@pushary/agent-hooks 0.87.3 → 0.88.0

package/data/cursor-plugin/scripts/pushary-gate.mjs

@@ -403,6 +403,15 @@ const describeRequest = (input) => {
     // same tool whichever agent called it. That portability is the only reason
     // the policy engine is server-side.
     const toolName = server ? `mcp__${server}__${tool}` : `mcp__${tool}`
+
+    // Never gate Pushary's own MCP tools. Asking Pushary to approve Pushary's
+    // ask_user call deadlocks: the approval cannot be delivered until the call
+    // it is gating goes through. The Claude hook carries the same guard, where
+    // it is a precaution because the matcher does not route these there. Here it
+    // is load-bearing: `beforeMCPExecution` is registered with NO matcher, so
+    // every MCP call reaches this gate, ours included.
+    if (toolName.startsWith('mcp__pushary__')) return null
+
     const params = typeof input.tool_input === 'string'
       ? input.tool_input
       : input.tool_input === undefined ? '' : JSON.stringify(input.tool_input)

package/data/cursor-plugin/scripts/pushary-gate.test.mjs

@@ -64,6 +64,45 @@ describe('what the gate was asked about', () => {
     assert.equal(describeRequest({ command: 'git push' }).toolName, 'Bash')
   })
 
+  /**
+   * `beforeMCPExecution` is registered with NO matcher, so every MCP call in the
+   * editor reaches this gate, ours included. Gating our own tools deadlocks: the
+   * approval for `ask_user` cannot reach the phone until the `ask_user` call it
+   * is gating goes through. With `failClosed: true` on that entry it is worse
+   * than a hang, because a timeout turns into a denial of the user's own
+   * question.
+   *
+   * The Claude hook carries this guard three times over and calls it a
+   * precaution, because its matcher does not route these there. Here it is the
+   * only thing standing between the two.
+   */
+  it('never gates Pushary\'s own MCP tools', () => {
+    for (const tool of ['ask_user', 'wait_for_answer', 'send_notification', 'propose_scope']) {
+      assert.equal(
+        describeRequest({
+          hook_event_name: 'beforeMCPExecution',
+          tool_name: tool,
+          mcp_server_name: 'pushary',
+          tool_input: '{}',
+        }),
+        null,
+        `mcp__pushary__${tool} must reach Cursor's own prompt, not ours`,
+      )
+    }
+
+    // A neighbour whose name merely starts the same way is still gated. The
+    // guard is on the `mcp__pushary__` prefix, not on "contains pushary".
+    assert.equal(
+      describeRequest({
+        hook_event_name: 'beforeMCPExecution',
+        tool_name: 'run',
+        mcp_server_name: 'pushary-clone',
+        tool_input: '{}',
+      }).toolName,
+      'mcp__pushary-clone__run',
+    )
+  })
+
   it('declines an event it does not gate rather than calling it Bash', () => {
     // beforeReadFile is registered by nobody here on purpose: its response
     // schema has no `ask`, so the no-opinion path this gate takes on every error

package/dist/bin/pushary-bell-hook.js

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-YYTLTEGU.js";
+} from "../chunk-WXCHB6BO.js";
 import {
   readHookInput
 } from "../chunk-6CUUA7HO.js";
-import "../chunk-YX6ZKCC5.js";
+import "../chunk-67TNJVJW.js";
 import "../chunk-BC3VCZ3E.js";
 import "../chunk-6MTNS63X.js";
-import "../chunk-KBS53WOE.js";
+import "../chunk-VSCSZ2LI.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-DMW54VWK.js";
+import "../chunk-3JL64GVE.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,19 +5,19 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-YYTLTEGU.js";
+} from "../chunk-WXCHB6BO.js";
 import {
   guardBinary
 } from "../chunk-B7ZBHWOW.js";
 import "../chunk-VT4IVERX.js";
 import {
   claudeSettings
-} from "../chunk-VL5ZNK6V.js";
+} from "../chunk-VHHVGVFQ.js";
 import "../chunk-GIRT7677.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
-import "../chunk-YX6ZKCC5.js";
+import "../chunk-67TNJVJW.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
@@ -31,13 +31,13 @@ import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-6MTNS63X.js";
-import "../chunk-KBS53WOE.js";
+import "../chunk-VSCSZ2LI.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-DMW54VWK.js";
+import "../chunk-3JL64GVE.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/bin/pushary-claude.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   ensureDaemonRunning
-} from "../chunk-KCAFCGGY.js";
+} from "../chunk-OULRSHFB.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
@@ -9,17 +9,17 @@ import {
   generateSessionKey,
   uploadTranscriptRecords,
   wrapSessionKey
-} from "../chunk-QLMX5LLV.js";
+} from "../chunk-LEYXXXRN.js";
 import {
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-LGVHYFIB.js";
+} from "../chunk-3B3PYTKH.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import "../chunk-VT4IVERX.js";
-import "../chunk-VL5ZNK6V.js";
+import "../chunk-VHHVGVFQ.js";
 import {
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
@@ -29,7 +29,7 @@ import {
   getPolicy,
   repoKeyFor,
   reportEvent
-} from "../chunk-VOE4SYPR.js";
+} from "../chunk-MNXG6IIM.js";
 import {
   askUser,
   cancelQuestion,
@@ -39,7 +39,7 @@ import {
   deriveToolTarget,
   describeToolCall,
   scopePathFor
-} from "../chunk-7J67NYK4.js";
+} from "../chunk-F5W3AY6L.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
@@ -47,7 +47,7 @@ import "../chunk-DINDL2CF.js";
 import "../chunk-6MTNS63X.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
-import "../chunk-KBS53WOE.js";
+import "../chunk-VSCSZ2LI.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
 import {
@@ -57,7 +57,7 @@ import {
 import {
   KILL_REASON,
   resolveGate
-} from "../chunk-DMW54VWK.js";
+} from "../chunk-3JL64GVE.js";
 
 // src/wrapper/claudeBinary.ts
 import { statSync } from "fs";

package/dist/bin/pushary-clean.js

@@ -2,18 +2,17 @@
 import {
   removeClaudeMcpServers,
   removePusharySettings
-} from "../chunk-2JYQAW4B.js";
+} from "../chunk-U6HRYNHC.js";
 import {
-  CURSOR_GATE_EVENTS,
   removeInstructionBlock,
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-DPUOW6NS.js";
-import "../chunk-ZGC3W23N.js";
+} from "../chunk-T2XZH7D5.js";
+import "../chunk-DSTZ2RBU.js";
 import {
   removeGeminiSettings
-} from "../chunk-K42RXJPG.js";
+} from "../chunk-MY5A4EPQ.js";
 import "../chunk-ATBKJNWS.js";
 import "../chunk-B7ZBHWOW.js";
 import {
@@ -38,9 +37,9 @@ import {
   removeCodexHookTrust,
   removeCodexHooks,
   vscodePluginDir
-} from "../chunk-VL5ZNK6V.js";
+} from "../chunk-VHHVGVFQ.js";
 import "../chunk-GIRT7677.js";
-import "../chunk-7J67NYK4.js";
+import "../chunk-F5W3AY6L.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
@@ -56,7 +55,9 @@ import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-DMW54VWK.js";
+import {
+  CURSOR_GATE_EVENTS
+} from "../chunk-3JL64GVE.js";
 
 // bin/pushary-clean.ts
 import { existsSync, readFileSync, copyFileSync, readdirSync } from "fs";

package/dist/bin/pushary-codex-bridge.js

@@ -6,19 +6,19 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-TV3UFGT7.js";
-import "../chunk-QLMX5LLV.js";
+} from "../chunk-XFHMGVMX.js";
+import "../chunk-LEYXXXRN.js";
 import {
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-LGVHYFIB.js";
+} from "../chunk-3B3PYTKH.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import {
   resolveBinary
 } from "../chunk-VT4IVERX.js";
-import "../chunk-VL5ZNK6V.js";
+import "../chunk-VHHVGVFQ.js";
 import "../chunk-GIRT7677.js";
 import {
   getMachineId
@@ -28,7 +28,7 @@ import {
   getApiKey,
   getBaseUrl
 } from "../chunk-2UMNXADU.js";
-import "../chunk-DMW54VWK.js";
+import "../chunk-3JL64GVE.js";
 
 // bin/pushary-codex-bridge.ts
 import { existsSync } from "fs";

package/dist/bin/pushary-codex-hook.js

@@ -2,7 +2,7 @@
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-VIHRP25S.js";
+} from "../chunk-4VYELDAH.js";
 import {
   readHookInput
 } from "../chunk-6CUUA7HO.js";
@@ -34,7 +34,7 @@ import {
   toCodexWire,
   toPolicyLookup,
   toPolicyLookups
-} from "../chunk-VOE4SYPR.js";
+} from "../chunk-MNXG6IIM.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -49,13 +49,13 @@ import {
   deriveToolTarget,
   describeToolCall,
   scopePathFor
-} from "../chunk-7J67NYK4.js";
+} from "../chunk-F5W3AY6L.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
-import "../chunk-KBS53WOE.js";
+import "../chunk-VSCSZ2LI.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
 import {
@@ -68,7 +68,7 @@ import {
   hookWaitClamped,
   hookWaitDeadline,
   resolveGate
-} from "../chunk-DMW54VWK.js";
+} from "../chunk-3JL64GVE.js";
 
 // bin/pushary-codex-hook.ts
 import { basename } from "path";
@@ -366,6 +366,12 @@ var asToolResult = (value) => value && typeof value === "object" && !Array.isArr
 var emit = (wire) => {
   if (wire) process.stdout.write(JSON.stringify(wire));
 };
+var emitContext = (event, additionalContext) => {
+  if (!additionalContext) return;
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: { hookEventName: event, additionalContext }
+  }));
+};
 var main = async () => {
   const input = await readHookInput("codex");
   if (!input) {
@@ -381,21 +387,21 @@ var main = async () => {
         break;
       case "PostToolUse": {
         const lookup = toPolicyLookup(input.tool_name ?? "", input.tool_input ?? {}, input.cwd);
-        await handlePostToolUse({
+        emitContext("PostToolUse", await handlePostToolUse({
           tool_name: lookup.tool,
           tool_input: lookup.input,
           tool_result: asToolResult(input.tool_response),
           cwd: input.cwd,
           session_id: input.session_id
-        }, CODEX_AGENT);
+        }, CODEX_AGENT));
         break;
       }
       case "UserPromptSubmit":
-        await handleUserPrompt({
+        emitContext("UserPromptSubmit", await handleUserPrompt({
           prompt: input.prompt,
           cwd: input.cwd,
           session_id: input.session_id
-        }, CODEX_AGENT);
+        }, CODEX_AGENT));
         break;
       case "Stop":
         await handleStop({

package/dist/bin/pushary-codex.js

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import {
   reportEvent
-} from "../chunk-VOE4SYPR.js";
+} from "../chunk-MNXG6IIM.js";
 import {
   askUser,
   waitForAnswer
 } from "../chunk-J3YDT4HM.js";
-import "../chunk-7J67NYK4.js";
+import "../chunk-F5W3AY6L.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
-import "../chunk-KBS53WOE.js";
+import "../chunk-VSCSZ2LI.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
-import "../chunk-DMW54VWK.js";
+import "../chunk-3JL64GVE.js";
 
 // bin/pushary-codex.ts
 import { basename } from "path";

package/dist/bin/pushary-connect.js

@@ -1,22 +1,22 @@
 #!/usr/bin/env node
 import {
   printKeyCheck
-} from "../chunk-TD3M232T.js";
+} from "../chunk-3PSEZOC4.js";
 import {
   confirmAppConnection,
   connectDevice,
   printConnectInstructions
-} from "../chunk-EJL3PJU7.js";
+} from "../chunk-ESARAYRI.js";
 import "../chunk-3EGEA4KH.js";
 import {
   checkApiKey
-} from "../chunk-KFAH6KRE.js";
+} from "../chunk-6BOE5NJZ.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
 import {
   readKeySource
-} from "../chunk-YX6ZKCC5.js";
+} from "../chunk-67TNJVJW.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
@@ -29,7 +29,7 @@ import "../chunk-DINDL2CF.js";
 import "../chunk-6MTNS63X.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
-import "../chunk-KBS53WOE.js";
+import "../chunk-VSCSZ2LI.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
@@ -37,7 +37,7 @@ import {
   EXIT
 } from "../chunk-KZERVKTD.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-DMW54VWK.js";
+import "../chunk-3JL64GVE.js";
 
 // bin/pushary-connect.ts
 exitOnHelpFlag("connect");

package/dist/bin/pushary-daemon.js

@@ -8,7 +8,7 @@ import {
   acquireDaemonLease,
   readDaemonStatus,
   requestDaemonHandoff
-} from "../chunk-KCAFCGGY.js";
+} from "../chunk-OULRSHFB.js";
 import {
   CODEX_BRIDGE_CAPABILITY,
   CODEX_RESUME_CAPABILITY,
@@ -17,7 +17,7 @@ import {
 import {
   findLiveProcessBySpawnId,
   ownsLiveProcess
-} from "../chunk-LGVHYFIB.js";
+} from "../chunk-3B3PYTKH.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
@@ -26,7 +26,7 @@ import {
   resolveGlobalPackageVersion,
   resolvePackageVersionFromBinary
 } from "../chunk-VT4IVERX.js";
-import "../chunk-VL5ZNK6V.js";
+import "../chunk-VHHVGVFQ.js";
 import "../chunk-GIRT7677.js";
 import {
   getMachineId
@@ -44,7 +44,7 @@ import {
   getApiKey,
   getBaseUrl
 } from "../chunk-2UMNXADU.js";
-import "../chunk-DMW54VWK.js";
+import "../chunk-3JL64GVE.js";
 
 // src/spawn-daemon.ts
 import { execFileSync, spawn } from "child_process";

package/dist/bin/pushary-disconnect.js

@@ -2,7 +2,7 @@
 import {
   removeClaudeMcpServers,
   removePusharySettings
-} from "../chunk-2JYQAW4B.js";
+} from "../chunk-U6HRYNHC.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -12,10 +12,10 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-ZGC3W23N.js";
+} from "../chunk-DSTZ2RBU.js";
 import {
   removeGeminiSettings
-} from "../chunk-K42RXJPG.js";
+} from "../chunk-MY5A4EPQ.js";
 import "../chunk-ATBKJNWS.js";
 import "../chunk-B7ZBHWOW.js";
 import "../chunk-VT4IVERX.js";
@@ -31,7 +31,7 @@ import {
   geminiSettings,
   removeCodexHooks,
   removeCodexSettings
-} from "../chunk-VL5ZNK6V.js";
+} from "../chunk-VHHVGVFQ.js";
 import "../chunk-GIRT7677.js";
 import {
   exitOnHelpFlag
@@ -39,7 +39,7 @@ import {
 import "../chunk-GOEXZ5QJ.js";
 import "../chunk-DINDL2CF.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-DMW54VWK.js";
+import "../chunk-3JL64GVE.js";
 
 // bin/pushary-disconnect.ts
 import { readdirSync, readFileSync, rmSync, writeFileSync } from "fs";

package/dist/bin/pushary-doctor.js

@@ -6,12 +6,11 @@ import {
   claudeWired,
   codexWired,
   geminiWired
-} from "../chunk-TAYHEJFF.js";
+} from "../chunk-RSUBLTMP.js";
 import {
   readDaemonStatus
-} from "../chunk-KCAFCGGY.js";
+} from "../chunk-OULRSHFB.js";
 import {
-  CURSOR_GATE_EVENTS,
   agentProbes,
   detectAgent,
   detectAllAgents,
@@ -19,18 +18,18 @@ import {
   isDetected,
   isPluginRegistered,
   vscodeSettingsTargets
-} from "../chunk-DPUOW6NS.js";
+} from "../chunk-T2XZH7D5.js";
 import {
   OPENCODE_PLUGIN_PLACEHOLDER,
   openCodePluginDir,
   openCodePluginFile,
   openCodeWired
-} from "../chunk-ZGC3W23N.js";
+} from "../chunk-DSTZ2RBU.js";
 import {
   GEMINI_HOOK_BINARY,
   hasGeminiHooks,
   missingGeminiHookEvents
-} from "../chunk-K42RXJPG.js";
+} from "../chunk-MY5A4EPQ.js";
 import "../chunk-ATBKJNWS.js";
 import "../chunk-B7ZBHWOW.js";
 import "../chunk-XHKBHWLX.js";
@@ -56,12 +55,12 @@ import {
   readCodexMcpAuth,
   untrustedCodexHookEvents,
   vscodePluginDir
-} from "../chunk-VL5ZNK6V.js";
+} from "../chunk-VHHVGVFQ.js";
 import {
   readLedgerSummary
-} from "../chunk-VIHRP25S.js";
+} from "../chunk-4VYELDAH.js";
 import "../chunk-GIRT7677.js";
-import "../chunk-7J67NYK4.js";
+import "../chunk-F5W3AY6L.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
@@ -71,19 +70,19 @@ import {
   fetchChannels,
   reachVerdict,
   verifyRoundTrip
-} from "../chunk-EJL3PJU7.js";
+} from "../chunk-ESARAYRI.js";
 import "../chunk-3EGEA4KH.js";
 import {
   checkApiKey,
   describeKeyCheck
-} from "../chunk-KFAH6KRE.js";
+} from "../chunk-6BOE5NJZ.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
 import {
   keyPrefix,
   readKeySource
-} from "../chunk-YX6ZKCC5.js";
+} from "../chunk-67TNJVJW.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
@@ -101,7 +100,7 @@ import {
   sendMcpRequest
 } from "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
-import "../chunk-KBS53WOE.js";
+import "../chunk-VSCSZ2LI.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
@@ -111,7 +110,9 @@ import {
 import {
   getBaseUrl
 } from "../chunk-2UMNXADU.js";
-import "../chunk-DMW54VWK.js";
+import {
+  CURSOR_GATE_EVENTS
+} from "../chunk-3JL64GVE.js";
 
 // bin/pushary-doctor.ts
 import { existsSync, readFileSync, writeFileSync } from "fs";

package/dist/bin/pushary-elicitation-hook.js

@@ -27,7 +27,7 @@ import {
   hookWaitDeadline,
   parseAgentQuestionAnswers,
   renderElicitationOutput
-} from "../chunk-DMW54VWK.js";
+} from "../chunk-3JL64GVE.js";
 
 // bin/pushary-elicitation-hook.ts
 import { basename } from "path";

package/dist/bin/pushary-gemini-bridge.js

@@ -5,19 +5,19 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-TV3UFGT7.js";
-import "../chunk-QLMX5LLV.js";
+} from "../chunk-XFHMGVMX.js";
+import "../chunk-LEYXXXRN.js";
 import {
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-LGVHYFIB.js";
+} from "../chunk-3B3PYTKH.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import {
   resolveBinary
 } from "../chunk-VT4IVERX.js";
-import "../chunk-VL5ZNK6V.js";
+import "../chunk-VHHVGVFQ.js";
 import "../chunk-GIRT7677.js";
 import {
   getMachineId
@@ -27,7 +27,7 @@ import {
   getApiKey,
   getBaseUrl
 } from "../chunk-2UMNXADU.js";
-import "../chunk-DMW54VWK.js";
+import "../chunk-3JL64GVE.js";
 
 // bin/pushary-gemini-bridge.ts
 import { existsSync } from "fs";