@pushary/agent-hooks 0.85.1 → 0.86.0

package/dist/{chunk-G3LXA2ZP.js → chunk-CY4TZK5O.js}

@@ -65,6 +65,7 @@ var hookWaitDeadline = (startMs, policyWaitSeconds, agent, nowMs) => {
 };
 var hookWaitClamped = (startMs, policyWaitSeconds, agent, nowMs) => startMs + hookMaxWaitSeconds(agent) * 1e3 < nowMs + Math.max(policyWaitSeconds, 0) * 1e3;
 var effectiveWaitSeconds = (timeoutAction, policySeconds, agent) => timeoutAction === "wait" ? hookMaxWaitSeconds(agent) : policySeconds;
+var HOOK_LOCATOR_BINARY = "pushary-bridge";
 var HOOK_BATCH_MAX_BYTES = 4 * 1024 * 1024;
 var REPO_KEY_MAX_LENGTH = 200;
 var isRepoKeyMatch = (ruleRepoKey, currentRepoKey) => {
@@ -502,6 +503,8 @@ var selectGoverningRule = (policies, toolName, args, repoKey, sessionId) => {
   }
   return best;
 };
+var ARG_PREFIX_TARGET_TOOLS = Object.keys(POLICY_COMMAND_KEYS);
+var FILE_TARGET_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit"]);
 var API_KEY_PATTERN = /^pk_[a-f0-9]+\.[a-f0-9]+$/;
 var isValidApiKey = (value) => API_KEY_PATTERN.test(value);
 var ACTION_BODY_MAX = 4e3;
@@ -1035,6 +1038,56 @@ var modeStateFromResponse = (data) => {
     degraded: false
   };
 };
+var claudePreToolUseOutput = (decision, reason, updatedInput) => ({
+  hookSpecificOutput: {
+    hookEventName: "PreToolUse",
+    permissionDecision: decision,
+    ...reason ? { permissionDecisionReason: reason } : {},
+    ...updatedInput ? { updatedInput } : {}
+  }
+});
+var claudePermissionRequestOutput = (decision, reason, updatedInput) => ({
+  hookSpecificOutput: {
+    hookEventName: "PermissionRequest",
+    decision: decision === "allow" ? { behavior: "allow", ...updatedInput ? { updatedInput } : {} } : { behavior: "deny", ...reason ? { message: reason } : {} }
+  }
+});
+var gateOutputFor = (source, event, decision, reason) => {
+  let output;
+  if (source === "claude") {
+    if (event === "PreToolUse") {
+      output = claudePreToolUseOutput(decision, reason);
+    } else if (event === "PermissionRequest" && decision !== "ask") {
+      output = claudePermissionRequestOutput(decision, reason);
+    }
+  } else if (source === "codex") {
+    if (event === "PermissionRequest" && decision !== "ask") {
+      output = {
+        hookSpecificOutput: {
+          hookEventName: "PermissionRequest",
+          decision: decision === "allow" ? { behavior: "allow" } : { behavior: "deny", message: reason ?? "Denied from Pushary" }
+        }
+      };
+    } else if (event === "PreToolUse" && decision === "deny") {
+      output = {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: reason ?? "Denied from Pushary"
+        }
+      };
+    }
+  } else if (source === "gemini" && event === "BeforeTool" && decision !== "ask") {
+    output = decision === "allow" ? { decision: "allow" } : { decision: "deny", reason: reason ?? "Denied from Pushary" };
+  } else if (source === "cursor" && event === "beforeShellExecution") {
+    output = decision === "allow" ? { permission: "allow" } : decision === "ask" ? { permission: "ask" } : {
+      permission: "deny",
+      user_message: "Command denied via Pushary.",
+      agent_message: reason ?? "Denied from Pushary"
+    };
+  }
+  return output;
+};
 
 export {
   parseAgentQuestionAnswers,
@@ -1043,10 +1096,12 @@ export {
   hookWaitDeadline,
   hookWaitClamped,
   effectiveWaitSeconds,
+  HOOK_LOCATOR_BINARY,
   normalizeRepoRemote,
   localRepoKey,
   isSafeReadOnlyCommand,
   isAutoApprove,
+  FILE_TARGET_TOOLS,
   isValidApiKey,
   ACTION_BODY_MAX,
   DECISION_LINE_MAX,
@@ -1057,5 +1112,8 @@ export {
   resolvePolicy,
   KILL_REASON,
   resolveGate,
-  modeStateFromResponse
+  modeStateFromResponse,
+  claudePreToolUseOutput,
+  claudePermissionRequestOutput,
+  gateOutputFor
 };

package/dist/{chunk-XIR6N66V.js → chunk-FOY5FISQ.js}

@@ -5,7 +5,7 @@ import {
   generateSessionKey,
   uploadTranscriptRecords,
   wrapSessionKey
-} from "./chunk-JDQY47OW.js";
+} from "./chunk-XPAGN3SC.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;

package/dist/{chunk-GM54KC62.js → chunk-GK4CED6Z.js}

@@ -1,9 +1,14 @@
+import {
+  PRETOOLUSE_GATED_TOOLS,
+  PRETOOLUSE_PHONE_ANSWERED_TOOLS
+} from "./chunk-ATBKJNWS.js";
 import {
   guardBinary
 } from "./chunk-HSGEEBBL.js";
 import {
-  HOOK_BUDGETS
-} from "./chunk-G3LXA2ZP.js";
+  HOOK_BUDGETS,
+  HOOK_LOCATOR_BINARY
+} from "./chunk-CY4TZK5O.js";
 
 // src/claude-config.ts
 import { join } from "path";
@@ -21,21 +26,8 @@ var compareVersion = (a, b) => {
 };
 var atLeast = (version, floor) => compareVersion(version, floor) >= 0;
 
-// src/claude-tools.ts
-var PRETOOLUSE_GATED_TOOLS = [
-  "Bash",
-  "Write",
-  "Edit",
-  "MultiEdit",
-  "NotebookEdit",
-  "PowerShell",
-  "Monitor"
-];
-var POSTTOOLUSE_MIRRORED_TOOLS = [...PRETOOLUSE_GATED_TOOLS, "TodoWrite"];
-var PRETOOLUSE_HANDLED_TOOLS = /* @__PURE__ */ new Set([...PRETOOLUSE_GATED_TOOLS, "AskUserQuestion"]);
-
 // src/claude-events.ts
-var GATED_TOOLS = [...PRETOOLUSE_GATED_TOOLS, "AskUserQuestion"].join("|");
+var GATED_TOOLS = [...PRETOOLUSE_GATED_TOOLS, ...PRETOOLUSE_PHONE_ANSWERED_TOOLS].join("|");
 var MIRRORED_TOOLS = [...PRETOOLUSE_GATED_TOOLS, "TodoWrite"].join("|");
 var ESTABLISHED = [1, 0, 0];
 var OBSERVED = [2, 0, 0];
@@ -72,7 +64,10 @@ var ensureRecord = (target, key) => {
   return created;
 };
 var isPusharyPermission = (rule) => typeof rule === "string" && (rule.includes("pushary") || rule.includes("MCP(pushary"));
-var HOOK_BINARIES = new Set(CLAUDE_HOOK_EVENTS.map((hook) => hook.binary));
+var HOOK_BINARIES = /* @__PURE__ */ new Set([
+  ...CLAUDE_HOOK_EVENTS.map((hook) => hook.binary),
+  HOOK_LOCATOR_BINARY
+]);
 var namesPusharyBinary = (command) => command.split(/[\s/\\"']+/).some((segment) => HOOK_BINARIES.has(segment.replace(/\.(cmd|exe)$/i, "")));
 var isPusharyHook = (entry2) => {
   const hooks = asRecord(entry2)?.hooks;
@@ -178,7 +173,6 @@ var removePusharySettings = (settings) => {
 export {
   parseVersion,
   compareVersion,
-  PRETOOLUSE_HANDLED_TOOLS,
   addClaudeMcpServer,
   removeClaudeMcpServers,
   addPusharyToolPermissions,

package/dist/{chunk-VGADRFG6.js → chunk-MNQI6ZZU.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-G3LXA2ZP.js";
+} from "./chunk-CY4TZK5O.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-XLM6COJA.js → chunk-MTKR4YLW.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VT4IVERX.js";
 import {
   pusharyDir
-} from "./chunk-PHXEADSL.js";
+} from "./chunk-VPJAAGD4.js";
 import {
   getMachineId
 } from "./chunk-RN3NOEJF.js";

package/dist/{chunk-DNSIVHIA.js → chunk-N52CIK47.js}

@@ -1,7 +1,7 @@
 import {
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-QDKJTPAT.js";
+} from "./chunk-2TZCZ7CL.js";
 import {
   createIo
 } from "./chunk-5RUIFDTP.js";

package/dist/{chunk-BZKTCOZQ.js → chunk-PZR4XMFU.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-BSZYIAZL.js";
 import {
   reportedInstallSource
-} from "./chunk-ES3FAX5X.js";
+} from "./chunk-7C5CJC3H.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {

package/dist/{chunk-VKJUVPTJ.js → chunk-Q7N3XGWM.js}

@@ -1,9 +1,9 @@
 import {
   hasGeminiHooks
-} from "./chunk-OZKRF7MS.js";
+} from "./chunk-2C6B6V2U.js";
 import {
   hasCodexHooks
-} from "./chunk-PHXEADSL.js";
+} from "./chunk-VPJAAGD4.js";
 
 // src/diagnostics/wiring.ts
 var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;

package/dist/{chunk-IGV4KL7B.js → chunk-QW27ZFA4.js}

@@ -1,6 +1,6 @@
 import {
   codexHomeFrom
-} from "./chunk-PHXEADSL.js";
+} from "./chunk-VPJAAGD4.js";
 
 // src/vscode-config.ts
 import { homedir } from "os";
@@ -253,7 +253,7 @@ You have Pushary MCP tools that reach the user on their phone. Use them proactiv
 
 - When you need the user to make a decision or answer a clarifying question, call \`ask_user\` instead of guessing or stalling. Use type "confirm" for yes/no, "select" for a fixed set of options, and "input" for free text. \`ask_user\` blocks until the user replies or it times out, so you do not need a separate wait step.
 - Before any risky or irreversible step (deleting files, force pushing, spending money, sending external messages), call \`ask_user\` with type "confirm" and wait for approval.
-- Before starting a multi-step run that will change several files, call \`propose_scope\` once with the paths you expect to change, anything you promise not to touch, and what done means. The user agrees to the boundary in one tap, and after that only work outside it needs approving. Skip it for a single quick edit, and do not propose a new scope mid-run just to widen one: if you need to go outside the agreed scope, do the work and let the approval that follows widen it.
+- Before starting a multi-step run that will change several files, call \`propose_scope\` once with the paths you expect to change, anything you promise not to touch, and what done means. The user agrees to the boundary in one tap. A ratified boundary NARROWS what may proceed without asking, it does not pre-approve work inside it, so an action that would normally need approval still needs it. Skip it for a single quick edit, and do not propose a new scope mid-run just to widen one: if you need to go outside the agreed scope, do the work and let the approval that follows widen it.
 - When you are blocked, stuck, or hit an error you cannot resolve on your own, call \`send_notification\` so the user knows, and call \`ask_user\` if you need a decision to continue.
 - When a task that took several steps finishes, call \`send_notification\` so the user knows it is done. Always pass \`context\` with a \`type\` of "task_complete", "error" or "info": it is what tells Pushary this is a task update, so the user's own setting for where updates land can route it.
 - Use \`cancel_question\` to retract a pending question once it is no longer needed.

package/dist/{chunk-LB6RSCLL.js → chunk-S3UD7O35.js}

@@ -1,10 +1,11 @@
 import {
-  PRETOOLUSE_HANDLED_TOOLS
-} from "./chunk-GM54KC62.js";
+  PRETOOLUSE_HANDLED_TOOLS,
+  PRETOOLUSE_PHONE_ANSWERED_TOOLS
+} from "./chunk-ATBKJNWS.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-VGADRFG6.js";
+} from "./chunk-MNQI6ZZU.js";
 import {
   denyReasonFrom,
   isDeferAnswer
@@ -28,7 +29,7 @@ import {
   sendNotification,
   throttlePass,
   waitForAnswer
-} from "./chunk-Y7BALRVB.js";
+} from "./chunk-33T5OOKP.js";
 import {
   getMachineId
 } from "./chunk-RN3NOEJF.js";
@@ -38,12 +39,14 @@ import {
 } from "./chunk-2UMNXADU.js";
 import {
   buildDecisionEpisodeFeatures,
+  claudePermissionRequestOutput,
+  claudePreToolUseOutput,
   effectiveWaitSeconds,
   hookWaitClamped,
   hookWaitDeadline,
   parseAgentQuestionAnswers,
   resolveGate
-} from "./chunk-G3LXA2ZP.js";
+} from "./chunk-CY4TZK5O.js";
 
 // src/decision-episode.ts
 var EPISODE_PATH = "/api/agent/decision-episode";
@@ -73,33 +76,10 @@ import { tmpdir } from "os";
 import { existsSync, writeFileSync } from "fs";
 var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 var START_MS = Date.now();
-var allow = () => ({
-  hookSpecificOutput: {
-    hookEventName: "PreToolUse",
-    permissionDecision: "allow"
-  }
-});
-var deny = (reason) => ({
-  hookSpecificOutput: {
-    hookEventName: "PreToolUse",
-    permissionDecision: "deny",
-    permissionDecisionReason: reason
-  }
-});
-var allowWithInput = (updatedInput) => ({
-  hookSpecificOutput: {
-    hookEventName: "PreToolUse",
-    permissionDecision: "allow",
-    updatedInput
-  }
-});
-var ask = (reason) => ({
-  hookSpecificOutput: {
-    hookEventName: "PreToolUse",
-    permissionDecision: "ask",
-    ...reason ? { permissionDecisionReason: reason } : {}
-  }
-});
+var allow = () => claudePreToolUseOutput("allow");
+var deny = (reason) => claudePreToolUseOutput("deny", reason);
+var allowWithInput = (updatedInput) => claudePreToolUseOutput("allow", void 0, updatedInput);
+var ask = (reason) => claudePreToolUseOutput("ask", reason);
 var pollForAnswer = async (apiKey, correlationId, deadlineMs, pollInterval = 2e3) => {
   while (Date.now() < deadlineMs) {
     const remaining = Math.min(Math.max(deadlineMs - Date.now(), 1e3), 3e4);
@@ -469,6 +449,47 @@ var handleAskUserQuestion = async (apiKey, input) => {
   if (!answers) return void 0;
   return allowWithInput({ ...input.tool_input ?? {}, answers });
 };
+var PLAN_APPROVE = "Approve, start coding";
+var PLAN_KEEP_PLANNING = "Keep planning";
+var handleExitPlanMode = async (apiKey, input) => {
+  const toolInput = input.tool_input ?? {};
+  const projectName = basename(input.cwd ?? process.cwd());
+  let result;
+  try {
+    result = await askUser(apiKey, {
+      question: `Approve the plan and start coding in ${projectName}?`,
+      type: "select",
+      options: [PLAN_APPROVE, PLAN_KEEP_PLANNING],
+      context: `Your agent finished planning in ${projectName} and is waiting to start.`,
+      agentName: `Claude Code - ${projectName}`,
+      sessionId: input.session_id,
+      machineId: getMachineId(),
+      toolName: "ExitPlanMode",
+      action: deriveAction("ExitPlanMode", toolInput),
+      // The plan markdown itself, through the same redaction and cap as any diff,
+      // so approving from a lock screen is a real decision and not a blind yes.
+      actionBody: deriveActionBody("ExitPlanMode", toolInput),
+      intent: readLastPrompt(input.session_id ?? DEFAULT_SESSION) ?? (input.transcript_path ? readLastUserPrompt(input.transcript_path) : void 0),
+      blocker: "Waiting for you to approve the plan"
+    });
+  } catch {
+    return void 0;
+  }
+  if (result.suppressed || result.noDevices) {
+    await cancelQuestion(apiKey, result.correlationId).catch(() => {
+    });
+    return void 0;
+  }
+  const deadline = hookWaitDeadline(START_MS, effectiveWaitSeconds("wait", 0, "claude"), "claude", Date.now());
+  const answer = await pollForAnswer(apiKey, result.correlationId, deadline);
+  const value = answer.answered ? (answer.value ?? "").trim() : "";
+  if (!value || isDeferAnswer(answer.value)) {
+    savePendingQuestion(input.session_id || DEFAULT_SESSION, result.correlationId);
+    return void 0;
+  }
+  if (value === PLAN_APPROVE) return allow();
+  return deny("Plan declined from the phone. Ask what to change before coding.");
+};
 var handleKeyless = (input) => {
   try {
     if (isGatingMoment(input.tool_name, input.tool_input ?? {})) {
@@ -514,6 +535,9 @@ var handlePreToolUse = async (input) => {
       return handleAskUserQuestion(apiKey, input);
     }
     if (verdict.kind === "deny") return deny(verdict.reason);
+    if (input.tool_name === "ExitPlanMode") {
+      return handleExitPlanMode(apiKey, input);
+    }
     if (shouldDeferToNativeMode(input.permission_mode, input.tool_name)) {
       return void 0;
     }
@@ -534,18 +558,8 @@ var handlePreToolUse = async (input) => {
     return void 0;
   }
 };
-var permReqAllow = (updatedInput) => ({
-  hookSpecificOutput: {
-    hookEventName: "PermissionRequest",
-    decision: { behavior: "allow", ...updatedInput ? { updatedInput } : {} }
-  }
-});
-var permReqDeny = (message) => ({
-  hookSpecificOutput: {
-    hookEventName: "PermissionRequest",
-    decision: { behavior: "deny", ...message ? { message } : {} }
-  }
-});
+var permReqAllow = (updatedInput) => claudePermissionRequestOutput("allow", void 0, updatedInput);
+var permReqDeny = (message) => claudePermissionRequestOutput("deny", message);
 var toPermissionRequestOutput = (hookOutput) => {
   if (!hookOutput) return void 0;
   const d = hookOutput.hookSpecificOutput;
@@ -555,7 +569,7 @@ var toPermissionRequestOutput = (hookOutput) => {
 };
 var handlePermissionRequest = async (input) => {
   if (PRETOOLUSE_HANDLED_TOOLS.has(input.tool_name)) {
-    const reclaimDeferredExec = input.tool_name !== "AskUserQuestion" && shouldDeferToNativeMode(input.permission_mode, input.tool_name);
+    const reclaimDeferredExec = !PRETOOLUSE_PHONE_ANSWERED_TOOLS.includes(input.tool_name) && shouldDeferToNativeMode(input.permission_mode, input.tool_name);
     if (!reclaimDeferredExec) return void 0;
   }
   if (input.tool_name.startsWith("mcp__pushary__")) return void 0;

package/dist/{chunk-PHXEADSL.js → chunk-VPJAAGD4.js}

@@ -1,6 +1,7 @@
 import {
-  HOOK_BUDGETS
-} from "./chunk-G3LXA2ZP.js";
+  HOOK_BUDGETS,
+  HOOK_LOCATOR_BINARY
+} from "./chunk-CY4TZK5O.js";
 
 // src/codex-config.ts
 import { createHash } from "crypto";
@@ -63,7 +64,10 @@ var readCodexMcpAuth = (config) => {
 var isPusharyCodexHook = (entry) => {
   const hooks = asRecord(entry)?.hooks;
   if (!Array.isArray(hooks)) return false;
-  return hooks.some((hook) => String(asRecord(hook)?.command ?? "").includes(CODEX_HOOK_BINARY));
+  return hooks.some((hook) => {
+    const command = String(asRecord(hook)?.command ?? "");
+    return command.includes(CODEX_HOOK_BINARY) || command.includes(HOOK_LOCATOR_BINARY);
+  });
 };
 var addCodexHooks = (config, command) => {
   const hooks = ensureRecord(config, "hooks");

package/dist/{chunk-55656H4Q.js → chunk-VZNDR3Z7.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-PHXEADSL.js";
+} from "./chunk-VPJAAGD4.js";
 import {
   readJsonSafe
 } from "./chunk-6MTNS63X.js";

package/dist/{chunk-JDQY47OW.js → chunk-XPAGN3SC.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-2UMNXADU.js";
 import {
   redactSecrets
-} from "./chunk-G3LXA2ZP.js";
+} from "./chunk-CY4TZK5O.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";

package/dist/src/index.d.ts

@@ -1,6 +1,6 @@
-import { ReceiptMeta } from '@pushary/hook-mapping';
-import { PolicyConfig, ApprovalMode, ModeState, AutoResolveOrigin, AgentQuestion } from '@pushary/contracts';
+import { ClaudePreToolUseOutput, PolicyConfig, ApprovalMode, ModeState, AutoResolveOrigin, AgentQuestion } from '@pushary/contracts';
 export { ApprovalMode, ModeState, PolicyConfig, ToolPolicy, resolvePolicy } from '@pushary/contracts';
+import { ReceiptMeta } from '@pushary/hook-mapping';
 
 interface ToolInput {
     tool_name: string;
@@ -11,14 +11,7 @@ interface ToolInput {
     tool_use_id?: string;
     permission_mode?: string;
 }
-interface HookOutput {
-    hookSpecificOutput: {
-        hookEventName: 'PreToolUse';
-        permissionDecision: 'allow' | 'deny' | 'ask';
-        permissionDecisionReason?: string;
-        updatedInput?: Record<string, unknown>;
-    };
-}
+type HookOutput = ClaudePreToolUseOutput;
 declare const handlePreToolUse: (input: ToolInput) => Promise<HookOutput | undefined>;
 
 declare const getPolicy: (apiKey: string, expectedVersion?: string | null, agent?: string, repoAware?: boolean, sessionId?: string) => Promise<PolicyConfig>;

package/dist/src/index.js

@@ -1,10 +1,8 @@
 import {
   handlePreToolUse
-} from "../chunk-LB6RSCLL.js";
-import "../chunk-GM54KC62.js";
-import "../chunk-HSGEEBBL.js";
-import "../chunk-VT4IVERX.js";
-import "../chunk-VGADRFG6.js";
+} from "../chunk-S3UD7O35.js";
+import "../chunk-ATBKJNWS.js";
+import "../chunk-MNQI6ZZU.js";
 import "../chunk-YHG74UFF.js";
 import {
   askUser,
@@ -17,11 +15,11 @@ import {
   handleStop,
   reportEvent,
   waitForAnswer
-} from "../chunk-Y7BALRVB.js";
+} from "../chunk-33T5OOKP.js";
 import "../chunk-RN3NOEJF.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
-import "../chunk-ES3FAX5X.js";
+import "../chunk-7C5CJC3H.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
 import {
@@ -30,7 +28,7 @@ import {
 } from "../chunk-2UMNXADU.js";
 import {
   resolvePolicy
-} from "../chunk-G3LXA2ZP.js";
+} from "../chunk-CY4TZK5O.js";
 export {
   askUser,
   cancelQuestion,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.85.1",
+  "version": "0.86.0",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",