@pushary/agent-hooks 0.85.0 → 0.85.2

package/dist/{chunk-MQMPG5X4.js → chunk-K337LIBD.js}

@@ -65,6 +65,7 @@ var hookWaitDeadline = (startMs, policyWaitSeconds, agent, nowMs) => {
 };
 var hookWaitClamped = (startMs, policyWaitSeconds, agent, nowMs) => startMs + hookMaxWaitSeconds(agent) * 1e3 < nowMs + Math.max(policyWaitSeconds, 0) * 1e3;
 var effectiveWaitSeconds = (timeoutAction, policySeconds, agent) => timeoutAction === "wait" ? hookMaxWaitSeconds(agent) : policySeconds;
+var HOOK_BATCH_MAX_BYTES = 4 * 1024 * 1024;
 var REPO_KEY_MAX_LENGTH = 200;
 var isRepoKeyMatch = (ruleRepoKey, currentRepoKey) => {
   if (!ruleRepoKey) return true;
@@ -635,6 +636,88 @@ var SECRET_REDACTION_RULES = [
 var HIGH_ENTROPY_RULE = { pattern: /[A-Za-z0-9+/]{40,}={0,2}/g, replacement: "[redacted]" };
 var redactSecrets = (text) => SECRET_REDACTION_RULES.reduce((acc, rule) => acc.replace(rule.pattern, rule.replacement), text);
 var redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE.pattern, HIGH_ENTROPY_RULE.replacement);
+var AUTHORIZATION_CANONICAL_VERSION = "pushary.authz.v1";
+var AUTHORIZATION_CANONICAL_FIXTURE = [
+  {
+    subject: { toolName: "refund.create" },
+    canonical: `${AUTHORIZATION_CANONICAL_VERSION}
+action:13:refund.create
+target:0:
+actor:0:
+environment:0:
+externalId:0:`
+  },
+  {
+    subject: {
+      toolName: "refund.create",
+      toolTarget: "ord_991",
+      actor: "user:u_44",
+      environment: "production",
+      externalId: "cust_7",
+      parameters: { currency: "EUR", amount: 4800, expedited: true, rate: 1.5 }
+    },
+    canonical: `${AUTHORIZATION_CANONICAL_VERSION}
+action:13:refund.create
+target:7:ord_991
+actor:9:user:u_44
+environment:10:production
+externalId:6:cust_7
+p:13:amount=n:4800
+p:14:currency=s:EUR
+p:16:expedited=b:true
+p:10:rate=n:1.5`
+  },
+  {
+    // Parameter order is not part of the subject. The same facts written in a
+    // different order are the same authorization.
+    subject: { toolName: "refund.create", parameters: { b: 2, a: 1 } },
+    canonical: `${AUTHORIZATION_CANONICAL_VERSION}
+action:13:refund.create
+target:0:
+actor:0:
+environment:0:
+externalId:0:
+p:5:a=n:1
+p:5:b=n:2`
+  },
+  {
+    // An integral float is the same number as the integer.
+    subject: { toolName: "a", parameters: { n: 49 } },
+    canonical: `${AUTHORIZATION_CANONICAL_VERSION}
+action:1:a
+target:0:
+actor:0:
+environment:0:
+externalId:0:
+p:6:n=n:49`
+  },
+  {
+    // Delimiters inside a value cannot forge another subject.
+    subject: { toolName: "a", parameters: { "x\ny": "1" } },
+    canonical: `${AUTHORIZATION_CANONICAL_VERSION}
+action:1:a
+target:0:
+actor:0:
+environment:0:
+externalId:0:
+p:7:x
+y=s:1`
+  },
+  {
+    // Every finite number, including the ones another language would render
+    // differently. One runtime computes both sides of the comparison.
+    subject: { toolName: "a", parameters: { small: 1e-7, big: 1e21 } },
+    canonical: `${AUTHORIZATION_CANONICAL_VERSION}
+action:1:a
+target:0:
+actor:0:
+environment:0:
+externalId:0:
+p:11:big=n:1e+21
+p:12:small=n:1e-7`
+  }
+];
+var AUTHORIZATION_PERMIT_TTL_SECONDS = 60 * 60;
 var classifyDecisionRisk = (toolName, toolTarget) => {
   const parts = [toolName, toolTarget ?? ""];
   const matchesAny = (patterns) => parts.some((part) => patterns.some((re) => re.test(part)));
@@ -833,9 +916,177 @@ var isScopeContract = (value) => {
   const strings = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
   return strings(c.allowedPaths) && strings(c.offLimitsPaths) && typeof c.doneWhen === "string";
 };
+var autoApprove = (tool) => ({
+  tool,
+  timeoutSeconds: 0,
+  timeoutAction: "approve",
+  mode: "terminal_only",
+  pushFirstSeconds: 0
+});
+var resolveAutoResolveOrigin = (config, toolName, toolInput, cwd, repoKey, sessionId) => {
+  const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
+  const arg = args[0];
+  const match = selectGoverningRule(config.policies, toolName, args, repoKey, sessionId);
+  const governedBySpecificRule = match?.rank === "exact" || match?.rank === "prefix";
+  if (!governedBySpecificRule && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg)) {
+    return "safe_readonly";
+  }
+  return "policy_timeout";
+};
+var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
+  const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
+  const arg = args[0];
+  const match = selectGoverningRule(config.policies, toolName, args, repoKey, sessionId);
+  let base = match?.policy ?? config.policies.find((p) => p.tool === "*") ?? {
+    tool: toolName,
+    timeoutSeconds: config.defaultTimeoutSeconds,
+    timeoutAction: config.defaultTimeoutAction,
+    mode: config.defaultMode ?? "push_first",
+    pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
+  };
+  const governedBySpecificRule = match?.rank === "exact" || match?.rank === "prefix";
+  if (!governedBySpecificRule && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg)) {
+    base = autoApprove(base.tool);
+  }
+  const wouldAutoApprove = isAutoApprove(base);
+  if (!governedBySpecificRule && wouldAutoApprove && toolName === "Bash" && typeof arg === "string" && classifyDecisionRisk(toolName, arg) === "destructive") {
+    base = {
+      tool: base.tool,
+      timeoutSeconds: config.defaultTimeoutSeconds,
+      timeoutAction: "wait",
+      mode: "push_first",
+      pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
+    };
+  }
+  const effectiveOverride = modeOverride ?? config.modeOverride;
+  if (effectiveOverride) {
+    return { ...base, mode: effectiveOverride };
+  }
+  return base;
+};
+var restraintRank = (policy) => {
+  if (isAutoDeny(policy)) return 4;
+  if (isAutoApprove(policy)) return 0;
+  if (policy.mode === "push_only") return 3;
+  return policy.mode === "terminal_only" || policy.mode === "notify_only" ? 1 : 2;
+};
+var strictestPolicy = (a, b) => restraintRank(b) > restraintRank(a) ? b : a;
+var resolvePolicyAcross = (config, toolName, modeOverride, toolInputs, cwd, repoKey, sessionId) => {
+  if (toolInputs.length === 0) return resolvePolicy(config, toolName, modeOverride, void 0, cwd, repoKey, sessionId);
+  return toolInputs.map((input) => resolvePolicy(config, toolName, modeOverride, input, cwd, repoKey, sessionId)).reduce(strictestPolicy);
+};
+var isModeStateDegraded = (state) => state?.degraded === true;
+var KILL_REASON = "Stopped by user, this agent was halted from Pushary";
+var strictestScopeVerdict = (scope, paths) => {
+  if (paths.length === 0) return evaluateScope(scope, void 0);
+  let worst = { outcome: "in_scope" };
+  for (const path of paths) {
+    const verdict = evaluateScope(scope, path);
+    if (verdict.outcome === "off_limits") return verdict;
+    if (verdict.outcome === "out_of_scope") worst = verdict;
+  }
+  return worst;
+};
+var survivesDegraded = (config, toolName, toolInputs, cwd, repoKey, sessionId) => toolInputs.length === 1 && resolveAutoResolveOrigin(config, toolName, toolInputs[0], cwd, repoKey, sessionId) === "safe_readonly";
+var resolveGate = (input) => {
+  const { modeState, config, toolName, toolInputs, cwd, repoKey, sessionId } = input;
+  if (modeState.kill) return { kind: "kill", reason: KILL_REASON };
+  const policy = resolvePolicyAcross(config, toolName, modeState.mode, toolInputs, cwd, repoKey, sessionId);
+  const verdict = verdictForPolicy(policy);
+  const autoApproves = verdict === "allow";
+  const autoDenies = verdict === "deny";
+  if (autoDenies) return { kind: "deny", policy, reason: `Denied by policy for ${policy.tool}` };
+  if (isModeStateDegraded(modeState)) {
+    if (autoApproves) {
+      return survivesDegraded(config, toolName, toolInputs, cwd, repoKey, sessionId) ? { kind: "allow", policy, source: "allowlist" } : { kind: "defer", policy };
+    }
+    return { kind: "gate", policy };
+  }
+  const scopeVerdict = modeState.scope ? strictestScopeVerdict(modeState.scope, input.scopePaths ?? []) : { outcome: "no_contract" };
+  if (autoApproves) {
+    if (!scopeRequiresHuman(scopeVerdict)) {
+      return {
+        kind: "allow",
+        policy,
+        source: toolInputs.length === 1 && resolveAutoResolveOrigin(config, toolName, toolInputs[0], cwd, repoKey, sessionId) === "safe_readonly" ? "allowlist" : "policy"
+      };
+    }
+  }
+  const scopeReason = scopeChangeReason(scopeVerdict);
+  return {
+    kind: "gate",
+    policy,
+    scopeReason,
+    scopePath: scopeReason && "path" in scopeVerdict ? scopeVerdict.path : void 0
+  };
+};
+var toPolicyVersion = (value) => typeof value === "string" || typeof value === "number" ? String(value) : null;
+var modeStateFromResponse = (data) => {
+  const mode = data.override?.mode;
+  return {
+    mode: isApprovalMode(mode) ? mode : null,
+    kill: data.kill === true,
+    policyVersion: toPolicyVersion(data.policyVersion),
+    relayUrl: typeof data.relayUrl === "string" && data.relayUrl.length > 0 ? data.relayUrl : null,
+    trainingConsent: data.trainingConsent === true,
+    // Validated rather than cast: a malformed contract must read as no contract,
+    // never as one that silently matches nothing.
+    scope: isScopeContract(data.scope) ? data.scope : null,
+    degraded: false
+  };
+};
+var claudePreToolUseOutput = (decision, reason, updatedInput) => ({
+  hookSpecificOutput: {
+    hookEventName: "PreToolUse",
+    permissionDecision: decision,
+    ...reason ? { permissionDecisionReason: reason } : {},
+    ...updatedInput ? { updatedInput } : {}
+  }
+});
+var claudePermissionRequestOutput = (decision, reason, updatedInput) => ({
+  hookSpecificOutput: {
+    hookEventName: "PermissionRequest",
+    decision: decision === "allow" ? { behavior: "allow", ...updatedInput ? { updatedInput } : {} } : { behavior: "deny", ...reason ? { message: reason } : {} }
+  }
+});
+var gateOutputFor = (source, event, decision, reason) => {
+  let output;
+  if (source === "claude") {
+    if (event === "PreToolUse") {
+      output = claudePreToolUseOutput(decision, reason);
+    } else if (event === "PermissionRequest" && decision !== "ask") {
+      output = claudePermissionRequestOutput(decision, reason);
+    }
+  } else if (source === "codex") {
+    if (event === "PermissionRequest" && decision !== "ask") {
+      output = {
+        hookSpecificOutput: {
+          hookEventName: "PermissionRequest",
+          decision: decision === "allow" ? { behavior: "allow" } : { behavior: "deny", message: reason ?? "Denied from Pushary" }
+        }
+      };
+    } else if (event === "PreToolUse" && decision === "deny") {
+      output = {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: reason ?? "Denied from Pushary"
+        }
+      };
+    }
+  } else if (source === "gemini" && event === "BeforeTool" && decision !== "ask") {
+    output = decision === "allow" ? { decision: "allow" } : { decision: "deny", reason: reason ?? "Denied from Pushary" };
+  } else if (source === "cursor" && event === "beforeShellExecution") {
+    output = decision === "allow" ? { permission: "allow" } : decision === "ask" ? { permission: "ask" } : {
+      permission: "deny",
+      user_message: "Command denied via Pushary.",
+      agent_message: reason ?? "Denied from Pushary"
+    };
+  }
+  return output;
+};
 
 export {
-  isApprovalMode,
   parseAgentQuestionAnswers,
   normalizeInstallSource,
   HOOK_BUDGETS,
@@ -844,21 +1095,20 @@ export {
   effectiveWaitSeconds,
   normalizeRepoRemote,
   localRepoKey,
-  policyArgForms,
   isSafeReadOnlyCommand,
   isAutoApprove,
-  isAutoDeny,
-  verdictForPolicy,
-  selectGoverningRule,
   isValidApiKey,
   ACTION_BODY_MAX,
   DECISION_LINE_MAX,
   redactSecrets,
   redactSecretsDeep,
-  classifyDecisionRisk,
   buildDecisionEpisodeFeatures,
-  evaluateScope,
-  scopeRequiresHuman,
-  scopeChangeReason,
-  isScopeContract
+  resolveAutoResolveOrigin,
+  resolvePolicy,
+  KILL_REASON,
+  resolveGate,
+  modeStateFromResponse,
+  claudePreToolUseOutput,
+  claudePermissionRequestOutput,
+  gateOutputFor
 };

package/dist/{chunk-HVZIHTOO.js → chunk-KJW6NKF7.js}

@@ -1,6 +1,6 @@
 import {
   HOOK_BUDGETS
-} from "./chunk-MQMPG5X4.js";
+} from "./chunk-K337LIBD.js";
 
 // src/codex-config.ts
 import { createHash } from "crypto";
@@ -14,12 +14,12 @@ var codexHooksJson = () => join(codexHome(), "hooks.json");
 var codexAgentsMd = () => join(codexHome(), "AGENTS.md");
 var codexSkillDir = () => join(codexHome(), "skills", "pushary");
 var CODEX_HOOK_EVENTS = [
-  { event: "PermissionRequest", matcher: "Bash|apply_patch", timeout: HOOK_BUDGETS.codex.budgetSeconds, statusMessage: "Waiting for your phone" },
-  { event: "PreToolUse", matcher: "Bash|apply_patch", timeout: HOOK_BUDGETS.codex.budgetSeconds, statusMessage: "Checking Pushary policy" },
-  { event: "PostToolUse", matcher: "Bash|apply_patch", timeout: 10 },
-  { event: "UserPromptSubmit", timeout: 10 },
-  { event: "Stop", timeout: 10 },
-  { event: "SessionStart", matcher: "startup|resume", timeout: 10 }
+  { event: "PermissionRequest", matcher: "Bash|apply_patch", delivery: "approval", timeout: HOOK_BUDGETS.codex.budgetSeconds, statusMessage: "Waiting for your phone" },
+  { event: "PreToolUse", matcher: "Bash|apply_patch", delivery: "approval", timeout: HOOK_BUDGETS.codex.budgetSeconds, statusMessage: "Checking Pushary policy" },
+  { event: "PostToolUse", matcher: "Bash|apply_patch", delivery: "telemetry", timeout: 10 },
+  { event: "UserPromptSubmit", delivery: "telemetry", timeout: 10 },
+  { event: "Stop", delivery: "telemetry", timeout: 10 },
+  { event: "SessionStart", matcher: "startup|resume", delivery: "telemetry", timeout: 10 }
 ];
 var CODEX_EVENT_KEY = {
   PermissionRequest: "permission_request",

package/dist/{chunk-K7CSRGKZ.js → chunk-KZIGJLOX.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-6MTNS63X.js";
 import {
   resolveInstallSourceFor
-} from "./chunk-437T77TY.js";
+} from "./chunk-CWV4CMB6.js";
 import {
   configFilePath
 } from "./chunk-2UMNXADU.js";

package/dist/{chunk-6LC4WSCL.js → chunk-LCA2EQTK.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-BSZYIAZL.js";
 import {
   reportedInstallSource
-} from "./chunk-437T77TY.js";
+} from "./chunk-CWV4CMB6.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {

package/dist/{chunk-F52SIIDG.js → chunk-LSB6PFLN.js}

@@ -12,7 +12,7 @@ import {
 } from "./chunk-2UMNXADU.js";
 import {
   isValidApiKey
-} from "./chunk-MQMPG5X4.js";
+} from "./chunk-K337LIBD.js";
 
 // src/session.ts
 var IDENTITY_PATH = "/api/v1/server/identity";

package/dist/{chunk-YKW6JCWI.js → chunk-LXWISFF3.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-HVZIHTOO.js";
+} from "./chunk-KJW6NKF7.js";
 import {
   readJsonSafe
 } from "./chunk-6MTNS63X.js";

package/dist/{chunk-FBGBJXVC.js → chunk-NTIUQB3E.js}

@@ -1,7 +1,7 @@
 import {
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-F52SIIDG.js";
+} from "./chunk-LSB6PFLN.js";
 import {
   createIo
 } from "./chunk-5RUIFDTP.js";

package/dist/{chunk-NJ7JT26G.js → chunk-PKUNB3SN.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-MQMPG5X4.js";
+} from "./chunk-K337LIBD.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-AXRATIS6.js → chunk-Q4URN3E7.js}

@@ -1,6 +1,6 @@
 import {
   parseVersion
-} from "./chunk-64PXDATC.js";
+} from "./chunk-XJDL3MUE.js";
 
 // src/setup/agent-probe.ts
 import { execSync } from "child_process";

package/dist/{chunk-GCKAWHFP.js → chunk-T54OT7IY.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-2UMNXADU.js";
 import {
   redactSecrets
-} from "./chunk-MQMPG5X4.js";
+} from "./chunk-K337LIBD.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";

package/dist/{chunk-64PXDATC.js → chunk-XJDL3MUE.js}

@@ -1,9 +1,9 @@
 import {
   guardBinary
-} from "./chunk-PWTKKQQI.js";
+} from "./chunk-HSGEEBBL.js";
 import {
   HOOK_BUDGETS
-} from "./chunk-MQMPG5X4.js";
+} from "./chunk-K337LIBD.js";
 
 // src/claude-config.ts
 import { join } from "path";
@@ -40,23 +40,23 @@ var MIRRORED_TOOLS = [...PRETOOLUSE_GATED_TOOLS, "TodoWrite"].join("|");
 var ESTABLISHED = [1, 0, 0];
 var OBSERVED = [2, 0, 0];
 var CLAUDE_HOOK_EVENTS = [
-  { event: "PreToolUse", binary: "pushary-hook", matcher: GATED_TOOLS, timeout: HOOK_BUDGETS.claude.budgetSeconds, since: ESTABLISHED },
-  { event: "PostToolUse", binary: "pushary-post-hook", matcher: MIRRORED_TOOLS, timeout: 10, since: ESTABLISHED },
-  { event: "Stop", binary: "pushary-stop-hook", timeout: 10, since: ESTABLISHED },
-  { event: "UserPromptSubmit", binary: "pushary-prompt-hook", timeout: 10, since: ESTABLISHED },
-  { event: "Notification", binary: "pushary-notification-hook", matcher: "permission_prompt|idle_prompt|agent_needs_input|agent_completed", timeout: 10, since: ESTABLISHED },
-  { event: "SessionStart", binary: "pushary-session-start-hook", matcher: "startup|resume|clear", timeout: 10, since: ESTABLISHED },
-  { event: "SessionEnd", binary: "pushary-session-end-hook", timeout: 10, since: ESTABLISHED },
-  { event: "StopFailure", binary: "pushary-stopfailure-hook", timeout: 10, since: ESTABLISHED },
-  { event: "PermissionRequest", binary: "pushary-permission-hook", timeout: HOOK_BUDGETS.claude.budgetSeconds, since: ESTABLISHED },
-  { event: "PermissionDenied", binary: "pushary-permission-denied-hook", timeout: 60, since: ESTABLISHED },
+  { event: "PreToolUse", binary: "pushary-hook", matcher: GATED_TOOLS, timeout: HOOK_BUDGETS.claude.budgetSeconds, delivery: "approval", since: ESTABLISHED },
+  { event: "PostToolUse", binary: "pushary-post-hook", matcher: MIRRORED_TOOLS, timeout: 10, delivery: "telemetry", since: ESTABLISHED },
+  { event: "Stop", binary: "pushary-stop-hook", timeout: 10, delivery: "telemetry", since: ESTABLISHED },
+  { event: "UserPromptSubmit", binary: "pushary-prompt-hook", timeout: 10, delivery: "telemetry", since: ESTABLISHED },
+  { event: "Notification", binary: "pushary-notification-hook", matcher: "permission_prompt|idle_prompt|agent_needs_input|agent_completed", timeout: 10, delivery: "telemetry", since: ESTABLISHED },
+  { event: "SessionStart", binary: "pushary-session-start-hook", matcher: "startup|resume|clear", timeout: 10, delivery: "telemetry", since: ESTABLISHED },
+  { event: "SessionEnd", binary: "pushary-session-end-hook", timeout: 10, delivery: "telemetry", since: ESTABLISHED },
+  { event: "StopFailure", binary: "pushary-stopfailure-hook", timeout: 10, delivery: "telemetry", since: ESTABLISHED },
+  { event: "PermissionRequest", binary: "pushary-permission-hook", timeout: HOOK_BUDGETS.claude.budgetSeconds, delivery: "approval", since: ESTABLISHED },
+  { event: "PermissionDenied", binary: "pushary-permission-denied-hook", timeout: 60, delivery: "telemetry", since: ESTABLISHED },
   // Observability only. Each carries session shape the island cannot get any other
   // way, and none of them decides anything.
-  { event: "SubagentStart", binary: "pushary-session-start-hook", timeout: 10, since: OBSERVED },
-  { event: "SubagentStop", binary: "pushary-stop-hook", timeout: 10, since: OBSERVED },
-  { event: "PreCompact", binary: "pushary-post-hook", matcher: "manual|auto", timeout: 10, since: OBSERVED },
-  { event: "PostCompact", binary: "pushary-post-hook", matcher: "manual|auto", timeout: 10, since: OBSERVED },
-  { event: "TeammateIdle", binary: "pushary-notification-hook", timeout: 10, since: OBSERVED }
+  { event: "SubagentStart", binary: "pushary-session-start-hook", timeout: 10, delivery: "telemetry", since: OBSERVED },
+  { event: "SubagentStop", binary: "pushary-stop-hook", timeout: 10, delivery: "telemetry", since: OBSERVED },
+  { event: "PreCompact", binary: "pushary-post-hook", matcher: "manual|auto", timeout: 10, delivery: "telemetry", since: OBSERVED },
+  { event: "PostCompact", binary: "pushary-post-hook", matcher: "manual|auto", timeout: 10, delivery: "telemetry", since: OBSERVED },
+  { event: "TeammateIdle", binary: "pushary-notification-hook", timeout: 10, delivery: "telemetry", since: OBSERVED }
 ];
 var supportedClaudeEvents = (version) => CLAUDE_HOOK_EVENTS.filter((hook) => version ? atLeast(version, hook.since) : hook.since === ESTABLISHED);
 

package/dist/{chunk-GFM3STWO.js → chunk-Y7E2MC3G.js}

@@ -1,15 +1,14 @@
 import {
   PRETOOLUSE_HANDLED_TOOLS
-} from "./chunk-64PXDATC.js";
+} from "./chunk-XJDL3MUE.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-NJ7JT26G.js";
+} from "./chunk-PKUNB3SN.js";
 import {
   denyReasonFrom,
-  isDeferAnswer,
-  resolveGate
-} from "./chunk-GXIFADGD.js";
+  isDeferAnswer
+} from "./chunk-YHG74UFF.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -29,7 +28,7 @@ import {
   sendNotification,
   throttlePass,
   waitForAnswer
-} from "./chunk-EXMUM226.js";
+} from "./chunk-DPDUB4XF.js";
 import {
   getMachineId
 } from "./chunk-RN3NOEJF.js";
@@ -39,11 +38,14 @@ import {
 } from "./chunk-2UMNXADU.js";
 import {
   buildDecisionEpisodeFeatures,
+  claudePermissionRequestOutput,
+  claudePreToolUseOutput,
   effectiveWaitSeconds,
   hookWaitClamped,
   hookWaitDeadline,
-  parseAgentQuestionAnswers
-} from "./chunk-MQMPG5X4.js";
+  parseAgentQuestionAnswers,
+  resolveGate
+} from "./chunk-K337LIBD.js";
 
 // src/decision-episode.ts
 var EPISODE_PATH = "/api/agent/decision-episode";
@@ -73,33 +75,10 @@ import { tmpdir } from "os";
 import { existsSync, writeFileSync } from "fs";
 var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 var START_MS = Date.now();
-var allow = () => ({
-  hookSpecificOutput: {
-    hookEventName: "PreToolUse",
-    permissionDecision: "allow"
-  }
-});
-var deny = (reason) => ({
-  hookSpecificOutput: {
-    hookEventName: "PreToolUse",
-    permissionDecision: "deny",
-    permissionDecisionReason: reason
-  }
-});
-var allowWithInput = (updatedInput) => ({
-  hookSpecificOutput: {
-    hookEventName: "PreToolUse",
-    permissionDecision: "allow",
-    updatedInput
-  }
-});
-var ask = (reason) => ({
-  hookSpecificOutput: {
-    hookEventName: "PreToolUse",
-    permissionDecision: "ask",
-    ...reason ? { permissionDecisionReason: reason } : {}
-  }
-});
+var allow = () => claudePreToolUseOutput("allow");
+var deny = (reason) => claudePreToolUseOutput("deny", reason);
+var allowWithInput = (updatedInput) => claudePreToolUseOutput("allow", void 0, updatedInput);
+var ask = (reason) => claudePreToolUseOutput("ask", reason);
 var pollForAnswer = async (apiKey, correlationId, deadlineMs, pollInterval = 2e3) => {
   while (Date.now() < deadlineMs) {
     const remaining = Math.min(Math.max(deadlineMs - Date.now(), 1e3), 3e4);
@@ -513,14 +492,16 @@ var handlePreToolUse = async (input) => {
     if (input.tool_name === "AskUserQuestion") {
       return handleAskUserQuestion(apiKey, input);
     }
+    if (verdict.kind === "deny") return deny(verdict.reason);
     if (shouldDeferToNativeMode(input.permission_mode, input.tool_name)) {
       return void 0;
     }
     switch (verdict.kind) {
       case "allow":
         return allow();
-      case "deny":
-        return deny(verdict.reason);
+      // No `deny` case: it is handled above the defer, and the compiler enforces
+      // that it stays there. Restoring one here would type-error as unreachable.
+      //
       // State we could not establish, with an auto-approve on the table. No
       // opinion, so Claude Code's own flow runs as if the hook were absent.
       case "defer":
@@ -532,18 +513,8 @@ var handlePreToolUse = async (input) => {
     return void 0;
   }
 };
-var permReqAllow = (updatedInput) => ({
-  hookSpecificOutput: {
-    hookEventName: "PermissionRequest",
-    decision: { behavior: "allow", ...updatedInput ? { updatedInput } : {} }
-  }
-});
-var permReqDeny = (message) => ({
-  hookSpecificOutput: {
-    hookEventName: "PermissionRequest",
-    decision: { behavior: "deny", ...message ? { message } : {} }
-  }
-});
+var permReqAllow = (updatedInput) => claudePermissionRequestOutput("allow", void 0, updatedInput);
+var permReqDeny = (message) => claudePermissionRequestOutput("deny", message);
 var toPermissionRequestOutput = (hookOutput) => {
   if (!hookOutput) return void 0;
   const d = hookOutput.hookSpecificOutput;

package/dist/chunk-YHG74UFF.js

@@ -0,0 +1,12 @@
+// src/answer.ts
+var denyReasonFrom = (value, note) => {
+  const trimmed = note?.trim();
+  if (trimmed) return `Denied from your phone: ${trimmed}`;
+  return value && value !== "no" && value !== "yes" ? `Denied from your phone: ${value}` : "Denied via push notification";
+};
+var isDeferAnswer = (value) => value === "defer";
+
+export {
+  denyReasonFrom,
+  isDeferAnswer
+};

package/dist/src/index.d.ts

@@ -1,5 +1,6 @@
-import { PolicyConfig, ApprovalMode, ToolPolicy, ScopeContract, AgentQuestion } from '@pushary/contracts';
-export { ApprovalMode, PolicyConfig, ToolPolicy } from '@pushary/contracts';
+import { ClaudePreToolUseOutput, PolicyConfig, ApprovalMode, ModeState, AutoResolveOrigin, AgentQuestion } from '@pushary/contracts';
+export { ApprovalMode, ModeState, PolicyConfig, ToolPolicy, resolvePolicy } from '@pushary/contracts';
+import { ReceiptMeta } from '@pushary/hook-mapping';
 
 interface ToolInput {
     tool_name: string;
@@ -10,35 +11,11 @@ interface ToolInput {
     tool_use_id?: string;
     permission_mode?: string;
 }
-interface HookOutput {
-    hookSpecificOutput: {
-        hookEventName: 'PreToolUse';
-        permissionDecision: 'allow' | 'deny' | 'ask';
-        permissionDecisionReason?: string;
-        updatedInput?: Record<string, unknown>;
-    };
-}
+type HookOutput = ClaudePreToolUseOutput;
 declare const handlePreToolUse: (input: ToolInput) => Promise<HookOutput | undefined>;
 
-type ReceiptKind = 'edit' | 'write' | 'bash' | 'commit';
-interface ReceiptMeta {
-    kind: ReceiptKind;
-    target: string;
-    ok: boolean;
-}
-
 declare const getPolicy: (apiKey: string, expectedVersion?: string | null, agent?: string, repoAware?: boolean, sessionId?: string) => Promise<PolicyConfig>;
-type AutoResolveOrigin = 'safe_readonly' | 'policy_timeout';
-declare const resolvePolicy: (config: PolicyConfig, toolName: string, modeOverride?: ApprovalMode | null, toolInput?: Record<string, unknown>, cwd?: string, repoKey?: string, sessionId?: string) => ToolPolicy;
-interface ModeState {
-    readonly mode: ApprovalMode | null;
-    readonly kill: boolean;
-    readonly policyVersion: string | null;
-    readonly relayUrl: string | null;
-    readonly trainingConsent?: boolean;
-    readonly scope?: ScopeContract | null;
-    readonly degraded?: boolean;
-}
+
 declare const fetchModeState: (apiKey: string, sessionId?: string, reuseWithinMs?: number) => Promise<ModeState>;
 declare const fetchModeOverride: (apiKey: string) => Promise<ApprovalMode | null>;
 
@@ -142,6 +119,7 @@ interface AskUserParams {
     actionBody?: string;
     scopePath?: string;
     toolUseId?: string;
+    requestId?: string;
 }
 interface AskUserResponse {
     correlationId: string;
@@ -166,4 +144,4 @@ declare const cancelQuestion: (apiKey: string, correlationId: string) => Promise
 declare const getApiKey: () => string;
 declare const getBaseUrl: () => string;
 
-export { type ModeState, askUser, cancelQuestion, fetchModeOverride, fetchModeState, getApiKey, getBaseUrl, getPolicy, handleNotification, handlePostToolUse, handlePreToolUse, handleStop, reportEvent, resolvePolicy, waitForAnswer };
+export { askUser, cancelQuestion, fetchModeOverride, fetchModeState, getApiKey, getBaseUrl, getPolicy, handleNotification, handlePostToolUse, handlePreToolUse, handleStop, reportEvent, waitForAnswer };