@pushary/agent-hooks 0.85.0 → 0.85.1

package/dist/{chunk-EXMUM226.js → chunk-Y7BALRVB.js}

@@ -10,7 +10,7 @@ import {
 } from "./chunk-SAF6HGAA.js";
 import {
   reportedInstallSource
-} from "./chunk-437T77TY.js";
+} from "./chunk-ES3FAX5X.js";
 import {
   getApiKey,
   getBaseUrl
@@ -18,19 +18,15 @@ import {
 import {
   ACTION_BODY_MAX,
   DECISION_LINE_MAX,
-  classifyDecisionRisk,
-  isApprovalMode,
   isAutoApprove,
-  isAutoDeny,
-  isSafeReadOnlyCommand,
-  isScopeContract,
   localRepoKey,
+  modeStateFromResponse,
   normalizeRepoRemote,
-  policyArgForms,
   redactSecrets,
   redactSecretsDeep,
-  selectGoverningRule
-} from "./chunk-MQMPG5X4.js";
+  resolveAutoResolveOrigin,
+  resolvePolicy
+} from "./chunk-G3LXA2ZP.js";
 
 // src/policy.ts
 import { createHash } from "crypto";
@@ -120,66 +116,6 @@ var getPolicy = async (apiKey, expectedVersion, agent, repoAware = false, sessio
     throw new Error("Failed to fetch policy and no cached policy available");
   }
 };
-var autoApprove = (tool) => ({
-  tool,
-  timeoutSeconds: 0,
-  timeoutAction: "approve",
-  mode: "terminal_only",
-  pushFirstSeconds: 0
-});
-var resolveAutoResolveOrigin = (config, toolName, toolInput, cwd, repoKey, sessionId) => {
-  const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
-  const arg = args[0];
-  const match = selectGoverningRule(config.policies, toolName, args, repoKey, sessionId);
-  const governedBySpecificRule = match?.rank === "exact" || match?.rank === "prefix";
-  if (!governedBySpecificRule && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg)) {
-    return "safe_readonly";
-  }
-  return "policy_timeout";
-};
-var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
-  const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
-  const arg = args[0];
-  const match = selectGoverningRule(config.policies, toolName, args, repoKey, sessionId);
-  let base = match?.policy ?? config.policies.find((p) => p.tool === "*") ?? {
-    tool: toolName,
-    timeoutSeconds: config.defaultTimeoutSeconds,
-    timeoutAction: config.defaultTimeoutAction,
-    mode: config.defaultMode ?? "push_first",
-    pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
-  };
-  const governedBySpecificRule = match?.rank === "exact" || match?.rank === "prefix";
-  if (!governedBySpecificRule && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg)) {
-    base = autoApprove(base.tool);
-  }
-  const wouldAutoApprove = isAutoApprove(base);
-  if (!governedBySpecificRule && wouldAutoApprove && toolName === "Bash" && typeof arg === "string" && classifyDecisionRisk(toolName, arg) === "destructive") {
-    base = {
-      tool: base.tool,
-      timeoutSeconds: config.defaultTimeoutSeconds,
-      timeoutAction: "wait",
-      mode: "push_first",
-      pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
-    };
-  }
-  const effectiveOverride = modeOverride ?? config.modeOverride;
-  if (effectiveOverride) {
-    return { ...base, mode: effectiveOverride };
-  }
-  return base;
-};
-var restraintRank = (policy) => {
-  if (isAutoDeny(policy)) return 4;
-  if (isAutoApprove(policy)) return 0;
-  if (policy.mode === "push_only") return 3;
-  return policy.mode === "terminal_only" || policy.mode === "notify_only" ? 1 : 2;
-};
-var strictestPolicy = (a, b) => restraintRank(b) > restraintRank(a) ? b : a;
-var resolvePolicyAcross = (config, toolName, modeOverride, toolInputs, cwd, repoKey, sessionId) => {
-  if (toolInputs.length === 0) return resolvePolicy(config, toolName, modeOverride, void 0, cwd, repoKey, sessionId);
-  return toolInputs.map((input) => resolvePolicy(config, toolName, modeOverride, input, cwd, repoKey, sessionId)).reduce(strictestPolicy);
-};
-var isModeStateDegraded = (state) => state?.degraded === true;
 var MODE_GRACE_MS = 60 * 1e3;
 var modeStateCacheFile = (apiKey) => {
   const hash = createHash("sha256").update(`mode:${apiKey}`).digest("hex").slice(0, 12);
@@ -220,7 +156,6 @@ var degradedFallback = (apiKey, authoritative = false) => {
   }
   return unknownMode();
 };
-var toPolicyVersion = (value) => typeof value === "string" || typeof value === "number" ? String(value) : null;
 var MODE_REUSE_MS = CACHE_TTL_MS;
 var readReusableMode = (apiKey, sessionId, maxAgeMs) => {
   const last = readLastGoodMode(apiKey);
@@ -243,19 +178,7 @@ var fetchModeState = async (apiKey, sessionId, reuseWithinMs = 0) => {
     if (!response.ok) {
       return degradedFallback(apiKey, response.status === 401 || response.status === 403);
     }
-    const data = await response.json();
-    const mode = data.override?.mode;
-    const state = {
-      mode: isApprovalMode(mode) ? mode : null,
-      kill: data.kill === true,
-      policyVersion: toPolicyVersion(data.policyVersion),
-      relayUrl: typeof data.relayUrl === "string" && data.relayUrl.length > 0 ? data.relayUrl : null,
-      trainingConsent: data.trainingConsent === true,
-      // Validated rather than cast: a malformed contract must read as no contract,
-      // never as one that silently matches nothing.
-      scope: isScopeContract(data.scope) ? data.scope : null,
-      degraded: false
-    };
+    const state = modeStateFromResponse(await response.json());
     writeLastGoodMode(apiKey, state, sessionId);
     return state;
   } catch {
@@ -265,9 +188,11 @@ var fetchModeState = async (apiKey, sessionId, reuseWithinMs = 0) => {
 var fetchModeOverride = async (apiKey) => (await fetchModeState(apiKey)).mode;
 
 // src/api.ts
+import { randomUUID } from "crypto";
 installProxyDispatcher();
 var askUser = async (apiKey, params, timeoutMs = 15e3) => {
-  const result = await callMcpTool(apiKey, "ask_user", { ...params, wait: false }, { maxRetries: 3, timeoutMs });
+  const identified = params.toolUseId || params.requestId ? params : { ...params, requestId: randomUUID() };
+  const result = await callMcpTool(apiKey, "ask_user", { ...identified, wait: false }, { maxRetries: 3, timeoutMs });
   if (!isAskUserResponse(result)) throw new Error("Invalid ask_user response");
   return result;
 };
@@ -286,7 +211,7 @@ var sendNotification = async (apiKey, params, timeoutMs = 15e3) => {
   await callMcpTool(apiKey, "send_notification", { ...params }, { maxRetries: 3, timeoutMs });
 };
 
-// src/describe.ts
+// ../hook-mapping/src/describe.ts
 import { isAbsolute, relative } from "path";
 var hookPrefixes = {
   Bash: (input) => `bash: ${input.command ?? "(no command)"}`,
@@ -455,6 +380,36 @@ var deriveBlocker = (mode, reason) => {
   return text.slice(0, DECISION_LINE_MAX);
 };
 
+// ../hook-mapping/src/map.ts
+import { basename } from "path";
+var TASK_TITLE_MAX_LENGTH = 120;
+var STOP_SUMMARY_MAX_LENGTH = 200;
+var SESSION_END_ACTIONS = {
+  clear: "Session cleared",
+  logout: "Logged out",
+  resume: "Session suspended",
+  prompt_input_exit: "Session ended",
+  bypass_permissions_disabled: "Session ended",
+  other: "Session ended"
+};
+var countArray = (value) => Array.isArray(value) ? value.length : 0;
+var summarizeFinalMessage = (message) => {
+  if (typeof message !== "string") return "Session ended";
+  const collapsed = message.replace(/\s+/g, " ").trim();
+  if (!collapsed) return "Session ended";
+  return collapsed.slice(0, STOP_SUMMARY_MAX_LENGTH);
+};
+var summarizeStop = (input) => {
+  const running = countArray(input.background_tasks);
+  if (running > 0) return `Paused with ${running} background task${running === 1 ? "" : "s"} still running`;
+  const crons = countArray(input.session_crons);
+  if (crons > 0) return `Idle until a scheduled task wakes it (${crons} pending)`;
+  return summarizeFinalMessage(input.last_assistant_message);
+};
+var sessionStartAction = (source) => source === "resume" ? "Session resumed" : "Session started";
+var sessionEndAction = (reason) => typeof reason === "string" && SESSION_END_ACTIONS[reason] || "Session ended";
+var taskTitleFrom = (prompt) => typeof prompt === "string" ? prompt.replace(/\s+/g, " ").trim().slice(0, TASK_TITLE_MAX_LENGTH) || void 0 : void 0;
+
 // src/pending.ts
 import { join as join2 } from "path";
 import { tmpdir as tmpdir2 } from "os";
@@ -503,7 +458,7 @@ var removePendingSession = (sessionId) => {
 
 // src/repo.ts
 import { existsSync as existsSync3, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
-import { basename, dirname, isAbsolute as isAbsolute2, join as join3, resolve } from "path";
+import { basename as basename2, dirname, isAbsolute as isAbsolute2, join as join3, resolve } from "path";
 var MAX_PARENT_WALK = 64;
 var GIT_FILE_PREFIX = "gitdir:";
 var findGitDir = (startDir) => {
@@ -562,9 +517,9 @@ var deriveRepoKey = (cwd) => {
       const normalized = remote ? normalizeRepoRemote(remote) : void 0;
       if (normalized) return normalized;
       const root = gitDir.endsWith(".git") ? dirname(gitDir) : dir;
-      return localRepoKey(basename(root));
+      return localRepoKey(basename2(root));
     }
-    return localRepoKey(basename(resolve(dir)));
+    return localRepoKey(basename2(resolve(dir)));
   } catch {
     return void 0;
   }
@@ -869,7 +824,7 @@ var throttlePass = (key, windowMs) => {
 };
 
 // src/events.ts
-import { basename as basename2, join as join6 } from "path";
+import { basename as basename3, join as join6 } from "path";
 import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync4, statSync as statSync5, writeFileSync as writeFileSync5 } from "fs";
 import { tmpdir as tmpdir5 } from "os";
 var INTENT_DIR = join6(tmpdir5(), "pushary-intent");
@@ -1058,7 +1013,7 @@ var reportEvent = async (event, options = {}) => {
 var NON_GATED_MIRROR_TOOLS = /* @__PURE__ */ new Set(["TodoWrite"]);
 var handlePostToolUse = async (input, agent = CLAUDE_CODE_AGENT) => {
   try {
-    const projectName = basename2(input.cwd ?? process.cwd());
+    const projectName = basename3(input.cwd ?? process.cwd());
     const action = describeToolCall(input.tool_name, input.tool_input, "event");
     const lookup = toPolicyLookup(input.tool_name, input.tool_input);
     const toolResult = input.tool_response ?? input.tool_result;
@@ -1110,13 +1065,12 @@ var handlePostToolUse = async (input, agent = CLAUDE_CODE_AGENT) => {
     return void 0;
   }
 };
-var TASK_TITLE_MAX_LENGTH = 120;
 var handleUserPrompt = async (input, agent = CLAUDE_CODE_AGENT) => {
   try {
-    const projectName = basename2(input.cwd ?? process.cwd());
+    const projectName = basename3(input.cwd ?? process.cwd());
     const sessionKey = input.session_id || DEFAULT_SESSION;
     const titlesEnabled = process.env.PUSHARY_TASK_TITLES !== "off";
-    const taskTitle = titlesEnabled ? input.prompt?.replace(/\s+/g, " ").trim().slice(0, TASK_TITLE_MAX_LENGTH) || void 0 : void 0;
+    const taskTitle = titlesEnabled ? taskTitleFrom(input.prompt) : void 0;
     if (input.prompt) saveLastPrompt(sessionKey, input.prompt);
     const late = await reconcilePendingQuestions(sessionKey);
     let additionalContext;
@@ -1141,24 +1095,9 @@ var handleUserPrompt = async (input, agent = CLAUDE_CODE_AGENT) => {
     return void 0;
   }
 };
-var STOP_SUMMARY_MAX_LENGTH = 200;
-var summarizeFinalMessage = (message) => {
-  if (typeof message !== "string") return "Session ended";
-  const collapsed = message.replace(/\s+/g, " ").trim();
-  if (!collapsed) return "Session ended";
-  return collapsed.slice(0, STOP_SUMMARY_MAX_LENGTH);
-};
-var countArray = (value) => Array.isArray(value) ? value.length : 0;
-var summarizeStop = (input) => {
-  const running = countArray(input.background_tasks);
-  if (running > 0) return `Paused with ${running} background task${running === 1 ? "" : "s"} still running`;
-  const crons = countArray(input.session_crons);
-  if (crons > 0) return `Idle until a scheduled task wakes it (${crons} pending)`;
-  return summarizeFinalMessage(input.last_assistant_message);
-};
 var handleStop = async (input, agent = CLAUDE_CODE_AGENT) => {
   try {
-    const projectName = basename2(input.cwd ?? process.cwd());
+    const projectName = basename3(input.cwd ?? process.cwd());
     const sessionKey = input.session_id || DEFAULT_SESSION;
     const late = await reconcilePendingQuestions(sessionKey);
     const tasks = [
@@ -1194,8 +1133,8 @@ var handleStop = async (input, agent = CLAUDE_CODE_AGENT) => {
 };
 var handleSessionStart = async (input, agent = CLAUDE_CODE_AGENT) => {
   try {
-    const projectName = basename2(input.cwd ?? process.cwd());
-    const action = input.source === "resume" ? "Session resumed" : "Session started";
+    const projectName = basename3(input.cwd ?? process.cwd());
+    const action = sessionStartAction(input.source);
     await reportEvent({
       event: "session_start",
       agentType: agent.type,
@@ -1206,18 +1145,10 @@ var handleSessionStart = async (input, agent = CLAUDE_CODE_AGENT) => {
   } catch {
   }
 };
-var SESSION_END_ACTIONS = {
-  clear: "Session cleared",
-  logout: "Logged out",
-  resume: "Session suspended",
-  prompt_input_exit: "Session ended",
-  bypass_permissions_disabled: "Session ended",
-  other: "Session ended"
-};
 var handleSessionEnd = async (input, agent = CLAUDE_CODE_AGENT) => {
   try {
-    const projectName = basename2(input.cwd ?? process.cwd());
-    const action = typeof input.reason === "string" && SESSION_END_ACTIONS[input.reason] || "Session ended";
+    const projectName = basename3(input.cwd ?? process.cwd());
+    const action = sessionEndAction(input.reason);
     const sessionKey = input.session_id || DEFAULT_SESSION;
     const late = await reconcilePendingQuestions(sessionKey);
     if (late.length > 0) {
@@ -1240,7 +1171,7 @@ var NOTIFICATION_PUSH_TYPES = /* @__PURE__ */ new Set(["idle_prompt", "agent_nee
 var NOTIFICATION_THROTTLE_MS = 60 * 1e3;
 var handleNotification = async (input, agent = CLAUDE_CODE_AGENT) => {
   try {
-    const projectName = basename2(input.cwd ?? process.cwd());
+    const projectName = basename3(input.cwd ?? process.cwd());
     const notifType = input.notification_type ?? input.type ?? "";
     const sessionKey = input.session_id || DEFAULT_SESSION;
     if (NOTIFICATION_PUSH_TYPES.has(notifType)) {
@@ -1313,7 +1244,7 @@ var handleStopFailure = async (input, agent = CLAUDE_CODE_AGENT) => {
     } catch {
       return;
     }
-    const projectName = basename2(input.cwd ?? process.cwd());
+    const projectName = basename3(input.cwd ?? process.cwd());
     const mode = await fetchModeState(apiKey, input.session_id, MODE_REUSE_MS).catch(() => null);
     if (mode?.kill || mode?.mode === "terminal_only") return;
     const reason = describeStopFailure(input.error);
@@ -1332,10 +1263,6 @@ var handleStopFailure = async (input, agent = CLAUDE_CODE_AGENT) => {
 export {
   policyRequestFor,
   getPolicy,
-  resolveAutoResolveOrigin,
-  resolvePolicy,
-  resolvePolicyAcross,
-  isModeStateDegraded,
   fetchModeState,
   fetchModeOverride,
   askUser,

package/dist/chunk-YHG74UFF.js

@@ -0,0 +1,12 @@
+// src/answer.ts
+var denyReasonFrom = (value, note) => {
+  const trimmed = note?.trim();
+  if (trimmed) return `Denied from your phone: ${trimmed}`;
+  return value && value !== "no" && value !== "yes" ? `Denied from your phone: ${value}` : "Denied via push notification";
+};
+var isDeferAnswer = (value) => value === "defer";
+
+export {
+  denyReasonFrom,
+  isDeferAnswer
+};

package/dist/src/index.d.ts

@@ -1,5 +1,6 @@
-import { PolicyConfig, ApprovalMode, ToolPolicy, ScopeContract, AgentQuestion } from '@pushary/contracts';
-export { ApprovalMode, PolicyConfig, ToolPolicy } from '@pushary/contracts';
+import { ReceiptMeta } from '@pushary/hook-mapping';
+import { PolicyConfig, ApprovalMode, ModeState, AutoResolveOrigin, AgentQuestion } from '@pushary/contracts';
+export { ApprovalMode, ModeState, PolicyConfig, ToolPolicy, resolvePolicy } from '@pushary/contracts';
 
 interface ToolInput {
     tool_name: string;
@@ -20,25 +21,8 @@ interface HookOutput {
 }
 declare const handlePreToolUse: (input: ToolInput) => Promise<HookOutput | undefined>;
 
-type ReceiptKind = 'edit' | 'write' | 'bash' | 'commit';
-interface ReceiptMeta {
-    kind: ReceiptKind;
-    target: string;
-    ok: boolean;
-}
-
 declare const getPolicy: (apiKey: string, expectedVersion?: string | null, agent?: string, repoAware?: boolean, sessionId?: string) => Promise<PolicyConfig>;
-type AutoResolveOrigin = 'safe_readonly' | 'policy_timeout';
-declare const resolvePolicy: (config: PolicyConfig, toolName: string, modeOverride?: ApprovalMode | null, toolInput?: Record<string, unknown>, cwd?: string, repoKey?: string, sessionId?: string) => ToolPolicy;
-interface ModeState {
-    readonly mode: ApprovalMode | null;
-    readonly kill: boolean;
-    readonly policyVersion: string | null;
-    readonly relayUrl: string | null;
-    readonly trainingConsent?: boolean;
-    readonly scope?: ScopeContract | null;
-    readonly degraded?: boolean;
-}
+
 declare const fetchModeState: (apiKey: string, sessionId?: string, reuseWithinMs?: number) => Promise<ModeState>;
 declare const fetchModeOverride: (apiKey: string) => Promise<ApprovalMode | null>;
 
@@ -142,6 +126,7 @@ interface AskUserParams {
     actionBody?: string;
     scopePath?: string;
     toolUseId?: string;
+    requestId?: string;
 }
 interface AskUserResponse {
     correlationId: string;
@@ -166,4 +151,4 @@ declare const cancelQuestion: (apiKey: string, correlationId: string) => Promise
 declare const getApiKey: () => string;
 declare const getBaseUrl: () => string;
 
-export { type ModeState, askUser, cancelQuestion, fetchModeOverride, fetchModeState, getApiKey, getBaseUrl, getPolicy, handleNotification, handlePostToolUse, handlePreToolUse, handleStop, reportEvent, resolvePolicy, waitForAnswer };
+export { askUser, cancelQuestion, fetchModeOverride, fetchModeState, getApiKey, getBaseUrl, getPolicy, handleNotification, handlePostToolUse, handlePreToolUse, handleStop, reportEvent, waitForAnswer };

package/dist/src/index.js

@@ -1,11 +1,11 @@
 import {
   handlePreToolUse
-} from "../chunk-GFM3STWO.js";
-import "../chunk-64PXDATC.js";
-import "../chunk-PWTKKQQI.js";
+} from "../chunk-LB6RSCLL.js";
+import "../chunk-GM54KC62.js";
+import "../chunk-HSGEEBBL.js";
 import "../chunk-VT4IVERX.js";
-import "../chunk-NJ7JT26G.js";
-import "../chunk-GXIFADGD.js";
+import "../chunk-VGADRFG6.js";
+import "../chunk-YHG74UFF.js";
 import {
   askUser,
   cancelQuestion,
@@ -16,20 +16,21 @@ import {
   handlePostToolUse,
   handleStop,
   reportEvent,
-  resolvePolicy,
   waitForAnswer
-} from "../chunk-EXMUM226.js";
+} from "../chunk-Y7BALRVB.js";
 import "../chunk-RN3NOEJF.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
-import "../chunk-437T77TY.js";
+import "../chunk-ES3FAX5X.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
 import {
   getApiKey,
   getBaseUrl
 } from "../chunk-2UMNXADU.js";
-import "../chunk-MQMPG5X4.js";
+import {
+  resolvePolicy
+} from "../chunk-G3LXA2ZP.js";
 export {
   askUser,
   cancelQuestion,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.85.0",
+  "version": "0.85.1",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",
@@ -80,7 +80,8 @@
     "build": "node scripts/bundle-plugin.mjs && tsup",
     "dev": "tsup --watch",
     "test": "node ../../scripts/ci/run-tests.mjs src bin",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "gen:hooks-spec": "bun scripts/generate-hooks-spec.ts"
   },
   "dependencies": {
     "@inquirer/prompts": "^8.4.2",
@@ -91,6 +92,7 @@
   },
   "devDependencies": {
     "@pushary/contracts": "workspace:*",
+    "@pushary/hook-mapping": "workspace:*",
     "tsup": "^8.0.0",
     "typescript": "^5.0.0"
   }

package/dist/chunk-GXIFADGD.js

@@ -1,66 +0,0 @@
-import {
-  isModeStateDegraded,
-  resolveAutoResolveOrigin,
-  resolvePolicyAcross
-} from "./chunk-EXMUM226.js";
-import {
-  evaluateScope,
-  scopeChangeReason,
-  scopeRequiresHuman,
-  verdictForPolicy
-} from "./chunk-MQMPG5X4.js";
-
-// src/answer.ts
-var denyReasonFrom = (value, note) => {
-  const trimmed = note?.trim();
-  if (trimmed) return `Denied from your phone: ${trimmed}`;
-  return value && value !== "no" && value !== "yes" ? `Denied from your phone: ${value}` : "Denied via push notification";
-};
-var isDeferAnswer = (value) => value === "defer";
-
-// src/gate.ts
-var KILL_REASON = "Stopped by user, this agent was halted from Pushary";
-var strictestScopeVerdict = (scope, paths) => {
-  if (paths.length === 0) return evaluateScope(scope, void 0);
-  let worst = { outcome: "in_scope" };
-  for (const path of paths) {
-    const verdict = evaluateScope(scope, path);
-    if (verdict.outcome === "off_limits") return verdict;
-    if (verdict.outcome === "out_of_scope") worst = verdict;
-  }
-  return worst;
-};
-var survivesDegraded = (config, toolName, toolInputs, cwd, repoKey, sessionId) => toolInputs.length === 1 && resolveAutoResolveOrigin(config, toolName, toolInputs[0], cwd, repoKey, sessionId) === "safe_readonly";
-var resolveGate = (input) => {
-  const { modeState, config, toolName, toolInputs, cwd, repoKey, sessionId } = input;
-  if (modeState.kill) return { kind: "kill", reason: KILL_REASON };
-  const policy = resolvePolicyAcross(config, toolName, modeState.mode, toolInputs, cwd, repoKey, sessionId);
-  const verdict = verdictForPolicy(policy);
-  const autoApproves = verdict === "allow";
-  const autoDenies = verdict === "deny";
-  if (autoDenies) return { kind: "deny", policy, reason: `Denied by policy for ${policy.tool}` };
-  if (isModeStateDegraded(modeState)) {
-    if (autoApproves) {
-      return survivesDegraded(config, toolName, toolInputs, cwd, repoKey, sessionId) ? { kind: "allow", policy } : { kind: "defer", policy };
-    }
-    return { kind: "gate", policy };
-  }
-  const scopeVerdict = modeState.scope ? strictestScopeVerdict(modeState.scope, input.scopePaths ?? []) : { outcome: "no_contract" };
-  if (autoApproves) {
-    if (!scopeRequiresHuman(scopeVerdict)) return { kind: "allow", policy };
-  }
-  const scopeReason = scopeChangeReason(scopeVerdict);
-  return {
-    kind: "gate",
-    policy,
-    scopeReason,
-    scopePath: scopeReason && "path" in scopeVerdict ? scopeVerdict.path : void 0
-  };
-};
-
-export {
-  denyReasonFrom,
-  isDeferAnswer,
-  KILL_REASON,
-  resolveGate
-};

package/dist/chunk-PWTKKQQI.js

@@ -1,27 +0,0 @@
-import {
-  quoteIfNeeded
-} from "./chunk-VT4IVERX.js";
-
-// src/hook-command.ts
-var SHELL = "/bin/sh -c";
-var LOCATE = 'B=$(command -v "$0") || exit 0; [ -f "$B" ] || exit 0; [ -x "$B" ] || exit 0';
-var NODE_PRESENT = "command -v node >/dev/null 2>&1 || exit 0";
-var RESOLVE = {
-  native: `${LOCATE}; exec "$B"`,
-  node: `${LOCATE}; ${NODE_PRESENT}; exec "$B"`
-};
-var guardHookCommand = (target, platform = process.platform) => {
-  if (target.kind === "node") {
-    const script = quoteIfNeeded(target.script);
-    return platform === "win32" ? `node ${script}` : `${SHELL} '[ -f "$0" ] || exit 0; command -v node >/dev/null 2>&1 || exit 0; exec node "$0"' ${script}`;
-  }
-  const path = quoteIfNeeded(target.path);
-  return platform === "win32" ? path : `${SHELL} '${RESOLVE[target.runtime]}' ${path}`;
-};
-var guardBinary = (path, platform) => guardHookCommand({ kind: "binary", path, runtime: "node" }, platform);
-var guardNodeScript = (script, platform) => guardHookCommand({ kind: "node", script }, platform);
-
-export {
-  guardBinary,
-  guardNodeScript
-};