalMs ?? 2e3, options.signal);
+          continue;
+        }
+        const response = await postLiveSession(options, "/api/agent/command/drain", { sessionId: threadId, ackMode: true });
+        if (response.ok) {
+          const command = object((await response.json()).command);
+          const commandId = string(command?.id);
+          const text = string(command?.text);
+          if (commandId && text) {
+            try {
+              await startTurn(text, commandId);
+              pendingAck = { commandId, state: "delivered" };
+            } catch {
+              pendingAck = {
+                commandId,
+                state: "failed",
+                failureCode: "codex_rejected"
+              };
+            }
+          }
+        }
+      } catch {
+      }
+      await relay?.flush();
+      await liveSessionSleep(options.pollIntervalMs ?? 2e3, options.signal);
+    }
+    if (rpc.isClosed && !options.signal.aborted) throw new Error("Codex app-server exited");
+    if (activeTurnId) {
+      await rpc.request("turn/interrupt", { threadId, turnId: activeTurnId }).catch(() => null);
+    }
+    await relay?.flush();
+    await report("session_closed", "Session stopped").catch(() => null);
+    return "stopped";
+  } catch (error) {
+    if (!linked && options.claimId) {
+      const message = error instanceof Error ? error.message : String(error);
+      for (let attempt = 0; attempt < 3; attempt++) {
+        const acknowledged = await postLiveSession(options, "/api/agent/spawn/ack", {
+          spawnId: options.spawnId,
+          claimId: options.claimId,
+          machineId: options.machineId,
+          state: "failed",
+          failure: {
+            code: "bridge_failed",
+            message: message.slice(0, 240),
+            retryable: false
+          }
+        }).catch(() => null);
+        if (acknowledged?.ok) break;
+        await liveSessionSleep(200 * (attempt + 1), options.signal);
+      }
+    }
+    await report("error", "Live bridge failed").catch(() => null);
+    return "failed";
+  } finally {
+    stopHeartbeat();
+    ownership?.stop();
+    removeNotification();
+    await rpc.close();
+  }
+};
+
+// bin/pushary-codex-bridge.ts
+var spawnId = process.env.PUSHARY_SPAWN_ID?.trim();
+var requestedCwd = process.env.PUSHARY_BRIDGE_CWD?.trim();
+if (!spawnId || !requestedCwd || !existsSync(requestedCwd)) {
+  process.stderr.write("[pushary] Codex bridge received an invalid launch request\n");
+  process.exit(1);
+}
+var abort = new AbortController();
+var signals = process.platform === "win32" ? ["SIGINT", "SIGTERM"] : ["SIGINT", "SIGTERM", "SIGHUP"];
+var stop = () => abort.abort();
+for (const signal of signals) process.on(signal, stop);
+var outcome = await withSpawnProcessOwnership(spawnId, () => runCodexBridge({
+  apiKey: getApiKey(),
+  baseUrl: getBaseUrl(),
+  machineId: getMachineId(),
+  spawnId,
+  claimId: process.env.PUSHARY_SPAWN_CLAIM_ID?.trim() || void 0,
+  cwd: requestedCwd,
+  prompt: process.env.PUSHARY_BRIDGE_PROMPT?.trim() || void 0,
+  model: process.env.PUSHARY_BRIDGE_MODEL?.trim() || void 0,
+  resumeThreadId: process.env.PUSHARY_BRIDGE_RESUME_SESSION_ID?.trim() || void 0,
+  appServer: {
+    command: process.env.PUSHARY_CODEX_COMMAND?.trim() || resolveBinary("codex") || "codex",
+    args: ["app-server", "--stdio"]
+  },
+  signal: abort.signal,
+  transcripts: process.env.PUSHARY_TRANSCRIPTS === "1"
+}));
+for (const signal of signals) process.off(signal, stop);
+process.exit(outcome === "stopped" ? 0 : 1);

package/dist/bin/pushary-codex-hook.js

@@ -2,13 +2,13 @@
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-3AGM3TDM.js";
+} from "../chunk-NJ7JT26G.js";
 import {
   KILL_REASON,
   denyReasonFrom,
   isDeferAnswer,
   resolveGate
-} from "../chunk-4QQOKEOS.js";
+} from "../chunk-BLDDXHHA.js";
 import {
   CODEX_AGENT,
   DEFAULT_SESSION,
@@ -28,6 +28,7 @@ import {
   handleStop,
   handleUserPrompt,
   permissionTimeoutDecision,
+  policyRequestFor,
   preToolUseTimeoutDecision,
   readLastPrompt,
   repoKeyFor,
@@ -39,24 +40,24 @@ import {
   toPolicyLookup,
   toPolicyLookups,
   waitForAnswer
-} from "../chunk-7PO2VEA4.js";
+} from "../chunk-CCCJ6BPW.js";
+import {
+  getMachineId
+} from "../chunk-RN3NOEJF.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
-import "../chunk-SAA3VBDK.js";
+import "../chunk-437T77TY.js";
 import "../chunk-7QLSKOSU.js";
+import "../chunk-KZERVKTD.js";
+import {
+  getApiKey
+} from "../chunk-2UMNXADU.js";
 import {
   DECISION_LINE_MAX,
   effectiveWaitSeconds,
   hookWaitClamped,
   hookWaitDeadline
-} from "../chunk-YWRJGYUH.js";
-import {
-  getMachineId
-} from "../chunk-RN3NOEJF.js";
-import {
-  getApiKey
-} from "../chunk-2UMNXADU.js";
-import "../chunk-KZERVKTD.js";
+} from "../chunk-MQMPG5X4.js";
 
 // bin/pushary-codex-hook.ts
 import { basename, join } from "path";
@@ -143,6 +144,7 @@ var pushQuestion = async (apiKey, input, lookup, waitSeconds, mode) => {
     action: description.slice(0, DECISION_LINE_MAX),
     blocker: deriveBlocker(mode),
     actionBody: deriveActionBody(input.tool_name ?? "", input.tool_input ?? {}),
+    repoKey: repoKeyFor(input.cwd),
     // Codex has always sent this; it is what claimNotify and markApproved already
     // key on locally. Passing it through lets the server collapse a retried create
     // the same way, instead of putting the same approval on the phone twice.
@@ -177,9 +179,10 @@ var notifyApprovalNeeded = async (apiKey, input, lookup) => {
 };
 var codexGate = async (apiKey, input) => {
   const modeState = await fetchModeState(apiKey, input.session_id);
+  const policyRequest = policyRequestFor("codex");
   const lookup = toPolicyLookup(input.tool_name ?? "", input.tool_input ?? {}, input.cwd);
   const lookups = toPolicyLookups(input.tool_name ?? "", input.tool_input ?? {}, input.cwd);
-  const config = await getPolicy(apiKey, modeState.policyVersion, "codex");
+  const config = await getPolicy(apiKey, modeState.policyVersion, policyRequest.agent, policyRequest.repoAware, input.session_id);
   const verdict = resolveGate({
     modeState,
     config,
@@ -189,7 +192,8 @@ var codexGate = async (apiKey, input) => {
     // session. A multi-file patch contributes one path per file.
     scopePaths: modeState.scope ? lookups.inputs.map((entry) => scopePathFor(lookups.tool, entry, input.cwd)).filter((path) => typeof path === "string") : [],
     cwd: input.cwd,
-    repoKey: repoKeyFor(input.cwd)
+    repoKey: repoKeyFor(input.cwd),
+    sessionId: input.session_id
   });
   return { verdict, lookup };
 };

package/dist/bin/pushary-codex.js

@@ -3,19 +3,19 @@ import {
   askUser,
   reportEvent,
   waitForAnswer
-} from "../chunk-7PO2VEA4.js";
-import "../chunk-BSZYIAZL.js";
-import "../chunk-SAF6HGAA.js";
-import "../chunk-SAA3VBDK.js";
-import "../chunk-7QLSKOSU.js";
-import "../chunk-YWRJGYUH.js";
+} from "../chunk-CCCJ6BPW.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
+import "../chunk-BSZYIAZL.js";
+import "../chunk-SAF6HGAA.js";
+import "../chunk-437T77TY.js";
+import "../chunk-7QLSKOSU.js";
+import "../chunk-KZERVKTD.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
-import "../chunk-KZERVKTD.js";
+import "../chunk-MQMPG5X4.js";
 
 // bin/pushary-codex.ts
 import { basename } from "path";

package/dist/bin/pushary-connect.js

@@ -3,40 +3,41 @@ import {
   confirmAppConnection,
   connectDevice,
   printConnectInstructions
-} from "../chunk-U27BZWFT.js";
+} from "../chunk-6LC4WSCL.js";
 import "../chunk-3EGEA4KH.js";
 import {
   printKeyCheck
-} from "../chunk-26D2YMDU.js";
+} from "../chunk-FBGBJXVC.js";
 import {
   checkApiKey
-} from "../chunk-QR6MVVQ7.js";
+} from "../chunk-F52SIIDG.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
 import {
   readKeySource
-} from "../chunk-WDRRULBH.js";
-import "../chunk-6MTNS63X.js";
+} from "../chunk-K7CSRGKZ.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
+import {
+  exitOnHelpFlag
+} from "../chunk-J4KFVOCQ.js";
+import "../chunk-MGJBC6DD.js";
 import "../chunk-BC3VCZ3E.js";
+import "../chunk-DINDL2CF.js";
+import "../chunk-6MTNS63X.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
-import "../chunk-SAA3VBDK.js";
+import "../chunk-437T77TY.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
-import "../chunk-YWRJGYUH.js";
-import {
-  exitOnHelpFlag
-} from "../chunk-RRZZ7TFJ.js";
-import "../chunk-ZUKH2NPJ.js";
-import "../chunk-2UMNXADU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
+import "../chunk-2UMNXADU.js";
+import "../chunk-MQMPG5X4.js";
 
 // bin/pushary-connect.ts
 exitOnHelpFlag("connect");