@pushary/agent-hooks 0.89.8 → 0.89.10

package/dist/bin/pushary-stop-hook.js

@@ -4,19 +4,19 @@ import {
 } from "../chunk-6CUUA7HO.js";
 import {
   handleStop
-} from "../chunk-4XZCDSNG.js";
-import "../chunk-GKAKAOKC.js";
-import "../chunk-KOPUTJQC.js";
-import "../chunk-DKDDLF5P.js";
-import "../chunk-GMI5QZLG.js";
+} from "../chunk-GTZLL7F4.js";
+import "../chunk-UXHMWF4H.js";
+import "../chunk-TG3T3M4K.js";
+import "../chunk-DKWM5T3P.js";
+import "../chunk-QA72MKIT.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
-import "../chunk-OFRNZWC4.js";
+import "../chunk-IUWRVTQK.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
 import "../chunk-XX2V4QS5.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-L4C2JXJS.js";
+import "../chunk-X6RXX2NF.js";
 
 // bin/pushary-stop-hook.ts
 var main = async () => {

package/dist/bin/pushary-stopfailure-hook.js

@@ -4,19 +4,19 @@ import {
 } from "../chunk-6CUUA7HO.js";
 import {
   handleStopFailure
-} from "../chunk-4XZCDSNG.js";
-import "../chunk-GKAKAOKC.js";
-import "../chunk-KOPUTJQC.js";
-import "../chunk-DKDDLF5P.js";
-import "../chunk-GMI5QZLG.js";
+} from "../chunk-GTZLL7F4.js";
+import "../chunk-UXHMWF4H.js";
+import "../chunk-TG3T3M4K.js";
+import "../chunk-DKWM5T3P.js";
+import "../chunk-QA72MKIT.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
-import "../chunk-OFRNZWC4.js";
+import "../chunk-IUWRVTQK.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
 import "../chunk-XX2V4QS5.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-L4C2JXJS.js";
+import "../chunk-X6RXX2NF.js";
 
 // bin/pushary-stopfailure-hook.ts
 var main = async () => {

package/dist/bin/pushary-upgrade.js

@@ -1,26 +1,31 @@
 #!/usr/bin/env node
 import {
   reapplyAllAgents
-} from "../chunk-EA3E74P2.js";
-import "../chunk-J2JZJZKB.js";
-import "../chunk-BAE45YLP.js";
-import "../chunk-VA7VUNRD.js";
-import "../chunk-ATBKJNWS.js";
-import "../chunk-AIGDBRIJ.js";
+} from "../chunk-PZRWFWSR.js";
+import "../chunk-KVE5RCQL.js";
+import "../chunk-FZ73G2RO.js";
 import {
+  waitForMachineReadiness
+} from "../chunk-TY5HVMXT.js";
+import "../chunk-Q223OM5J.js";
+import "../chunk-6EKQZA6R.js";
+import "../chunk-SYUIXXQW.js";
+import {
+  daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   disableDaemonService,
   ensureDaemonRunning,
   hasDaemonServiceDefinition,
   readDaemonStatus,
   replaceDaemonService,
-  stopDaemonService
-} from "../chunk-R2AGKCXL.js";
+  stopDaemonService,
+  waitForDaemonRemoteProof
+} from "../chunk-3SQYKLBW.js";
 import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "../chunk-NKHEHEUM.js";
+} from "../chunk-6XUABEX2.js";
 import {
   needsShell
 } from "../chunk-XHKBHWLX.js";
@@ -28,18 +33,18 @@ import {
   execNpm,
   npmErrorMessage,
   resolveGlobalBinary
-} from "../chunk-PZA7G4CN.js";
-import "../chunk-DKDDLF5P.js";
+} from "../chunk-X4ZUUFKV.js";
+import "../chunk-DKWM5T3P.js";
 import {
   claudeJson,
   codexConfigToml,
   cursorPluginDir,
   geminiSettings,
   vscodePluginDir
-} from "../chunk-GMI5QZLG.js";
+} from "../chunk-QA72MKIT.js";
 import {
   readControlMode
-} from "../chunk-V6N4Q223.js";
+} from "../chunk-3CUDMTL4.js";
 import {
   exitOnHelpFlag
 } from "../chunk-LURY4WNF.js";
@@ -48,13 +53,13 @@ import "../chunk-BC3VCZ3E.js";
 import {
   isNewerVersion
 } from "../chunk-DINDL2CF.js";
-import "../chunk-OFRNZWC4.js";
+import "../chunk-IUWRVTQK.js";
 import "../chunk-KZERVKTD.js";
 import "../chunk-XX2V4QS5.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
-import "../chunk-L4C2JXJS.js";
+import "../chunk-X6RXX2NF.js";
 
 // bin/pushary-upgrade.ts
 import { existsSync } from "fs";
@@ -129,9 +134,10 @@ var finishUpgrade = async () => {
   const controlMode = readControlMode();
   const daemonStatus = readDaemonStatus();
   const serviceWasPresent = daemonStatus.kind !== "absent" || hasDaemonServiceDefinition();
+  const controlCapabilities = detectProviderLiveCapabilities(configuredControlProviders);
   const controlPolicy = resolveControlPolicy({
     mode: controlMode,
-    providerAvailable: hasSpawnProvider(detectProviderLiveCapabilities(configuredControlProviders)),
+    providerAvailable: hasSpawnProvider(controlCapabilities),
     managerAvailable: daemonServiceManagerAvailable(),
     servicePresent: serviceWasPresent
   });
@@ -150,7 +156,9 @@ var finishUpgrade = async () => {
       const service = await replaceDaemonService();
       const daemon = service.kind === "ok" ? await ensureDaemonRunning({ spawnDaemon: () => {
       } }) : null;
-      daemonReady = service.kind === "ok" && (daemon?.kind === "running" || daemon?.kind === "started");
+      const localProof = daemon?.kind === "running" || daemon?.kind === "started" ? await waitForDaemonRemoteProof() : null;
+      const serverProof = localProof && daemonHasRemoteProof(localProof) ? await waitForMachineReadiness(apiKey, ["spawn", ...controlCapabilities]) : null;
+      daemonReady = service.kind === "ok" && localProof !== null && daemonHasRemoteProof(localProof) && (serverProof?.kind === "ready" || serverProof?.kind === "unsupported");
     }
   } else if (controlMode === "on" && controlPolicy === "unsupported") {
     daemonReady = false;

package/dist/bin/pushary-wait.js

@@ -4,8 +4,8 @@ import {
 } from "../chunk-IIENZE2J.js";
 import {
   exitOnFailedResponse
-} from "../chunk-SS72Z7FV.js";
-import "../chunk-I5L6SK5V.js";
+} from "../chunk-253WC6O5.js";
+import "../chunk-BLODMQKJ.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
@@ -28,7 +28,7 @@ import {
   getApiKey,
   getBaseUrl
 } from "../chunk-2UMNXADU.js";
-import "../chunk-L4C2JXJS.js";
+import "../chunk-X6RXX2NF.js";
 
 // bin/pushary-wait.ts
 exitOnHelpFlag("wait");

package/dist/{chunk-SS72Z7FV.js → chunk-253WC6O5.js}

@@ -1,7 +1,7 @@
 import {
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-I5L6SK5V.js";
+} from "./chunk-BLODMQKJ.js";
 import {
   createIo
 } from "./chunk-5RUIFDTP.js";

package/dist/{chunk-T3LRWZKI.js → chunk-2LPEZYMC.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-BSZYIAZL.js";
 import {
   reportedInstallSource
-} from "./chunk-OFRNZWC4.js";
+} from "./chunk-IUWRVTQK.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {

package/dist/{chunk-O5B7EK5U.js → chunk-34GN3IPX.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_BUDGETS,
   OPENCODE_APPROVAL_EVENT
-} from "./chunk-L4C2JXJS.js";
+} from "./chunk-X6RXX2NF.js";
 
 // src/opencode-plugin.ts
 var OPENCODE_PLUGIN_MARKER = "pushary-opencode-plugin w1";

package/dist/{chunk-V6N4Q223.js → chunk-3CUDMTL4.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-BC3VCZ3E.js";
 import {
   resolveInstallSourceFor
-} from "./chunk-OFRNZWC4.js";
+} from "./chunk-IUWRVTQK.js";
 import {
   backupFile,
   readJsonSafe,

package/dist/{chunk-VZKXBFUA.js → chunk-3HFK3UXM.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-L4C2JXJS.js";
+} from "./chunk-X6RXX2NF.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-R2AGKCXL.js → chunk-3SQYKLBW.js}

@@ -4,13 +4,13 @@ import {
 } from "./chunk-XHKBHWLX.js";
 import {
   resolveGlobalBinary
-} from "./chunk-PZA7G4CN.js";
+} from "./chunk-X4ZUUFKV.js";
 import {
   getMachineId
-} from "./chunk-DKDDLF5P.js";
+} from "./chunk-DKWM5T3P.js";
 import {
   pusharyDir
-} from "./chunk-GMI5QZLG.js";
+} from "./chunk-QA72MKIT.js";
 import {
   getPackageVersion
 } from "./chunk-DINDL2CF.js";
@@ -31,6 +31,14 @@ import { createHash, randomUUID } from "crypto";
 import { homedir } from "os";
 import { execFileSync } from "child_process";
 var daemonNeedsHandoff = (status) => status.kind === "version-mismatch" || status.kind === "configuration-mismatch" || status.kind === "unresponsive" && status.processAlive === true;
+var DAEMON_REMOTE_PROOF_MAX_AGE_MS = 18e4;
+var DAEMON_REMOTE_PROOF_CLOCK_SKEW_MS = 3e4;
+var remoteProofIsFresh = (timestamp, now) => {
+  if (timestamp === null) return false;
+  const age = now - Date.parse(timestamp);
+  return Number.isFinite(age) && age >= -DAEMON_REMOTE_PROOF_CLOCK_SKEW_MS && age < DAEMON_REMOTE_PROOF_MAX_AGE_MS;
+};
+var daemonHasRemoteProof = (status, now = Date.now()) => status.kind === "running" && remoteProofIsFresh(status.lastSuccessfulHeartbeatAt, now) && remoteProofIsFresh(status.lastSuccessfulControlAt, now);
 var runDaemonServiceCommand = (command, args) => execFileSync(command, [...args], {
   encoding: "utf-8",
   stdio: ["ignore", "pipe", "ignore"],
@@ -241,7 +249,7 @@ WantedBy=default.target
           "-NoProfile",
           "-NonInteractive",
           "-Command",
-          "$task = @(Get-ScheduledTask -ErrorAction Stop) | Where-Object { $_.TaskName -eq 'Pushary Daemon' -and $_.TaskPath -eq '\\' } | Select-Object -First 1; if ($null -eq $task) { exit 3 }; if ($task.State -eq 'Disabled') { exit 4 }"
+          "$task = @(Get-ScheduledTask -ErrorAction Stop) | Where-Object { $_.TaskName -eq 'Pushary Daemon' -and $_.TaskPath -eq '\\' } | Select-Object -First 1; if ($null -eq $task) { exit 3 }; if ($null -eq $task.Settings -or $null -eq $task.Settings.Enabled) { exit 5 }; if (-not $task.Settings.Enabled) { exit 4 }"
         ],
         negativeExitCodes: [3, 4]
       },
@@ -313,16 +321,10 @@ var applyDaemonService = (action, definition, options = {}) => {
     const steps = action === "uninstall" ? [...definition.stop, ...definition.uninstall] : definition[action];
     runDaemonServiceSteps(steps, run);
     if (action === "uninstall") {
-      let registered = true;
-      try {
-        run(definition.registrationProbe.command, definition.registrationProbe.args);
-      } catch (err) {
-        if (!isExpectedProbeFailure(definition.registrationProbe, err)) {
-          throw new Error(`Could not verify native background service is absent: ${commandFailureOutput(err) || String(err)}`);
-        }
-        registered = false;
-      }
-      if (registered) throw new Error("Native background service remains registered");
+      const state = probeDaemonServiceState(definition, run);
+      if (state.kind !== "ok") throw new Error(`Could not verify native background service is absent: ${state.detail}`);
+      if (state.registered) throw new Error("Native background service remains registered");
+      if (state.running) throw new Error("Native background service remains active");
       safeUnlink(definition.definitionPath);
       const reload = definition.reloadAfterUninstall;
       if (reload) run(reload.command, reload.args);
@@ -412,7 +414,7 @@ var currentConfigurationId = () => {
 var parseDaemonState = (value) => {
   if (typeof value !== "object" || value === null) return null;
   const state = value;
-  if (!isString(state.instanceId) || !Number.isInteger(state.pid) || state.pid <= 0 || !isString(state.version) || !(state.configurationId === void 0 || state.configurationId === null || isString(state.configurationId)) || !isString(state.machineId) || !isTimestamp(state.startedAt) || !isTimestamp(state.updatedAt) || !(state.lastSuccessfulHeartbeatAt === null || isTimestamp(state.lastSuccessfulHeartbeatAt))) return null;
+  if (!isString(state.instanceId) || !Number.isInteger(state.pid) || state.pid <= 0 || !isString(state.version) || !(state.configurationId === void 0 || state.configurationId === null || isString(state.configurationId)) || !isString(state.machineId) || !isTimestamp(state.startedAt) || !isTimestamp(state.updatedAt) || !(state.lastSuccessfulHeartbeatAt === null || isTimestamp(state.lastSuccessfulHeartbeatAt)) || !(state.lastSuccessfulControlAt === void 0 || state.lastSuccessfulControlAt === null || isTimestamp(state.lastSuccessfulControlAt))) return null;
   return {
     instanceId: state.instanceId,
     pid: state.pid,
@@ -421,7 +423,8 @@ var parseDaemonState = (value) => {
     machineId: state.machineId,
     startedAt: state.startedAt,
     updatedAt: state.updatedAt,
-    lastSuccessfulHeartbeatAt: state.lastSuccessfulHeartbeatAt
+    lastSuccessfulHeartbeatAt: state.lastSuccessfulHeartbeatAt,
+    lastSuccessfulControlAt: state.lastSuccessfulControlAt ?? null
   };
 };
 var parseLockOwner = (value) => {
@@ -443,7 +446,8 @@ var readDaemonStatus = (options = {}) => {
       daemonVersion: null,
       startedAt: null,
       updatedAt: null,
-      lastSuccessfulHeartbeatAt: null
+      lastSuccessfulHeartbeatAt: null,
+      lastSuccessfulControlAt: null
     };
   }
   const value = state.kind === "ok" ? parseDaemonState(state.value) : null;
@@ -460,7 +464,8 @@ var readDaemonStatus = (options = {}) => {
       daemonVersion: value.version,
       startedAt: value.startedAt,
       updatedAt: value.updatedAt,
-      lastSuccessfulHeartbeatAt: value.lastSuccessfulHeartbeatAt
+      lastSuccessfulHeartbeatAt: value.lastSuccessfulHeartbeatAt,
+      lastSuccessfulControlAt: value.lastSuccessfulControlAt
     };
   }
   return {
@@ -472,7 +477,8 @@ var readDaemonStatus = (options = {}) => {
     daemonVersion: null,
     startedAt: null,
     updatedAt: null,
-    lastSuccessfulHeartbeatAt: null
+    lastSuccessfulHeartbeatAt: null,
+    lastSuccessfulControlAt: null
   };
 };
 var safeUnlink = (path) => {
@@ -540,7 +546,8 @@ var acquireDaemonLease = (options = {}) => {
     machineId,
     startedAt,
     updatedAt: startedAt,
-    lastSuccessfulHeartbeatAt: null
+    lastSuccessfulHeartbeatAt: null,
+    lastSuccessfulControlAt: null
   };
   try {
     writeJsonAtomic(statePath(dir), state, 384);
@@ -576,6 +583,14 @@ var acquireDaemonLease = (options = {}) => {
           lastSuccessfulHeartbeatAt: timestamp
         });
       },
+      recordSuccessfulControl: (at = now()) => {
+        const timestamp = new Date(at).toISOString();
+        updateState({
+          ...currentState,
+          updatedAt: timestamp,
+          lastSuccessfulControlAt: timestamp
+        });
+      },
       shouldYield: () => {
         if (!isOwner()) return true;
         const target = readJsonSafe(targetPath(dir));
@@ -645,7 +660,8 @@ var deactivateDaemonService = async (action, options) => {
   const platform = options.platform ?? process.platform;
   const supported = ["darwin", "linux", "win32"].includes(platform);
   const managerAvailable = supported && daemonServiceManagerAvailable(options);
-  const service = supported && !managerAvailable ? { kind: "failed", detail: "Native background-service manager is unavailable" } : managerAvailable ? manageDaemonService(action, options) : { kind: "ok" };
+  const absenceMustBeProven = options.requireAbsenceProof || hasDaemonServiceDefinition(options);
+  const service = supported && !managerAvailable && absenceMustBeProven ? { kind: "failed", detail: "Native background-service manager is unavailable" } : managerAvailable ? manageDaemonService(action, options) : { kind: "ok" };
   const stopped = await stopDaemonRunning(options);
   const failures = [
     service.kind === "ok" ? null : service.detail,
@@ -956,8 +972,21 @@ var ensureDaemonRunning = async (options = {}) => {
   }
   return { kind: "unavailable", status, detail: `daemon did not become healthy (${status.kind})` };
 };
+var waitForDaemonRemoteProof = async (options = {}) => {
+  const sleep = options.sleep ?? wait;
+  const pollIntervalMs = options.pollIntervalMs ?? 250;
+  const attempts = Math.max(1, Math.ceil((options.waitTimeoutMs ?? 5e3) / pollIntervalMs));
+  let status = readDaemonStatus(options);
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    status = readDaemonStatus(options);
+    if (daemonHasRemoteProof(status)) return status;
+    if (attempt + 1 < attempts) await sleep(pollIntervalMs);
+  }
+  return status;
+};
 
 export {
+  daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   DAEMON_LEASE_RENEW_INTERVAL_MS,
   parseDaemonAction,
@@ -970,5 +999,6 @@ export {
   stopDaemonService,
   disableDaemonService,
   replaceDaemonService,
-  ensureDaemonRunning
+  ensureDaemonRunning,
+  waitForDaemonRemoteProof
 };

package/dist/{chunk-ATBKJNWS.js → chunk-6EKQZA6R.js}

@@ -1,3 +1,7 @@
+import {
+  ASKED_IN_EVERY_MODE_TOOLS
+} from "./chunk-X6RXX2NF.js";
+
 // src/claude-tools.ts
 var PRETOOLUSE_GATED_TOOLS = [
   "Bash",
@@ -8,7 +12,7 @@ var PRETOOLUSE_GATED_TOOLS = [
   "PowerShell",
   "Monitor"
 ];
-var PRETOOLUSE_PHONE_ANSWERED_TOOLS = ["AskUserQuestion", "ExitPlanMode"];
+var PRETOOLUSE_PHONE_ANSWERED_TOOLS = ASKED_IN_EVERY_MODE_TOOLS;
 var POSTTOOLUSE_MIRRORED_TOOLS = [...PRETOOLUSE_GATED_TOOLS, "TodoWrite"];
 var PRETOOLUSE_HANDLED_TOOLS = /* @__PURE__ */ new Set([...PRETOOLUSE_GATED_TOOLS, ...PRETOOLUSE_PHONE_ANSWERED_TOOLS]);
 

package/dist/{chunk-NKHEHEUM.js → chunk-6XUABEX2.js}

@@ -2,7 +2,7 @@ import {
   resolveBinary,
   resolveGlobalPackageVersion,
   resolvePackageVersionFromBinary
-} from "./chunk-PZA7G4CN.js";
+} from "./chunk-X4ZUUFKV.js";
 
 // src/live-capabilities.ts
 var CLAUDE_BRIDGE_CAPABILITY = "claude-bridge";

package/dist/{chunk-I5L6SK5V.js → chunk-BLODMQKJ.js}

@@ -12,7 +12,7 @@ import {
 } from "./chunk-2UMNXADU.js";
 import {
   isValidApiKey
-} from "./chunk-L4C2JXJS.js";
+} from "./chunk-X6RXX2NF.js";
 
 // src/session.ts
 var IDENTITY_PATH = "/api/v1/server/identity";

package/dist/{chunk-DKDDLF5P.js → chunk-DKWM5T3P.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-GMI5QZLG.js";
+} from "./chunk-QA72MKIT.js";
 import {
   writeFileAtomic
 } from "./chunk-XX2V4QS5.js";

package/dist/{chunk-BAE45YLP.js → chunk-FZ73G2RO.js}

@@ -1,12 +1,12 @@
 import {
   hasGeminiHooks
-} from "./chunk-VA7VUNRD.js";
+} from "./chunk-Q223OM5J.js";
 import {
   hasCodexHooks
-} from "./chunk-GMI5QZLG.js";
+} from "./chunk-QA72MKIT.js";
 import {
   HOOK_LOCATOR_BINARY
-} from "./chunk-L4C2JXJS.js";
+} from "./chunk-X6RXX2NF.js";
 
 // src/diagnostics/wiring.ts
 var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;

package/dist/{chunk-EJT2ER6G.js → chunk-GSSFSVAQ.js}

@@ -1,11 +1,14 @@
 import {
   PRETOOLUSE_HANDLED_TOOLS,
   PRETOOLUSE_PHONE_ANSWERED_TOOLS
-} from "./chunk-ATBKJNWS.js";
+} from "./chunk-6EKQZA6R.js";
+import {
+  defersToNativeMode
+} from "./chunk-NCVIWGVA.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-VZKXBFUA.js";
+} from "./chunk-3HFK3UXM.js";
 import {
   denyReasonFrom,
   isDeferAnswer
@@ -17,7 +20,7 @@ import {
   readLastUserPrompt,
   repoKeyFor,
   throttlePass
-} from "./chunk-4XZCDSNG.js";
+} from "./chunk-GTZLL7F4.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -25,7 +28,7 @@ import {
   pollForAnswer,
   savePendingQuestion,
   sendNotification
-} from "./chunk-GKAKAOKC.js";
+} from "./chunk-UXHMWF4H.js";
 import {
   deriveAction,
   deriveActionBody,
@@ -33,10 +36,10 @@ import {
   deriveToolTarget,
   describeToolCall,
   scopePathFor
-} from "./chunk-KOPUTJQC.js";
+} from "./chunk-TG3T3M4K.js";
 import {
   getMachineId
-} from "./chunk-DKDDLF5P.js";
+} from "./chunk-DKWM5T3P.js";
 import {
   getApiKey,
   getBaseUrl
@@ -50,9 +53,8 @@ import {
   hookWaitDeadline,
   parseAgentQuestionAnswers,
   parseAgentQuestions,
-  resolveGate,
-  shouldDeferToNativeMode
-} from "./chunk-L4C2JXJS.js";
+  resolveGate
+} from "./chunk-X6RXX2NF.js";
 
 // src/decision-episode.ts
 var EPISODE_PATH = "/api/agent/decision-episode";
@@ -302,15 +304,7 @@ var keylessNoticeOnce = (sessionId) => {
   } catch {
   }
 };
-var nativeDeferOptions = () => {
-  const respect = process.env.PUSHARY_RESPECT_PERMISSION_MODE;
-  const bypass = process.env.PUSHARY_DEFER_BYPASS;
-  return {
-    respectPermissionMode: !(respect === "0" || respect === "false"),
-    deferBypass: bypass === "1" || bypass === "true"
-  };
-};
-var shouldDeferToNativeMode2 = (permissionMode, toolName) => shouldDeferToNativeMode(permissionMode, toolName, nativeDeferOptions());
+var shouldDeferToNativeMode = defersToNativeMode;
 var handedToTerminal = (result) => result.suppressed === true || result.noDevices === true || result.status === "terminal";
 var withLabels = (question) => ({
   ...question,
@@ -487,14 +481,14 @@ var handlePreToolUse = async (input) => {
     const policy = await getPolicy(apiKey, modeState.policyVersion, "claude_code", true, input.session_id);
     const verdict = resolveGate(claudeGateInput(modeState, policy, input));
     if (verdict.kind === "kill") return deny(verdict.reason);
+    if (verdict.kind === "deny") return deny(verdict.reason);
     if (input.tool_name === "AskUserQuestion") {
       return handleAskUserQuestion(apiKey, input);
     }
-    if (verdict.kind === "deny") return deny(verdict.reason);
     if (input.tool_name === "ExitPlanMode") {
       return handleExitPlanMode(apiKey, input);
     }
-    if (shouldDeferToNativeMode2(input.permission_mode, input.tool_name)) {
+    if (shouldDeferToNativeMode(input.permission_mode, input.tool_name)) {
       return void 0;
     }
     switch (verdict.kind) {
@@ -525,7 +519,7 @@ var toPermissionRequestOutput = (hookOutput) => {
 };
 var handlePermissionRequest = async (input) => {
   if (PRETOOLUSE_HANDLED_TOOLS.has(input.tool_name)) {
-    const reclaimDeferredExec = !PRETOOLUSE_PHONE_ANSWERED_TOOLS.includes(input.tool_name) && shouldDeferToNativeMode2(input.permission_mode, input.tool_name);
+    const reclaimDeferredExec = !PRETOOLUSE_PHONE_ANSWERED_TOOLS.includes(input.tool_name) && shouldDeferToNativeMode(input.permission_mode, input.tool_name);
     if (!reclaimDeferredExec) return void 0;
   }
   if (input.tool_name.startsWith("mcp__pushary__")) return void 0;

package/dist/{chunk-4XZCDSNG.js → chunk-GTZLL7F4.js}

@@ -12,7 +12,7 @@ import {
   savePendingCommand,
   sendNotification,
   waitForAnswer
-} from "./chunk-GKAKAOKC.js";
+} from "./chunk-UXHMWF4H.js";
 import {
   AGENT_IDENTITIES,
   deriveReceiptMeta,
@@ -26,16 +26,16 @@ import {
   summarizeStop,
   taskTitleFrom,
   toolResultErrorText
-} from "./chunk-KOPUTJQC.js";
+} from "./chunk-TG3T3M4K.js";
 import {
   getMachineId
-} from "./chunk-DKDDLF5P.js";
+} from "./chunk-DKWM5T3P.js";
 import {
   withRetry
 } from "./chunk-BSZYIAZL.js";
 import {
   reportedInstallSource
-} from "./chunk-OFRNZWC4.js";
+} from "./chunk-IUWRVTQK.js";
 import {
   getApiKey,
   getBaseUrl
@@ -51,7 +51,7 @@ import {
   pendingCommandEvents,
   resolveAutoResolveOrigin,
   resolvePolicy
-} from "./chunk-L4C2JXJS.js";
+} from "./chunk-X6RXX2NF.js";
 
 // src/policy.ts
 import { createHash } from "crypto";

package/dist/{chunk-PMHTCDEO.js → chunk-IUN6VOKV.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-2UMNXADU.js";
 import {
   redactSecrets
-} from "./chunk-L4C2JXJS.js";
+} from "./chunk-X6RXX2NF.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";

package/dist/{chunk-OFRNZWC4.js → chunk-IUWRVTQK.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-2UMNXADU.js";
 import {
   normalizeInstallSource
-} from "./chunk-L4C2JXJS.js";
+} from "./chunk-X6RXX2NF.js";
 
 // src/install-source.ts
 import { readFileSync } from "fs";

package/dist/{chunk-J2JZJZKB.js → chunk-KVE5RCQL.js}

@@ -1,6 +1,6 @@
 import {
   parseVersion
-} from "./chunk-VA7VUNRD.js";
+} from "./chunk-Q223OM5J.js";
 
 // src/setup/agent-probe.ts
 import { execSync } from "child_process";

package/dist/{chunk-A4O5ROZK.js → chunk-MZGWKIUZ.js}

@@ -1,9 +1,9 @@
 import {
   openCodeConfigDirFrom
-} from "./chunk-O5B7EK5U.js";
+} from "./chunk-34GN3IPX.js";
 import {
   codexHomeFrom
-} from "./chunk-GMI5QZLG.js";
+} from "./chunk-QA72MKIT.js";
 
 // src/vscode-config.ts
 import { homedir } from "os";

package/dist/chunk-NCVIWGVA.js

@@ -0,0 +1,18 @@
+import {
+  shouldDeferToNativeMode
+} from "./chunk-X6RXX2NF.js";
+
+// src/native-defer.ts
+var nativeDeferOptions = () => {
+  const respect = process.env.PUSHARY_RESPECT_PERMISSION_MODE;
+  const bypass = process.env.PUSHARY_DEFER_BYPASS;
+  return {
+    respectPermissionMode: !(respect === "0" || respect === "false"),
+    deferBypass: bypass === "1" || bypass === "true"
+  };
+};
+var defersToNativeMode = (permissionMode, toolName) => shouldDeferToNativeMode(permissionMode, toolName, nativeDeferOptions());
+
+export {
+  defersToNativeMode
+};