@pushary/agent-hooks 0.95.4 → 0.95.6

package/dist/{chunk-U24ERDPE.js → chunk-FHIVWF4B.js}

@@ -1,10 +1,10 @@
 import {
   defersToNativeMode
-} from "./chunk-AGQA72IH.js";
+} from "./chunk-SRFA5BOO.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-EEJ6EQMI.js";
+} from "./chunk-32WFHA77.js";
 import {
   denyReasonFrom,
   isDeferAnswer
@@ -20,7 +20,7 @@ import {
   reportEvent,
   settleQuestionsForToolUse,
   throttlePass
-} from "./chunk-MQO7J2OJ.js";
+} from "./chunk-ZJ6QXXBC.js";
 import {
   DECISION_STOP_REASON,
   askUser,
@@ -28,7 +28,7 @@ import {
   isLocalQuestionHandoff,
   sendNotification,
   waitForQuestion
-} from "./chunk-2BE7ZVWP.js";
+} from "./chunk-XS33QBJA.js";
 import {
   UNNAMED_ACTION,
   deriveAction,
@@ -38,14 +38,10 @@ import {
   describeToolCall,
   permissionDeniedAction,
   scopePathFor
-} from "./chunk-LVU3Q43J.js";
-import {
-  PRETOOLUSE_HANDLED_TOOLS,
-  PRETOOLUSE_PHONE_ANSWERED_TOOLS
-} from "./chunk-YE37HYN3.js";
+} from "./chunk-HBBQO77U.js";
 import {
   getMachineId
-} from "./chunk-O7ODXFII.js";
+} from "./chunk-C7BFOC35.js";
 import {
   getApiKey,
   getBaseUrl
@@ -57,12 +53,14 @@ import {
   effectiveWaitSeconds,
   hookWaitClamped,
   hookWaitDeadline,
+  hookWritePath,
+  isPermissionRequestOwnedByPreToolUse,
   isPusharyOwnTool,
   parseAgentQuestionAnswers,
   parseAgentQuestions,
   resolveGate,
   stoppedOutput
-} from "./chunk-7VVX6HQG.js";
+} from "./chunk-VZADMT7R.js";
 
 // src/decision-episode.ts
 var EPISODE_PATH = "/api/agent/decision-episode";
@@ -228,6 +226,7 @@ var dispatchModeHandler = async (apiKey, input, toolPolicy, machineId, trainingC
   const toolTarget = deriveToolTarget(input.tool_name, input.tool_input);
   const intent = readLastPrompt(sessionId ?? DEFAULT_SESSION) ?? (input.transcript_path ? readLastUserPrompt(input.transcript_path) : void 0);
   const decision = {
+    toolPath: hookWritePath(input.tool_name, input.tool_input),
     intent,
     action: deriveAction(input.tool_name, input.tool_input),
     blocker: scopeReason ?? deriveBlocker(toolPolicy.mode),
@@ -501,10 +500,7 @@ var toPermissionRequestOutput = (hookOutput) => {
   return void 0;
 };
 var handlePermissionRequest = async (input) => {
-  if (PRETOOLUSE_HANDLED_TOOLS.has(input.tool_name)) {
-    const reclaimDeferredExec = !PRETOOLUSE_PHONE_ANSWERED_TOOLS.includes(input.tool_name) && shouldDeferToNativeMode(input.permission_mode, input.tool_name);
-    if (!reclaimDeferredExec) return void 0;
-  }
+  if (isPermissionRequestOwnedByPreToolUse(input.tool_name, input.permission_mode, shouldDeferToNativeMode)) return void 0;
   if (isPusharyOwnTool(input.tool_name)) return void 0;
   let apiKey;
   try {
@@ -543,6 +539,8 @@ var automodeRetryEnabled = () => {
 };
 var reportPermissionDenied = (input) => reportEvent({
   event: "permission_denied",
+  occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+  toolUseId: input.tool_use_id,
   agentType: CLAUDE_CODE_AGENT.type,
   agentName: `${CLAUDE_CODE_AGENT.label} - ${basename(input.cwd ?? process.cwd())}`,
   action: permissionDeniedAction(input.tool_name),

package/dist/{chunk-HTWQH3VI.js → chunk-FVTFSYKB.js}

@@ -1,6 +1,6 @@
 import {
   HOOK_LOCATOR_BINARY
-} from "./chunk-7VVX6HQG.js";
+} from "./chunk-VZADMT7R.js";
 
 // src/diagnostics/bridge.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-HJYGC7IR.js → chunk-GOPIMNVC.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-GGX5QTBG.js";
+} from "./chunk-3AJIK5AO.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-DLLAWCQB.js → chunk-GOQHN2UH.js}

@@ -1,6 +1,6 @@
 import {
   renderCommandHelp
-} from "./chunk-D6PRC3YQ.js";
+} from "./chunk-LZQVAEWP.js";
 import {
   getPackageVersion
 } from "./chunk-DINDL2CF.js";

package/dist/{chunk-LVU3Q43J.js → chunk-HBBQO77U.js}

@@ -5,7 +5,7 @@ import {
   FILE_TARGET_TOOLS,
   redactSecrets,
   redactSecretsDeep
-} from "./chunk-7VVX6HQG.js";
+} from "./chunk-VZADMT7R.js";
 
 // ../hook-mapping/src/describe.ts
 import { isAbsolute, relative, resolve } from "path";

package/dist/{chunk-CVZP67ST.js → chunk-HHODMHTH.js}

@@ -1,16 +1,16 @@
 import {
   CLAUDE_HOOK_EVENTS,
   supportedClaudeEvents
-} from "./chunk-TKA2L2BU.js";
+} from "./chunk-CDBTCEKE.js";
 import {
   guardBinary
-} from "./chunk-GGX5QTBG.js";
+} from "./chunk-3AJIK5AO.js";
 import {
   isProtectedByScope
-} from "./chunk-W5GH5GTX.js";
+} from "./chunk-FBO5WS3D.js";
 import {
   HOOK_LOCATOR_BINARY
-} from "./chunk-7VVX6HQG.js";
+} from "./chunk-VZADMT7R.js";
 
 // src/claude-config.ts
 import { join } from "path";

package/dist/{chunk-3OXHYPZG.js → chunk-HKQ6CD32.js}

@@ -3,6 +3,9 @@ import {
   resolveGlobalPackageVersion,
   resolvePackageVersionFromBinary
 } from "./chunk-L4ZCFMWW.js";
+import {
+  MANAGED_PROVIDERS
+} from "./chunk-VZADMT7R.js";
 
 // src/live-capabilities.ts
 var CLAUDE_BRIDGE_CAPABILITY = "claude-bridge";
@@ -39,7 +42,7 @@ var resolveControlPolicy = (input) => {
   if (input.providerAvailable && input.managerAvailable) return "enabled";
   return input.servicePresent ? "legacy" : "unsupported";
 };
-var detectProviderLiveCapabilities = (providers = ["claude", "codex", "gemini"]) => {
+var detectProviderLiveCapabilities = (providers = MANAGED_PROVIDERS) => {
   const enabled = new Set(providers);
   const geminiBin = enabled.has("gemini") ? resolveBinary("gemini") : void 0;
   return providerLiveCapabilities({

package/dist/{chunk-TGORRMOU.js → chunk-JZSWA3VT.js}

@@ -1,6 +1,6 @@
 import {
   readTranscriptPreference
-} from "./chunk-3N4FT4WQ.js";
+} from "./chunk-6MRPTYYH.js";
 
 // src/transcript-setting.ts
 var transcriptEnvironmentPreference = () => {

package/dist/{chunk-MNWDOXX6.js → chunk-KAWLZTRJ.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-2UMNXADU.js";
 import {
   normalizeInstallSource
-} from "./chunk-7VVX6HQG.js";
+} from "./chunk-VZADMT7R.js";
 
 // src/cli/fsx.ts
 import { copyFileSync, existsSync, fsyncSync, mkdirSync, openSync, closeSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "fs";

package/dist/{chunk-7W6E3C3I.js → chunk-KNIVXEW4.js}

@@ -3,7 +3,7 @@ import {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-JDNW6FTV.js";
+} from "./chunk-DH4INZW3.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords

package/dist/{chunk-D6PRC3YQ.js → chunk-LZQVAEWP.js}

@@ -125,7 +125,8 @@ var COMMAND_OPTIONS = {
   ],
   doctor: [
     ["--json", "Emit every check as one object instead of the screen"],
-    ["--roundtrip", "Also send a real question and wait for you to answer it on your phone"],
+    ["--roundtrip", "Send a synthetic question and report the returned answer; does not test hooks"],
+    ["--activation claude_code --activation-target <path>", "Read correlated evidence for one unique scratch file; sends no test question"],
     ["--no-push", "Run every check without waking a device"],
     ["--bundle", "Write a redacted diagnostics file you can attach to a support thread"]
   ],

package/dist/{chunk-JAKWHALW.js → chunk-O5RQ7RYJ.js}

@@ -15,7 +15,10 @@ import {
 } from "./chunk-EYRGBYZG.js";
 import {
   reportedInstallSource
-} from "./chunk-MNWDOXX6.js";
+} from "./chunk-KAWLZTRJ.js";
+import {
+  isAnswerSource
+} from "./chunk-VZADMT7R.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {
@@ -119,7 +122,7 @@ var classifyDelivery = (channels, push) => {
 var sendTestNotification = async (apiKey) => {
   const result = await callMcpTool(apiKey, "send_notification", {
     title: "Pushary is connected",
-    body: "Your AI agent can now reach you right here.",
+    body: "This setup notification reached you. Agent hooks still need a real-agent check.",
     agentName: "Pushary setup"
   }, { timeoutMs: 2e4 });
   const toCount = (value) => typeof value === "number" && Number.isFinite(value) ? value : 0;
@@ -145,7 +148,7 @@ var describeVerifyOutcome = (outcome) => {
         message: "Nothing to deliver to. Agents are configured; approvals will fall back to the terminal.",
         next: [
           "Run pushary connect to add your phone.",
-          "Then pushary doctor --roundtrip to test a real approval."
+          "Then pushary doctor --roundtrip to test a synthetic question and answer."
         ]
       };
     case "others-only":
@@ -174,7 +177,7 @@ var describeVerifyOutcome = (outcome) => {
       };
   }
 };
-var ROUND_TRIP_QUESTION = "Setup is nearly done. Tap Yes and this machine is connected.";
+var ROUND_TRIP_QUESTION = "Pushary delivery test. Tap Yes or No to test returning an answer. This does not test your agent hooks.";
 var ROUND_TRIP_TIMEOUT_MS = 55e3;
 var defaultAsk = (apiKey, agentName) => (
   // wait:false so the poll is ours: the blocking form returns on the SITE's
@@ -195,6 +198,18 @@ var defaultCancel = async (apiKey, correlationId) => {
   await callMcpTool(apiKey, "cancel_question", { correlationId }, { timeoutMs: 1e4 }).catch(() => {
   });
 };
+var answeredRoundTrip = (answer, correlationId, latencyMs) => {
+  if (answer.value !== "yes" && answer.value !== "no") {
+    return { kind: "error", detail: "the server reported an answer without a valid Yes or No value" };
+  }
+  return {
+    kind: "answered",
+    value: answer.value,
+    latencyMs,
+    correlationId,
+    ...isAnswerSource(answer.answerSource) ? { answerSource: answer.answerSource } : {}
+  };
+};
 var verifyRoundTrip = async (apiKey, agentName = "Pushary setup", deps = {}) => {
   const ask = deps.ask ?? defaultAsk;
   const wait = deps.wait ?? defaultWait;
@@ -207,31 +222,73 @@ var verifyRoundTrip = async (apiKey, agentName = "Pushary setup", deps = {}) =>
   } catch (err) {
     return { kind: "error", detail: err instanceof Error ? err.message : "ask failed" };
   }
-  if (asked.noDevices || asked.warning) return { kind: "no-recipients" };
-  if (asked.mode === "notify_only" || asked.status === "notified") return { kind: "notify-only" };
-  if (!asked.correlationId) return { kind: "error", detail: "no correlationId returned" };
-  if (asked.answered === true) {
-    return { kind: "answered", value: asked.value ?? "yes", latencyMs: now() - started };
+  let shutdown;
+  const stop = (code) => {
+    if (shutdown) return;
+    shutdown = (async () => {
+      let timer;
+      try {
+        await Promise.race([
+          cancel(apiKey, asked.correlationId).catch(() => {
+          }),
+          new Promise((resolve) => {
+            timer = setTimeout(resolve, 4e3);
+          })
+        ]);
+      } finally {
+        clearTimeout(timer);
+        process.stderr.write("Delivery test interrupted. Cleanup was attempted; an unresolved question expires automatically.\n");
+        process.exit(code);
+      }
+    })();
+  };
+  const onInterrupt = () => stop(130);
+  const onTerminate = () => stop(143);
+  if (asked.correlationId) {
+    process.on("SIGINT", onInterrupt);
+    process.on("SIGTERM", onTerminate);
   }
-  let answer;
+  let answerObserved = false;
   try {
-    answer = await wait(apiKey, asked.correlationId);
+    if (asked.noDevices || asked.warning) return { kind: "no-recipients" };
+    if (asked.mode === "notify_only" || asked.status === "notified") return { kind: "notify-only" };
+    if (!asked.correlationId) return { kind: "error", detail: "no correlationId returned" };
+    const answer = asked.answered === true ? asked : await wait(apiKey, asked.correlationId);
+    if (answer.answered === true) {
+      const outcome = answeredRoundTrip(answer, asked.correlationId, now() - started);
+      answerObserved = outcome.kind === "answered";
+      return outcome;
+    }
+    return { kind: "unanswered" };
   } catch (err) {
-    await cancel(apiKey, asked.correlationId);
     return { kind: "error", detail: err instanceof Error ? err.message : "wait failed" };
+  } finally {
+    if (shutdown) await shutdown;
+    process.off("SIGINT", onInterrupt);
+    process.off("SIGTERM", onTerminate);
+    if (!answerObserved && asked.correlationId) await cancel(apiKey, asked.correlationId).catch(() => {
+    });
   }
-  if (answer.answered === true) {
-    return { kind: "answered", value: answer.value ?? "yes", latencyMs: now() - started };
+};
+var describeAnswerSource = (source) => {
+  switch (source) {
+    case "mobile_app":
+    case "mobile_background":
+      return "A phone answered this synthetic test.";
+    case "mac_app":
+      return "A Mac answered this synthetic test.";
+    case "sandbox":
+      return "This was a simulated sandbox answer.";
+    default:
+      return source ? `Answer source: ${source}. This was a synthetic test.` : "The answering surface was not reported. This was a synthetic test.";
   }
-  await cancel(apiKey, asked.correlationId);
-  return { kind: "unanswered" };
 };
-var describeRoundTrip = (outcome) => {
+var describeRoundTripOutcome = (outcome) => {
   switch (outcome.kind) {
     case "answered":
       return {
         ok: true,
-        message: `Answered "${outcome.value}" in ${(outcome.latencyMs / 1e3).toFixed(1)}s. Your agent can reach you and you can answer it.`,
+        message: `Answered "${outcome.value}" in ${(outcome.latencyMs / 1e3).toFixed(1)}s. ${describeAnswerSource(outcome.answerSource)}`,
         next: []
       };
     case "unanswered":
@@ -266,6 +323,20 @@ var describeRoundTrip = (outcome) => {
       };
   }
 };
+var describeRoundTrip = (outcome) => {
+  const report = describeRoundTripOutcome(outcome);
+  return { ...report, next: [...report.next, "Agent hook activation remains unverified. Restart your agent and check one real approval."] };
+};
+var roundTripEvidence = (outcome) => ({
+  kind: outcome?.kind ?? "skipped",
+  ...outcome?.kind === "answered" ? {
+    correlationId: outcome.correlationId ?? null,
+    answerSource: outcome.answerSource ?? null,
+    value: outcome.value,
+    latencyMs: outcome.latencyMs
+  } : {},
+  hookActivation: "unverified"
+});
 
 // src/onboarding.ts
 import qrcodeTerminal from "qrcode-terminal";
@@ -863,6 +934,7 @@ export {
   describeReach,
   verifyRoundTrip,
   describeRoundTrip,
+  roundTripEvidence,
   fetchChannels,
   connectDevice,
   confirmAppConnection,

package/dist/{chunk-TR6DBXO3.js → chunk-OIZVYUED.js}

@@ -1,6 +1,6 @@
 import {
   parseVersion
-} from "./chunk-TKA2L2BU.js";
+} from "./chunk-CDBTCEKE.js";
 
 // src/setup/agent-probe.ts
 import { execSync } from "child_process";

package/dist/{chunk-V4G7BQZ6.js → chunk-R4MBUCPQ.js}

@@ -1,6 +1,6 @@
 import {
   registerTranscript
-} from "./chunk-4NJURLRP.js";
+} from "./chunk-XKIB2FQY.js";
 
 // src/admission.ts
 import { readFileSync } from "fs";

package/dist/{chunk-XDHJ4KZJ.js → chunk-RPHXG4HI.js}

@@ -1,9 +1,9 @@
 import {
   openCodeConfigDirFrom
-} from "./chunk-PFRLYYF6.js";
+} from "./chunk-43TFQOAT.js";
 import {
   codexHomeFrom
-} from "./chunk-W5GH5GTX.js";
+} from "./chunk-FBO5WS3D.js";
 
 // src/vscode-config.ts
 import { homedir } from "os";

package/dist/{chunk-J5KTLGO5.js → chunk-SLVXQOYU.js}

@@ -1,6 +1,6 @@
 import {
   readConfigFileKey
-} from "./chunk-3N4FT4WQ.js";
+} from "./chunk-6MRPTYYH.js";
 
 // src/bell/fleet.ts
 import { closeSync, constants, futimesSync, lstatSync, mkdirSync, openSync, readdirSync, unlinkSync } from "fs";

package/dist/{chunk-AGQA72IH.js → chunk-SRFA5BOO.js}

@@ -1,6 +1,6 @@
 import {
   shouldDeferToNativeMode
-} from "./chunk-7VVX6HQG.js";
+} from "./chunk-VZADMT7R.js";
 
 // src/native-defer.ts
 var nativeDeferOptions = () => {