@pushary/agent-hooks 0.89.13 → 0.90.1

package/dist/{chunk-N4QJ3CLX.js → chunk-L4E2BIJ2.js}

@@ -5,7 +5,7 @@ import {
   FILE_TARGET_TOOLS,
   redactSecrets,
   redactSecretsDeep
-} from "./chunk-QINYXLA5.js";
+} from "./chunk-VNMKIJZB.js";
 
 // ../hook-mapping/src/describe.ts
 import { isAbsolute, relative, resolve } from "path";
@@ -44,6 +44,48 @@ var eventPrefixes = {
   Read: (input) => `read: ${input.file_path ?? "unknown"}`,
   TodoWrite: (input) => describeTodoProgress(input.todos)
 };
+var MCP_TOOL_PREFIX = "mcp__";
+var parseMcpToolName = (toolName) => {
+  if (!toolName.startsWith(MCP_TOOL_PREFIX)) return void 0;
+  const rest = toolName.slice(MCP_TOOL_PREFIX.length);
+  const split = rest.indexOf("__");
+  if (split <= 0 || split + 2 >= rest.length) return void 0;
+  return { server: rest.slice(0, split), tool: rest.slice(split + 2) };
+};
+var NETWORK_TARGET_KEYS = ["url", "urls", "href", "host", "hosts", "hostname", "domain", "domains"];
+var ABSOLUTE_HTTP_URL = /^https?:\/\//i;
+var HOSTNAME = /^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?::\d{1,5})?$/i;
+var hostOfUrl = (value) => {
+  try {
+    return new URL(value).host || void 0;
+  } catch {
+    return void 0;
+  }
+};
+var hostOf = (value, bareHostnames) => {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  if (ABSOLUTE_HTTP_URL.test(trimmed)) return hostOfUrl(trimmed);
+  return bareHostnames && HOSTNAME.test(trimmed) ? trimmed : void 0;
+};
+var firstHost = (value, bareHostnames) => Array.isArray(value) ? value.map((entry) => hostOf(entry, bareHostnames)).find((host) => host !== void 0) : hostOf(value, bareHostnames);
+var deriveNetworkTarget = (toolInput) => {
+  for (const key of NETWORK_TARGET_KEYS) {
+    const host = firstHost(toolInput[key], true);
+    if (host) return host;
+  }
+  return Object.values(toolInput).map((value) => firstHost(value, false)).find((host) => host !== void 0);
+};
+var describeUnbuiltCall = (toolName, toolInput, format) => {
+  const mcp = parseMcpToolName(toolName);
+  const host = deriveNetworkTarget(toolInput);
+  if (mcp) {
+    if (format === "event") return `called ${mcp.tool} on ${mcp.server}`;
+    return host ? `call ${mcp.tool} on ${mcp.server} to reach ${host}` : `call ${mcp.tool} on ${mcp.server}`;
+  }
+  if (host) return format === "event" ? `accessed ${host}` : `network access to ${host}`;
+  return void 0;
+};
 var EVENT_ACTION_MAX = 120;
 var HOOK_FALLBACK_MAX = 200;
 var UNNAMED_ACTION = "this request";
@@ -51,11 +93,12 @@ var describeToolCall = (toolName, toolInput, format = "hook") => {
   if (!toolName) return "";
   const prefixes = format === "hook" ? hookPrefixes : eventPrefixes;
   const builder = prefixes[toolName];
+  const unbuilt = builder ? void 0 : describeUnbuiltCall(toolName, toolInput ?? {}, format);
   const detail = JSON.stringify(toolInput ?? {});
-  const raw = builder ? builder(toolInput) : format === "hook" ? detail === "{}" || detail === void 0 ? toolName : `${toolName}: ${detail}` : `${toolName}: done`;
+  const raw = builder ? builder(toolInput) : unbuilt ?? (format === "hook" ? detail === "{}" || detail === void 0 ? toolName : `${toolName}: ${detail}` : `${toolName}: done`);
   const redacted = redactSecrets(raw);
   if (format === "event") return redacted.slice(0, EVENT_ACTION_MAX);
-  return builder ? redacted : redacted.slice(0, HOOK_FALLBACK_MAX);
+  return builder || unbuilt ? redacted : redacted.slice(0, HOOK_FALLBACK_MAX);
 };
 var TOOL_TARGET_MAX_LENGTH = 80;
 var deriveCommandHead = (command) => {
@@ -76,7 +119,9 @@ var deriveToolTarget = (toolName, toolInput) => {
     if (dot <= 0) return void 0;
     return base.slice(dot).slice(0, TOOL_TARGET_MAX_LENGTH);
   }
-  return void 0;
+  const mcp = parseMcpToolName(toolName);
+  if (mcp) return mcp.server.slice(0, TOOL_TARGET_MAX_LENGTH);
+  return deriveNetworkTarget(toolInput)?.slice(0, TOOL_TARGET_MAX_LENGTH);
 };
 var SCRIPT_RUNNERS = /* @__PURE__ */ new Set(["npm", "pnpm", "yarn", "bun", "npx", "deno", "rake", "make", "just", "task", "turbo"]);
 var RUN_SUBCOMMANDS = /* @__PURE__ */ new Set(["run", "run-script", "exec", "task"]);
@@ -210,7 +255,7 @@ var rawActionBody = (toolName, toolInput) => {
   if (toolName === "Bash" || toolName === "PowerShell" || toolName === "Monitor" || toolName === "run_shell_command" || toolName === "shell" || toolName === "apply_patch") {
     return firstString(toolInput.command);
   }
-  return void 0;
+  return firstString(toolInput.url, toolInput.href);
 };
 var deriveActionBody = (toolName, toolInput) => {
   try {
@@ -264,11 +309,36 @@ var summarizeStop = (input) => {
   if (running > 0) return `Paused with ${running} background task${running === 1 ? "" : "s"} still running`;
   const crons = countArray(input.session_crons);
   if (crons > 0) return `Idle until a scheduled task wakes it (${crons} pending)`;
-  return summarizeFinalMessage(input.last_assistant_message);
+  return summarizeFinalMessage(input.last_assistant_message ?? input.prompt_response);
+};
+var subagentStopAction = (agentType) => {
+  const name = typeof agentType === "string" ? agentType.replace(/\s+/g, " ").trim() : "";
+  return name ? `${name} subagent finished` : "Subagent finished";
+};
+var subagentStopSummary = (input) => {
+  const message = input.last_assistant_message ?? input.prompt_response;
+  if (typeof message === "string" && message.trim()) return summarizeStop(input);
+  return subagentStopAction(input.agent_type);
+};
+var COMPACTION_TRIGGERS = {
+  manual: "on request",
+  auto: "automatically"
+};
+var compactionAction = (hookEvent, trigger) => {
+  const how = typeof trigger === "string" ? COMPACTION_TRIGGERS[trigger] : void 0;
+  const base = hookEvent === "PostCompact" ? "Compacted context" : "Compacting context";
+  return how ? `${base} ${how}` : base;
 };
 var sessionStartAction = (source) => source === "resume" ? "Session resumed" : "Session started";
 var sessionEndAction = (reason) => typeof reason === "string" && SESSION_END_ACTIONS[reason] || "Session ended";
 var taskTitleFrom = (prompt) => typeof prompt === "string" ? prompt.replace(/\s+/g, " ").trim().slice(0, TASK_TITLE_MAX_LENGTH) || void 0 : void 0;
+var asString = (value) => typeof value === "string" && value.length > 0 ? value : void 0;
+var sessionIdentityOf = (payload) => {
+  const sessionId = asString(payload.session_id);
+  const agentId = asString(payload.agent_id);
+  if (!agentId) return { sessionId };
+  return { sessionId: agentId, parentSessionId: sessionId };
+};
 
 export {
   HOOK_FALLBACK_MAX,
@@ -287,7 +357,10 @@ export {
   deriveBlocker,
   AGENT_IDENTITIES,
   summarizeStop,
+  subagentStopSummary,
+  compactionAction,
   sessionStartAction,
   sessionEndAction,
-  taskTitleFrom
+  taskTitleFrom,
+  sessionIdentityOf
 };

package/dist/{chunk-NBDU3R3G.js → chunk-OSALSIUF.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-BC3VCZ3E.js";
 import {
   resolveInstallSourceFor
-} from "./chunk-ANMHIZZY.js";
+} from "./chunk-JW4KO5AF.js";
 import {
   backupFile,
   readJsonSafe,

package/dist/{chunk-KNLKHJZR.js → chunk-PYA4FLKI.js}

@@ -3,6 +3,10 @@ import {
   openSealedKey,
   publicKeyFingerprint
 } from "./chunk-3EGEA4KH.js";
+import {
+  humanIsTty,
+  writeHuman
+} from "./chunk-QCGNGEGE.js";
 import {
   useColor
 } from "./chunk-5RUIFDTP.js";
@@ -11,7 +15,7 @@ import {
 } from "./chunk-BSZYIAZL.js";
 import {
   reportedInstallSource
-} from "./chunk-ANMHIZZY.js";
+} from "./chunk-JW4KO5AF.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {
@@ -263,16 +267,6 @@ var describeRoundTrip = (outcome) => {
   }
 };
 
-// src/cli/human.ts
-var stream = process.stdout;
-var setHumanStream = (target) => {
-  stream = target;
-};
-var writeHuman = (text) => {
-  stream.write(text);
-};
-var humanIsTty = () => stream === process.stdout && process.stdout.isTTY === true;
-
 // src/onboarding.ts
 import qrcodeTerminal from "qrcode-terminal";
 var paint = (open) => (s) => useColor() ? `${open}${s}\x1B[0m` : s;
@@ -650,6 +644,20 @@ var confirmAppConnection = async (apiKey) => {
   }
   return sendAndConfirm(apiKey, channels);
 };
+var planAppConnect = (channels) => channels.precise && ownedApp(channels) === 0 ? { kind: "unpaired", repair: describeAppRepair(reachVerdict(channels)) ?? [] } : { kind: "send" };
+var connectExistingApp = async (apiKey) => {
+  const probe = await fetchChannels(apiKey);
+  if (probe.kind !== "ok") return describeProbeFailure(probe);
+  const plan = planAppConnect(probe.status);
+  if (plan.kind === "send") {
+    console.log(`  ${check} ${describeExistingConnection(probe.status)}`);
+    return sendAndConfirm(apiKey, probe.status);
+  }
+  console.log(`  ${yellow("!")} No Pushary app of yours is connected to this site, and nothing was paired just now.`);
+  for (const line of plan.repair) console.log(`  ${dim(line)}`);
+  console.log(`  ${dim("No app yet? Get it at")} ${cyan("https://pushary.com/download")}`);
+  return phoneFailure("app_not_paired", plan.repair);
+};
 var printConnectInstructions = async (apiKey) => {
   const probe = await fetchChannels(apiKey);
   if (probe.kind !== "ok") return describeProbeFailure(probe);
@@ -737,6 +745,8 @@ var ackPairing = async (pairId) => {
   } catch {
   }
 };
+var pairFailed = (reason) => ({ kind: "failed", reason });
+var pairingEscapeApplies = (outcome) => outcome.reason === "timeout" || outcome.reason === "expired" || outcome.reason === "cancelled";
 var buildPairLinks = (pairId, publicKeyB64, baseUrl = apiBase(), code = null) => {
   const id = encodeURIComponent(pairId);
   const pk = encodeURIComponent(publicKeyB64);
@@ -760,7 +770,7 @@ var connectViaAppPairing = async (options = {}) => {
   const started = await startPairing(keypair.publicKeyB64);
   if (!started) {
     console.log(`  ${yellow("!")} Couldn't start pairing. Check your connection and try again.`);
-    return null;
+    return pairFailed("unreachable");
   }
   const { pairId, code } = started;
   const { qrLink, universalLink, deepLink } = buildPairLinks(pairId, keypair.publicKeyB64, apiBase(), code);
@@ -800,14 +810,14 @@ var connectViaAppPairing = async (options = {}) => {
   let consecutiveFailures = 0;
   try {
     while (Date.now() < deadline) {
-      if (cancelled) return null;
+      if (cancelled) return pairFailed("cancelled");
       const claim = await claimPairing(pairId);
       if (claim === null) {
         consecutiveFailures += 1;
         if (consecutiveFailures >= PAIR_MAX_CONSECUTIVE_FAILURES) {
           stop(yellow("!"), "Can't reach pushary.com to finish pairing. Check your connection, then re-run setup.");
           await cancelPairing(pairId);
-          return null;
+          return pairFailed("unreachable");
         }
         await sleep(PAIR_POLL_INTERVAL_MS);
         continue;
@@ -820,29 +830,29 @@ var connectViaAppPairing = async (options = {}) => {
         } catch {
           stop(yellow("!"), "Pairing failed to decrypt \u2014 re-run setup to try again");
           await cancelPairing(pairId);
-          return null;
+          return pairFailed("decrypt");
         }
         await ackPairing(pairId);
         stop(check, "App connected");
-        return { apiKey, handle: claim.siteSlug };
+        return { kind: "paired", apiKey, handle: claim.siteSlug };
       }
       if (claim?.status === "expired") {
         stop(yellow("!"), "Pairing expired \u2014 re-run setup to try again");
-        return null;
+        return pairFailed("expired");
       }
       if (claim?.status === "failed") {
         stop(yellow("!"), describePairFailure(claim.reason));
-        return null;
+        return pairFailed("rejected");
       }
       await sleep(PAIR_POLL_INTERVAL_MS);
     }
     stop(yellow("!"), "Timed out waiting for the app");
     await cancelPairing(pairId);
-    return null;
+    return pairFailed("timeout");
   } catch (err) {
     stop(yellow("!"), `Pairing error ${dim(`(${err instanceof Error ? err.message : "network"})`)}`);
     await cancelPairing(pairId);
-    return null;
+    return pairFailed("unreachable");
   } finally {
     process.off("SIGINT", onInterrupt);
   }
@@ -853,10 +863,11 @@ export {
   describeReach,
   verifyRoundTrip,
   describeRoundTrip,
-  setHumanStream,
   fetchChannels,
   connectDevice,
   confirmAppConnection,
+  connectExistingApp,
   printConnectInstructions,
+  pairingEscapeApplies,
   connectViaAppPairing
 };

package/dist/chunk-QCGNGEGE.js

@@ -0,0 +1,15 @@
+// src/cli/human.ts
+var stream = process.stdout;
+var setHumanStream = (target) => {
+  stream = target;
+};
+var writeHuman = (text) => {
+  stream.write(text);
+};
+var humanIsTty = () => stream === process.stdout && process.stdout.isTTY === true;
+
+export {
+  setHumanStream,
+  writeHuman,
+  humanIsTty
+};

package/dist/chunk-S6LYP7QA.js

@@ -0,0 +1,127 @@
+import {
+  HOOK_LOCATOR_BINARY
+} from "./chunk-VNMKIJZB.js";
+
+// src/diagnostics/bridge.ts
+import { execFileSync } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var BRIDGE_BUNDLE_IDENTIFIER = "com.pushary.app";
+var BRIDGE_HELPER_SUFFIX = "/Contents/Helpers/pushary-bridge";
+var BRIDGE_BUNDLE_ROOTS = ["/Applications/Pushary.app", "$HOME/Applications/Pushary.app"];
+var expandHome = (path, home) => path.replaceAll("$HOME", home);
+var parseBridgeStub = (contents, stubPath) => {
+  const helperSuffix = contents.match(/^H=(\S+)$/m)?.[1] ?? BRIDGE_HELPER_SUFFIX;
+  const cachePath = contents.match(/^C="([^"\n]+)"$/m)?.[1] ?? join(dirname(stubPath), ".bridge-cache");
+  const rootsLine = contents.match(/^for P in ((?:"[^"\n]*"\s*)+); do$/m)?.[1];
+  const bundleRoots = rootsLine ? [...rootsLine.matchAll(/"([^"]*)"/g)].map((match) => match[1]) : BRIDGE_BUNDLE_ROOTS;
+  const bundleIdentifier = contents.match(/kMDItemCFBundleIdentifier == "([^"]+)"/)?.[1] ?? BRIDGE_BUNDLE_IDENTIFIER;
+  return { helperSuffix, cachePath, bundleRoots, bundleIdentifier };
+};
+var resolveBridgeStub = (stubPath, probe) => {
+  const contents = probe.readFile(stubPath);
+  if (contents === null) return { kind: "no-stub", stub: stubPath };
+  const shape = parseBridgeStub(contents, stubPath);
+  const helperIn = (bundle) => `${bundle}${shape.helperSuffix}`;
+  const looked = [];
+  for (const root of shape.bundleRoots.map((root2) => expandHome(root2, probe.home))) {
+    looked.push(root);
+    if (probe.exists(helperIn(root))) return { kind: "bundle", helper: helperIn(root), via: "root" };
+  }
+  const cached = shape.cachePath ? probe.readFile(shape.cachePath)?.split("\n")[0]?.trim() : void 0;
+  if (cached) {
+    looked.push(cached);
+    if (probe.exists(helperIn(cached))) return { kind: "bundle", helper: helperIn(cached), via: "cache" };
+  }
+  for (const found of probe.mdfind(shape.bundleIdentifier)) {
+    looked.push(found);
+    if (probe.exists(helperIn(found))) return { kind: "bundle", helper: helperIn(found), via: "spotlight" };
+  }
+  return { kind: "missing", stub: stubPath, looked };
+};
+var BRIDGE_GONE_MESSAGE = "the Mac app is gone but its hooks remain; run pushary setup or reinstall the app";
+var describeBridgeResolution = (resolution) => {
+  switch (resolution.kind) {
+    case "bundle":
+      return `${resolution.helper} (${resolution.via === "root" ? "installed" : resolution.via === "cache" ? "cached path" : "found by Spotlight"})`;
+    case "missing":
+      return BRIDGE_GONE_MESSAGE;
+    case "no-stub":
+      return `${resolution.stub} is not there; ${BRIDGE_GONE_MESSAGE}`;
+  }
+};
+var isBridgeLocator = (executable) => executable !== null && executable.split(/[/\\]/).pop() === HOOK_LOCATOR_BINARY;
+var spotlight = (bundleIdentifier) => {
+  if (process.platform !== "darwin") return [];
+  try {
+    return execFileSync("/usr/bin/mdfind", [`kMDItemCFBundleIdentifier == "${bundleIdentifier}"`], {
+      encoding: "utf-8",
+      timeout: 5e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).split("\n").map((line) => line.trim()).filter((line) => line !== "");
+  } catch {
+    return [];
+  }
+};
+var readOrNull = (path) => {
+  try {
+    return readFileSync(path, "utf-8");
+  } catch {
+    return null;
+  }
+};
+var liveBridgeProbe = () => ({
+  exists: existsSync,
+  readFile: readOrNull,
+  mdfind: spotlight,
+  home: homedir()
+});
+
+// src/diagnostics/service-runtime.ts
+var unescapeXml = (value) => value.replaceAll("&quot;", '"').replaceAll("&apos;", "'").replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&amp;", "&");
+var unquoteSystemd = (value) => value.replaceAll('\\"', '"').replaceAll("\\\\", "\\").replaceAll("%%", "%");
+var readServiceExecPath = (contents, platform) => {
+  if (platform === "darwin") {
+    const program = contents.match(/<key>ProgramArguments<\/key>\s*<array>\s*<string>([^<]*)<\/string>/)?.[1];
+    return program ? unescapeXml(program) : null;
+  }
+  if (platform === "linux") {
+    const exec = contents.match(/^ExecStart="((?:[^"\\]|\\.)*)"/m)?.[1];
+    return exec ? unquoteSystemd(exec) : null;
+  }
+  if (platform === "win32") {
+    const command = contents.match(/<Command>([^<]*)<\/Command>/)?.[1];
+    return command ? unescapeXml(command) : null;
+  }
+  return null;
+};
+var MANAGER_SEGMENTS = [
+  [".nvm", "nvm"],
+  ["nvm", "nvm"],
+  ["fnm", "fnm"],
+  [".fnm", "fnm"],
+  [".volta", "volta"],
+  ["volta", "volta"],
+  [".asdf", "asdf"],
+  ["asdf", "asdf"]
+];
+var versionManagerOf = (execPath) => {
+  const segments = execPath.split(/[/\\]/);
+  for (const segment of segments) {
+    const hit = MANAGER_SEGMENTS.find(([name]) => name === segment);
+    if (hit) return hit[1];
+  }
+  return null;
+};
+var describeVersionManagerPin = (execPath, manager) => `The background service is pinned to ${execPath}, which ${manager} manages. Switching Node versions strands it; run pushary daemon install afterwards.`;
+
+export {
+  resolveBridgeStub,
+  describeBridgeResolution,
+  isBridgeLocator,
+  liveBridgeProbe,
+  readServiceExecPath,
+  versionManagerOf,
+  describeVersionManagerPin
+};

package/dist/{chunk-M3UABYRT.js → chunk-UZNKVRLE.js}

@@ -1,6 +1,6 @@
 import {
   readTranscriptPreference
-} from "./chunk-NBDU3R3G.js";
+} from "./chunk-OSALSIUF.js";
 
 // src/transcript-setting.ts
 var fromEnv = () => {

package/dist/{chunk-FOGW6O2Y.js → chunk-VHWCVD42.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-QINYXLA5.js";
+} from "./chunk-VNMKIJZB.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-QINYXLA5.js → chunk-VNMKIJZB.js}

@@ -91,7 +91,7 @@ var INSTALL_SOURCES = [
 var isInstallSource = (value) => typeof value === "string" && INSTALL_SOURCES.includes(value);
 var normalizeInstallSource = (value) => isInstallSource(value) ? value : "unknown";
 var HOOK_BUDGETS = {
-  claude: { budgetSeconds: 120, guardSeconds: 10 },
+  claude: { budgetSeconds: 600, guardSeconds: 10 },
   codex: { budgetSeconds: 180, guardSeconds: 10 },
   gemini: { budgetSeconds: 180, guardSeconds: 10 },
   // The Cursor gate is a dependency-free .mjs that cannot import this module; it
@@ -1054,6 +1054,8 @@ var resolvePolicyAcross = (config, toolName, modeOverride, toolInputs, cwd, repo
 };
 var isModeStateDegraded = (state) => state?.degraded === true;
 var KILL_REASON = "Stopped by user, this agent was halted from Pushary";
+var PUSHARY_TOOL_PREFIX = "mcp__pushary__";
+var isPusharyOwnTool = (toolName) => toolName.startsWith(PUSHARY_TOOL_PREFIX);
 var strictestScopeVerdict = (scope, paths) => {
   if (paths.length === 0) return evaluateScope(scope, void 0);
   let worst = { outcome: "in_scope" };
@@ -1085,6 +1087,13 @@ var ASKED_IN_EVERY_MODE = new Set(ASKED_IN_EVERY_MODE_TOOLS);
 var isAskedInEveryMode = (toolName) => ASKED_IN_EVERY_MODE.has(toolName);
 var resolveGate = (input) => {
   const { modeState, config, toolName, toolInputs, cwd, repoKey, sessionId } = input;
+  if (isPusharyOwnTool(toolName)) {
+    return {
+      kind: "defer",
+      policy: resolvePolicyAcross(config, toolName, modeState.mode, toolInputs, cwd, repoKey, sessionId),
+      reason: "own_tool"
+    };
+  }
   if (modeState.kill) return { kind: "kill", reason: KILL_REASON };
   const policy = resolvePolicyAcross(config, toolName, modeState.mode, toolInputs, cwd, repoKey, sessionId);
   const verdict = verdictForPolicy(policy);
@@ -1128,9 +1137,11 @@ var modeStateFromResponse = (data) => {
     // Validated rather than cast: a malformed contract must read as no contract,
     // never as one that silently matches nothing.
     scope: isScopeContract(data.scope) ? data.scope : null,
-    degraded: false
+    degraded: false,
+    askHandoff: data.askHandoff === true
   };
 };
+var stoppedOutput = (output, stopReason) => ({ ...output, continue: false, stopReason });
 var claudePreToolUseOutput = (decision, reason, updatedInput) => ({
   hookSpecificOutput: {
     hookEventName: "PreToolUse",
@@ -1362,10 +1373,12 @@ export {
   resolveAutoResolveOrigin,
   resolvePolicy,
   KILL_REASON,
+  isPusharyOwnTool,
   shouldDeferToNativeMode,
   ASKED_IN_EVERY_MODE_TOOLS,
   resolveGate,
   modeStateFromResponse,
+  stoppedOutput,
   claudePreToolUseOutput,
   PENDING_COMMAND_PREFIX,
   pendingCommandEvents,

package/dist/{chunk-CBGGUEKE.js → chunk-Y6BWPERV.js}

@@ -1,22 +1,23 @@
 import {
   pusharyDir
-} from "./chunk-3YGGEDJK.js";
+} from "./chunk-KUZWXPUS.js";
 import {
   readJsonSafe
 } from "./chunk-4LL6LG5X.js";
 
 // src/process-ownership.ts
 import { createHash, randomUUID } from "crypto";
-import { mkdirSync, readdirSync, unlinkSync, writeFileSync } from "fs";
+import { mkdirSync, readdirSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { createConnection, createServer } from "net";
 import { join } from "path";
 var MAX_PROOF_BYTES = 1024;
 var ownershipDir = (options) => options.dir ?? join(pusharyDir(), "processes");
 var proofPath = (dir, sessionId) => join(dir, `${createHash("sha256").update(sessionId).digest("hex")}.json`);
+var isOptionalTimestamp = (value) => value === void 0 || typeof value === "string" && Number.isFinite(Date.parse(value));
 var isProof = (value) => {
   if (!value || typeof value !== "object") return false;
   const proof = value;
-  return typeof proof.sessionId === "string" && Number.isInteger(proof.pid) && proof.pid > 1 && Number.isInteger(proof.port) && proof.port > 0 && proof.port <= 65535 && typeof proof.token === "string" && proof.token.length > 0 && (proof.spawnId === void 0 || typeof proof.spawnId === "string");
+  return typeof proof.sessionId === "string" && Number.isInteger(proof.pid) && proof.pid > 1 && Number.isInteger(proof.port) && proof.port > 0 && proof.port <= 65535 && typeof proof.token === "string" && proof.token.length > 0 && (proof.spawnId === void 0 || typeof proof.spawnId === "string") && isOptionalTimestamp(proof.startedAt) && isOptionalTimestamp(proof.heartbeatAt);
 };
 var removeProof = (path, token) => {
   const current = readJsonSafe(path);
@@ -34,16 +35,74 @@ var processIsAlive = (pid) => {
     return error.code === "EPERM";
   }
 };
-var pruneProofs = (dir) => {
+var fileTimes = (path) => {
+  try {
+    const stat = statSync(path);
+    return { createdAt: stat.birthtimeMs || stat.mtimeMs, modifiedAt: stat.mtimeMs };
+  } catch {
+    return { createdAt: 0, modifiedAt: 0 };
+  }
+};
+var parseTimestamp = (value) => {
+  if (value === void 0) return null;
+  const parsed = Date.parse(value);
+  return Number.isFinite(parsed) ? parsed : null;
+};
+var proofEntry = (proof, path) => {
+  const times = fileTimes(path);
+  const recordedStart = parseTimestamp(proof.startedAt);
+  const startedAt = recordedStart ?? times.createdAt;
+  return {
+    sessionId: proof.sessionId,
+    pid: proof.pid,
+    spawnId: proof.spawnId ?? null,
+    startedAt,
+    lastSeenAt: parseTimestamp(proof.heartbeatAt) ?? recordedStart ?? times.modifiedAt,
+    alive: processIsAlive(proof.pid)
+  };
+};
+var safeUnlink = (path) => {
+  try {
+    unlinkSync(path);
+  } catch {
+  }
+};
+var listProcessProofs = (options = {}) => {
+  const dir = ownershipDir(options);
+  const entries = [];
   try {
     for (const entry of readdirSync(dir, { withFileTypes: true })) {
       if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
       const path = join(dir, entry.name);
       const stored = readJsonSafe(path);
-      if (stored.kind !== "ok" || !isProof(stored.value) || !processIsAlive(stored.value.pid)) unlinkSync(path);
+      if (stored.kind !== "ok" || !isProof(stored.value)) {
+        if (options.reapDead) safeUnlink(path);
+        continue;
+      }
+      const listed = proofEntry(stored.value, path);
+      if (!listed.alive && options.reapDead) safeUnlink(path);
+      entries.push(listed);
     }
   } catch {
   }
+  return entries;
+};
+var pruneProofs = (dir) => {
+  listProcessProofs({ dir, reapDead: true });
+};
+var wasSpawned = (entry) => entry.spawnId !== null;
+var silentSpawnedProofs = (entries, now, silenceMs) => {
+  const freshestByPid = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    freshestByPid.set(entry.pid, Math.max(freshestByPid.get(entry.pid) ?? 0, entry.lastSeenAt));
+  }
+  const reported = /* @__PURE__ */ new Set();
+  return entries.filter((entry) => {
+    if (!entry.alive || !wasSpawned(entry) || reported.has(entry.pid)) return false;
+    if (now - (freshestByPid.get(entry.pid) ?? 0) < silenceMs) return false;
+    reported.add(entry.pid);
+    return true;
+  });
 };
 var startProcessOwnership = (identity, options = {}) => {
   const dir = ownershipDir(options);
@@ -88,7 +147,7 @@ var startProcessOwnership = (identity, options = {}) => {
         return;
       }
       try {
-        proof = { ...identity, port: address.port, token };
+        proof = { ...identity, port: address.port, token, startedAt: (/* @__PURE__ */ new Date()).toISOString() };
         mkdirSync(dir, { recursive: true, mode: 448 });
         pruneProofs(dir);
         writeFileSync(path, JSON.stringify(proof), {
@@ -107,6 +166,14 @@ var startProcessOwnership = (identity, options = {}) => {
   process.once("exit", cleanup);
   return {
     ready,
+    touch(at = Date.now()) {
+      if (stopped || !proof) return;
+      proof = { ...proof, heartbeatAt: new Date(at).toISOString() };
+      try {
+        writeFileSync(path, JSON.stringify(proof), { encoding: "utf8", mode: 384 });
+      } catch {
+      }
+    },
     stop() {
       if (stopped) return;
       stopped = true;
@@ -184,9 +251,25 @@ var verifyProof = (proof, options) => new Promise((resolve) => {
   });
 });
 
+// src/session-idle.ts
+var SESSION_IDLE_TIMEOUT_MS = 10 * 6e4;
+var SESSION_REAP_GRACE_MS = 5 * 6e4;
+var SESSION_REAP_SILENCE_MS = SESSION_IDLE_TIMEOUT_MS + SESSION_REAP_GRACE_MS;
+var idleDeadlinePassed = (idleSince, now, timeoutMs = SESSION_IDLE_TIMEOUT_MS) => idleSince !== null && now - idleSince >= timeoutMs;
+var describeIdleWindow = (timeoutMs) => {
+  const minutes = Math.round(timeoutMs / 6e4);
+  return minutes >= 1 ? `${minutes} minute${minutes === 1 ? "" : "s"}` : `${Math.round(timeoutMs / 1e3)}s`;
+};
+
 export {
+  listProcessProofs,
+  silentSpawnedProofs,
   startProcessOwnership,
   withSpawnProcessOwnership,
   ownsLiveProcess,
-  findLiveProcessBySpawnId
+  findLiveProcessBySpawnId,
+  SESSION_IDLE_TIMEOUT_MS,
+  SESSION_REAP_SILENCE_MS,
+  idleDeadlinePassed,
+  describeIdleWindow
 };