@pushary/agent-hooks 0.84.1 → 0.85.1

package/CHANGELOG.md

@@ -1,5 +1,69 @@
 # Changelog
 
+## 0.85.1
+
+### A rule you wrote is now honoured in auto mode
+
+A policy set to deny a tool outright was computed and then discarded in the three
+Claude Code permission modes Pushary steps aside for: `auto`, `plan` and `dontAsk`.
+`auto` is the default on Pro, Max and Team, so this was most sessions. The native
+classifier has never heard of your rule, so it would approve what you had forbidden.
+
+The defer exists to stop Pushary double-prompting on top of Claude Code's own
+prompt. A deny prompts nobody, so that reasoning never covered it. A standing deny
+now sits with the kill switch, ahead of the defer, and applies in every mode.
+
+Approvals are unchanged: `auto` still defers them, and a tool the classifier
+decides to ask about is still reclaimed through `PermissionRequest` and pushed to
+your phone. This only closes the case where a rule of yours was silently dropped.
+
+The Codex, Gemini and SDK wrapper paths already behaved this way. This brings the
+Claude Code path in line with them.
+
+## 0.85.0
+
+### A hook command that cannot outlive what it points at
+
+Every hook command written into `~/.claude/settings.json`, `~/.codex/hooks.json`
+and `~/.gemini/settings.json`, the free bell included, is now wrapped so that a missing binary, a removed
+`node`, a changed npm prefix or a moved home directory exits 0 and the agent reads
+"no opinion". Before, any of those turned every tool call into a failing hook.
+The guard is tested on every shell that can be `/bin/sh`, including dash, and with
+`node` off PATH, which used to exit 127 and print on every tool call.
+
+Codex hashes the exact command string to trust a hook, so `pushary upgrade` rewrites
+the trust entry when it re-applies the hooks.
+
+### Hooks registered for the CLI you have
+
+Claude Code events are registered from a table with a version floor per event.
+`SubagentStart`, `SubagentStop`, `PreCompact`, `PostCompact` and `TeammateIdle`
+are added on a CLI that understands them, and `pushary upgrade` re-registers
+against the CLI you have now. Disconnect removes every event in the table; a
+hand-typed list used to leave the five observability events behind.
+
+### `pushary disconnect <agent>`
+
+Removes the MCP server, the hooks, the skill and, for Codex, the trust entries and
+the API key from `config.toml`, for one agent, leaving the others alone. The bin
+map entry was written in a shape the build silently dropped, and the command read
+the dispatcher's own token as the agent name; both are fixed before this, its
+first release, and a test now holds every bin entry to the one shape tsup builds.
+
+### A kill switch per hook path
+
+`~/.pushary/admission-rules.json` (`{"version":1,"disabled":["claude:PostToolUse"]}`)
+silences one event on one agent, or one agent entirely, without a release. Every
+hook binary reads its input through this check, from the same file the macOS
+helper reads, so one file governs both transports. Deny-only: nothing in the file
+can enable a hook.
+
+### `PostToolUse` no longer pays two round trips per tool call
+
+The telemetry hooks reuse the mode state the gate fetched for the same session
+within the last 60 seconds. The gate itself still reads it live, so a remote stop
+and a scope contract are never served stale where they decide anything.
+
 ## 0.84.1
 
 ### Remote starts survive lost acknowledgements without double-launching

package/README.md

@@ -108,6 +108,29 @@ npx @pushary/agent-hooks@latest doctor
 
 Any other MCP client can use notify and ask by pointing at the Pushary MCP endpoint directly.
 
+## Hook events, gated by version
+
+Claude Code 2.1.239 names thirty-one hook events and the set grows release by release,
+so the ones we register are gated on the version actually installed. The version is
+read from disk and never by running the binary: `codex --version` once submitted the
+Codex CLI to XProtect, which killed it and moved the 181 MB binary to the Trash, so
+setup deleted the user's installation as a side effect of asking its version.
+
+An unreadable version registers only the events that predate gating. Each registration
+records `registered|<version>`, which is what lets an upgrade pick up newer events
+without anyone re-running setup.
+
+## Admission rules
+
+Publishing this package is a version bump merged to main, and a hook change is not
+live until that happens, so a hook that floods on one event would otherwise need a
+release to stop. `~/.pushary/admission-rules.json` can disable an `(agent, event)`
+pair as data.
+
+Deny-only by construction: a rule can silence a hook we ship, and no shape of the file
+can enable one we do not. A file that cannot be read admits everything, because
+failing closed would let one malformed download silence every hook on the machine.
+
 ## Commands
 
 <!-- Managed: every command below is declared in src/cli/commands.ts, and a test
@@ -123,6 +146,7 @@ logout       Remove the key this machine stores, and say what it does not remove
 connect      Connect a phone without re-running setup (--app for the Pushary app)
 bell         Free local bell when an agent finishes or needs you. No account, no key, no network
 doctor       Verify your Pushary installation is working
+disconnect   Turn off one agent (claude|codex|gemini|cursor)
 clean        Remove all Pushary configuration (--yes for non-interactive)
 mode         Switch approval mode (push_only, push_first, terminal_only)
 wait         Show or set the "wait for your phone" ladder (pushary wait 45)

package/data/cursor-plugin/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.2.0
+
+The gate stopped carrying its own copy of the policy engine.
+
+Pattern matching, glob compilation, the destructive-command list and policy
+resolution all lived in this file, roughly two hundred and fifty lines of it,
+kept in step with the real engine by hand. That is how 0.1.1 happened: the copy
+matched on tool name alone, so every argument rule was invisible here. It also
+never gained the safe read-only allowlist, so `git status` reached your phone
+from Cursor and from nowhere else.
+
+The gate now asks the server, which runs the same engine as every other client
+over the same policy and mode state. There is nothing left to keep in step.
+
+- The safe read-only allowlist applies here now: ordinary read-only commands
+  stop reaching your phone.
+- A policy change takes effect immediately. The five-minute on-disk policy cache
+  is gone, along with the stale-cache fallback.
+- An unreachable Pushary hands the command to Cursor's own prompt, as before.
+  Nothing is ever denied because we could not reach the server.
+
 ## 0.1.1
 
 Policy parity with the other agents. The gate matched rules on tool NAME alone, so

package/data/cursor-plugin/scripts/pushary-gate.mjs

@@ -27,20 +27,17 @@
 // it unapproved.
 
 import { createHash } from 'node:crypto'
-import { hostname, tmpdir } from 'node:os'
-import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { hostname } from 'node:os'
+import { existsSync, readFileSync } from 'node:fs'
 import { basename, dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 const BASE_URL = 'https://pushary.com'
 const MCP_URL = `${BASE_URL}/api/mcp/mcp`
-const POLICY_CACHE_TTL_MS = 5 * 60 * 1000
 const MAX_BLOCK_MS = 45_000 // longest we can wait before Cursor's hook timeout
 const WAIT_CHUNK_MS = 20_000 // per wait_for_answer long-poll
 const POLL_GAP_MS = 1_500 // pause between polls after a transient error
 const NET_TIMEOUT_MS = 27_000 // abort a single MCP request
-const POLICY_TIMEOUT_MS = 10_000
-const MODE_TIMEOUT_MS = 3_000
 const HARD_GUARD_MS = 55_000 // force a graceful "ask" before failClosed (60s) fires
 
 // ── Cursor decisions ──────────────────────────────────────────────────────────
@@ -229,221 +226,51 @@ const callTool = async (apiKey, name, args) => {
   return JSON.parse(payload)
 }
 
-const getJson = async (path, apiKey, timeoutMs) => {
-  const response = await fetch(`${BASE_URL}${path}`, {
-    headers: { Authorization: `Bearer ${apiKey}` },
-    signal: AbortSignal.timeout(timeoutMs),
-  })
-  if (!response.ok) throw new Error(`GET ${path} ${response.status}`)
-  return response.json()
-}
-
-// ── Policy (mirrors @pushary/agent-hooks policy.ts) ──────────────────────────────
-const isPolicyConfig = (d) =>
-  !!d && typeof d === 'object' && Array.isArray(d.policies) && typeof d.defaultTimeoutSeconds === 'number' && typeof d.defaultTimeoutAction === 'string'
-
-// Keyed by the capability as well as the key: the server returns a different rule
-// set to a client that did not ask for repo-scoped rules, so one key for both
-// would serve the wrong policy across an upgrade.
-const policyCacheFile = (apiKey) =>
-  join(tmpdir(), `pushary-policy-${createHash('sha256').update(`${apiKey}:cursor:repoAware`).digest('hex').slice(0, 12)}.json`)
-
-const getPolicy = async (apiKey) => {
-  const path = policyCacheFile(apiKey)
-  let stale = null
-  if (existsSync(path)) {
-    try {
-      const cached = JSON.parse(readFileSync(path, 'utf-8'))
-      if (isPolicyConfig(cached)) {
-        if (!cached._cachedAt || Date.now() - cached._cachedAt < POLICY_CACHE_TTL_MS) return cached
-        stale = cached
-      }
-    } catch {}
-  }
-  try {
-    const fresh = await withRetry(async () => {
-      const raw = await getJson('/api/mcp/policy?repoAware=1', apiKey, POLICY_TIMEOUT_MS)
-      if (!isPolicyConfig(raw)) throw new Error('invalid policy')
-      return raw
-    }, 2)
-    try {
-      writeFileSync(path, JSON.stringify({ ...fresh, _cachedAt: Date.now() }), 'utf-8')
-    } catch {}
-    return fresh
-  } catch (error) {
-    if (stale) return stale
-    throw error
-  }
-}
-
-// ── Rule matching ────────────────────────────────────────────────────────────
-// Ported from @pushary/contracts (agent-hooks 0.56.0). This file cannot take a
-// dependency — a Cursor plugin is cloned, not installed — so the logic is
-// vendored. Keep it in step with packages/contracts/src/index.ts; the cases in
-// scripts/pushary-gate.test.mjs mirror the ones in policy.test.ts.
+// ── The verdict ─────────────────────────────────────────────────────────────
+// Asked for, not worked out here.
 //
-// Previously this matched on tool NAME alone, which meant every argument rule was
-// invisible here: a user's own `Bash(rm:*)` deny did nothing and `rm -rf` was
-// auto-approved by a broad `Bash` allow. Cursor was strictly less safe than
-// Claude Code for the same policy.
-
-const MATCH_RANKS = ['none', 'tool', 'prefix', 'exact']
-const matchRankWeight = (rank) => MATCH_RANKS.indexOf(rank)
-
-const GLOB_MAX_WILDCARDS = 8
-const GLOB_MAX_ARG_LENGTH = 4096
-
-// Offset propagation rather than a compiled regex: several `**` render as `.*`
-// and backtrack catastrophically on a long non-matching argument, which would
-// hang this gate and, with failClosed, block the command.
-const globMatches = (glob, text) => {
-  let stars = 0
-  for (const ch of glob) if (ch === '*') stars += 1
-  if (stars > GLOB_MAX_WILDCARDS) return false
-
-  const tokens = []
-  let literal = ''
-  const flush = () => { if (literal) { tokens.push({ literal }); literal = '' } }
-  for (let i = 0; i < glob.length; i += 1) {
-    if (glob[i] !== '*') { literal += glob[i]; continue }
-    flush()
-    if (glob[i + 1] === '*') { tokens.push({ any: true }); i += 1 } else { tokens.push({ any: false }) }
-  }
-  flush()
-
-  const n = text.length
-  let reach = new Uint8Array(n + 1)
-  reach[0] = 1
-  for (const token of tokens) {
-    const next = new Uint8Array(n + 1)
-    if (token.literal !== undefined) {
-      for (let p = 0; p <= n - token.literal.length; p += 1) {
-        if (reach[p] && text.startsWith(token.literal, p)) next[p + token.literal.length] = 1
-      }
-    } else {
-      let open = 0
-      for (let p = 0; p <= n; p += 1) {
-        if (!token.any && p > 0 && text.charCodeAt(p - 1) === 47) open = 0
-        if (reach[p]) open = 1
-        if (open) next[p] = 1
-      }
-    }
-    reach = next
-  }
-  return reach[n] === 1
-}
-
-const matchToolPattern = (pattern, toolName, arg) => {
-  const open = pattern.indexOf('(')
-  if (open === -1 || !pattern.endsWith(')')) return pattern === toolName ? 'tool' : 'none'
-  if (pattern.slice(0, open) !== toolName || arg === undefined) return 'none'
-  const inner = pattern.slice(open + 1, -1)
-  if (inner.endsWith(':*')) return arg.startsWith(inner.slice(0, -2)) ? 'prefix' : 'none'
-  if (inner.includes('*')) {
-    if (arg.length > GLOB_MAX_ARG_LENGTH) return 'none'
-    return globMatches(inner, arg) ? 'prefix' : 'none'
-  }
-  return arg === inner ? 'exact' : 'none'
-}
-
-// A rule with no repoKey applies everywhere; a scoped one only in its own repo,
-// and never when the repo could not be established.
-const repoMatches = (ruleRepoKey, currentRepoKey) => !ruleRepoKey || ruleRepoKey === currentRepoKey
-
-// Rank first, then a repo-scoped rule over a workspace-wide one, then the longer
-// pattern — the same precedence the hook applies.
-const findBestMatch = (policies, toolName, arg, repoKey) => {
-  let best
-  let bestWeight = 0
-  let bestScoped = -1
-  let bestLength = -1
-  for (const candidate of policies) {
-    if (!repoMatches(candidate.repoKey, repoKey)) continue
-    const rank = matchToolPattern(candidate.tool, toolName, arg)
-    if (rank === 'none') continue
-    const weight = matchRankWeight(rank)
-    const scoped = candidate.repoKey ? 1 : 0
-    const length = rank === 'prefix' ? candidate.tool.length : -1
-    if (
-      weight > bestWeight ||
-      (weight === bestWeight && scoped > bestScoped) ||
-      (weight === bestWeight && scoped === bestScoped && length > bestLength)
-    ) {
-      best = { policy: candidate, rank }
-      bestWeight = weight
-      bestScoped = scoped
-      bestLength = length
-    }
-  }
-  return best
-}
-
-// The destructive ceiling. A call the classifier flags must never auto-approve
-// through a general bare-tool or wildcard rule, so the "destructive always asks"
-// guarantee holds for wrapped or unlisted commands too. An explicit rule the user
-// wrote still wins. Mirrors APPROVAL_FATIGUE_FLAG_PATTERNS in contracts.
-const DESTRUCTIVE_PATTERNS = [
-  /\brm\s+-[a-z]*r/i,
-  /\brmdir\b/i,
-  /git\s+push[^\n]*(--force|--force-with-lease|\s-f\b)/i,
-  /git\s+reset\s+--hard/i,
-  /git\s+clean\s+-[a-z]*f/i,
-  /\bdrop\s+(table|database|schema)\b/i,
-  /\bdelete\s+from\b/i,
-  /\btruncate\b/i,
-  /\b(deploy|publish|release)\b/i,
-  /\bnpm\s+publish\b/i,
-  /\bsudo\b/i,
-  /chmod\s+-?R?\s*777/i,
-  /\bkubectl\s+delete\b/i,
-  /\bterraform\s+(apply|destroy)\b/i,
-  /\bdocker\s+system\s+prune\b/i,
-]
-
-const isDestructive = (command) => DESTRUCTIVE_PATTERNS.some((re) => re.test(command))
-
-// The safe-read-only floor is deliberately NOT ported. It only ever loosens a
-// decision, and hooks.json already routes just the risky commands here, so
-// omitting it can cost an extra prompt but can never approve something unsafe.
-
-const resolvePolicy = (config, toolName, modeOverride, command, repoKey) => {
-  const match = findBestMatch(config.policies, toolName, command, repoKey)
-  let base =
-    match?.policy ??
-    config.policies.find((p) => p.tool === '*') ??
-    {
-      tool: toolName,
-      timeoutSeconds: config.defaultTimeoutSeconds,
-      timeoutAction: config.defaultTimeoutAction,
-      mode: config.defaultMode ?? 'push_first',
-      pushFirstSeconds: config.defaultPushFirstSeconds ?? 20,
-    }
-
-  const governedBySpecificRule = match?.rank === 'exact' || match?.rank === 'prefix'
-  const wouldAutoApprove = base.timeoutSeconds === 0 && base.timeoutAction === 'approve'
-  if (!governedBySpecificRule && wouldAutoApprove && typeof command === 'string' && isDestructive(command)) {
-    base = {
-      tool: base.tool,
-      timeoutSeconds: config.defaultTimeoutSeconds,
-      timeoutAction: 'wait',
-      mode: 'push_first',
-      pushFirstSeconds: config.defaultPushFirstSeconds ?? 20,
-    }
-  }
-
-  const effective = modeOverride ?? config.modeOverride
-  return effective ? { ...base, mode: effective } : base
-}
-
-const APPROVAL_MODES = ['push_only', 'terminal_only', 'push_first', 'notify_only']
-const fetchModeState = async (apiKey, sessionId) => {
+// This file used to carry its own copy of the authorization boundary: pattern
+// matching, glob compilation, a destructive-command list and policy resolution,
+// roughly two hundred and fifty lines of it. A copy of a rule is a rule that
+// drifts, and this one had already drifted twice. It matched on tool name alone
+// once, so a user's own `Bash(rm:*)` deny did nothing while a broad `Bash` allow
+// approved `rm -rf`. And it never gained `isSafeReadOnlyCommand`, so `git status`
+// reached the phone here and nowhere else.
+//
+// The server now answers with the same `resolveGate` the CLI runs, over the same
+// state, so there is one boundary and this asks it. What stays local is only
+// what a server cannot know: the repository this checkout is in, which needs a
+// parent walk and a git config read on this machine.
+
+const GATE_TIMEOUT_MS = 5000
+
+/**
+ * The verdict for one command, or null if we could not get one.
+ *
+ * Null is not a denial and not an approval: every failure here hands the call
+ * back to Cursor's own prompt, exactly as if this gate were not installed.
+ */
+const decide = async (apiKey, command, cwd, sessionId) => {
   try {
-    const path = sessionId ? `/api/mcp/mode?session=${encodeURIComponent(sessionId)}` : '/api/mcp/mode'
-    const data = await getJson(path, apiKey, MODE_TIMEOUT_MS)
-    const mode = data?.override?.mode
-    return { mode: APPROVAL_MODES.includes(mode) ? mode : null, kill: data?.kill === true }
+    const response = await fetch(`${BASE_URL}/api/agent/gate`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify({
+        v: 1,
+        source: 'cursor',
+        toolName: 'Bash',
+        toolInputs: [{ command }],
+        cwd,
+        repoKey: deriveRepoKey(cwd),
+        sessionId,
+      }),
+      signal: AbortSignal.timeout(GATE_TIMEOUT_MS),
+    })
+    if (!response.ok) return null
+    const verdict = await response.json()
+    return verdict && typeof verdict.kind === 'string' ? verdict : null
   } catch {
-    return { mode: null, kill: false }
+    return null
   }
 }
 
@@ -624,12 +451,17 @@ const main = async () => {
   const ident = { agentName: `Cursor - ${project}`, sessionId, machineId: getMachineId() }
 
   try {
-    const [policy, modeState] = await Promise.all([getPolicy(apiKey), fetchModeState(apiKey, sessionId)])
+    const verdict = await decide(apiKey, command, input.cwd, sessionId)
 
-    if (modeState.kill) return respond(deny('Stopped by user — this agent was halted from Pushary. Do not run this command.'))
+    // No verdict, or one that says nothing: Cursor's own prompt decides, exactly
+    // as if this gate were not installed. Never a forced denial on an outage.
+    if (!verdict || verdict.kind === 'no_opinion') return respond(ask())
+    if (verdict.kind === 'kill') return respond(deny(verdict.reason))
+    if (verdict.kind === 'allow') return respond(ALLOW)
+    if (verdict.kind === 'deny') return respond(deny(verdict.reason))
+    if (verdict.kind !== 'ask') return respond(ask())
 
-    const tool = resolvePolicy(policy, 'Bash', modeState.mode, command, deriveRepoKey(input.cwd))
-    if (tool.timeoutSeconds === 0 && tool.timeoutAction === 'approve') return respond(ALLOW)
+    const tool = verdict.policy
 
     switch (tool.mode) {
       case 'terminal_only':
@@ -650,7 +482,7 @@ const main = async () => {
 
 // Exported for scripts/pushary-gate.test.mjs. main() only runs when the gate is
 // executed directly, so importing this file for a test does not read stdin.
-export { matchToolPattern, resolvePolicy, isDestructive, normalizeRepoRemote, deriveRepoKey }
+export { normalizeRepoRemote, deriveRepoKey }
 
 const isDirectRun = process.argv[1] && import.meta.url === `file://${process.argv[1]}`
 if (!isDirectRun) {

package/data/cursor-plugin/scripts/pushary-gate.test.mjs

@@ -1,115 +1,20 @@
-// Parity tests for the vendored policy logic in pushary-gate.mjs.
+// What is left to test in the gate itself.
 //
-// The gate cannot depend on @pushary/contracts — a Cursor plugin is cloned, not
-// installed — so the matcher is vendored. These cases mirror policy.test.ts in
-// the Pushary monorepo. If they drift, Cursor silently resolves a different
-// policy from every other agent, which is the bug this file exists to prevent.
+// This file used to cover the vendored policy engine: pattern matching, argument
+// rules, the destructive ceiling and repo scoping. None of that lives here any
+// more. The gate asks POST /api/agent/gate, which runs the same `resolveGate` as
+// every other client, and those behaviours are tested once against the engine in
+// packages/contracts/src/gate.test.ts rather than once per copy.
+//
+// What remains is the one thing a server cannot answer: which repository this
+// checkout is in. Deriving it means walking parent directories for a `.git` and
+// reading its config, so the gate still does it and sends the result.
 //
 // Run: node --test scripts/pushary-gate.test.mjs
 
 import assert from 'node:assert/strict'
 import { describe, it } from 'node:test'
-import { matchToolPattern, resolvePolicy, isDestructive, normalizeRepoRemote } from './pushary-gate.mjs'
-
-const base = {
-  defaultTimeoutSeconds: 60,
-  defaultTimeoutAction: 'escalate',
-  defaultMode: 'push_first',
-  defaultPushFirstSeconds: 20,
-}
-const cfg = (...policies) => ({ ...base, policies })
-const allow = { timeoutSeconds: 0, timeoutAction: 'approve', mode: 'terminal_only', pushFirstSeconds: 0 }
-const denyRule = { timeoutSeconds: 0, timeoutAction: 'deny', mode: 'push_only', pushFirstSeconds: 0 }
-const autoApproves = (p) => p.timeoutSeconds === 0 && p.timeoutAction === 'approve'
-
-describe('matchToolPattern', () => {
-  it('matches bare, exact and prefix forms', () => {
-    assert.equal(matchToolPattern('Bash', 'Bash', 'npm test'), 'tool')
-    assert.equal(matchToolPattern('Bash(git status)', 'Bash', 'git status'), 'exact')
-    assert.equal(matchToolPattern('Bash(npm test:*)', 'Bash', 'npm test -- --watch'), 'prefix')
-    assert.equal(matchToolPattern('Bash(npm test:*)', 'Bash', 'npm install'), 'none')
-  })
-
-  it('checks :* before globs so destructive prefixes keep their meaning', () => {
-    assert.equal(matchToolPattern('Bash(rm -rf:*)', 'Bash', 'rm -rf /tmp/x'), 'prefix')
-  })
-
-  it('supports globs', () => {
-    assert.equal(matchToolPattern('Bash(deploy *)', 'Bash', 'deploy staging'), 'prefix')
-    assert.equal(matchToolPattern('Bash(deploy *)', 'Bash', 'deploy'), 'none')
-  })
-
-  it('does not backtrack on adversarial star patterns', () => {
-    const started = Date.now()
-    assert.equal(matchToolPattern(`Bash(${'*'.repeat(8)}x)`, 'Bash', 'a'.repeat(4000)), 'none')
-    assert.ok(Date.now() - started < 1000, 'must not backtrack')
-  })
-})
-
-describe('argument rules, which the gate previously ignored entirely', () => {
-  it("honours a user's explicit deny under a broad allow", () => {
-    const config = cfg({ tool: 'Bash', ...allow }, { tool: 'Bash(rm:*)', ...denyRule })
-    const resolved = resolvePolicy(config, 'Bash', null, 'rm -rf /important', undefined)
-    assert.equal(resolved.timeoutAction, 'deny')
-    assert.equal(autoApproves(resolved), false)
-  })
-
-  it('honours the preset always-ask rule for force pushes', () => {
-    const config = cfg({ tool: 'Bash', ...allow }, { tool: 'Bash(git push:*)', timeoutSeconds: 60, timeoutAction: 'wait', mode: 'push_first', pushFirstSeconds: 20 })
-    assert.equal(resolvePolicy(config, 'Bash', null, 'git push --force origin main', undefined).timeoutAction, 'wait')
-  })
-
-  it('prefers an exact rule over a matching prefix rule', () => {
-    const config = cfg({ tool: 'Bash(git:*)', ...denyRule }, { tool: 'Bash(git status)', ...allow })
-    assert.equal(autoApproves(resolvePolicy(config, 'Bash', null, 'git status', undefined)), true)
-  })
-})
-
-describe('destructive ceiling', () => {
-  it('refuses to auto-approve a destructive command through a bare-tool allow', () => {
-    const resolved = resolvePolicy(cfg({ tool: 'Bash', ...allow }), 'Bash', null, 'rm -rf /important', undefined)
-    assert.equal(autoApproves(resolved), false)
-    assert.equal(resolved.timeoutAction, 'wait')
-  })
-
-  it('refuses through a wildcard allow too', () => {
-    assert.equal(autoApproves(resolvePolicy(cfg({ tool: '*', ...allow }), 'Bash', null, 'git push --force origin main', undefined)), false)
-  })
-
-  it('still lets an explicit rule the user wrote win', () => {
-    const config = cfg({ tool: 'Bash', ...allow }, { tool: 'Bash(rm -rf:*)', ...allow })
-    assert.equal(autoApproves(resolvePolicy(config, 'Bash', null, 'rm -rf /tmp/x', undefined)), true)
-  })
-
-  it('leaves ordinary commands alone', () => {
-    assert.equal(autoApproves(resolvePolicy(cfg({ tool: 'Bash', ...allow }), 'Bash', null, 'npm test', undefined)), true)
-  })
-
-  it('flags the classifier set', () => {
-    for (const c of ['rm -rf /', 'sudo reboot', 'git reset --hard', 'terraform destroy', 'npm publish', 'DROP TABLE users']) {
-      assert.equal(isDestructive(c), true, c)
-    }
-    assert.equal(isDestructive('npm test'), false)
-  })
-})
-
-describe('repo scoping', () => {
-  const scoped = { tool: 'Bash', repoKey: 'github.com/acme/api', ...denyRule }
-
-  it('applies a scoped rule only in its own repository', () => {
-    assert.equal(resolvePolicy(cfg(scoped), 'Bash', null, 'npm test', 'github.com/acme/api').timeoutAction, 'deny')
-    assert.notEqual(resolvePolicy(cfg(scoped), 'Bash', null, 'npm test', 'github.com/acme/web').timeoutAction, 'deny')
-  })
-
-  it('never applies a scoped rule when the repository is unknown', () => {
-    assert.notEqual(resolvePolicy(cfg(scoped), 'Bash', null, 'npm test', undefined).timeoutAction, 'deny')
-  })
-
-  it('prefers the scoped rule at equal rank', () => {
-    const config = cfg({ tool: 'Bash', ...allow }, scoped)
-    assert.equal(resolvePolicy(config, 'Bash', null, 'npm test', 'github.com/acme/api').timeoutAction, 'deny')
-  })
-})
+import { normalizeRepoRemote } from './pushary-gate.mjs'
 
 describe('repo identity', () => {
   it('collapses the forms of one remote', () => {

package/data/vscode-plugin/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 0.2.0
+
+The gate stopped carrying its own copy of the policy engine, and two defects went
+with it.
+
+It matched rules on tool NAME alone, so every argument rule was invisible: a
+`Bash(rm:*)` deny you had written did nothing here, and `rm -rf` was auto-approved
+by a broad `Bash` allow. The same bug was found and fixed in the Cursor gate in
+its 0.1.1; this copy still had it. It also had no safe read-only allowlist, so
+`git status` reached your phone.
+
+Its mode fetch read an unreachable server as "not halted", which is not the same
+thing as "we could not ask". A remote stop that could not be fetched looked like
+a clean bill of health.
+
+The gate now asks the server, which runs the same engine as every other client
+over the same state, and which distinguishes state it could not establish from
+state that says no.
+
+- Argument rules apply, with the same precedence every other agent uses.
+- The destructive ceiling applies: a command the classifier flags can no longer
+  be auto-approved through a broad rule.
+- A policy change takes effect immediately; the on-disk policy cache is gone.
+- An unreachable Pushary hands the command to VS Code's own prompt. Nothing is
+  ever denied because we could not reach the server.
+
 ## 0.1.0
 
 First release.