@pushary/agent-hooks 0.87.2 → 0.87.4

package/dist/bin/pushary-stats.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   readLedgerSummary
-} from "../chunk-7MBDFNUC.js";
+} from "../chunk-VIHRP25S.js";
 import {
   exitOnHelpFlag
 } from "../chunk-SQOFGPNX.js";
@@ -11,7 +11,7 @@ import "../chunk-KZERVKTD.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
-import "../chunk-7YJS2VTG.js";
+import "../chunk-DMW54VWK.js";
 
 // bin/pushary-stats.ts
 exitOnHelpFlag("stats");

package/dist/bin/pushary-status.js

@@ -8,18 +8,18 @@ import {
   describeReach,
   fetchChannels,
   reachVerdict
-} from "../chunk-3LKYBFWA.js";
+} from "../chunk-EJL3PJU7.js";
 import "../chunk-3EGEA4KH.js";
 import {
   checkApiKey,
   describeKeyCheck
-} from "../chunk-A4I5JGCW.js";
+} from "../chunk-KFAH6KRE.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
 import {
   readKeySource
-} from "../chunk-OT4YD54Q.js";
+} from "../chunk-YX6ZKCC5.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
@@ -32,7 +32,7 @@ import "../chunk-DINDL2CF.js";
 import "../chunk-6MTNS63X.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
-import "../chunk-Y3UTTFTZ.js";
+import "../chunk-KBS53WOE.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
@@ -40,7 +40,7 @@ import {
   EXIT
 } from "../chunk-KZERVKTD.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-7YJS2VTG.js";
+import "../chunk-DMW54VWK.js";
 
 // src/status.ts
 var keySourceLine = (source) => {

package/dist/bin/pushary-stop-hook.js

@@ -4,16 +4,17 @@ import {
 } from "../chunk-6CUUA7HO.js";
 import {
   handleStop
-} from "../chunk-V2XPF77V.js";
+} from "../chunk-VOE4SYPR.js";
 import "../chunk-J3YDT4HM.js";
+import "../chunk-7J67NYK4.js";
 import "../chunk-RN3NOEJF.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
-import "../chunk-Y3UTTFTZ.js";
+import "../chunk-KBS53WOE.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-7YJS2VTG.js";
+import "../chunk-DMW54VWK.js";
 
 // bin/pushary-stop-hook.ts
 var main = async () => {

package/dist/bin/pushary-stopfailure-hook.js

@@ -4,16 +4,17 @@ import {
 } from "../chunk-6CUUA7HO.js";
 import {
   handleStopFailure
-} from "../chunk-V2XPF77V.js";
+} from "../chunk-VOE4SYPR.js";
 import "../chunk-J3YDT4HM.js";
+import "../chunk-7J67NYK4.js";
 import "../chunk-RN3NOEJF.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
-import "../chunk-Y3UTTFTZ.js";
+import "../chunk-KBS53WOE.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-7YJS2VTG.js";
+import "../chunk-DMW54VWK.js";
 
 // bin/pushary-stopfailure-hook.ts
 var main = async () => {

package/dist/bin/pushary-upgrade.js

@@ -1,22 +1,22 @@
 #!/usr/bin/env node
 import {
   detectClaudeVersion
-} from "../chunk-HAUTLCMA.js";
+} from "../chunk-ICERLAE2.js";
 import {
   addClaudeMcpServer,
   addPusharyHooks,
   addPusharyToolPermissions
-} from "../chunk-5646VKR4.js";
+} from "../chunk-2JYQAW4B.js";
 import {
   GEMINI_HOOK_BINARY,
   addGeminiHooks,
   addGeminiMcpServer,
   hasGeminiHooks
-} from "../chunk-ZZE6FN7T.js";
+} from "../chunk-K42RXJPG.js";
 import "../chunk-ATBKJNWS.js";
 import {
   guardBinary
-} from "../chunk-M7RYIZX6.js";
+} from "../chunk-B7ZBHWOW.js";
 import {
   execNpm,
   npmErrorMessage,
@@ -37,7 +37,8 @@ import {
   hasCodexHooks,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-B3V2H6SA.js";
+} from "../chunk-NAPRGHZ3.js";
+import "../chunk-GIRT7677.js";
 import {
   exitOnHelpFlag
 } from "../chunk-SQOFGPNX.js";
@@ -52,7 +53,7 @@ import "../chunk-KZERVKTD.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
-import "../chunk-7YJS2VTG.js";
+import "../chunk-DMW54VWK.js";
 
 // bin/pushary-upgrade.ts
 import { existsSync as existsSync2 } from "fs";

package/dist/bin/pushary-wait.js

@@ -4,8 +4,8 @@ import {
 } from "../chunk-IIENZE2J.js";
 import {
   exitOnFailedResponse
-} from "../chunk-JAICP7BA.js";
-import "../chunk-A4I5JGCW.js";
+} from "../chunk-TD3M232T.js";
+import "../chunk-KFAH6KRE.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
@@ -28,7 +28,7 @@ import {
   getApiKey,
   getBaseUrl
 } from "../chunk-2UMNXADU.js";
-import "../chunk-7YJS2VTG.js";
+import "../chunk-DMW54VWK.js";
 
 // bin/pushary-wait.ts
 exitOnHelpFlag("wait");

package/dist/{chunk-5646VKR4.js → chunk-2JYQAW4B.js}

@@ -1,62 +1,16 @@
 import {
-  PRETOOLUSE_GATED_TOOLS,
-  PRETOOLUSE_PHONE_ANSWERED_TOOLS
-} from "./chunk-ATBKJNWS.js";
+  CLAUDE_HOOK_EVENTS,
+  supportedClaudeEvents
+} from "./chunk-K42RXJPG.js";
 import {
   guardBinary
-} from "./chunk-M7RYIZX6.js";
+} from "./chunk-B7ZBHWOW.js";
 import {
-  HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY
-} from "./chunk-7YJS2VTG.js";
+} from "./chunk-DMW54VWK.js";
 
 // src/claude-config.ts
 import { join } from "path";
-
-// src/agent-version.ts
-var parseVersion = (raw) => {
-  const match = raw.match(/(\d+)\.(\d+)\.(\d+)/);
-  return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
-};
-var compareVersion = (a, b) => {
-  for (let index = 0; index < 3; index++) {
-    if (a[index] !== b[index]) return a[index] < b[index] ? -1 : 1;
-  }
-  return 0;
-};
-var atLeast = (version, floor) => compareVersion(version, floor) >= 0;
-
-// src/claude-events.ts
-var GATED_TOOLS = [...PRETOOLUSE_GATED_TOOLS, ...PRETOOLUSE_PHONE_ANSWERED_TOOLS].join("|");
-var MIRRORED_TOOLS = [...PRETOOLUSE_GATED_TOOLS, "TodoWrite"].join("|");
-var ESTABLISHED = [1, 0, 0];
-var OBSERVED = [2, 0, 0];
-var CLAUDE_HOOK_EVENTS = [
-  { event: "PreToolUse", binary: "pushary-hook", matcher: GATED_TOOLS, timeout: HOOK_BUDGETS.claude.budgetSeconds, delivery: "approval", since: ESTABLISHED },
-  { event: "PostToolUse", binary: "pushary-post-hook", matcher: MIRRORED_TOOLS, timeout: 10, delivery: "telemetry", since: ESTABLISHED },
-  { event: "Stop", binary: "pushary-stop-hook", timeout: 10, delivery: "telemetry", since: ESTABLISHED },
-  { event: "UserPromptSubmit", binary: "pushary-prompt-hook", timeout: 10, delivery: "telemetry", since: ESTABLISHED },
-  { event: "Notification", binary: "pushary-notification-hook", matcher: "permission_prompt|idle_prompt|agent_needs_input|agent_completed", timeout: 10, delivery: "telemetry", since: ESTABLISHED },
-  { event: "SessionStart", binary: "pushary-session-start-hook", matcher: "startup|resume|clear", timeout: 10, delivery: "telemetry", since: ESTABLISHED },
-  { event: "SessionEnd", binary: "pushary-session-end-hook", timeout: 10, delivery: "telemetry", since: ESTABLISHED },
-  { event: "StopFailure", binary: "pushary-stopfailure-hook", timeout: 10, delivery: "telemetry", since: ESTABLISHED },
-  { event: "PermissionRequest", binary: "pushary-permission-hook", timeout: HOOK_BUDGETS.claude.budgetSeconds, delivery: "approval", since: ESTABLISHED },
-  { event: "PermissionDenied", binary: "pushary-permission-denied-hook", timeout: 60, delivery: "telemetry", since: ESTABLISHED },
-  // Observability only. Each carries session shape the island cannot get any other
-  // way, and none of them decides anything.
-  { event: "SubagentStart", binary: "pushary-session-start-hook", timeout: 10, delivery: "telemetry", since: OBSERVED },
-  { event: "SubagentStop", binary: "pushary-stop-hook", timeout: 10, delivery: "telemetry", since: OBSERVED },
-  { event: "PreCompact", binary: "pushary-post-hook", matcher: "manual|auto", timeout: 10, delivery: "telemetry", since: OBSERVED },
-  { event: "PostCompact", binary: "pushary-post-hook", matcher: "manual|auto", timeout: 10, delivery: "telemetry", since: OBSERVED },
-  { event: "TeammateIdle", binary: "pushary-notification-hook", timeout: 10, delivery: "telemetry", since: OBSERVED },
-  // An MCP server asking the person for a value, answered from the phone rather
-  // than the terminal. No matcher: Claude Code matches this event on the MCP
-  // server's name, and we have no business preferring one server over another.
-  { event: "Elicitation", binary: "pushary-elicitation-hook", timeout: HOOK_BUDGETS.claude.budgetSeconds, delivery: "approval", since: OBSERVED, cliOnly: true }
-];
-var supportedClaudeEvents = (version) => CLAUDE_HOOK_EVENTS.filter((hook) => version ? atLeast(version, hook.since) : hook.since === ESTABLISHED);
-
-// src/claude-config.ts
 var PUSHARY_MCP_URL = "https://pushary.com/api/mcp/mcp";
 var PUSHARY_PERMISSION_RULE = "mcp__pushary__*";
 var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
@@ -175,8 +129,6 @@ var removePusharySettings = (settings) => {
 };
 
 export {
-  parseVersion,
-  compareVersion,
   addClaudeMcpServer,
   removeClaudeMcpServers,
   addPusharyToolPermissions,

package/dist/chunk-7J67NYK4.js

@@ -0,0 +1,287 @@
+import {
+  ACTION_BODY_MAX,
+  AGENT_LABELS_BY_TYPE,
+  DECISION_LINE_MAX,
+  FILE_TARGET_TOOLS,
+  redactSecrets,
+  redactSecretsDeep
+} from "./chunk-DMW54VWK.js";
+
+// ../hook-mapping/src/describe.ts
+import { isAbsolute, relative, resolve } from "path";
+var hookPrefixes = {
+  Bash: (input) => `bash: ${input.command ?? "(no command)"}`,
+  PowerShell: (input) => `powershell: ${input.command ?? "(no command)"}`,
+  Monitor: (input) => `monitor: ${input.command ?? "(no command)"}`,
+  Write: (input) => `write file: ${input.file_path ?? "(unknown path)"}`,
+  Edit: (input) => `edit file: ${input.file_path ?? "(unknown path)"}`,
+  MultiEdit: (input) => `edit file: ${input.file_path ?? "(unknown path)"}`,
+  Read: (input) => `read file: ${input.file_path ?? "(unknown path)"}`,
+  // Without an entry here the fallback stringifies the whole tool input, and for
+  // ExitPlanMode that input IS the plan: the action line became a truncated dump of
+  // the plan markdown. The plan belongs in the body, not the one-line summary.
+  ExitPlanMode: () => "finished planning and wants to start coding"
+};
+var describeTodoProgress = (todos) => {
+  if (!Array.isArray(todos)) return "updated the plan";
+  const items = todos.filter((t) => !!t && typeof t === "object");
+  const total = items.length;
+  if (total === 0) return "updated the plan";
+  const done = items.filter((t) => t.status === "completed").length;
+  const current = items.find((t) => t.status === "in_progress");
+  const label = current ? [current.activeForm, current.content].find((v) => typeof v === "string" && v.trim().length > 0) : void 0;
+  if (done >= total) return `finished all ${total} tasks`;
+  if (label) return `${label.trim()} (${done}/${total} done)`;
+  return `${done}/${total} tasks done`;
+};
+var eventPrefixes = {
+  Bash: (input) => `ran: ${String(input.command ?? "")}`,
+  PowerShell: (input) => `ran: ${String(input.command ?? "")}`,
+  Monitor: (input) => `ran: ${String(input.command ?? "")}`,
+  Write: (input) => `wrote: ${input.file_path ?? "unknown"}`,
+  Edit: (input) => `edited: ${input.file_path ?? "unknown"}`,
+  MultiEdit: (input) => `edited: ${input.file_path ?? "unknown"}`,
+  Read: (input) => `read: ${input.file_path ?? "unknown"}`,
+  TodoWrite: (input) => describeTodoProgress(input.todos)
+};
+var EVENT_ACTION_MAX = 120;
+var HOOK_FALLBACK_MAX = 200;
+var describeToolCall = (toolName, toolInput, format = "hook") => {
+  const prefixes = format === "hook" ? hookPrefixes : eventPrefixes;
+  const builder = prefixes[toolName];
+  const raw = builder ? builder(toolInput) : format === "hook" ? `${toolName}: ${JSON.stringify(toolInput)}` : `${toolName}: done`;
+  const redacted = redactSecrets(raw);
+  if (format === "event") return redacted.slice(0, EVENT_ACTION_MAX);
+  return builder ? redacted : redacted.slice(0, HOOK_FALLBACK_MAX);
+};
+var TOOL_TARGET_MAX_LENGTH = 80;
+var deriveCommandHead = (command) => {
+  if (typeof command !== "string") return void 0;
+  const head = command.trim().split(/\s+/).slice(0, 2).join(" ");
+  return head ? redactSecrets(head).slice(0, TOOL_TARGET_MAX_LENGTH) : void 0;
+};
+var deriveToolTarget = (toolName, toolInput) => {
+  if (toolName === "Bash" || toolName === "PowerShell" || toolName === "Monitor") {
+    return deriveCommandHead(toolInput.command);
+  }
+  if (FILE_TARGET_TOOLS.has(toolName)) {
+    const filePath = toolInput.file_path;
+    if (typeof filePath !== "string") return void 0;
+    const separator = Math.max(filePath.lastIndexOf("/"), filePath.lastIndexOf("\\"));
+    const base = filePath.slice(separator + 1);
+    const dot = base.lastIndexOf(".");
+    if (dot <= 0) return void 0;
+    return base.slice(dot).slice(0, TOOL_TARGET_MAX_LENGTH);
+  }
+  return void 0;
+};
+var SCRIPT_RUNNERS = /* @__PURE__ */ new Set(["npm", "pnpm", "yarn", "bun", "npx", "deno", "rake", "make", "just", "task", "turbo"]);
+var RUN_SUBCOMMANDS = /* @__PURE__ */ new Set(["run", "run-script", "exec", "task"]);
+var deriveReceiptCommandHead = (command) => {
+  if (typeof command !== "string") return void 0;
+  const tokens = command.trim().split(/\s+/);
+  const [first, second] = tokens;
+  const keep = first && second && SCRIPT_RUNNERS.has(first.toLowerCase()) && RUN_SUBCOMMANDS.has(second.toLowerCase()) ? 3 : 2;
+  const head = tokens.slice(0, keep).join(" ");
+  return head ? redactSecrets(head).slice(0, TOOL_TARGET_MAX_LENGTH) : void 0;
+};
+var RECEIPT_TARGET_MAX_LENGTH = 256;
+var parseApplyPatchOps = (command) => {
+  if (typeof command !== "string") return [];
+  const ops = [];
+  for (const line of command.split("\n")) {
+    const file = line.match(/^\*\*\*\s+(Add|Update|Delete) File:\s+(.+?)\s*$/);
+    if (file) {
+      ops.push({ op: file[1].toLowerCase(), path: file[2] });
+      continue;
+    }
+    const move = line.match(/^\*\*\*\s+Move to:\s+(.+?)\s*$/);
+    if (move) ops.push({ op: "move", path: move[1] });
+  }
+  return ops;
+};
+var parseApplyPatchFiles = (command) => [...new Set(parseApplyPatchOps(command).map((entry) => entry.path))];
+var OPENCODE_TOOL_NAMES = {
+  bash: "Bash",
+  // A shell command reaching outside the worktree asks a second time under its
+  // own key. It is still the same command, and still Bash.
+  external_directory: "Bash",
+  edit: "Edit",
+  patch: "Edit",
+  apply_patch: "Edit",
+  write: "Write",
+  read: "Read",
+  glob: "Glob",
+  grep: "Grep",
+  webfetch: "WebFetch",
+  websearch: "WebSearch",
+  task: "Task"
+};
+var EXIT_CODE_FAILURE = /^Error: Exit code \d+/;
+var isToolResultError = (toolResult) => {
+  try {
+    if (typeof toolResult === "string") return EXIT_CODE_FAILURE.test(toolResult);
+    if (!toolResult || typeof toolResult !== "object") return false;
+    return "error" in toolResult || "is_error" in toolResult;
+  } catch {
+    return false;
+  }
+};
+var toolResultErrorText = (toolResult) => {
+  try {
+    const raw = typeof toolResult === "string" ? toolResult : toolResult && typeof toolResult === "object" ? String(
+      toolResult.error ?? toolResult.stderr ?? ""
+    ) : "";
+    return redactSecrets(raw);
+  } catch {
+    return "";
+  }
+};
+var relativizeReceiptPath = (filePath, cwd) => {
+  if (!cwd || !isAbsolute(filePath)) return filePath;
+  return relative(cwd, filePath);
+};
+var deriveReceiptMeta = (toolName, toolInput, toolResult, cwd) => {
+  try {
+    const ok = !isToolResultError(toolResult);
+    if (toolName === "apply_patch") {
+      const files = parseApplyPatchFiles(toolInput.command);
+      const target = files.length === 1 ? files[0] : toolInput.command;
+      if (typeof target !== "string" || !target) return void 0;
+      return { kind: "edit", target: redactSecrets(target).slice(0, RECEIPT_TARGET_MAX_LENGTH), ok };
+    }
+    const canonicalTool = {
+      run_shell_command: "Bash",
+      write_file: "Write",
+      replace: "Edit"
+    }[toolName] ?? toolName;
+    const canonicalInput = canonicalTool === toolName ? toolInput : {
+      ...toolInput,
+      file_path: toolInput.file_path ?? toolInput.absolute_path ?? toolInput.path
+    };
+    if (FILE_TARGET_TOOLS.has(canonicalTool)) {
+      const filePath = canonicalInput.file_path;
+      if (typeof filePath !== "string" || !filePath) return void 0;
+      return {
+        kind: canonicalTool === "Write" ? "write" : "edit",
+        // A path is an unlikely place for a credential but not an impossible one
+        // (a token in a temp directory name), and this field is persisted.
+        target: redactSecrets(relativizeReceiptPath(filePath, cwd)).slice(0, RECEIPT_TARGET_MAX_LENGTH),
+        ok
+      };
+    }
+    if (canonicalTool === "Bash" || canonicalTool === "PowerShell" || canonicalTool === "Monitor") {
+      const head = deriveReceiptCommandHead(canonicalInput.command);
+      if (!head) return void 0;
+      return {
+        kind: head === "git commit" ? "commit" : "bash",
+        target: head,
+        ok
+      };
+    }
+    return void 0;
+  } catch {
+    return void 0;
+  }
+};
+var scopePathFor = (toolName, toolInput, cwd) => {
+  const meta = deriveReceiptMeta(toolName, toolInput, void 0, cwd);
+  if (!meta) return void 0;
+  return meta.kind === "edit" || meta.kind === "write" ? meta.target : void 0;
+};
+var firstString = (...values) => values.find((v) => typeof v === "string" && v.length > 0);
+var ACTION_BODY_TRUNCATION_MARKER = "\n\u2026 [truncated]";
+var capActionBody = (text) => text.length <= ACTION_BODY_MAX ? text : `${text.slice(0, ACTION_BODY_MAX - ACTION_BODY_TRUNCATION_MARKER.length)}${ACTION_BODY_TRUNCATION_MARKER}`;
+var rawActionBody = (toolName, toolInput) => {
+  if (toolName === "Edit" || toolName === "replace") {
+    const before = firstString(toolInput.old_string);
+    const after = firstString(toolInput.new_string);
+    if (before === void 0 && after === void 0) return firstString(toolInput.diff);
+    return `- ${before ?? ""}
++ ${after ?? ""}`;
+  }
+  if (toolName === "Write" || toolName === "write_file") {
+    return firstString(toolInput.content) ?? firstString(toolInput.diff);
+  }
+  if (toolName === "ExitPlanMode") return firstString(toolInput.plan);
+  if (toolName === "Bash" || toolName === "PowerShell" || toolName === "Monitor" || toolName === "run_shell_command" || toolName === "shell" || toolName === "apply_patch") {
+    return firstString(toolInput.command);
+  }
+  return void 0;
+};
+var deriveActionBody = (toolName, toolInput) => {
+  try {
+    const raw = rawActionBody(toolName, toolInput);
+    if (!raw) return void 0;
+    return capActionBody(redactSecretsDeep(raw));
+  } catch {
+    return void 0;
+  }
+};
+var deriveAction = (toolName, toolInput) => describeToolCall(toolName, toolInput, "hook").slice(0, DECISION_LINE_MAX);
+var BLOCKER_BY_MODE = {
+  push_only: "Approval required before this runs",
+  push_first: "Paused for your approval before continuing",
+  escalate: "Escalated to you after the approval timeout"
+};
+var deriveBlocker = (mode, reason) => {
+  const text = reason?.replace(/\s+/g, " ").trim() || BLOCKER_BY_MODE[mode] || "Waiting for your approval";
+  return text.slice(0, DECISION_LINE_MAX);
+};
+
+// ../hook-mapping/src/map.ts
+import { basename } from "path";
+var AGENT_IDENTITIES = {
+  claude: { type: "claude_code", label: AGENT_LABELS_BY_TYPE.claude_code },
+  codex: { type: "codex", label: AGENT_LABELS_BY_TYPE.codex },
+  gemini: { type: "gemini_cli", label: AGENT_LABELS_BY_TYPE.gemini_cli },
+  cursor: { type: "cursor", label: AGENT_LABELS_BY_TYPE.cursor },
+  vscode: { type: "vscode", label: AGENT_LABELS_BY_TYPE.vscode },
+  opencode: { type: "opencode", label: AGENT_LABELS_BY_TYPE.opencode }
+};
+var TASK_TITLE_MAX_LENGTH = 120;
+var STOP_SUMMARY_MAX_LENGTH = 200;
+var SESSION_END_ACTIONS = {
+  clear: "Session cleared",
+  logout: "Logged out",
+  resume: "Session suspended",
+  prompt_input_exit: "Session ended",
+  bypass_permissions_disabled: "Session ended",
+  other: "Session ended"
+};
+var countArray = (value) => Array.isArray(value) ? value.length : 0;
+var summarizeFinalMessage = (message) => {
+  if (typeof message !== "string") return "Session ended";
+  const collapsed = message.replace(/\s+/g, " ").trim();
+  if (!collapsed) return "Session ended";
+  return collapsed.slice(0, STOP_SUMMARY_MAX_LENGTH);
+};
+var summarizeStop = (input) => {
+  const running = countArray(input.background_tasks);
+  if (running > 0) return `Paused with ${running} background task${running === 1 ? "" : "s"} still running`;
+  const crons = countArray(input.session_crons);
+  if (crons > 0) return `Idle until a scheduled task wakes it (${crons} pending)`;
+  return summarizeFinalMessage(input.last_assistant_message);
+};
+var sessionStartAction = (source) => source === "resume" ? "Session resumed" : "Session started";
+var sessionEndAction = (reason) => typeof reason === "string" && SESSION_END_ACTIONS[reason] || "Session ended";
+var taskTitleFrom = (prompt) => typeof prompt === "string" ? prompt.replace(/\s+/g, " ").trim().slice(0, TASK_TITLE_MAX_LENGTH) || void 0 : void 0;
+
+export {
+  describeToolCall,
+  deriveToolTarget,
+  parseApplyPatchOps,
+  parseApplyPatchFiles,
+  OPENCODE_TOOL_NAMES,
+  isToolResultError,
+  toolResultErrorText,
+  deriveReceiptMeta,
+  scopePathFor,
+  deriveActionBody,
+  deriveAction,
+  deriveBlocker,
+  summarizeStop,
+  sessionStartAction,
+  sessionEndAction,
+  taskTitleFrom
+};

package/dist/{chunk-M7RYIZX6.js → chunk-B7ZBHWOW.js}

@@ -30,8 +30,17 @@ var guardHookCommand = (target, platform = process.platform) => {
 };
 var guardBinary = (path, platform) => guardHookCommand({ kind: "binary", path, runtime: "node" }, platform);
 var guardNodeScript = (script, platform) => guardHookCommand({ kind: "node", script }, platform);
+var guardedArgv = (target, args = [], platform = process.platform) => {
+  const path = target.kind === "node" ? target.script : target.path;
+  if (platform === "win32") {
+    return target.kind === "node" ? ["node", path, ...args] : [path, ...args];
+  }
+  const [shell, ...shellArgs] = HOOK_SHELL.split(/\s+/);
+  return [shell, ...shellArgs, HOOK_GUARD_SCRIPTS[guardKindOf(target)], path, ...args];
+};
 
 export {
   guardBinary,
-  guardNodeScript
+  guardNodeScript,
+  guardedArgv
 };

package/dist/{chunk-QBWYNVKY.js → chunk-BFBAHOGR.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-B3V2H6SA.js";
+} from "./chunk-NAPRGHZ3.js";
 import {
   readJsonSafe
 } from "./chunk-6MTNS63X.js";

package/dist/{chunk-7YJS2VTG.js → chunk-DMW54VWK.js}

@@ -54,7 +54,13 @@ var HOOK_BUDGETS = {
   // The Cursor gate is a dependency-free .mjs that cannot import this module; it
   // mirrors these as MAX_BLOCK_MS (45s) inside its 60s failClosed budget.
   cursor: { budgetSeconds: 60, guardSeconds: 15 },
-  vscode: { budgetSeconds: 60, guardSeconds: 15 }
+  vscode: { budgetSeconds: 60, guardSeconds: 15 },
+  // OpenCode kills nothing and waits forever: `Permission.ask` blocks on a
+  // `Deferred` with no deadline of its own, so this budget is ours to choose
+  // rather than one we are told. Chosen to match Claude Code, because what it
+  // bounds is how long the person's tool call sits unanswered before Pushary
+  // stops asking and hands it back to the terminal.
+  opencode: { budgetSeconds: 120, guardSeconds: 10 }
 };
 var hookMaxWaitSeconds = (agent) => Math.max(HOOK_BUDGETS[agent].budgetSeconds - HOOK_BUDGETS[agent].guardSeconds, 1);
 var hookWaitDeadline = (startMs, policyWaitSeconds, agent, nowMs) => {
@@ -75,9 +81,11 @@ var AGENT_LABELS_BY_TYPE = {
   hermes: "Hermes",
   cursor: "Cursor",
   vscode: "VS Code",
+  opencode: "OpenCode",
   windsurf: "Windsurf",
   unknown: "Agent"
 };
+var OPENCODE_APPROVAL_EVENT = "permission.ask";
 var HOOK_LOCATOR_BINARY = "pushary-bridge";
 var HOOK_BATCH_MAX_BYTES = 4 * 1024 * 1024;
 var REPO_KEY_MAX_LENGTH = 200;
@@ -1093,6 +1101,8 @@ var gateOutputFor = (source, event, decision, reason) => {
     }
   } else if (source === "gemini" && event === "BeforeTool" && decision !== "ask") {
     output = decision === "allow" ? { decision: "allow" } : { decision: "deny", reason: reason ?? "Denied from Pushary" };
+  } else if (source === "opencode" && event === OPENCODE_APPROVAL_EVENT) {
+    output = decision === "deny" ? { status: "deny", reason: reason ?? "Denied from Pushary" } : { status: decision };
   } else if (source === "cursor" && event === "beforeShellExecution") {
     output = decision === "allow" ? { permission: "allow" } : decision === "ask" ? { permission: "ask" } : {
       permission: "deny",
@@ -1122,6 +1132,7 @@ export {
   hookWaitClamped,
   effectiveWaitSeconds,
   AGENT_LABELS_BY_TYPE,
+  OPENCODE_APPROVAL_EVENT,
   HOOK_LOCATOR_BINARY,
   normalizeRepoRemote,
   localRepoKey,

package/dist/{chunk-3LKYBFWA.js → chunk-EJL3PJU7.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-BSZYIAZL.js";
 import {
   reportedInstallSource
-} from "./chunk-Y3UTTFTZ.js";
+} from "./chunk-KBS53WOE.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {

package/dist/chunk-GIRT7677.js

@@ -0,0 +1,11 @@
+// src/canonical-json.ts
+var canonicalJson = (value) => {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return "[" + value.map(canonicalJson).join(",") + "]";
+  const record = value;
+  return "{" + Object.keys(record).sort().map((key) => JSON.stringify(key) + ":" + canonicalJson(record[key])).join(",") + "}";
+};
+
+export {
+  canonicalJson
+};

package/dist/{chunk-SJVLFIYP.js → chunk-H5PIPIKQ.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VT4IVERX.js";
 import {
   pusharyDir
-} from "./chunk-B3V2H6SA.js";
+} from "./chunk-NAPRGHZ3.js";
 import {
   getMachineId
 } from "./chunk-RN3NOEJF.js";

package/dist/{chunk-HAUTLCMA.js → chunk-ICERLAE2.js}

@@ -1,6 +1,6 @@
 import {
   parseVersion
-} from "./chunk-5646VKR4.js";
+} from "./chunk-K42RXJPG.js";
 
 // src/setup/agent-probe.ts
 import { execSync } from "child_process";