@pushary/agent-hooks 0.95.2 → 0.95.5

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.95.5
+
+- Preserve the full approval window while allowing the final poll time to return; keep late denials and cancellation authoritative.
+- Bundle corrected VS Code read classification and Cursor file-gate fallback, including native shell/MCP prompts when a gate script is missing.
+- Share Claude hook ownership with the server to avoid duplicate decisions while retaining native-mode handoff.
+- Keep supported-agent setup guidance and policy scope aligned with the shared agent manifest.
+
+## 0.95.4
+
+- Keep inactive/offline login results truthful, with one JSON result and no duplicate key minting to recheck readiness.
+- Preserve authentication blocks until readiness is verified; recover the verified saved account while respecting explicit control off.
+- Keep setup and CLI help accurate about approval delivery modes.
+
+## 0.95.3
+
+- Verify account readiness after phone pairing before activating approvals or starting managed services.
+- Preserve useful configuration while offline, with consistent unverified output and exit codes instead of a successful activation claim.
+- Reuse the saved key when setup is rerun after payment or connectivity recovers; preserve explicit phone-start opt-outs.
+
 ## 0.95.2
 
 - Add `pushary cowork` and connector-only setup aliases for Claude Desktop, Chat and Cowork, without acquiring a CLI key or installing local hooks.

package/README.md

@@ -195,7 +195,7 @@ bell         Free local bell when an agent finishes or needs you. No account, no
 doctor       Verify your Pushary installation is working
 disconnect   Turn off one agent (claude|codex|gemini|cursor)
 clean        Remove all Pushary configuration (--yes for non-interactive)
-mode         Switch approval mode (push_only, push_first, terminal_only)
+mode         Choose where approval requests appear
 wait         Show or set the "wait for your phone" ladder (pushary wait 45)
 stats        Show the approval moments your agents hit while not connected
 suggestions  List rules mined from your own approvals

package/data/cursor-plugin/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "pushary",
   "displayName": "Pushary — Control Panel for AI Agents",
   "description": "Push notifications, human-in-the-loop questions, and permission gating for your AI coding agent. Get a push when a task finishes, answer the agent from your phone, and approve risky commands before they run.",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "author": { "name": "Pushary", "email": "business@pushary.com" },
   "homepage": "https://pushary.com",
   "repository": "https://github.com/Pushary/cursor-plugin",

package/data/cursor-plugin/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.2.2
+
+- Allow file edits when the server explicitly says the action is not gated.
+- Keep unresolved file checks denied with an accurate retry message, while shell/MCP hooks retain the native prompt.
+
 ## 0.2.0
 
 The gate stopped carrying its own copy of the policy engine.

package/data/cursor-plugin/README.md

@@ -18,9 +18,9 @@ There are three things.
 
 1. Notify. The agent sends a push when a long task finishes, or when a build, test, or deploy fails. The push can include what changed, the error, and suggested next steps.
 
-2. Ask. The agent asks you questions through push: yes or no, multiple choice, or free text. It waits for your answer. When Pushary is connected, the agent sends its questions to your phone instead of waiting in the editor.
+2. Ask. The agent asks you questions through push: yes or no, multiple choice, or free text. It waits for your answer. The bundled instructions guide the agent to use Pushary for questions. Native editor question dialogs are not automatically intercepted.
 
-3. Gate. Risky shell commands (like rm, force push, history rewrites, database drops, deploys, and systemctl) are checked before they run. What happens is set by your Pushary dashboard policy: auto approve trusted commands, push to your phone for approval, or just notify. If you do not answer in time, it falls back to Cursor's own prompt, so nothing dangerous runs silently. If the check cannot run at all, the command is blocked instead of allowed.
+3. Gate. Shell commands, file writes/edits/deletes, and third-party MCP calls reach your Pushary policy before execution. The policy can approve, deny, or wait for your answer. Cancelled or unverifiable decisions stop the action. Cursor’s generic file-tool hook does not enforce `ask`, so an unresolved file action is denied. File actions explicitly marked `not_gated` by the server proceed; shell/MCP hooks can hand off to Cursor’s prompt.
 
 ## Install
 
@@ -54,7 +54,7 @@ Add this to `.cursor/mcp.json` in your project, or `~/.cursor/mcp.json` for ever
 }
 ```
 
-However you install it, Pushary talks to the same server, so the plugin and the CLI give you the same setup.
+The plugin and CLI installer use the same decision service. Manual MCP-only configuration provides questions and notifications, but does not install approval or activity hooks.
 
 ## Set your API key
 
@@ -78,16 +78,14 @@ macOS GUI apps do not read `.zshrc`. If Settings > MCP shows pushary in red afte
 | MCP server | `mcp.json` | Connects Cursor to the Pushary tools: `send_notification`, `ask_user`, `wait_for_answer`, `cancel_question`, `list_sessions` |
 | Rule | `rules/pushary.mdc` | Always on guidance so the agent uses Pushary on its own |
 | Skill | `skills/pushary/SKILL.md` | Full tool reference: parameters, examples, return values |
-| Hook | `hooks/hooks.json` and `scripts/pushary-gate.mjs` | Sends risky commands to your phone for approval |
+| Hook | `hooks/hooks.json` and `scripts/pushary-gate.mjs` | Evaluates tool approvals and reports session/tool activity |
 | Commands | `commands/` | `/pushary-test` and `/notify-when-done` |
 
 ## How the gate decides
 
-There are two layers.
+The hooks register the supported execution boundaries; your dashboard policy decides which actions need approval. No shell-command regex hides a tool from policy evaluation. Lifecycle hooks report session starts, turn completion, tool results, compaction, and subagent activity.
 
-1. The matcher in `hooks/hooks.json` is a list of patterns that decides which commands get checked at all. Edit it to add or remove patterns.
-
-2. Your Pushary dashboard policy decides what happens to a checked command, per tool: auto approve, the approval mode (push and wait, push then prompt, notify only, or prompt only), the timeout action, a live mode override, and the kill switch. This is the same policy your other Pushary agents use, so the behavior stays the same across agents.
+Timeout approvals apply only after the configured wait actually elapsed. Short editor hook budgets can end a wait earlier; cancellation is attempted before handoff. An uncertain cancellation denies the action. Local plugin installation does not install hooks into remote or cloud agent environments.
 
 ## Commands
 

package/data/cursor-plugin/hooks/hooks.json

@@ -4,7 +4,6 @@
     "beforeShellExecution": [
       {
         "command": "node ./scripts/pushary-gate.mjs",
-        "matcher": "\\brm\\b|\\brmdir\\b|\\bunlink\\b|\\bmkfs|\\bdd\\b|\\bshutdown\\b|\\breboot\\b|\\bpkill\\b|\\bkillall\\b|\\bsystemctl\\b|--force\\b|force-push|reset --hard|\\brebase\\b|\\bdrop\\b|\\bDROP\\b|\\btruncate\\b|\\bTRUNCATE\\b|delete from|DELETE FROM|\\bdeploy\\b|\\bpublish\\b|\\brelease\\b|\\bmigrate\\b",
         "timeout": 60,
         "failClosed": true
       }
@@ -15,6 +14,62 @@
         "timeout": 60,
         "failClosed": true
       }
+    ],
+    "preToolUse": [
+      {
+        "command": "node ./scripts/pushary-gate.mjs",
+        "matcher": "Write|Delete|Edit",
+        "timeout": 60,
+        "failClosed": true
+      }
+    ],
+    "postToolUse": [
+      {
+        "command": "node ./scripts/pushary-gate.mjs",
+        "timeout": 10
+      }
+    ],
+    "stop": [
+      {
+        "command": "node ./scripts/pushary-gate.mjs",
+        "timeout": 10
+      }
+    ],
+    "sessionStart": [
+      {
+        "command": "node ./scripts/pushary-gate.mjs",
+        "timeout": 10
+      }
+    ],
+    "sessionEnd": [
+      {
+        "command": "node ./scripts/pushary-gate.mjs",
+        "timeout": 10
+      }
+    ],
+    "beforeSubmitPrompt": [
+      {
+        "command": "node ./scripts/pushary-gate.mjs",
+        "timeout": 10
+      }
+    ],
+    "preCompact": [
+      {
+        "command": "node ./scripts/pushary-gate.mjs",
+        "timeout": 10
+      }
+    ],
+    "subagentStart": [
+      {
+        "command": "node ./scripts/pushary-gate.mjs",
+        "timeout": 10
+      }
+    ],
+    "subagentStop": [
+      {
+        "command": "node ./scripts/pushary-gate.mjs",
+        "timeout": 10
+      }
     ]
   }
 }

package/data/cursor-plugin/scripts/pushary-gate.mjs

@@ -1,40 +1,14 @@
 #!/usr/bin/env node
-// Pushary gate — Cursor `beforeShellExecution` and `beforeMCPExecution` hooks.
-//
-// Routes risky shell commands through your Pushary permission policy before they
-// run. Which commands reach this gate is the `matcher` in ../hooks/hooks.json; what
-// HAPPENS to a matched command is decided by your dashboard policy (the same policy
-// the @pushary/agent-hooks CLI uses for Claude Code), so behavior is consistent
-// across agents.
-//
-// It honors, per tool ("Bash"): auto-approve, the four approval modes
-// (push_only / push_first / notify_only / terminal_only), the timeout action
-// (approve / deny / escalate), a live mode override, and the kill switch — all
-// scoped to the Cursor conversation. Policy is cached in the temp dir for 5 minutes
-// with a stale-fallback, and requests retry.
-//
-// Self-contained: no dependencies, uses the global fetch (Node 18+).
-//
-// Contract (https://cursor.com/docs/hooks):
-//   stdin  : { "hook_event_name": string, "cwd": string, "conversation_id": string, ... }
-//            beforeShellExecution adds { "command": string }
-//            beforeMCPExecution   adds { "tool_name", "tool_input", "mcp_server_name" }
-//   stdout : { "permission": "allow" | "deny" | "ask", "user_message"?, "agent_message"? }
-//
-// Failure model: every handled path writes a decision and exits 0. Network/parse
-// errors and no-policy fall back to "ask" (Cursor's own prompt) — it never silently
-// allows a risky command. A 55s hard guard guarantees a decision before the hook's
-// `failClosed` deadline; only a catastrophic crash (e.g. Node missing) leaves no
-// output, in which case `failClosed: true` blocks the command rather than allowing
-// it unapproved.
-
-import { createHash } from 'node:crypto'
+// Pushary Cursor hooks: server policy, fenced phone approvals, and lifecycle telemetry.
+// Dependency-free for marketplace installs. Regenerate agent-hooks/data after edits.
+
+import { createHash, randomUUID } from 'node:crypto'
 import { hostname } from 'node:os'
 import { existsSync, readFileSync } from 'node:fs'
 import { basename, dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
-const BASE_URL = 'https://pushary.com'
+const BASE_URL = process.env.PUSHARY_BASE_URL?.trim() || 'https://pushary.com'
 const MCP_URL = `${BASE_URL}/api/mcp/mcp`
 const MAX_BLOCK_MS = 45_000 // longest we can wait before Cursor's hook timeout
 const WAIT_CHUNK_MS = 20_000 // per wait_for_answer long-poll
@@ -45,9 +19,14 @@ const HARD_GUARD_MS = 55_000 // force a graceful "ask" before failClosed (60s) f
 
 // ── Cursor decisions ──────────────────────────────────────────────────────────
 const ALLOW = { permission: 'allow' }
-const ask = (agentMessage) => (agentMessage ? { permission: 'ask', agent_message: agentMessage } : { permission: 'ask' })
+let genericToolHook = false
+const ask = (agentMessage) => genericToolHook ? deny(agentMessage ?? 'Approval requires a user decision. Ask through Pushary, then retry.') : (agentMessage ? { permission: 'ask', agent_message: agentMessage } : { permission: 'ask' })
 const deny = (agentMessage) => ({ permission: 'deny', user_message: 'Command denied via Pushary.', agent_message: agentMessage })
+const unresolved = (verdict) => genericToolHook && verdict?.reason === 'not_gated'
+  ? ALLOW
+  : ask(genericToolHook ? 'Pushary could not reach a verdict for this change. Retry shortly.' : undefined)
 
+let activeQuestion
 let done = false
 const respond = (decision) => {
   if (done) return
@@ -56,10 +35,6 @@ const respond = (decision) => {
   process.exit(0)
 }
 
-// Backstop: if anything hangs, return "ask" rather than letting the hook time out
-// (which, with failClosed, would block the command).
-setTimeout(() => respond(ask()), HARD_GUARD_MS).unref()
-
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
 const clamp = (n, lo, hi) => Math.min(Math.max(n, lo), hi)
 
@@ -355,6 +330,7 @@ const askArgs = (request, project, ident) => ({
   toolTarget: request.toolTarget,
   actionBody: deriveActionBody(request.display),
   wait: false,
+  waitEndsAt: new Date(Date.now() + MAX_BLOCK_MS).toISOString(),
 })
 
 const pollForAnswer = async (apiKey, correlationId, deadlineMs) => {
@@ -362,14 +338,12 @@ const pollForAnswer = async (apiKey, correlationId, deadlineMs) => {
     const remaining = clamp(deadlineMs - Date.now(), 1_000, WAIT_CHUNK_MS)
     try {
       const answer = await callTool(apiKey, 'wait_for_answer', { correlationId, timeoutMs: remaining })
-      if (answer?.answered) return answer
+      if (answer?.error) return STOPPED
+      if (answer?.answered || stopped(answer) || (answer?.status && answer.status !== 'pending')) return answer
     } catch {
-      if (Date.now() + POLL_GAP_MS >= deadlineMs) break
-      await sleep(POLL_GAP_MS)
-      continue
+      return { answered: false, handoffAction: 'stop' }
     }
-    if (Date.now() + POLL_GAP_MS >= deadlineMs) break
-    await sleep(POLL_GAP_MS)
+    await sleep(Math.min(POLL_GAP_MS, Math.max(0, deadlineMs - Date.now())))
   }
   return { answered: false }
 }
@@ -377,25 +351,29 @@ const pollForAnswer = async (apiKey, correlationId, deadlineMs) => {
 const fromTimeoutAction = (action, deniedReason) =>
   action === 'approve' ? ALLOW : action === 'deny' ? deny(deniedReason) : ask()
 
-const fromAnswer = (answer, deniedReason) => {
+const fromAnswer = (answer, deniedReason = 'Denied via Pushary.') => {
+  activeQuestion = undefined
   if (answer.value === 'defer') return ask()
   return answer.value === 'yes' ? ALLOW : deny(deniedReason)
 }
 
+const stopped = (result) => result?.handoffAction === 'stop'
+  || ['cancelled', 'unavailable', 'stopped', 'missing'].includes(result?.status)
+const STOPPED = { answered: false, handoffAction: 'stop' }
+const STOP_REASON = 'This approval was cancelled or its state could not be verified. Do not run the action; wait for a new user instruction.'
+
 const withdraw = async (apiKey, correlationId) => {
-  const unanswered = { answered: false }
-  let cancelled
-  try {
-    cancelled = await callTool(apiKey, 'cancel_question', { correlationId }, WITHDRAW_TIMEOUT_MS)
-  } catch {
-    return unanswered
-  }
-  if (cancelled?.cancelled !== false || cancelled?.status === 'unavailable') return unanswered
   try {
+    const cancelled = await callTool(apiKey, 'cancel_question', { correlationId }, WITHDRAW_TIMEOUT_MS)
+    if (stopped(cancelled)) return STOPPED
+    if (cancelled?.cancelled === true) return { answered: false }
     const answer = await callTool(apiKey, 'wait_for_answer', { correlationId, timeoutMs: 1_000 }, WITHDRAW_TIMEOUT_MS)
-    return answer?.answered ? answer : unanswered
+    if (answer?.answered) return answer
+    return ['expired', 'missing'].includes(answer?.status) ? { answered: false } : STOPPED
   } catch {
-    return unanswered
+    return STOPPED
+  } finally {
+    activeQuestion = undefined
   }
 }
 
@@ -416,12 +394,21 @@ const denialFor = (noun) =>
  * was not a shell execution fell out at the empty-command guard as `ask`. That
  * was correct while `beforeShellExecution` was the only thing registered.
  *
- * Returns null when there is nothing to gate, which the caller answers with
- * Cursor's own prompt.
+ * Returns null for events and tools handled elsewhere.
  */
 const describeRequest = (input) => {
   const event = typeof input.hook_event_name === 'string' ? input.hook_event_name : ''
 
+  if (event === 'preToolUse') {
+    // Shell and MCP have their own gate events; never ask twice.
+    if (!['Write', 'Delete', 'Edit'].includes(input.tool_name)) return null
+    const params = input.tool_input && typeof input.tool_input === 'object' ? input.tool_input : {}
+    const display = `${input.tool_name}\n${JSON.stringify(params)}`
+    return { toolName: input.tool_name, toolInputs: [params], display,
+      toolTarget: String(params.file_path ?? params.path ?? '').slice(0, 120),
+      prompt: 'Allow this file change?', verb: 'change this file', denied: denialFor('file change') }
+  }
+
   if (event === 'beforeMCPExecution') {
     const tool = typeof input.tool_name === 'string' ? input.tool_name.trim() : ''
     if (!tool) return null
@@ -473,64 +460,88 @@ const describeRequest = (input) => {
 // push_only: wait up to the policy timeout, then apply the timeout action.
 const handlePushOnly = async (apiKey, request, project, ident, timeoutSeconds, timeoutAction) => {
   let asked
+  const args = { ...askArgs(request, project, ident), requestId: randomUUID() }
   try {
-    asked = await withRetry(() => callTool(apiKey, 'ask_user', askArgs(request, project, ident)), 3)
+    asked = await withRetry(() => callTool(apiKey, 'ask_user', args), 3)
   } catch {
-    return fromTimeoutAction(timeoutAction, 'Push notification failed; denied per your Pushary policy.')
+    return deny('Pushary could not create a verifiable approval. Retry the action.')
   }
-  if (!asked?.correlationId) return ask()
+  if (stopped(asked)) return deny(STOP_REASON)
+  if (asked?.answered) return fromAnswer(asked)
+  if (!asked?.correlationId) return deny('Pushary did not return a verifiable approval.')
+  activeQuestion = { apiKey, correlationId: asked.correlationId }
 
   if (handedOff(asked)) {
     const late = await withdraw(apiKey, asked.correlationId)
+    if (stopped(late)) return deny(STOP_REASON)
     if (late.answered) return fromAnswer(late, request.denied)
     return ask(handoffMessage(asked))
   }
   if (asked.noDevices) {
     const late = await withdraw(apiKey, asked.correlationId)
+    if (stopped(late)) return deny(STOP_REASON)
     if (late.answered) return fromAnswer(late, request.denied)
-    return fromTimeoutAction(timeoutAction, 'No device connected to approve on; denied per your Pushary policy.')
+    return ask('No device connected, approve here.')
   }
 
   const realMs = timeoutAction === 'wait' ? MAX_BLOCK_MS : Math.max(timeoutSeconds, 1) * 1000
   const cap = Math.min(realMs, MAX_BLOCK_MS)
-  const answer = await pollForAnswer(apiKey, asked.correlationId, Date.now() + cap)
+  const deadline = Date.now() + cap
+  const answer = await pollForAnswer(apiKey, asked.correlationId, deadline)
+  if (stopped(answer)) {
+    await withdraw(apiKey, asked.correlationId)
+    return deny(STOP_REASON)
+  }
   if (answer.answered) return fromAnswer(answer, request.denied)
 
   const late = await withdraw(apiKey, asked.correlationId)
+  if (stopped(late)) return deny(STOP_REASON)
   if (late.answered) return fromAnswer(late, request.denied)
 
   // If Cursor's hook limit cut us off before the configured timeout, hand off to
   // Cursor's own prompt rather than misapplying the policy's timeout action.
-  if (cap >= realMs) return fromTimeoutAction(timeoutAction, 'No response within the approval timeout; denied per your Pushary policy.')
+  if (cap >= realMs && Date.now() >= deadline) return fromTimeoutAction(timeoutAction, 'No response within the approval timeout; denied per your Pushary policy.')
   return ask()
 }
 
 // push_first: race the push for a short window, then fall back to Cursor's prompt.
 const handlePushFirst = async (apiKey, request, project, ident, pushFirstSeconds) => {
   let asked
+  const args = { ...askArgs(request, project, ident), requestId: randomUUID() }
   try {
-    asked = await withRetry(() => callTool(apiKey, 'ask_user', askArgs(request, project, ident)), 3)
+    asked = await withRetry(() => callTool(apiKey, 'ask_user', args), 3)
   } catch {
-    return ask()
+    return deny('Pushary could not create a verifiable approval. Retry the action.')
   }
-  if (!asked?.correlationId) return ask()
+  if (stopped(asked)) return deny(STOP_REASON)
+  if (asked?.answered) return fromAnswer(asked)
+  if (!asked?.correlationId) return deny('Pushary did not return a verifiable approval.')
+  activeQuestion = { apiKey, correlationId: asked.correlationId }
 
   if (handedOff(asked)) {
     const late = await withdraw(apiKey, asked.correlationId)
+    if (stopped(late)) return deny(STOP_REASON)
     if (late.answered) return fromAnswer(late, request.denied)
     return ask(handoffMessage(asked))
   }
   if (asked.noDevices) {
     const late = await withdraw(apiKey, asked.correlationId)
+    if (stopped(late)) return deny(STOP_REASON)
     if (late.answered) return fromAnswer(late, request.denied)
     return ask('No device connected, approve here.')
   }
 
   const cap = Math.min(Math.max(pushFirstSeconds, 1) * 1000, MAX_BLOCK_MS)
-  const answer = await pollForAnswer(apiKey, asked.correlationId, Date.now() + cap)
+  const deadline = Date.now() + cap
+  const answer = await pollForAnswer(apiKey, asked.correlationId, deadline)
+  if (stopped(answer)) {
+    await withdraw(apiKey, asked.correlationId)
+    return deny(STOP_REASON)
+  }
   if (answer.answered) return fromAnswer(answer, request.denied)
 
   const late = await withdraw(apiKey, asked.correlationId)
+  if (stopped(late)) return deny(STOP_REASON)
   if (late.answered) return fromAnswer(late, request.denied)
   return ask('No answer from your phone in time, so the request was withdrawn there. Approve here.')
 }
@@ -549,17 +560,56 @@ const handleNotifyOnly = async (apiKey, request, project, ident) => {
   return ask()
 }
 
+const TELEMETRY_EVENTS = ["postToolUse", "stop", "sessionStart", "sessionEnd", "beforeSubmitPrompt", "preCompact", "subagentStart", "subagentStop"]
+
+const reportTelemetry = async (input, source) => {
+  const apiKey = resolveApiKey()
+  if (!apiKey) return
+  const sentAt = new Date().toISOString()
+  const payload = JSON.stringify(input, (_key, value) => typeof value === 'string' ? redactSecretsDeep(value) : value)
+  if (Buffer.byteLength(payload) > 262144) return
+  const hash = value => createHash('sha256').update(value).digest('hex')
+  const sessionId = input.session_id ?? input.sessionId ?? input.conversation_id ?? ''
+  const hookId = hash([source, sessionId, input.hook_event_name, sentAt, hash(payload)].join('|')).slice(0, 32)
+  try {
+    await fetch(`${BASE_URL}/api/agent/hook`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify({ v: 1, machineId: getMachineId(), app: { platform: 'cli', version: 'editor-plugin' },
+        envelopes: [{ wire: 1, hookId, source, event: input.hook_event_name, sentAt,
+          cwd: input.cwd, repoKey: deriveRepoKey(input.cwd), payload }] }),
+      signal: AbortSignal.timeout(5000),
+    })
+  } catch { /* Telemetry never blocks an agent. */ }
+}
+
 const main = async () => {
+  // Backstop: if anything hangs, return "ask" rather than letting the hook time out
+// (which, with failClosed, would block the command).
+setTimeout(async () => {
+    if (!activeQuestion) return respond(deny('Pushary could not finish approval safely. Retry the action.'))
+    const late = await withdraw(activeQuestion.apiKey, activeQuestion.correlationId)
+    respond(late.answered ? fromAnswer(late) : deny('Pushary approval expired or could not be withdrawn safely. Retry the action.'))
+  }, HARD_GUARD_MS - 5_000).unref()
+
+
   let input
   try {
     const raw = await readStdin()
     input = raw.trim() ? JSON.parse(raw) : {}
   } catch {
-    return respond(ask())
+    return respond(deny('Pushary received invalid hook input. Retry the action.'))
+  }
+
+  input.hook_event_name ??= input.hookEventName
+  if (TELEMETRY_EVENTS.includes(input.hook_event_name)) {
+    await reportTelemetry(input, 'cursor')
+    return respond({})
   }
 
+  genericToolHook = input.hook_event_name === 'preToolUse'
   const request = describeRequest(input)
-  if (!request) return respond(ask())
+  if (!request) return respond({})
 
   const apiKey = resolveApiKey()
   if (!apiKey) {
@@ -575,9 +625,8 @@ const main = async () => {
   try {
     const verdict = await decide(apiKey, request, input.cwd, sessionId)
 
-    // No verdict, or one that says nothing: Cursor's own prompt decides, exactly
-    // as if this gate were not installed. Never a forced denial on an outage.
-    if (!verdict || verdict.kind === 'no_opinion') return respond(ask())
+    // Native shell/MCP prompts can take over; generic file hooks must deny ask.
+    if (!verdict || verdict.kind === 'no_opinion') return respond(unresolved(verdict))
     if (verdict.kind === 'kill') return respond(deny(verdict.reason))
     if (verdict.kind === 'allow') return respond(ALLOW)
     if (verdict.kind === 'deny') return respond(deny(verdict.reason))
@@ -598,7 +647,7 @@ const main = async () => {
     }
   } catch (error) {
     process.stderr.write(`[pushary-gate] ${error?.message ?? error}\n`)
-    return respond(ask())
+    return respond(unresolved(null))
   }
 }
 

package/data/vscode-plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pushary",
   "description": "Push notifications, human-in-the-loop questions, and permission gating for your AI agent. Get a push when a task finishes, answer the agent from your phone, and approve risky commands before they run.",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "author": {
     "name": "Pushary",
     "email": "business@pushary.com",

package/data/vscode-plugin/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.2.2
+
+- Classify local reads, searches, diagnostics, and terminal/task output inspection as reads under the shared policy.
+- Let known read-only tools proceed when no verdict is available; keep the native prompt for other tools.
+
 ## 0.2.0
 
 The gate stopped carrying its own copy of the policy engine, and two defects went

package/data/vscode-plugin/README.md

@@ -18,9 +18,9 @@ There are three things.
 
 1. Notify. The agent sends a push when a long task finishes, or when a build, test, or deploy fails. The push can include what changed, the error, and suggested next steps.
 
-2. Ask. The agent asks you questions through push: yes or no, multiple choice, or free text. It waits for your answer. When Pushary is connected, the agent sends its questions to your phone instead of waiting in the chat panel.
+2. Ask. The agent asks you questions through push: yes or no, multiple choice, or free text. It waits for your answer. The bundled skill guides the agent to use Pushary for questions. Native VS Code question dialogs are not automatically intercepted.
 
-3. Gate. Risky terminal commands (like rm, force push, history rewrites, database drops, deploys, and systemctl) are checked before they run. What happens is set by your Pushary dashboard policy: auto approve trusted commands, push to your phone for approval, or just notify. If you do not answer in time, it falls back to VS Code's own approval prompt, so nothing dangerous runs silently.
+3. Gate. Every named tool reaches your Pushary policy before execution, including terminal commands, file edits, patches, and MCP calls. Standing rules are evaluated before safe-command handling. The policy can approve, deny, or ask; cancellation stops the action. Pushary’s own MCP tools are exempt so answering cannot deadlock.
 
 ## Requirements
 
@@ -66,7 +66,7 @@ Clone this repository, then add the absolute path to your VS Code `settings.json
 }
 ```
 
-However you install it, Pushary talks to the same server, so the plugin and the CLI give you the same setup.
+The source plugin and CLI installer use the same decision service. The Mac app can install a native bridge that also carries queued messages back through supported hook responses.
 
 ## Set your API key
 
@@ -87,26 +87,18 @@ Install the Pushary app on your phone (or turn on web push) so the agent can rea
 |------|------|--------------|
 | MCP server | `.mcp.json` | Connects VS Code to the Pushary tools: `send_notification`, `ask_user`, `wait_for_answer`, `cancel_question` |
 | Skill | `skills/pushary/SKILL.md` | Full tool reference: parameters, examples, return values, and the proactive-use guidance |
-| Hook | `hooks/hooks.json` and `scripts/pushary-gate.mjs` | Sends risky commands to your phone for approval |
+| Hook | `hooks/hooks.json` and `scripts/pushary-gate.mjs` | Evaluates tool approvals and reports session/tool activity |
 | Commands | `commands/` | `/pushary-test` and `/notify-when-done` |
 
 ## How the gate decides
 
-There are two layers.
+VS Code currently ignores hook matchers, so the script sends every named tool to policy evaluation. Host aliases such as `run_in_terminal`, `create_file`, and `apply_patch` are normalized by the shared service; third-party `mcp_` IDs are retained because their server boundaries cannot safely be reconstructed from underscores.
 
-1. `RISKY_COMMAND` in `scripts/pushary-gate.mjs` decides which commands get checked at all. Everything else passes straight through with no disk or network access.
-
-2. Your Pushary dashboard policy decides what happens to a checked command, per tool: auto approve, the approval mode (push and wait, push then prompt, notify only, or prompt only), the timeout action, a live mode override, and the kill switch. This is the same policy your other Pushary agents use, so behavior stays the same across agents.
-
-### Why the filtering lives in the script
-
-VS Code parses a hook's `matcher` but does not enforce it, so `PreToolUse` fires on every tool call the agent makes, including reads and searches. `hooks/hooks.json` therefore declares no matcher: one there would do nothing, and would only read as a promise the file cannot keep.
-
-The one and only gate is `RISKY_COMMAND` in `scripts/pushary-gate.mjs`. To change which commands need approval, edit that regex. Everything else returns immediately without touching the disk or the network.
+Lifecycle hooks report session starts, turn completion, tool results, compaction, and subagent activity. Timeout approval requires the configured wait to have elapsed; cancellation or unverifiable withdrawal denies the action. Stable and Insiders registrations are supported locally. Remote hosts and additional profiles require their own installation.
 
 ## Failure behavior
 
-Every path returns a decision. Network errors, a missing API key, and unparseable input all fall back to `ask`, which hands the decision to VS Code's own approval prompt rather than allowing the command unapproved. A 55 second guard guarantees output before the hook's 60 second timeout.
+Known read-only tools proceed when a missing API key or unavailable verdict prevents policy evaluation. Other tools fall back to `ask`, which hands the decision to VS Code's own approval prompt. A 55 second guard guarantees output before the hook's 60 second timeout.
 
 ## Cross-tool compatibility