@pushary/agent-hooks 0.95.5 → 0.95.7

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.95.7
+
+- Let Gemini's own prompt decide in When I'm out when Pushary cannot create the approval question, instead of refusing the call. Every time still refuses, and says Pushary could not create a verifiable approval.
+- Refuse approvals an unattended Gemini bridge cannot show locally with a specific reason (no local input, no phone answer in time, handled on the machine, no device connected), instead of passing them to Gemini's unexplained headless denial.
+- Withdraw the phone question before a Codex bridge gives up on a Terminal or Updates question, so an answer that arrives during the withdrawal still counts.
+- Describe what happens when you don't answer in `pushary doctor` and `pushary wait` in the current mode words: When I'm out asks your phone when you are away or Pushary cannot tell, then hands back to the agent's own prompt.
+
+## 0.95.6
+
+- Separate synthetic answer tests from real hook activation and report the actual answering surface.
+- Cancel known pending diagnostic questions on interrupted or unanswered exits without fabricating approval.
+- Add Claude Code activation evidence for a unique scratch-file approval, correlated with the observed tool result.
+- Report managed-control readiness separately from hook configuration and phone delivery, refreshing credentials, service state and remote proof after interactive waits.
+
 ## 0.95.5
 
 - Preserve the full approval window while allowing the final poll time to return; keep late denials and cancellation authoritative.

package/data/cursor-plugin/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "pushary",
   "displayName": "Pushary — Control Panel for AI Agents",
   "description": "Push notifications, human-in-the-loop questions, and permission gating for your AI coding agent. Get a push when a task finishes, answer the agent from your phone, and approve risky commands before they run.",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "author": { "name": "Pushary", "email": "business@pushary.com" },
   "homepage": "https://pushary.com",
   "repository": "https://github.com/Pushary/cursor-plugin",

package/data/cursor-plugin/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.2.3
+
+- Updates and Terminal hand an approval back to Cursor promptly. The gate no longer waits for a phone answer that Updates never asks for, and it withdraws the phone question before Cursor decides. An answer that arrives in that moment still counts.
+- A file change that goes back to the agent's own permissions is refused with the reason, because Cursor file hooks cannot show a local approval. Choose Every time for file changes you want to approve from your phone.
+- With no phone or other notification channel connected, a file change is refused with a message that says so. Shell commands and MCP calls still open Cursor's own prompt with "No device connected, approve here."
+- Approval questions carry the repository and the tool name the gate judged, so routing and repository rules apply to the question as they did to the gate. A file change is asked about with its full path, so path rules and routing match it. A path longer than 80 characters falls back to the file type instead of making the question fail.
+
 ## 0.2.2
 
 - Allow file edits when the server explicitly says the action is not gated.

package/data/cursor-plugin/scripts/pushary-gate.mjs

@@ -5,7 +5,7 @@
 import { createHash, randomUUID } from 'node:crypto'
 import { hostname } from 'node:os'
 import { existsSync, readFileSync } from 'node:fs'
-import { basename, dirname, join } from 'node:path'
+import { basename, dirname, isAbsolute, join, posix, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 const BASE_URL = process.env.PUSHARY_BASE_URL?.trim() || 'https://pushary.com'
@@ -22,6 +22,13 @@ const ALLOW = { permission: 'allow' }
 let genericToolHook = false
 const ask = (agentMessage) => genericToolHook ? deny(agentMessage ?? 'Approval requires a user decision. Ask through Pushary, then retry.') : (agentMessage ? { permission: 'ask', agent_message: agentMessage } : { permission: 'ask' })
 const deny = (agentMessage) => ({ permission: 'deny', user_message: 'Command denied via Pushary.', agent_message: agentMessage })
+// A quiet handoff returns to the agent's permissions, but a file hook has no
+// local prompt to return to. Retrying cannot help, so say why. Same text as the gate route.
+const QUIET_FILE_HOOK_REASON = 'This Cursor file hook cannot show a local approval. Switch to Every time for this action.'
+const handBack = (agentMessage) => genericToolHook ? deny(QUIET_FILE_HOOK_REASON) : ask(agentMessage)
+// No channel can reach anyone, and a file hook has no local prompt to fall back to either.
+const NO_DEVICE_FILE_HOOK_REASON = 'No phone or other notification channel is connected to Pushary, and this Cursor file hook cannot show a local approval. Connect one in Pushary, then retry.'
+const noDevice = () => genericToolHook ? deny(NO_DEVICE_FILE_HOOK_REASON) : ask('No device connected, approve here.')
 const unresolved = (verdict) => genericToolHook && verdict?.reason === 'not_gated'
   ? ALLOW
   : ask(genericToolHook ? 'Pushary could not reach a verdict for this change. Retry shortly.' : undefined)
@@ -317,7 +324,42 @@ const deriveActionBody = (command) => capActionBody(redactSecretsDeep(command))
 // one-tap Approve on a dangerous call, and record a decision at the same grain as
 // every other agent. Without them a destructive Cursor command arrived on the
 // lock screen ungated.
-const commandHead = (command) => command.trim().split(/\s+/).slice(0, 2).join(' ').slice(0, 120)
+// ask_user accepts a target of at most 80 characters (TOOL_TARGET_MAX_LENGTH in
+// @pushary/contracts). A longer one fails the whole ask.
+const TOOL_TARGET_MAX = 80
+
+// A file change is routed and matched by its path, so the ask carries the path the
+// gate judged, resolved against cwd the way the server resolves it. A path too long
+// for ask_user is left out and the server's own target is used instead.
+const filePathTarget = (path, cwd) => {
+  if (typeof path !== 'string' || !path) return undefined
+  const full = cwd && !isAbsolute(path) ? resolve(cwd, path) : path
+  return full.length <= TOOL_TARGET_MAX ? full : undefined
+}
+
+// ask_user takes toolPath as an absolute POSIX path of at most 4096 characters and
+// rejects the whole ask for anything else.
+const TOOL_PATH_MAX = 4096
+
+// The exact path, so routing and path rules still match a file whose path is too
+// long for toolTarget. Sent only when it is an absolute POSIX path: a relative path
+// with no absolute cwd, or a Windows path, is left out rather than failing the ask.
+const filePathForAsk = (path, cwd) => {
+  if (typeof path !== 'string' || !path) return undefined
+  if (/^[A-Za-z]:[\\/]/.test(path) || path.startsWith('\\')) return undefined
+  const full = path.startsWith('/') ? path
+    : typeof cwd === 'string' && cwd.startsWith('/') ? posix.resolve(cwd, path) : undefined
+  return full && full.length <= TOOL_PATH_MAX ? full : undefined
+}
+
+// The canonical tool and target from a gate verdict, taken by name. Anything else a
+// server adds to questionContext must never overwrite what this gate asks with.
+const canonicalQuestion = (context) => ({
+  toolName: typeof context?.toolName === 'string' && context.toolName ? context.toolName : undefined,
+  toolTarget: typeof context?.toolTarget === 'string' && context.toolTarget ? context.toolTarget : undefined,
+})
+
+const commandHead = (command) => command.trim().split(/\s+/).slice(0, 2).join(' ').slice(0, TOOL_TARGET_MAX)
 
 const askArgs = (request, project, ident) => ({
   question: `${request.prompt}\n\n${redactSecrets(request.display)}`,
@@ -326,8 +368,10 @@ const askArgs = (request, project, ident) => ({
   agentName: ident.agentName,
   sessionId: ident.sessionId,
   machineId: ident.machineId,
+  repoKey: ident.repoKey,
   toolName: request.toolName,
   toolTarget: request.toolTarget,
+  ...(request.toolPath ? { toolPath: request.toolPath } : {}),
   actionBody: deriveActionBody(request.display),
   wait: false,
   waitEndsAt: new Date(Date.now() + MAX_BLOCK_MS).toISOString(),
@@ -377,10 +421,11 @@ const withdraw = async (apiKey, correlationId) => {
   }
 }
 
-const handedOff = (asked) => asked.suppressed || asked.status === 'terminal'
+const handedOff = (asked) => asked.suppressed || asked.status === 'terminal' || asked.status === 'notified'
+  || asked.handoffAction === 'cancel_then_ask_in_current_client'
 
 const handoffMessage = (asked) =>
-  asked.suppressed ? 'You are at the keyboard, approve here.' : 'Delivery mode is Terminal, approve here.'
+  asked.suppressed ? 'You are at the keyboard, continue with the agent’s permissions.' : 'Continue with the agent’s permissions.'
 
 const denialFor = (noun) =>
   `The user denied this ${noun} via a Pushary push approval. Do not run it — propose an alternative or ask how to proceed.`
@@ -404,8 +449,10 @@ const describeRequest = (input) => {
     if (!['Write', 'Delete', 'Edit'].includes(input.tool_name)) return null
     const params = input.tool_input && typeof input.tool_input === 'object' ? input.tool_input : {}
     const display = `${input.tool_name}\n${JSON.stringify(params)}`
+    const toolPath = filePathForAsk(params.file_path ?? params.path, input.cwd)
     return { toolName: input.tool_name, toolInputs: [params], display,
-      toolTarget: String(params.file_path ?? params.path ?? '').slice(0, 120),
+      toolTarget: filePathTarget(params.file_path ?? params.path, input.cwd),
+      ...(toolPath ? { toolPath } : {}),
       prompt: 'Allow this file change?', verb: 'change this file', denied: denialFor('file change') }
   }
 
@@ -434,7 +481,7 @@ const describeRequest = (input) => {
       toolName,
       toolInputs: [{ tool: toolName, params }],
       display: params ? `${toolName}\n${params}` : toolName,
-      toolTarget: toolName.slice(0, 120),
+      toolTarget: toolName.slice(0, TOOL_TARGET_MAX),
       prompt: 'Allow this tool call?',
       verb: 'call this tool',
       denied: denialFor('tool call'),
@@ -471,17 +518,19 @@ const handlePushOnly = async (apiKey, request, project, ident, timeoutSeconds, t
   if (!asked?.correlationId) return deny('Pushary did not return a verifiable approval.')
   activeQuestion = { apiKey, correlationId: asked.correlationId }
 
-  if (handedOff(asked)) {
+  // No device first. The server checks for a channel before any quiet mode, and
+  // that reply carries the same handoffAction as a quiet handoff.
+  if (asked.noDevices) {
     const late = await withdraw(apiKey, asked.correlationId)
     if (stopped(late)) return deny(STOP_REASON)
     if (late.answered) return fromAnswer(late, request.denied)
-    return ask(handoffMessage(asked))
+    return noDevice()
   }
-  if (asked.noDevices) {
+  if (handedOff(asked)) {
     const late = await withdraw(apiKey, asked.correlationId)
     if (stopped(late)) return deny(STOP_REASON)
     if (late.answered) return fromAnswer(late, request.denied)
-    return ask('No device connected, approve here.')
+    return handBack(handoffMessage(asked))
   }
 
   const realMs = timeoutAction === 'wait' ? MAX_BLOCK_MS : Math.max(timeoutSeconds, 1) * 1000
@@ -518,17 +567,17 @@ const handlePushFirst = async (apiKey, request, project, ident, pushFirstSeconds
   if (!asked?.correlationId) return deny('Pushary did not return a verifiable approval.')
   activeQuestion = { apiKey, correlationId: asked.correlationId }
 
-  if (handedOff(asked)) {
+  if (asked.noDevices) {
     const late = await withdraw(apiKey, asked.correlationId)
     if (stopped(late)) return deny(STOP_REASON)
     if (late.answered) return fromAnswer(late, request.denied)
-    return ask(handoffMessage(asked))
+    return noDevice()
   }
-  if (asked.noDevices) {
+  if (handedOff(asked)) {
     const late = await withdraw(apiKey, asked.correlationId)
     if (stopped(late)) return deny(STOP_REASON)
     if (late.answered) return fromAnswer(late, request.denied)
-    return ask('No device connected, approve here.')
+    return handBack(handoffMessage(asked))
   }
 
   const cap = Math.min(Math.max(pushFirstSeconds, 1) * 1000, MAX_BLOCK_MS)
@@ -557,7 +606,7 @@ const handleNotifyOnly = async (apiKey, request, project, ident) => {
       machineId: ident.machineId,
     })
   } catch {}
-  return ask()
+  return handBack()
 }
 
 const TELEMETRY_EVENTS = ["postToolUse", "stop", "sessionStart", "sessionEnd", "beforeSubmitPrompt", "preCompact", "subagentStart", "subagentStop"]
@@ -620,7 +669,7 @@ setTimeout(async () => {
 
   const project = basename(input.cwd || process.cwd()) || 'workspace'
   const sessionId = typeof input.conversation_id === 'string' ? input.conversation_id : undefined
-  const ident = { agentName: `Cursor - ${project}`, sessionId, machineId: getMachineId() }
+  const ident = { agentName: `Cursor - ${project}`, sessionId, machineId: getMachineId(), repoKey: deriveRepoKey(input.cwd) }
 
   try {
     const verdict = await decide(apiKey, request, input.cwd, sessionId)
@@ -632,11 +681,17 @@ setTimeout(async () => {
     if (verdict.kind === 'deny') return respond(deny(verdict.reason))
     if (verdict.kind !== 'ask') return respond(ask())
 
+    // Reuse the server's canonical tool and target, so asking resolves the same rules
+    // as the gate. A file change keeps its own path: the server's target for a file
+    // is only its extension, which loses what routing and path rules match on.
+    const canonical = canonicalQuestion(verdict.questionContext)
+    request.toolName = canonical.toolName ?? request.toolName
+    request.toolTarget = (genericToolHook && request.toolTarget) || canonical.toolTarget || request.toolTarget
     const tool = verdict.policy
 
     switch (tool.mode) {
       case 'terminal_only':
-        return respond(ask())
+        return respond(handBack())
       case 'notify_only':
         return respond(await handleNotifyOnly(apiKey, request, project, ident))
       case 'push_only':

package/data/vscode-plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pushary",
   "description": "Push notifications, human-in-the-loop questions, and permission gating for your AI agent. Get a push when a task finishes, answer the agent from your phone, and approve risky commands before they run.",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "author": {
     "name": "Pushary",
     "email": "business@pushary.com",

package/data/vscode-plugin/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.2.3
+
+- Updates hands an approval back to VS Code promptly. The gate no longer waits for a phone answer that Updates never asks for, and it withdraws the phone question before VS Code asks. An answer that arrives in that moment still counts.
+- With no phone or other notification channel connected, VS Code's prompt says "No device connected, approve here." instead of naming a delivery mode.
+- Approval questions carry the repository and the tool name the gate judged, so routing and repository rules apply to the question as they did to the gate. A file edit is asked about with its full path, so path rules and routing match it. A path longer than 80 characters falls back to the file type instead of making the question fail.
+
 ## 0.2.2
 
 - Classify local reads, searches, diagnostics, and terminal/task output inspection as reads under the shared policy.

package/data/vscode-plugin/scripts/pushary-gate.mjs

@@ -5,7 +5,7 @@
 import { createHash, randomUUID } from 'node:crypto'
 import { homedir, hostname } from 'node:os'
 import { existsSync, readFileSync } from 'node:fs'
-import { basename, dirname, join } from 'node:path'
+import { basename, dirname, isAbsolute, join, posix, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 const BASE_URL = process.env.PUSHARY_BASE_URL?.trim() || process.env.PUSHARY_API_URL?.trim() || 'https://pushary.com'
@@ -213,16 +213,8 @@ const GATE_TIMEOUT_MS = 5000
  * Null is not a denial and not an approval: every failure hands the call back to
  * VS Code's own prompt, exactly as if this gate were not installed.
  *
- * Sent as `cursor`, which is the wire's identity for an editor gate: a caller
- * with a hard block budget and no hook config of its own. The only consequence
- * is which policy profile answers, and a site without an explicit Cursor profile
- * falls back to the all-agents one, which is what this gate already received.
- *
- * No `repoKey` is sent, because deriving one means walking parent directories
- * for a `.git` and parsing its config, and a second implementation of that rule
- * is how the last drift started. Without one the server correctly declines to
- * apply repo-scoped rules, since an unknown repository is not evidence of a
- * match -- which is what this gate already got, by being filtered server-side.
+ * Uses the VS Code policy profile and the same repository identity carried
+ * by the later question. Tool aliases and targets are canonicalized server-side.
  */
 const decide = async (apiKey, command, cwd, sessionId, ident = {}) => {
   try {
@@ -424,6 +416,51 @@ export const describeNetworkFailure = (error, env = process.env) => {
 // Bearer ..."` left the machine and landed in the question. The server scrubs
 // this field too, but a credential should never travel to be scrubbed on
 // arrival, and the notify body below was scrubbed nowhere at all.
+// ask_user accepts a target of at most 80 characters (TOOL_TARGET_MAX_LENGTH in
+// @pushary/contracts). A longer one fails the whole ask.
+const TOOL_TARGET_MAX = 80
+
+// A file change is routed and matched by its path, so the ask carries the path the
+// gate judged, resolved against cwd the way the server resolves it. A path too long
+// for ask_user is left out and the server's own target is used instead.
+const filePathTarget = (path, cwd) => {
+  if (typeof path !== 'string' || !path) return undefined
+  const full = cwd && !isAbsolute(path) ? resolve(cwd, path) : path
+  return full.length <= TOOL_TARGET_MAX ? full : undefined
+}
+
+// ask_user takes toolPath as an absolute POSIX path of at most 4096 characters and
+// rejects the whole ask for anything else.
+const TOOL_PATH_MAX = 4096
+
+// The exact path, so routing and path rules still match a file whose path is too
+// long for toolTarget. Sent only when it is an absolute POSIX path: a relative path
+// with no absolute cwd, or a Windows path, is left out rather than failing the ask.
+const filePathForAsk = (path, cwd) => {
+  if (typeof path !== 'string' || !path) return undefined
+  if (/^[A-Za-z]:[\\/]/.test(path) || path.startsWith('\\')) return undefined
+  const full = path.startsWith('/') ? path
+    : typeof cwd === 'string' && cwd.startsWith('/') ? posix.resolve(cwd, path) : undefined
+  return full && full.length <= TOOL_PATH_MAX ? full : undefined
+}
+
+// The canonical tool and target from a gate verdict, taken by name. Anything else a
+// server adds to questionContext must never overwrite what this gate asks with.
+const canonicalQuestion = (context) => ({
+  toolName: typeof context?.toolName === 'string' && context.toolName ? context.toolName : undefined,
+  toolTarget: typeof context?.toolTarget === 'string' && context.toolTarget ? context.toolTarget : undefined,
+})
+
+// The tools the server targets by file (FILE_TARGET_TOOLS in @pushary/contracts).
+const FILE_TOOLS = new Set(['Edit', 'Write', 'MultiEdit'])
+
+// The same fields the server reads a VS Code file tool's path from.
+const extractFilePath = (toolInput) => {
+  if (!toolInput || typeof toolInput !== 'object') return undefined
+  const path = toolInput.file_path ?? toolInput.filePath ?? toolInput.path
+  return typeof path === 'string' && path ? path : undefined
+}
+
 const askArgs = (command, project, ident) => ({
   question: `Allow this action?\n\n${redactSecrets(command)}`,
   type: 'confirm',
@@ -431,7 +468,10 @@ const askArgs = (command, project, ident) => ({
   agentName: ident.agentName,
   sessionId: ident.sessionId,
   machineId: ident.machineId,
+  repoKey: ident.repoKey,
   toolName: ident.toolName ?? 'Bash',
+  toolTarget: ident.toolTarget,
+  ...(ident.toolPath ? { toolPath: ident.toolPath } : {}),
   actionBody: deriveActionBody(command),
   wait: false,
   waitEndsAt: new Date(Date.now() + MAX_BLOCK_MS).toISOString(),
@@ -483,10 +523,11 @@ const withdrawQuestion = async (apiKey, correlationId) => {
   }
 }
 
-const handedOff = (asked) => asked.suppressed || asked.status === 'terminal'
+const handedOff = (asked) => asked.suppressed || asked.status === 'terminal' || asked.status === 'notified'
+  || asked.handoffAction === 'cancel_then_ask_in_current_client'
 
 const handoffMessage = (asked) =>
-  asked.suppressed ? 'You are at the keyboard, approve here.' : 'Delivery mode is Terminal, approve here.'
+  asked.suppressed ? 'You are at the keyboard, continue with the agent’s permissions.' : 'Continue with the agent’s permissions.'
 
 // push_only: wait up to the policy timeout, then apply the timeout action.
 const handlePushOnly = async (apiKey, command, project, ident, timeoutSeconds, timeoutAction) => {
@@ -502,19 +543,21 @@ const handlePushOnly = async (apiKey, command, project, ident, timeoutSeconds, t
   if (!asked?.correlationId) return deny('Pushary did not return a verifiable approval.')
   activeQuestion = { apiKey, correlationId: asked.correlationId }
 
-  // Keyboard bypass: the user is at the keyboard, so VS Code's own prompt is the
-  // faster channel.
-  if (handedOff(asked)) {
+  // No device first. The server checks for a channel before any quiet mode, and
+  // that reply carries the same handoffAction as a quiet handoff.
+  if (asked.noDevices) {
     const late = await withdrawQuestion(apiKey, asked.correlationId)
     if (stopped(late)) return deny(STOP_REASON)
     if (late.answered) return fromAnswer(late)
-    return ask(handoffMessage(asked))
+    return ask('No device connected, approve here.')
   }
-  if (asked.noDevices) {
+  // Keyboard bypass: the user is at the keyboard, so VS Code's own prompt is the
+  // faster channel.
+  if (handedOff(asked)) {
     const late = await withdrawQuestion(apiKey, asked.correlationId)
     if (stopped(late)) return deny(STOP_REASON)
     if (late.answered) return fromAnswer(late)
-    return ask('No device connected, approve here.')
+    return ask(handoffMessage(asked))
   }
 
   const realMs = timeoutAction === 'wait' ? MAX_BLOCK_MS : Math.max(timeoutSeconds, 1) * 1000
@@ -551,17 +594,17 @@ const handlePushFirst = async (apiKey, command, project, ident, pushFirstSeconds
   if (!asked?.correlationId) return deny('Pushary did not return a verifiable approval.')
   activeQuestion = { apiKey, correlationId: asked.correlationId }
 
-  if (handedOff(asked)) {
+  if (asked.noDevices) {
     const late = await withdrawQuestion(apiKey, asked.correlationId)
     if (stopped(late)) return deny(STOP_REASON)
     if (late.answered) return fromAnswer(late)
-    return ask(handoffMessage(asked))
+    return ask('No device connected, approve here.')
   }
-  if (asked.noDevices) {
+  if (handedOff(asked)) {
     const late = await withdrawQuestion(apiKey, asked.correlationId)
     if (stopped(late)) return deny(STOP_REASON)
     if (late.answered) return fromAnswer(late)
-    return ask('No device connected, approve here.')
+    return ask(handoffMessage(asked))
   }
 
   const cap = Math.min(Math.max(pushFirstSeconds, 1) * 1000, MAX_BLOCK_MS)
@@ -665,7 +708,7 @@ const main = async () => {
 
   const project = basename(input.cwd || process.cwd()) || 'workspace'
   const sessionId = typeof (input.session_id ?? input.sessionId) === 'string' ? (input.session_id ?? input.sessionId) : undefined
-  const ident = { agentName: `VS Code - ${project}`, sessionId, machineId: getMachineId(), toolName: input.tool_name, toolInputs: [input.tool_input ?? {}] }
+  const ident = { agentName: `VS Code - ${project}`, sessionId, machineId: getMachineId(), toolName: input.tool_name, toolInputs: [input.tool_input ?? {}], repoKey: deriveRepoKey(input.cwd) }
 
   try {
     const verdict = await decide(apiKey, command, input.cwd, sessionId, ident)
@@ -678,6 +721,15 @@ const main = async () => {
     if (verdict.kind === 'deny') return respond(deny(verdict.reason))
     if (verdict.kind !== 'ask') return respond(ask())
 
+    // Reuse the server's canonical tool and target so asking resolves the same rules
+    // as the gate, taken by name so nothing else in questionContext can overwrite this
+    // gate's identity. A file change keeps its own path: the server's target for a
+    // file is only its extension, which loses what routing and path rules match on.
+    const canonical = canonicalQuestion(verdict.questionContext)
+    if (canonical.toolName) ident.toolName = canonical.toolName
+    const ownFile = FILE_TOOLS.has(ident.toolName) ? extractFilePath(input.tool_input) : undefined
+    ident.toolTarget = filePathTarget(ownFile, input.cwd) ?? canonical.toolTarget
+    ident.toolPath = filePathForAsk(ownFile, input.cwd)
     const tool = verdict.policy
 
     switch (tool.mode) {

package/dist/bin/pushary-bell-hook.js

@@ -1,36 +1,36 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-VTO3TNIB.js";
+} from "../chunk-TY6IJY6I.js";
 import {
   readHookInput
-} from "../chunk-OEKFD5BC.js";
-import "../chunk-4RF52LSU.js";
-import "../chunk-BMANRGJQ.js";
-import "../chunk-VOSGZ6PH.js";
-import "../chunk-2ZTL3PGN.js";
-import "../chunk-CUEZMPLJ.js";
-import "../chunk-HBHEX3JQ.js";
-import "../chunk-XLOELLAS.js";
-import "../chunk-2D7BAOMY.js";
+} from "../chunk-IZVK6FKD.js";
+import "../chunk-HAXZ6CBF.js";
+import "../chunk-EMGGUO2Q.js";
+import "../chunk-WPS5IM7B.js";
+import "../chunk-XZWUOCJZ.js";
+import "../chunk-QJPYJVL3.js";
+import "../chunk-GQRU4KJF.js";
+import "../chunk-VMZ4SWQD.js";
+import "../chunk-7RNY3UHJ.js";
 import "../chunk-GOPIMNVC.js";
 import "../chunk-3AJIK5AO.js";
-import "../chunk-4PX4QK2Z.js";
+import "../chunk-SKPXQRKN.js";
 import "../chunk-EQRS3SGM.js";
-import "../chunk-OI3DJA7N.js";
+import "../chunk-VERXHIQF.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-L4ZCFMWW.js";
-import "../chunk-IVQMNLSA.js";
-import "../chunk-N4VNLISN.js";
-import "../chunk-OW6AZDY2.js";
+import "../chunk-XUTSZYYJ.js";
+import "../chunk-4OSQZ5TB.js";
+import "../chunk-BGX4QUQF.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-S5CMLR35.js";
+import "../chunk-VMQU7YEJ.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-KAVDAZ7A.js";
+import "../chunk-L7NOG547.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-WDKHZRAS.js";
+import "../chunk-MC5WUOJJ.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,7 +5,7 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-VTO3TNIB.js";
+} from "../chunk-TY6IJY6I.js";
 import {
   addBellHooks,
   bellInstalled,
@@ -15,19 +15,19 @@ import "../chunk-3AJIK5AO.js";
 import "../chunk-L4ZCFMWW.js";
 import {
   claudeSettings
-} from "../chunk-OW6AZDY2.js";
+} from "../chunk-BGX4QUQF.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
 import {
   exitOnHelpFlag
-} from "../chunk-DLLAWCQB.js";
-import "../chunk-D6PRC3YQ.js";
+} from "../chunk-GOQHN2UH.js";
+import "../chunk-LZQVAEWP.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-S5CMLR35.js";
+import "../chunk-VMQU7YEJ.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
@@ -35,9 +35,9 @@ import {
 import {
   readJsonSafe,
   writeJsonAtomic
-} from "../chunk-KAVDAZ7A.js";
+} from "../chunk-L7NOG547.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-WDKHZRAS.js";
+import "../chunk-MC5WUOJJ.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,7 +8,7 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-QQGNFHIK.js";
+} from "../chunk-PQGLDN4V.js";
 import {
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
@@ -17,25 +17,25 @@ import {
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-4RF52LSU.js";
-import "../chunk-BMANRGJQ.js";
-import "../chunk-VOSGZ6PH.js";
-import "../chunk-2ZTL3PGN.js";
-import "../chunk-CUEZMPLJ.js";
-import "../chunk-HBHEX3JQ.js";
+} from "../chunk-HAXZ6CBF.js";
+import "../chunk-EMGGUO2Q.js";
+import "../chunk-WPS5IM7B.js";
+import "../chunk-XZWUOCJZ.js";
+import "../chunk-QJPYJVL3.js";
+import "../chunk-GQRU4KJF.js";
 import {
   ensureDaemonRunning
-} from "../chunk-XLOELLAS.js";
-import "../chunk-2D7BAOMY.js";
+} from "../chunk-VMZ4SWQD.js";
+import "../chunk-7RNY3UHJ.js";
 import "../chunk-GOPIMNVC.js";
 import "../chunk-3AJIK5AO.js";
 import {
   encryptRecord
-} from "../chunk-4PX4QK2Z.js";
+} from "../chunk-SKPXQRKN.js";
 import "../chunk-EQRS3SGM.js";
 import {
   transcriptsEnabled
-} from "../chunk-OI3DJA7N.js";
+} from "../chunk-VERXHIQF.js";
 import {
   needsShell,
   spawnClaude
@@ -54,7 +54,14 @@ import {
   repoKeyFor,
   reportEvent,
   savePendingCommand
-} from "../chunk-HCMM3BOW.js";
+} from "../chunk-XJQOVWBQ.js";
+import {
+  UNNAMED_ACTION,
+  deriveToolTarget,
+  describeToolCall,
+  scopePathFor
+} from "../chunk-Z4JVEL7R.js";
+import "../chunk-XUTSZYYJ.js";
 import {
   DECISION_STOP_REASON,
   askUser,
@@ -65,25 +72,18 @@ import {
   waitForAnswer,
   withdrawQuestion
 } from "../chunk-XS33QBJA.js";
-import {
-  UNNAMED_ACTION,
-  deriveToolTarget,
-  describeToolCall,
-  scopePathFor
-} from "../chunk-BDI2MXTT.js";
-import "../chunk-IVQMNLSA.js";
 import {
   getMachineId
-} from "../chunk-N4VNLISN.js";
-import "../chunk-OW6AZDY2.js";
+} from "../chunk-4OSQZ5TB.js";
+import "../chunk-BGX4QUQF.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-S5CMLR35.js";
+import "../chunk-VMQU7YEJ.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-KAVDAZ7A.js";
+import "../chunk-L7NOG547.js";
 import {
   getApiKey,
   getBaseUrl
@@ -92,7 +92,7 @@ import {
   KILL_REASON,
   redactSecrets,
   resolveGate
-} from "../chunk-WDKHZRAS.js";
+} from "../chunk-MC5WUOJJ.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {