@pushary/agent-hooks 0.95.4 → 0.95.6

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.95.6
+
+- Separate synthetic answer tests from real hook activation and report the actual answering surface.
+- Cancel known pending diagnostic questions on interrupted or unanswered exits without fabricating approval.
+- Add Claude Code activation evidence for a unique scratch-file approval, correlated with the observed tool result.
+- Report managed-control readiness separately from hook configuration and phone delivery, refreshing credentials, service state and remote proof after interactive waits.
+
+## 0.95.5
+
+- Preserve the full approval window while allowing the final poll time to return; keep late denials and cancellation authoritative.
+- Bundle corrected VS Code read classification and Cursor file-gate fallback, including native shell/MCP prompts when a gate script is missing.
+- Share Claude hook ownership with the server to avoid duplicate decisions while retaining native-mode handoff.
+- Keep supported-agent setup guidance and policy scope aligned with the shared agent manifest.
+
 ## 0.95.4
 
 - Keep inactive/offline login results truthful, with one JSON result and no duplicate key minting to recheck readiness.

package/data/cursor-plugin/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "pushary",
   "displayName": "Pushary — Control Panel for AI Agents",
   "description": "Push notifications, human-in-the-loop questions, and permission gating for your AI coding agent. Get a push when a task finishes, answer the agent from your phone, and approve risky commands before they run.",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "author": { "name": "Pushary", "email": "business@pushary.com" },
   "homepage": "https://pushary.com",
   "repository": "https://github.com/Pushary/cursor-plugin",

package/data/cursor-plugin/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.2.2
+
+- Allow file edits when the server explicitly says the action is not gated.
+- Keep unresolved file checks denied with an accurate retry message, while shell/MCP hooks retain the native prompt.
+
 ## 0.2.0
 
 The gate stopped carrying its own copy of the policy engine.

package/data/cursor-plugin/README.md

@@ -20,7 +20,7 @@ There are three things.
 
 2. Ask. The agent asks you questions through push: yes or no, multiple choice, or free text. It waits for your answer. The bundled instructions guide the agent to use Pushary for questions. Native editor question dialogs are not automatically intercepted.
 
-3. Gate. Shell commands, file writes/edits/deletes, and third-party MCP calls reach your Pushary policy before execution. The policy can approve, deny, or wait for your answer. Cancelled or unverifiable decisions stop the action. Cursor’s generic file-tool hook does not enforce `ask`, so a file action without a completed approval is denied; shell/MCP hooks can hand off to Cursor’s prompt.
+3. Gate. Shell commands, file writes/edits/deletes, and third-party MCP calls reach your Pushary policy before execution. The policy can approve, deny, or wait for your answer. Cancelled or unverifiable decisions stop the action. Cursor’s generic file-tool hook does not enforce `ask`, so an unresolved file action is denied. File actions explicitly marked `not_gated` by the server proceed; shell/MCP hooks can hand off to Cursor’s prompt.
 
 ## Install
 

package/data/cursor-plugin/scripts/pushary-gate.mjs

@@ -22,6 +22,9 @@ const ALLOW = { permission: 'allow' }
 let genericToolHook = false
 const ask = (agentMessage) => genericToolHook ? deny(agentMessage ?? 'Approval requires a user decision. Ask through Pushary, then retry.') : (agentMessage ? { permission: 'ask', agent_message: agentMessage } : { permission: 'ask' })
 const deny = (agentMessage) => ({ permission: 'deny', user_message: 'Command denied via Pushary.', agent_message: agentMessage })
+const unresolved = (verdict) => genericToolHook && verdict?.reason === 'not_gated'
+  ? ALLOW
+  : ask(genericToolHook ? 'Pushary could not reach a verdict for this change. Retry shortly.' : undefined)
 
 let activeQuestion
 let done = false
@@ -623,7 +626,7 @@ setTimeout(async () => {
     const verdict = await decide(apiKey, request, input.cwd, sessionId)
 
     // Native shell/MCP prompts can take over; generic file hooks must deny ask.
-    if (!verdict || verdict.kind === 'no_opinion') return respond(ask())
+    if (!verdict || verdict.kind === 'no_opinion') return respond(unresolved(verdict))
     if (verdict.kind === 'kill') return respond(deny(verdict.reason))
     if (verdict.kind === 'allow') return respond(ALLOW)
     if (verdict.kind === 'deny') return respond(deny(verdict.reason))
@@ -644,7 +647,7 @@ setTimeout(async () => {
     }
   } catch (error) {
     process.stderr.write(`[pushary-gate] ${error?.message ?? error}\n`)
-    return respond(ask())
+    return respond(unresolved(null))
   }
 }
 

package/data/vscode-plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pushary",
   "description": "Push notifications, human-in-the-loop questions, and permission gating for your AI agent. Get a push when a task finishes, answer the agent from your phone, and approve risky commands before they run.",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "author": {
     "name": "Pushary",
     "email": "business@pushary.com",

package/data/vscode-plugin/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.2.2
+
+- Classify local reads, searches, diagnostics, and terminal/task output inspection as reads under the shared policy.
+- Let known read-only tools proceed when no verdict is available; keep the native prompt for other tools.
+
 ## 0.2.0
 
 The gate stopped carrying its own copy of the policy engine, and two defects went

package/data/vscode-plugin/README.md

@@ -98,7 +98,7 @@ Lifecycle hooks report session starts, turn completion, tool results, compaction
 
 ## Failure behavior
 
-Every path returns a decision. Network errors, a missing API key, and unparseable input all fall back to `ask`, which hands the decision to VS Code's own approval prompt rather than allowing the command unapproved. A 55 second guard guarantees output before the hook's 60 second timeout.
+Known read-only tools proceed when a missing API key or unavailable verdict prevents policy evaluation. Other tools fall back to `ask`, which hands the decision to VS Code's own approval prompt. A 55 second guard guarantees output before the hook's 60 second timeout.
 
 ## Cross-tool compatibility
 

package/data/vscode-plugin/scripts/pushary-gate.mjs

@@ -38,6 +38,16 @@ const TERMINAL_TOOLS = new Set([
 
 const normalizeToolName = (name) => name.toLowerCase().replace(/[^a-z0-9]/g, '')
 
+const READ_ONLY_TOOLS = new Set([
+  'readfile', 'viewimage', 'listdir', 'listdirectory', 'filesearch', 'findfiles', 'grepsearch', 'findtextinfiles',
+  'semanticsearch', 'searchcodebase', 'searchworkspacesymbols', 'geterrors', 'getchangedfiles', 'readprojectstructure',
+  'getnotebooksummary', 'readnotebookcelloutput', 'testsearch', 'findtestfiles', 'testfailure', 'getvscodeapi',
+  'getterminaloutput', 'gettaskoutput', 'terminalselection', 'terminallastcommand',
+])
+
+export const isReadOnlyTool = (toolName) =>
+  typeof toolName === 'string' && READ_ONLY_TOOLS.has(normalizeToolName(toolName.replace(/^copilot_/, '')))
+
 // ── VS Code decisions ─────────────────────────────────────────────────────────
 const PASS = { continue: true }
 const decision = (permissionDecision, permissionDecisionReason) => ({
@@ -50,6 +60,7 @@ const decision = (permissionDecision, permissionDecisionReason) => ({
 const ALLOW = decision('allow')
 const ask = (reason) => decision('ask', reason)
 const deny = (reason) => decision('deny', reason)
+const unresolved = (toolName, reason) => (isReadOnlyTool(toolName) ? PASS : ask(reason))
 
 let activeQuestion
 let done = false
@@ -648,7 +659,7 @@ const main = async () => {
   if (!apiKey) {
     diag('no API key found (PUSHARY_API_KEY, the plugin .mcp.json, or ~/.pushary/config.json). Run: npx @pushary/agent-hooks setup')
     return respond(
-      ask('Pushary is not configured: run `npx @pushary/agent-hooks setup` (get a key at https://pushary.com) to route this approval to your phone.')
+      unresolved(input.tool_name, 'Pushary is not configured: run `npx @pushary/agent-hooks setup` (get a key at https://pushary.com) to route this approval to your phone.')
     )
   }
 
@@ -661,7 +672,7 @@ const main = async () => {
 
     // No verdict, or one that says nothing: VS Code's own prompt decides, exactly
     // as if this gate were not installed. Never a forced denial on an outage.
-    if (!verdict || verdict.kind === 'no_opinion') return respond(ask())
+    if (!verdict || verdict.kind === 'no_opinion') return respond(unresolved(input.tool_name))
     if (verdict.kind === 'kill') return respond(deny(verdict.reason))
     if (verdict.kind === 'allow') return respond(ALLOW)
     if (verdict.kind === 'deny') return respond(deny(verdict.reason))
@@ -682,7 +693,7 @@ const main = async () => {
     }
   } catch (error) {
     diag(describeNetworkFailure(error))
-    return respond(ask())
+    return respond(unresolved(input.tool_name))
   }
 }
 

package/dist/bin/pushary-bell-hook.js

@@ -1,36 +1,36 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-J5KTLGO5.js";
+} from "../chunk-SLVXQOYU.js";
 import {
   readHookInput
-} from "../chunk-V4G7BQZ6.js";
-import "../chunk-4NJURLRP.js";
-import "../chunk-ZKDQ3QRP.js";
-import "../chunk-MZOTKCNZ.js";
-import "../chunk-MDDKA4QM.js";
-import "../chunk-HTWQH3VI.js";
-import "../chunk-TMOCSYJK.js";
-import "../chunk-ND52YE7L.js";
-import "../chunk-TKA2L2BU.js";
-import "../chunk-HJYGC7IR.js";
-import "../chunk-GGX5QTBG.js";
-import "../chunk-JDNW6FTV.js";
+} from "../chunk-R4MBUCPQ.js";
+import "../chunk-XKIB2FQY.js";
+import "../chunk-WZ63WTAZ.js";
+import "../chunk-BS5XR4J7.js";
+import "../chunk-4XFBO3GW.js";
+import "../chunk-FVTFSYKB.js";
+import "../chunk-A2M6FGUF.js";
+import "../chunk-7N3D4GN7.js";
+import "../chunk-CDBTCEKE.js";
+import "../chunk-GOPIMNVC.js";
+import "../chunk-3AJIK5AO.js";
+import "../chunk-DH4INZW3.js";
 import "../chunk-EQRS3SGM.js";
-import "../chunk-TGORRMOU.js";
+import "../chunk-JZSWA3VT.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-L4ZCFMWW.js";
-import "../chunk-YE37HYN3.js";
-import "../chunk-O7ODXFII.js";
-import "../chunk-W5GH5GTX.js";
+import "../chunk-32WWVRXN.js";
+import "../chunk-C7BFOC35.js";
+import "../chunk-FBO5WS3D.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-3N4FT4WQ.js";
+import "../chunk-6MRPTYYH.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-MNWDOXX6.js";
+import "../chunk-KAWLZTRJ.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-7VVX6HQG.js";
+import "../chunk-VZADMT7R.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,29 +5,29 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-J5KTLGO5.js";
+} from "../chunk-SLVXQOYU.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-HJYGC7IR.js";
-import "../chunk-GGX5QTBG.js";
+} from "../chunk-GOPIMNVC.js";
+import "../chunk-3AJIK5AO.js";
 import "../chunk-L4ZCFMWW.js";
 import {
   claudeSettings
-} from "../chunk-W5GH5GTX.js";
+} from "../chunk-FBO5WS3D.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
 import {
   exitOnHelpFlag
-} from "../chunk-DLLAWCQB.js";
-import "../chunk-D6PRC3YQ.js";
+} from "../chunk-GOQHN2UH.js";
+import "../chunk-LZQVAEWP.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-3N4FT4WQ.js";
+import "../chunk-6MRPTYYH.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
@@ -35,9 +35,9 @@ import {
 import {
   readJsonSafe,
   writeJsonAtomic
-} from "../chunk-MNWDOXX6.js";
+} from "../chunk-KAWLZTRJ.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-7VVX6HQG.js";
+import "../chunk-VZADMT7R.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,7 +8,7 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-6BNBW3M2.js";
+} from "../chunk-DSCGKZO5.js";
 import {
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
@@ -17,25 +17,25 @@ import {
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-4NJURLRP.js";
-import "../chunk-ZKDQ3QRP.js";
-import "../chunk-MZOTKCNZ.js";
-import "../chunk-MDDKA4QM.js";
-import "../chunk-HTWQH3VI.js";
-import "../chunk-TMOCSYJK.js";
+} from "../chunk-XKIB2FQY.js";
+import "../chunk-WZ63WTAZ.js";
+import "../chunk-BS5XR4J7.js";
+import "../chunk-4XFBO3GW.js";
+import "../chunk-FVTFSYKB.js";
+import "../chunk-A2M6FGUF.js";
 import {
   ensureDaemonRunning
-} from "../chunk-ND52YE7L.js";
-import "../chunk-TKA2L2BU.js";
-import "../chunk-HJYGC7IR.js";
-import "../chunk-GGX5QTBG.js";
+} from "../chunk-7N3D4GN7.js";
+import "../chunk-CDBTCEKE.js";
+import "../chunk-GOPIMNVC.js";
+import "../chunk-3AJIK5AO.js";
 import {
   encryptRecord
-} from "../chunk-JDNW6FTV.js";
+} from "../chunk-DH4INZW3.js";
 import "../chunk-EQRS3SGM.js";
 import {
   transcriptsEnabled
-} from "../chunk-TGORRMOU.js";
+} from "../chunk-JZSWA3VT.js";
 import {
   needsShell,
   spawnClaude
@@ -54,35 +54,36 @@ import {
   repoKeyFor,
   reportEvent,
   savePendingCommand
-} from "../chunk-MQO7J2OJ.js";
+} from "../chunk-ZJ6QXXBC.js";
 import {
   DECISION_STOP_REASON,
   askUser,
   cancelQuestion,
   isDecisionStopped,
   isLocalQuestionHandoff,
+  nextLongPollMs,
   waitForAnswer,
   withdrawQuestion
-} from "../chunk-2BE7ZVWP.js";
+} from "../chunk-XS33QBJA.js";
 import {
   UNNAMED_ACTION,
   deriveToolTarget,
   describeToolCall,
   scopePathFor
-} from "../chunk-LVU3Q43J.js";
-import "../chunk-YE37HYN3.js";
+} from "../chunk-HBBQO77U.js";
+import "../chunk-32WWVRXN.js";
 import {
   getMachineId
-} from "../chunk-O7ODXFII.js";
-import "../chunk-W5GH5GTX.js";
+} from "../chunk-C7BFOC35.js";
+import "../chunk-FBO5WS3D.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-3N4FT4WQ.js";
+import "../chunk-6MRPTYYH.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-MNWDOXX6.js";
+import "../chunk-KAWLZTRJ.js";
 import {
   getApiKey,
   getBaseUrl
@@ -91,7 +92,7 @@ import {
   KILL_REASON,
   redactSecrets,
   resolveGate
-} from "../chunk-7VVX6HQG.js";
+} from "../chunk-VZADMT7R.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {
@@ -450,7 +451,11 @@ var createRemoteApprover = (deps) => {
   const waitForPhone = async (entry, correlationId, windowMs) => {
     const deadline = now() + windowMs;
     while (now() < deadline && !entry.controller.signal.aborted) {
-      const remaining = Math.min(Math.max(deadline - now(), 1e3), 3e4);
+      const hold = nextLongPollMs(deadline, now());
+      if (hold === null) {
+        await sleep(Math.min(500, Math.max(0, deadline - now())));
+        continue;
+      }
       const abortPromise = new Promise((resolve) => {
         entry.controller.signal.addEventListener("abort", () => resolve({ answered: false, aborted: true }), {
           once: true
@@ -459,7 +464,7 @@ var createRemoteApprover = (deps) => {
       let outcome;
       try {
         outcome = await Promise.race([
-          waitForAnswer2(deps.apiKey, correlationId, remaining, AbortSignal.any([entry.controller.signal, AbortSignal.timeout(Math.max(1, deadline - now()))])),
+          waitForAnswer2(deps.apiKey, correlationId, hold, AbortSignal.any([entry.controller.signal, AbortSignal.timeout(Math.max(1, deadline - now()))])),
           abortPromise
         ]);
       } catch {

package/dist/bin/pushary-clean.js

@@ -12,7 +12,7 @@ import {
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-XDHJ4KZJ.js";
+} from "../chunk-RPHXG4HI.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -22,39 +22,39 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-PFRLYYF6.js";
+} from "../chunk-43TFQOAT.js";
 import {
   isClaudeMcpSnapshot,
   removeClaudeMcpServers,
   removePusharySettings,
   restoreClaudeMcpServer
-} from "../chunk-CVZP67ST.js";
+} from "../chunk-HHODMHTH.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-MZOTKCNZ.js";
-import "../chunk-MDDKA4QM.js";
-import "../chunk-HTWQH3VI.js";
+} from "../chunk-BS5XR4J7.js";
+import "../chunk-4XFBO3GW.js";
+import "../chunk-FVTFSYKB.js";
 import {
   pusharyHookExecutable
-} from "../chunk-TMOCSYJK.js";
+} from "../chunk-A2M6FGUF.js";
 import {
   disableDaemonService
-} from "../chunk-ND52YE7L.js";
+} from "../chunk-7N3D4GN7.js";
 import {
   removeGeminiSettings
-} from "../chunk-TKA2L2BU.js";
-import "../chunk-HJYGC7IR.js";
-import "../chunk-GGX5QTBG.js";
+} from "../chunk-CDBTCEKE.js";
+import "../chunk-GOPIMNVC.js";
+import "../chunk-3AJIK5AO.js";
 import "../chunk-XHKBHWLX.js";
 import {
   execNpm
 } from "../chunk-L4ZCFMWW.js";
-import "../chunk-LVU3Q43J.js";
-import "../chunk-YE37HYN3.js";
-import "../chunk-O7ODXFII.js";
+import "../chunk-HBBQO77U.js";
+import "../chunk-32WWVRXN.js";
+import "../chunk-C7BFOC35.js";
 import {
   claudeJson,
   claudeMcpReceipt,
@@ -80,28 +80,28 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-W5GH5GTX.js";
+} from "../chunk-FBO5WS3D.js";
 import {
   exitOnHelpFlag
-} from "../chunk-DLLAWCQB.js";
-import "../chunk-D6PRC3YQ.js";
+} from "../chunk-GOQHN2UH.js";
+import "../chunk-LZQVAEWP.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
 import {
   removeClaudeAlias
-} from "../chunk-3N4FT4WQ.js";
+} from "../chunk-6MRPTYYH.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-MNWDOXX6.js";
+import "../chunk-KAWLZTRJ.js";
 import "../chunk-2UMNXADU.js";
 import {
   CURSOR_GATE_EVENTS,
   HOOK_LOCATOR_BINARY
-} from "../chunk-7VVX6HQG.js";
+} from "../chunk-VZADMT7R.js";
 
 // bin/pushary-clean.ts
 import { existsSync, readFileSync, copyFileSync, readdirSync } from "fs";

package/dist/bin/pushary-codex-bridge.js

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
-import "../chunk-3OXHYPZG.js";
+import "../chunk-HKQ6CD32.js";
 import {
   LiveTranscriptRelay,
   liveSessionSleep,
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-7W6E3C3I.js";
+} from "../chunk-KNIVXEW4.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
   describeIdleWindow,
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-6BNBW3M2.js";
-import "../chunk-JDNW6FTV.js";
+} from "../chunk-DSCGKZO5.js";
+import "../chunk-DH4INZW3.js";
 import "../chunk-EQRS3SGM.js";
 import {
   transcriptsEnabled
-} from "../chunk-TGORRMOU.js";
+} from "../chunk-JZSWA3VT.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
@@ -27,16 +27,16 @@ import {
 } from "../chunk-L4ZCFMWW.js";
 import {
   getMachineId
-} from "../chunk-O7ODXFII.js";
-import "../chunk-W5GH5GTX.js";
-import "../chunk-3N4FT4WQ.js";
+} from "../chunk-C7BFOC35.js";
+import "../chunk-FBO5WS3D.js";
+import "../chunk-6MRPTYYH.js";
 import {
   callMcpTool
 } from "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-MNWDOXX6.js";
+import "../chunk-KAWLZTRJ.js";
 import {
   getApiKey,
   getBaseUrl
@@ -44,7 +44,7 @@ import {
 import {
   parseAgentQuestion,
   parseAgentQuestionAnswers
-} from "../chunk-7VVX6HQG.js";
+} from "../chunk-VZADMT7R.js";
 
 // bin/pushary-codex-bridge.ts
 import { existsSync } from "fs";

package/dist/bin/pushary-codex-hook.js

@@ -1,31 +1,31 @@
 #!/usr/bin/env node
 import {
   defersToNativeMode
-} from "../chunk-AGQA72IH.js";
+} from "../chunk-SRFA5BOO.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-EEJ6EQMI.js";
+} from "../chunk-32WFHA77.js";
 import {
   readHookInput
-} from "../chunk-V4G7BQZ6.js";
+} from "../chunk-R4MBUCPQ.js";
 import {
   denyReasonFrom,
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
-import "../chunk-4NJURLRP.js";
-import "../chunk-ZKDQ3QRP.js";
-import "../chunk-MZOTKCNZ.js";
-import "../chunk-MDDKA4QM.js";
-import "../chunk-HTWQH3VI.js";
-import "../chunk-TMOCSYJK.js";
-import "../chunk-ND52YE7L.js";
-import "../chunk-TKA2L2BU.js";
-import "../chunk-HJYGC7IR.js";
-import "../chunk-GGX5QTBG.js";
-import "../chunk-JDNW6FTV.js";
+import "../chunk-XKIB2FQY.js";
+import "../chunk-WZ63WTAZ.js";
+import "../chunk-BS5XR4J7.js";
+import "../chunk-4XFBO3GW.js";
+import "../chunk-FVTFSYKB.js";
+import "../chunk-A2M6FGUF.js";
+import "../chunk-7N3D4GN7.js";
+import "../chunk-CDBTCEKE.js";
+import "../chunk-GOPIMNVC.js";
+import "../chunk-3AJIK5AO.js";
+import "../chunk-DH4INZW3.js";
 import "../chunk-EQRS3SGM.js";
-import "../chunk-TGORRMOU.js";
+import "../chunk-JZSWA3VT.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-L4ZCFMWW.js";
 import {
@@ -52,7 +52,7 @@ import {
   toCodexWire,
   toPolicyLookup,
   toPolicyLookups
-} from "../chunk-MQO7J2OJ.js";
+} from "../chunk-ZJ6QXXBC.js";
 import {
   DECISION_STOP_REASON,
   askUser,
@@ -60,7 +60,7 @@ import {
   isLocalQuestionHandoff,
   sendNotification,
   waitForQuestion
-} from "../chunk-2BE7ZVWP.js";
+} from "../chunk-XS33QBJA.js";
 import {
   UNNAMED_ACTION,
   deriveActionBody,
@@ -69,22 +69,22 @@ import {
   describeToolCall,
   scopePathFor,
   sessionIdentityOf
-} from "../chunk-LVU3Q43J.js";
-import "../chunk-YE37HYN3.js";
+} from "../chunk-HBBQO77U.js";
+import "../chunk-32WWVRXN.js";
 import {
   getMachineId
-} from "../chunk-O7ODXFII.js";
+} from "../chunk-C7BFOC35.js";
 import {
   canonicalJson
-} from "../chunk-W5GH5GTX.js";
+} from "../chunk-FBO5WS3D.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-3N4FT4WQ.js";
+import "../chunk-6MRPTYYH.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-MNWDOXX6.js";
+import "../chunk-KAWLZTRJ.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
@@ -95,7 +95,7 @@ import {
   hookWaitClamped,
   hookWaitDeadline,
   resolveGate
-} from "../chunk-7VVX6HQG.js";
+} from "../chunk-VZADMT7R.js";
 
 // bin/pushary-codex-hook.ts
 import { basename } from "path";