@pushary/agent-hooks 0.86.0 → 0.87.1

package/dist/{chunk-VPJAAGD4.js → chunk-B3V2H6SA.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY
-} from "./chunk-CY4TZK5O.js";
+} from "./chunk-7YJS2VTG.js";
 
 // src/codex-config.ts
 import { createHash } from "crypto";
@@ -61,13 +61,13 @@ var readCodexMcpAuth = (config) => {
   if (typeof pushary.bearer_token === "string") return { method: "legacy-bearer" };
   return void 0;
 };
+var isPusharyCommand = (hook) => {
+  const command = String(asRecord(hook)?.command ?? "");
+  return command.includes(CODEX_HOOK_BINARY) || command.includes(HOOK_LOCATOR_BINARY);
+};
 var isPusharyCodexHook = (entry) => {
   const hooks = asRecord(entry)?.hooks;
-  if (!Array.isArray(hooks)) return false;
-  return hooks.some((hook) => {
-    const command = String(asRecord(hook)?.command ?? "");
-    return command.includes(CODEX_HOOK_BINARY) || command.includes(HOOK_LOCATOR_BINARY);
-  });
+  return Array.isArray(hooks) && hooks.some(isPusharyCommand);
 };
 var addCodexHooks = (config, command) => {
   const hooks = ensureRecord(config, "hooks");
@@ -134,13 +134,28 @@ var codexHookTrustHash = (definition, command) => {
   if (definition.matcher) identity.matcher = definition.matcher;
   return "sha256:" + createHash("sha256").update(canonicalJson(identity), "utf8").digest("hex");
 };
-var codexHookStateKey = (hooksJsonPath, event) => `${hooksJsonPath}:${CODEX_EVENT_KEY[event]}:0:0`;
-var untrustedCodexHookEvents = (config, hooksJsonPath, command) => {
+var codexHookPositions = (hooksConfig) => {
+  const hooks = asRecord(hooksConfig?.hooks);
+  const positions = {};
+  for (const definition of CODEX_HOOK_EVENTS) {
+    const entries = hooks?.[definition.event];
+    if (!Array.isArray(entries)) continue;
+    const entryIndex = entries.findIndex(isPusharyCodexHook);
+    if (entryIndex < 0) continue;
+    const inner = asRecord(entries[entryIndex])?.hooks;
+    const hookIndex = Array.isArray(inner) ? inner.findIndex(isPusharyCommand) : -1;
+    positions[definition.event] = [entryIndex, Math.max(hookIndex, 0)];
+  }
+  return positions;
+};
+var codexHookStateKey = (hooksJsonPath, event, position) => `${hooksJsonPath}:${CODEX_EVENT_KEY[event]}:${position[0]}:${position[1]}`;
+var untrustedCodexHookEvents = (config, hooksJsonPath, command, positions) => {
   const state = asRecord(asRecord(config.hooks)?.state);
   return CODEX_HOOK_EVENTS.filter((definition) => {
-    const entry = asRecord(state?.[codexHookStateKey(hooksJsonPath, definition.event)]);
-    const stored = entry?.trusted_hash;
-    return stored !== codexHookTrustHash(definition, command);
+    const position = positions[definition.event];
+    if (!position) return false;
+    const entry = asRecord(state?.[codexHookStateKey(hooksJsonPath, definition.event, position)]);
+    return entry?.trusted_hash !== codexHookTrustHash(definition, command);
   }).map((definition) => definition.event);
 };
 var removeCodexMcpServer = (config) => {
@@ -150,12 +165,14 @@ var removeCodexMcpServer = (config) => {
   if (Object.keys(servers).length === 0) delete config.mcp_servers;
   return true;
 };
-var removeCodexHookTrust = (config, hooksJsonPath) => {
+var removeCodexHookTrust = (config, hooksJsonPath, positions) => {
   const state = asRecord(asRecord(config.hooks)?.state);
   if (!state) return false;
   let changed = false;
   for (const definition of CODEX_HOOK_EVENTS) {
-    const key = codexHookStateKey(hooksJsonPath, definition.event);
+    const position = positions[definition.event];
+    if (!position) continue;
+    const key = codexHookStateKey(hooksJsonPath, definition.event, position);
     if (key in state) {
       delete state[key];
       changed = true;
@@ -170,16 +187,18 @@ var removeCodexHookTrust = (config, hooksJsonPath) => {
   }
   return changed;
 };
-var removeCodexSettings = (config, hooksJsonPath) => {
+var removeCodexSettings = (config, hooksJsonPath, positions) => {
   const mcp = removeCodexMcpServer(config);
-  const trust = removeCodexHookTrust(config, hooksJsonPath);
+  const trust = removeCodexHookTrust(config, hooksJsonPath, positions);
   return mcp || trust;
 };
-var addCodexHookTrust = (config, hooksJsonPath, command) => {
+var addCodexHookTrust = (config, hooksJsonPath, command, positions) => {
   const hooks = ensureRecord(config, "hooks");
   const state = ensureRecord(hooks, "state");
   for (const definition of CODEX_HOOK_EVENTS) {
-    const key = codexHookStateKey(hooksJsonPath, definition.event);
+    const position = positions[definition.event];
+    if (!position) continue;
+    const key = codexHookStateKey(hooksJsonPath, definition.event, position);
     const existing = asRecord(state[key]) ?? {};
     state[key] = { ...existing, trusted_hash: codexHookTrustHash(definition, command) };
   }
@@ -218,6 +237,7 @@ export {
   removeCodexHooks,
   hasCodexHooks,
   missingCodexHookEvents,
+  codexHookPositions,
   untrustedCodexHookEvents,
   removeCodexSettings,
   addCodexHookTrust,

package/dist/{chunk-XPAGN3SC.js → chunk-ECEUMWBH.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-2UMNXADU.js";
 import {
   redactSecrets
-} from "./chunk-CY4TZK5O.js";
+} from "./chunk-7YJS2VTG.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";

package/dist/{chunk-2255DZ74.js → chunk-HAUTLCMA.js}

@@ -1,6 +1,6 @@
 import {
   parseVersion
-} from "./chunk-GK4CED6Z.js";
+} from "./chunk-5646VKR4.js";
 
 // src/setup/agent-probe.ts
 import { execSync } from "child_process";

package/dist/{chunk-S3UD7O35.js → chunk-HJ44HIUW.js}

@@ -5,15 +5,12 @@ import {
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-MNQI6ZZU.js";
+} from "./chunk-7MBDFNUC.js";
 import {
   denyReasonFrom,
   isDeferAnswer
 } from "./chunk-YHG74UFF.js";
 import {
-  DEFAULT_SESSION,
-  askUser,
-  cancelQuestion,
   deriveAction,
   deriveActionBody,
   deriveBlocker,
@@ -24,12 +21,17 @@ import {
   readLastPrompt,
   readLastUserPrompt,
   repoKeyFor,
-  savePendingQuestion,
   scopePathFor,
-  sendNotification,
-  throttlePass,
-  waitForAnswer
-} from "./chunk-33T5OOKP.js";
+  throttlePass
+} from "./chunk-V2XPF77V.js";
+import {
+  DEFAULT_SESSION,
+  askUser,
+  cancelQuestion,
+  pollForAnswer,
+  savePendingQuestion,
+  sendNotification
+} from "./chunk-J3YDT4HM.js";
 import {
   getMachineId
 } from "./chunk-RN3NOEJF.js";
@@ -46,7 +48,7 @@ import {
   hookWaitDeadline,
   parseAgentQuestionAnswers,
   resolveGate
-} from "./chunk-CY4TZK5O.js";
+} from "./chunk-7YJS2VTG.js";
 
 // src/decision-episode.ts
 var EPISODE_PATH = "/api/agent/decision-episode";
@@ -74,29 +76,11 @@ var reportDecisionEpisode = async (apiKey, input) => {
 import { basename, join } from "path";
 import { tmpdir } from "os";
 import { existsSync, writeFileSync } from "fs";
-var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 var START_MS = Date.now();
 var allow = () => claudePreToolUseOutput("allow");
 var deny = (reason) => claudePreToolUseOutput("deny", reason);
 var allowWithInput = (updatedInput) => claudePreToolUseOutput("allow", void 0, updatedInput);
 var ask = (reason) => claudePreToolUseOutput("ask", reason);
-var pollForAnswer = async (apiKey, correlationId, deadlineMs, pollInterval = 2e3) => {
-  while (Date.now() < deadlineMs) {
-    const remaining = Math.min(Math.max(deadlineMs - Date.now(), 1e3), 3e4);
-    let answer;
-    try {
-      answer = await waitForAnswer(apiKey, correlationId, remaining);
-    } catch {
-      if (Date.now() + pollInterval >= deadlineMs) break;
-      await sleep(pollInterval);
-      continue;
-    }
-    if (answer.answered) return answer;
-    if (Date.now() + pollInterval >= deadlineMs) break;
-    await sleep(pollInterval);
-  }
-  return { answered: false };
-};
 var handlePushOnly = async (apiKey, description, projectName, timeoutSeconds, timeoutAction, sessionId, machineId, toolName, toolTarget, decision, signals) => {
   let result;
   try {

package/dist/chunk-J3YDT4HM.js

@@ -0,0 +1,128 @@
+import {
+  callMcpTool
+} from "./chunk-BSZYIAZL.js";
+import {
+  installProxyDispatcher
+} from "./chunk-SAF6HGAA.js";
+
+// src/api.ts
+import { randomUUID } from "crypto";
+
+// src/validate.ts
+var isPolicyConfig = (data) => {
+  if (!data || typeof data !== "object") return false;
+  const d = data;
+  return Array.isArray(d.policies) && typeof d.defaultTimeoutSeconds === "number" && typeof d.defaultTimeoutAction === "string";
+};
+var isAskUserResponse = (data) => {
+  if (!data || typeof data !== "object") return false;
+  const d = data;
+  return typeof d.correlationId === "string" && typeof d.status === "string";
+};
+var isWaitForAnswerResponse = (data) => {
+  if (!data || typeof data !== "object") return false;
+  const d = data;
+  return typeof d.answered === "boolean";
+};
+
+// src/api.ts
+installProxyDispatcher();
+var askUser = async (apiKey, params, timeoutMs = 15e3) => {
+  const identified = params.toolUseId || params.requestId ? params : { ...params, requestId: randomUUID() };
+  const result = await callMcpTool(apiKey, "ask_user", { ...identified, wait: false }, { maxRetries: 3, timeoutMs });
+  if (!isAskUserResponse(result)) throw new Error("Invalid ask_user response");
+  return result;
+};
+var waitForAnswer = async (apiKey, correlationId, timeoutMs = 3e4) => {
+  const result = await callMcpTool(apiKey, "wait_for_answer", {
+    correlationId,
+    timeoutMs
+  }, { timeoutMs: timeoutMs + 1e4 });
+  if (!isWaitForAnswerResponse(result)) throw new Error("Invalid wait_for_answer response");
+  return result;
+};
+var pollForAnswer = async (apiKey, correlationId, deadlineMs, pollInterval = 2e3) => {
+  const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+  while (Date.now() < deadlineMs) {
+    const remaining = Math.min(Math.max(deadlineMs - Date.now(), 1e3), 3e4);
+    let answer;
+    try {
+      answer = await waitForAnswer(apiKey, correlationId, remaining);
+    } catch {
+      if (Date.now() + pollInterval >= deadlineMs) break;
+      await sleep(pollInterval);
+      continue;
+    }
+    if (answer.answered) return answer;
+    if (Date.now() + pollInterval >= deadlineMs) break;
+    await sleep(pollInterval);
+  }
+  return { answered: false };
+};
+var cancelQuestion = async (apiKey, correlationId) => {
+  await callMcpTool(apiKey, "cancel_question", { correlationId });
+};
+var sendNotification = async (apiKey, params, timeoutMs = 15e3) => {
+  await callMcpTool(apiKey, "send_notification", { ...params }, { maxRetries: 3, timeoutMs });
+};
+
+// src/pending.ts
+import { join } from "path";
+import { tmpdir } from "os";
+import { existsSync, mkdirSync, writeFileSync, readdirSync, unlinkSync, rmSync, statSync } from "fs";
+var PENDING_DIR = join(tmpdir(), "pushary-pending");
+var DEFAULT_SESSION = "_no_session";
+var GRACE_MS = 10 * 60 * 1e3;
+var sanitize = (sessionId) => sessionId.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 128) || DEFAULT_SESSION;
+var dirFor = (sessionId) => join(PENDING_DIR, sanitize(sessionId));
+var isDefaultSession = (sessionId) => sanitize(sessionId) === DEFAULT_SESSION;
+var savePendingQuestion = (sessionId, correlationId) => {
+  const dir = dirFor(sessionId);
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, correlationId), "", "utf-8");
+};
+var listPendingQuestions = (sessionId) => {
+  const dir = dirFor(sessionId);
+  let files;
+  try {
+    files = readdirSync(dir);
+  } catch {
+    return [];
+  }
+  if (!isDefaultSession(sessionId)) return files;
+  const cutoff = Date.now() - GRACE_MS;
+  return files.filter((name) => {
+    try {
+      return statSync(join(dir, name)).mtimeMs < cutoff;
+    } catch {
+      return false;
+    }
+  });
+};
+var removePendingQuestion = (sessionId, correlationId) => {
+  try {
+    unlinkSync(join(dirFor(sessionId), correlationId));
+  } catch {
+  }
+};
+var removePendingSession = (sessionId) => {
+  try {
+    rmSync(dirFor(sessionId), { recursive: true, force: true });
+  } catch {
+  }
+};
+
+export {
+  isPolicyConfig,
+  askUser,
+  waitForAnswer,
+  pollForAnswer,
+  cancelQuestion,
+  sendNotification,
+  DEFAULT_SESSION,
+  isDefaultSession,
+  savePendingQuestion,
+  listPendingQuestions,
+  removePendingQuestion,
+  removePendingSession
+};

package/dist/{chunk-N52CIK47.js → chunk-JAICP7BA.js}

@@ -1,7 +1,7 @@
 import {
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-2TZCZ7CL.js";
+} from "./chunk-A4I5JGCW.js";
 import {
   createIo
 } from "./chunk-5RUIFDTP.js";

package/dist/{chunk-QW27ZFA4.js → chunk-LT2VLPUK.js}

@@ -1,6 +1,6 @@
 import {
   codexHomeFrom
-} from "./chunk-VPJAAGD4.js";
+} from "./chunk-B3V2H6SA.js";
 
 // src/vscode-config.ts
 import { homedir } from "os";
@@ -259,7 +259,7 @@ You have Pushary MCP tools that reach the user on their phone. Use them proactiv
 - Use \`cancel_question\` to retract a pending question once it is no longer needed.
 - Respect the user's Pushary delivery mode: it decides where an approval is surfaced (phone, terminal, or awareness only), not whether it is required. In Terminal mode do not expect a phone answer; the approval waits in the terminal. If the Pushary hook already gated an action, a single approval is enough, do not ask again.
 
-Pass \`agentName\` as "${label} - <project folder name>" so the user knows which session is asking. If a question times out with no answer, retry once with a longer timeout before falling back to asking in the terminal.`;
+Pass \`agentName\` as "${label} - <project folder name>" so the user knows which session is asking. If a question times out, follow \`handoffAction\` when present, otherwise \`nextAction\`: poll once, then cancel a live phone question before asking in the current client. If cancellation returns \`handoffAction: "stop"\`, stop. Otherwise, if cancellation returns false, poll once for 1 second and honor the answer that won the race.`;
 var renderAgentInstructions = (label) => instructionBody(label);
 var KEYLESS_FALLBACK_LINE = "This repo uses Pushary phone approvals. Your teammates get agent questions on their lock screens; you do not have a key yet, so questions will fall back to the terminal. Get your own key (3-day trial): https://pushary.com/sign-up?utm_source=agents-md&utm_medium=teammate";
 var renderProjectAgentInstructions = (label) => `${instructionBody(label)}

package/dist/{chunk-HSGEEBBL.js → chunk-M7RYIZX6.js}

@@ -7,9 +7,9 @@ var HOOK_SHELL = "/bin/sh -c";
 var LOCATE = 'B=$(command -v "$0") || exit 0; [ -f "$B" ] || exit 0; [ -x "$B" ] || exit 0';
 var NODE_PRESENT = "command -v node >/dev/null 2>&1 || exit 0";
 var HOOK_GUARD_SCRIPTS = {
-  native_binary: `${LOCATE}; exec "$B"`,
-  node_binary: `${LOCATE}; ${NODE_PRESENT}; exec "$B"`,
-  node_script: `[ -f "$0" ] || exit 0; ${NODE_PRESENT}; exec node "$0"`
+  native_binary: `${LOCATE}; exec "$B" "$@"`,
+  node_binary: `${LOCATE}; ${NODE_PRESENT}; exec "$B" "$@"`,
+  node_script: `[ -f "$0" ] || exit 0; ${NODE_PRESENT}; exec node "$0" "$@"`
 };
 var BINARY_GUARDS = {
   native: "native_binary",

package/dist/{chunk-7G5VO76N.js → chunk-OT4YD54Q.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-6MTNS63X.js";
 import {
   resolveInstallSourceFor
-} from "./chunk-7C5CJC3H.js";
+} from "./chunk-Y3UTTFTZ.js";
 import {
   configFilePath
 } from "./chunk-2UMNXADU.js";

package/dist/{chunk-VZNDR3Z7.js → chunk-QBWYNVKY.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-VPJAAGD4.js";
+} from "./chunk-B3V2H6SA.js";
 import {
   readJsonSafe
 } from "./chunk-6MTNS63X.js";

package/dist/{chunk-MTKR4YLW.js → chunk-SJVLFIYP.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VT4IVERX.js";
 import {
   pusharyDir
-} from "./chunk-VPJAAGD4.js";
+} from "./chunk-B3V2H6SA.js";
 import {
   getMachineId
 } from "./chunk-RN3NOEJF.js";