@pushary/agent-hooks 0.87.2 → 0.87.3

package/dist/{chunk-HAUTLCMA.js → chunk-ICERLAE2.js}

@@ -1,6 +1,6 @@
 import {
   parseVersion
-} from "./chunk-5646VKR4.js";
+} from "./chunk-K42RXJPG.js";
 
 // src/setup/agent-probe.ts
 import { execSync } from "child_process";

package/dist/{chunk-ZZE6FN7T.js → chunk-K42RXJPG.js}

@@ -1,7 +1,11 @@
+import {
+  PRETOOLUSE_GATED_TOOLS,
+  PRETOOLUSE_PHONE_ANSWERED_TOOLS
+} from "./chunk-ATBKJNWS.js";
 import {
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY
-} from "./chunk-7YJS2VTG.js";
+} from "./chunk-DMW54VWK.js";
 
 // src/gemini-config.ts
 var GEMINI_HOOK_BINARY = "pushary-gemini-hook";
@@ -102,7 +106,54 @@ var missingGeminiHookEvents = (settings) => {
   }).map((definition) => definition.event);
 };
 
+// src/agent-version.ts
+var parseVersion = (raw) => {
+  const match = raw.match(/(\d+)\.(\d+)\.(\d+)/);
+  return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
+};
+var compareVersion = (a, b) => {
+  for (let index = 0; index < 3; index++) {
+    if (a[index] !== b[index]) return a[index] < b[index] ? -1 : 1;
+  }
+  return 0;
+};
+var atLeast = (version, floor) => compareVersion(version, floor) >= 0;
+
+// src/claude-events.ts
+var GATED_TOOLS = [...PRETOOLUSE_GATED_TOOLS, ...PRETOOLUSE_PHONE_ANSWERED_TOOLS].join("|");
+var MIRRORED_TOOLS = [...PRETOOLUSE_GATED_TOOLS, "TodoWrite"].join("|");
+var ESTABLISHED = [1, 0, 0];
+var OBSERVED = [2, 0, 0];
+var CLAUDE_HOOK_EVENTS = [
+  { event: "PreToolUse", binary: "pushary-hook", matcher: GATED_TOOLS, timeout: HOOK_BUDGETS.claude.budgetSeconds, delivery: "approval", since: ESTABLISHED },
+  { event: "PostToolUse", binary: "pushary-post-hook", matcher: MIRRORED_TOOLS, timeout: 10, delivery: "telemetry", since: ESTABLISHED },
+  { event: "Stop", binary: "pushary-stop-hook", timeout: 10, delivery: "telemetry", since: ESTABLISHED },
+  { event: "UserPromptSubmit", binary: "pushary-prompt-hook", timeout: 10, delivery: "telemetry", since: ESTABLISHED },
+  { event: "Notification", binary: "pushary-notification-hook", matcher: "permission_prompt|idle_prompt|agent_needs_input|agent_completed", timeout: 10, delivery: "telemetry", since: ESTABLISHED },
+  { event: "SessionStart", binary: "pushary-session-start-hook", matcher: "startup|resume|clear", timeout: 10, delivery: "telemetry", since: ESTABLISHED },
+  { event: "SessionEnd", binary: "pushary-session-end-hook", timeout: 10, delivery: "telemetry", since: ESTABLISHED },
+  { event: "StopFailure", binary: "pushary-stopfailure-hook", timeout: 10, delivery: "telemetry", since: ESTABLISHED },
+  { event: "PermissionRequest", binary: "pushary-permission-hook", timeout: HOOK_BUDGETS.claude.budgetSeconds, delivery: "approval", since: ESTABLISHED },
+  { event: "PermissionDenied", binary: "pushary-permission-denied-hook", timeout: 60, delivery: "telemetry", since: ESTABLISHED },
+  // Observability only. Each carries session shape the island cannot get any other
+  // way, and none of them decides anything.
+  { event: "SubagentStart", binary: "pushary-session-start-hook", timeout: 10, delivery: "telemetry", since: OBSERVED },
+  { event: "SubagentStop", binary: "pushary-stop-hook", timeout: 10, delivery: "telemetry", since: OBSERVED },
+  { event: "PreCompact", binary: "pushary-post-hook", matcher: "manual|auto", timeout: 10, delivery: "telemetry", since: OBSERVED },
+  { event: "PostCompact", binary: "pushary-post-hook", matcher: "manual|auto", timeout: 10, delivery: "telemetry", since: OBSERVED },
+  { event: "TeammateIdle", binary: "pushary-notification-hook", timeout: 10, delivery: "telemetry", since: OBSERVED },
+  // An MCP server asking the person for a value, answered from the phone rather
+  // than the terminal. No matcher: Claude Code matches this event on the MCP
+  // server's name, and we have no business preferring one server over another.
+  { event: "Elicitation", binary: "pushary-elicitation-hook", timeout: HOOK_BUDGETS.claude.budgetSeconds, delivery: "approval", since: OBSERVED, cliOnly: true }
+];
+var supportedClaudeEvents = (version) => CLAUDE_HOOK_EVENTS.filter((hook) => version ? atLeast(version, hook.since) : hook.since === ESTABLISHED);
+
 export {
+  parseVersion,
+  compareVersion,
+  CLAUDE_HOOK_EVENTS,
+  supportedClaudeEvents,
   GEMINI_HOOK_BINARY,
   addGeminiMcpServer,
   addGeminiHooks,

package/dist/{chunk-Y3UTTFTZ.js → chunk-KBS53WOE.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-2UMNXADU.js";
 import {
   normalizeInstallSource
-} from "./chunk-7YJS2VTG.js";
+} from "./chunk-DMW54VWK.js";
 
 // src/install-source.ts
 import { readFileSync } from "fs";

package/dist/{chunk-SJVLFIYP.js → chunk-KCAFCGGY.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VT4IVERX.js";
 import {
   pusharyDir
-} from "./chunk-B3V2H6SA.js";
+} from "./chunk-VL5ZNK6V.js";
 import {
   getMachineId
 } from "./chunk-RN3NOEJF.js";

package/dist/{chunk-A4I5JGCW.js → chunk-KFAH6KRE.js}

@@ -12,7 +12,7 @@ import {
 } from "./chunk-2UMNXADU.js";
 import {
   isValidApiKey
-} from "./chunk-7YJS2VTG.js";
+} from "./chunk-DMW54VWK.js";
 
 // src/session.ts
 var IDENTITY_PATH = "/api/v1/server/identity";

package/dist/{chunk-QBWYNVKY.js → chunk-LGVHYFIB.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-B3V2H6SA.js";
+} from "./chunk-VL5ZNK6V.js";
 import {
   readJsonSafe
 } from "./chunk-6MTNS63X.js";

package/dist/{chunk-HJ44HIUW.js → chunk-OMA2OZRE.js}

@@ -5,25 +5,19 @@ import {
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-7MBDFNUC.js";
+} from "./chunk-VIHRP25S.js";
 import {
   denyReasonFrom,
   isDeferAnswer
 } from "./chunk-YHG74UFF.js";
 import {
-  deriveAction,
-  deriveActionBody,
-  deriveBlocker,
-  deriveToolTarget,
-  describeToolCall,
   fetchModeState,
   getPolicy,
   readLastPrompt,
   readLastUserPrompt,
   repoKeyFor,
-  scopePathFor,
   throttlePass
-} from "./chunk-V2XPF77V.js";
+} from "./chunk-VOE4SYPR.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -32,6 +26,14 @@ import {
   savePendingQuestion,
   sendNotification
 } from "./chunk-J3YDT4HM.js";
+import {
+  deriveAction,
+  deriveActionBody,
+  deriveBlocker,
+  deriveToolTarget,
+  describeToolCall,
+  scopePathFor
+} from "./chunk-7J67NYK4.js";
 import {
   getMachineId
 } from "./chunk-RN3NOEJF.js";
@@ -48,7 +50,7 @@ import {
   hookWaitDeadline,
   parseAgentQuestionAnswers,
   resolveGate
-} from "./chunk-7YJS2VTG.js";
+} from "./chunk-DMW54VWK.js";
 
 // src/decision-episode.ts
 var EPISODE_PATH = "/api/agent/decision-episode";

package/dist/{chunk-ECEUMWBH.js → chunk-QLMX5LLV.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-2UMNXADU.js";
 import {
   redactSecrets
-} from "./chunk-7YJS2VTG.js";
+} from "./chunk-DMW54VWK.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";

package/dist/{chunk-XW5CHAQX.js → chunk-TAYHEJFF.js}

@@ -1,9 +1,9 @@
 import {
   hasGeminiHooks
-} from "./chunk-ZZE6FN7T.js";
+} from "./chunk-K42RXJPG.js";
 import {
   hasCodexHooks
-} from "./chunk-B3V2H6SA.js";
+} from "./chunk-VL5ZNK6V.js";
 
 // src/diagnostics/wiring.ts
 var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;

package/dist/{chunk-JAICP7BA.js → chunk-TD3M232T.js}

@@ -1,7 +1,7 @@
 import {
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-A4I5JGCW.js";
+} from "./chunk-KFAH6KRE.js";
 import {
   createIo
 } from "./chunk-5RUIFDTP.js";

package/dist/{chunk-WLLBFDVY.js → chunk-TV3UFGT7.js}

@@ -5,7 +5,7 @@ import {
   generateSessionKey,
   uploadTranscriptRecords,
   wrapSessionKey
-} from "./chunk-ECEUMWBH.js";
+} from "./chunk-QLMX5LLV.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;

package/dist/{chunk-7MBDFNUC.js → chunk-VIHRP25S.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-7YJS2VTG.js";
+} from "./chunk-DMW54VWK.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-B3V2H6SA.js → chunk-VL5ZNK6V.js}

@@ -1,7 +1,10 @@
+import {
+  canonicalJson
+} from "./chunk-GIRT7677.js";
 import {
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY
-} from "./chunk-7YJS2VTG.js";
+} from "./chunk-DMW54VWK.js";
 
 // src/codex-config.ts
 import { createHash } from "crypto";
@@ -20,7 +23,11 @@ var CODEX_HOOK_EVENTS = [
   { event: "PostToolUse", matcher: "Bash|apply_patch", delivery: "telemetry", timeout: 10 },
   { event: "UserPromptSubmit", delivery: "telemetry", timeout: 10 },
   { event: "Stop", delivery: "telemetry", timeout: 10 },
-  { event: "SessionStart", matcher: "startup|resume", delivery: "telemetry", timeout: 10 }
+  { event: "SessionStart", matcher: "startup|resume", delivery: "telemetry", timeout: 10 },
+  // Codex caps SessionEnd at 3s and defaults it to 1s, unlike every other event
+  // here. It also runs synchronously whatever `async` says, so the handler must
+  // fit the window rather than assume the 10s Claude Code allows.
+  { event: "SessionEnd", delivery: "telemetry", timeout: 3 }
 ];
 var CODEX_EVENT_KEY = {
   PermissionRequest: "permission_request",
@@ -28,8 +35,10 @@ var CODEX_EVENT_KEY = {
   PostToolUse: "post_tool_use",
   UserPromptSubmit: "user_prompt_submit",
   Stop: "stop",
-  SessionStart: "session_start"
+  SessionStart: "session_start",
+  SessionEnd: "session_end"
 };
+var codexEventKeyOf = (event) => event.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase();
 var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 var ensureRecord = (target, key) => {
   const existing = asRecord(target[key]);
@@ -121,19 +130,39 @@ var missingCodexHookEvents = (config) => {
     return !Array.isArray(entries) || !entries.some(isPusharyCodexHook);
   }).map((definition) => definition.event);
 };
-var canonicalJson = (value) => {
-  if (value === null || typeof value !== "object") return JSON.stringify(value);
-  if (Array.isArray(value)) return "[" + value.map(canonicalJson).join(",") + "]";
-  const obj = value;
-  return "{" + Object.keys(obj).sort().map((key) => JSON.stringify(key) + ":" + canonicalJson(obj[key])).join(",") + "}";
-};
 var codexHookTrustHash = (definition, command) => {
-  const hook = { async: false, command, timeout: definition.timeout, type: "command" };
+  const hook = { command, timeout: definition.timeout, type: "command" };
   if (definition.statusMessage) hook.statusMessage = definition.statusMessage;
-  const identity = { event_name: CODEX_EVENT_KEY[definition.event], hooks: [hook] };
-  if (definition.matcher) identity.matcher = definition.matcher;
+  const entry = { hooks: [hook] };
+  if (definition.matcher) entry.matcher = definition.matcher;
+  return codexEntryTrustHash(CODEX_EVENT_KEY[definition.event], entry);
+};
+var codexEntryTrustHash = (eventKey, entry) => {
+  const hooks = Array.isArray(entry.hooks) ? entry.hooks : [];
+  const identity = {
+    event_name: eventKey,
+    hooks: hooks.map((hook) => ({ async: false, ...asRecord(hook) }))
+  };
+  if (typeof entry.matcher === "string") identity.matcher = entry.matcher;
   return "sha256:" + createHash("sha256").update(canonicalJson(identity), "utf8").digest("hex");
 };
+var codexTrustSchemeAgrees = (hooksConfig, config, hooksJsonPath) => {
+  const hooks = asRecord(hooksConfig?.hooks);
+  const state = asRecord(asRecord(config.hooks)?.state);
+  if (!hooks || !state) return false;
+  for (const [event, entries] of Object.entries(hooks)) {
+    if (!Array.isArray(entries)) continue;
+    const eventKey = CODEX_EVENT_KEY[event] ?? codexEventKeyOf(event);
+    for (const [index, entry] of entries.entries()) {
+      const record = asRecord(entry);
+      if (!record) continue;
+      const stored = asRecord(state[`${hooksJsonPath}:${eventKey}:${index}:0`])?.trusted_hash;
+      if (typeof stored !== "string") continue;
+      if (stored === codexEntryTrustHash(eventKey, record)) return true;
+    }
+  }
+  return false;
+};
 var codexHookPositions = (hooksConfig) => {
   const hooks = asRecord(hooksConfig?.hooks);
   const positions = {};
@@ -237,8 +266,10 @@ export {
   removeCodexHooks,
   hasCodexHooks,
   missingCodexHookEvents,
+  codexTrustSchemeAgrees,
   codexHookPositions,
   untrustedCodexHookEvents,
+  removeCodexHookTrust,
   removeCodexSettings,
   addCodexHookTrust,
   claudeSettings,