@pushary/agent-hooks 0.95.5 → 0.95.7

package/dist/bin/pushary-doctor.js

@@ -1,14 +1,15 @@
 #!/usr/bin/env node
 import {
   describeWaitLadder
-} from "../chunk-IIENZE2J.js";
+} from "../chunk-CVWG2N3Y.js";
 import {
   readServiceExecPath,
   versionManagerOf
 } from "../chunk-GU3EJCVV.js";
 import {
-  readMachineReadiness
-} from "../chunk-32RMQO5Z.js";
+  readMachineReadiness,
+  readManagedControlEvidence
+} from "../chunk-WAUAYRUQ.js";
 import {
   CURSOR_GATE_SCRIPT
 } from "../chunk-KBITFQST.js";
@@ -20,28 +21,28 @@ import {
   isDetected,
   isPluginRegistered,
   vscodeSettingsTargets
-} from "../chunk-6VANQN5Q.js";
+} from "../chunk-NKUE5SJB.js";
 import {
   OPENCODE_PLUGIN_PLACEHOLDER,
   openCodePluginDir,
   openCodePluginFile,
   openCodeWired
-} from "../chunk-HQIVR7MM.js";
-import "../chunk-HGUZOUB2.js";
+} from "../chunk-U5RIXR7I.js";
+import "../chunk-CNUDZS4V.js";
 import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "../chunk-IM2A5H33.js";
+} from "../chunk-54W7ELDQ.js";
 import {
   readLedgerSummary
-} from "../chunk-UCS65VVR.js";
+} from "../chunk-5GKNAQTG.js";
 import {
   describeBridgeResolution,
   isBridgeLocator,
   liveBridgeProbe,
   resolveBridgeStub
-} from "../chunk-CUEZMPLJ.js";
+} from "../chunk-QJPYJVL3.js";
 import {
   claudeOtherHolders,
   claudeWired,
@@ -56,7 +57,7 @@ import {
   geminiWired,
   holdsLong,
   pusharyHookExecutable
-} from "../chunk-HBHEX3JQ.js";
+} from "../chunk-GQRU4KJF.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
@@ -65,22 +66,22 @@ import {
   readDaemonNeedsLogin,
   readDaemonStatus,
   readInstalledDaemonService
-} from "../chunk-XLOELLAS.js";
+} from "../chunk-VMZ4SWQD.js";
 import {
   GEMINI_HOOK_BINARY,
   hasGeminiHooks,
   missingGeminiHookEvents
-} from "../chunk-2D7BAOMY.js";
+} from "../chunk-7RNY3UHJ.js";
 import "../chunk-3AJIK5AO.js";
 import "../chunk-XHKBHWLX.js";
 import {
   execNpm
 } from "../chunk-L4ZCFMWW.js";
-import "../chunk-BDI2MXTT.js";
-import "../chunk-IVQMNLSA.js";
+import "../chunk-Z4JVEL7R.js";
+import "../chunk-XUTSZYYJ.js";
 import {
   getMachineId
-} from "../chunk-N4VNLISN.js";
+} from "../chunk-4OSQZ5TB.js";
 import {
   CODEX_HOOK_EVENTS,
   claudeJson,
@@ -102,27 +103,28 @@ import {
   pusharyConfigFile,
   readCodexMcpAuth,
   vscodePluginDir
-} from "../chunk-OW6AZDY2.js";
+} from "../chunk-BGX4QUQF.js";
 import {
   describeReach,
   describeRoundTrip,
   fetchChannels,
   reachVerdict,
+  roundTripEvidence,
   verifyRoundTrip
-} from "../chunk-KI4PA7MQ.js";
+} from "../chunk-XO3JR3OP.js";
 import "../chunk-3EGEA4KH.js";
 import {
   checkApiKey,
   describeKeyCheck
-} from "../chunk-I6GZX3FT.js";
+} from "../chunk-BQL7UDIB.js";
 import "../chunk-QCGNGEGE.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
 import {
   exitOnHelpFlag
-} from "../chunk-DLLAWCQB.js";
-import "../chunk-D6PRC3YQ.js";
+} from "../chunk-GOQHN2UH.js";
+import "../chunk-LZQVAEWP.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
@@ -133,7 +135,7 @@ import {
   keyPrefix,
   readControlMode,
   readKeySource
-} from "../chunk-S5CMLR35.js";
+} from "../chunk-VMQU7YEJ.js";
 import {
   callMcpTool,
   sendMcpRequest
@@ -145,18 +147,21 @@ import {
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-KAVDAZ7A.js";
+import "../chunk-L7NOG547.js";
 import {
   getBaseUrl
 } from "../chunk-2UMNXADU.js";
 import {
+  AGENTS,
   CURSOR_GATE_EVENTS,
-  HOOK_LOCATOR_BINARY
-} from "../chunk-WDKHZRAS.js";
+  HOOK_LOCATOR_BINARY,
+  hookActivationResult,
+  isHookActivationReport
+} from "../chunk-MC5WUOJJ.js";
 
 // bin/pushary-doctor.ts
 import { existsSync, readFileSync, writeFileSync } from "fs";
-import { join } from "path";
+import { join, resolve } from "path";
 import { homedir as homedir2 } from "os";
 import { execFileSync } from "child_process";
 import { confirm } from "@inquirer/prompts";
@@ -215,6 +220,29 @@ var resolveDoctorExit = ({ keyExit, failures }) => {
   return EXIT.PROBLEMS_FOUND;
 };
 
+// src/diagnostics/activation.ts
+var readHookActivation = async (apiKey, agentType, target, deps = {}) => {
+  const machineId = deps.machineId ?? getMachineId();
+  const url = new URL("/api/agent/onboarding/activation", deps.baseUrl ?? getBaseUrl());
+  url.searchParams.set("machineId", machineId);
+  url.searchParams.set("agent", agentType);
+  url.searchParams.set("target", target);
+  try {
+    const response = await (deps.fetchImpl ?? fetch)(url, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!response.ok) return { kind: "unavailable", detail: response.status === 404 ? "This server does not report hook activation yet." : `Evidence request returned HTTP ${response.status}.` };
+    const body = await response.json();
+    if (!isHookActivationReport(body) || body.machineId !== machineId || body.agentType !== agentType || body.target !== target) {
+      return { kind: "unavailable", detail: "The server returned invalid or mismatched activation evidence." };
+    }
+    return { kind: "ok", report: body };
+  } catch {
+    return { kind: "unavailable", detail: "Activation evidence could not be read. Retry when the connection is available." };
+  }
+};
+
 // src/diagnostics/roundtrip-plan.ts
 var planRoundTrip = (context) => {
   if (context.roundtrip) return { kind: "always" };
@@ -238,17 +266,25 @@ var firstToken = (command) => {
 // bin/pushary-doctor.ts
 exitOnHelpFlag("doctor");
 var parseDoctorOptions = (argv) => {
-  const flags = parseFlags(argv, { bools: ["json", "roundtrip", "no-push", "bundle", "help", "h"], values: [] });
+  const flags = parseFlags(argv, { bools: ["json", "roundtrip", "no-push", "bundle", "help", "h"], values: ["activation", "activation-target"] });
   if (flags.command !== void 0 && flags.command !== "doctor") {
     throw new UsageError(`doctor takes no positional arguments (got ${flags.command})`);
   }
   const roundtrip = flags.bools.has("roundtrip");
-  const noPush = flags.bools.has("no-push");
+  const activation2 = flags.values.get("activation") ?? null;
+  if (activation2 && (!Object.hasOwn(AGENTS, activation2) || !AGENTS[activation2].activationGuide)) throw new UsageError("This build supports --activation claude_code. Other integrations remain unverified.");
+  const rawTarget = flags.values.get("activation-target");
+  if (Boolean(activation2) !== Boolean(rawTarget)) throw new UsageError("--activation requires --activation-target with the unique scratch-file path used for this check.");
+  const activationTarget = rawTarget ? resolve(rawTarget) : null;
+  const noPush = flags.bools.has("no-push") || activation2 !== null && !roundtrip;
   if (roundtrip && noPush) {
     throw new UsageError("--roundtrip needs to send a push, so it cannot be combined with --no-push");
   }
-  return { json: flags.bools.has("json"), roundtrip, noPush, bundle: flags.bools.has("bundle") };
+  return { activationTarget, activation: activation2, json: flags.bools.has("json"), roundtrip, noPush, bundle: flags.bools.has("bundle") };
 };
+var activation = null;
+var hookActivation = "unverified";
+var roundTrip = null;
 var options;
 try {
   options = parseDoctorOptions(process.argv.slice(2));
@@ -642,8 +678,8 @@ var main = async () => {
   const controlUnsupported = controlMode === "on" && controlPolicy !== "enabled";
   const daemonOk = controlUnsupported ? false : controlPolicy === "disabled" ? daemon.kind === "absent" && !serviceDefined : controlPolicy === "enabled" ? daemonHasRemoteProof(daemon) : controlPolicy === "legacy" ? false : daemon.kind === "absent" && !serviceDefined;
   const needsLogin = loginBlock.kind === "blocked" ? `needs login: ${describeDaemonLoginBlock(loginBlock.record)}` : null;
-  const daemonFailure = daemonOk ? null : needsLogin ?? (controlUnsupported ? "control is required but no usable provider/service-manager pair is available" : controlPolicy === "enabled" && daemon.kind === "running" ? "the daemon has not completed an authenticated heartbeat and control poll" : controlPolicy === "disabled" ? `control is disabled but ${serviceDefined ? "the service definition remains" : `local state is ${daemon.kind}`}` : controlPolicy === "legacy" ? "a legacy service exists without a usable provider/service-manager pair" : `local state is ${daemon.kind}`);
-  const daemonDetail = daemonFailure ? needsLogin ? daemonFailure : controlUnsupported ? `${daemonFailure}; re-run setup with \`--control off\`, or restore both requirements` : controlPolicy === "disabled" ? `${daemonFailure}; re-run setup with \`--control off\`` : controlPolicy === "legacy" ? `${daemonFailure}; run setup with \`--control off\`, or restore both requirements` : `${daemonFailure}; run \`pushary daemon install\` to install or repair the background service` : controlPolicy === "disabled" ? "disabled by setup" : controlPolicy === "preserve-absent" ? "legacy absence preserved" : !controlRequired && daemon.kind === "absent" ? "managed control is unsupported on this provider or operating-system session" : null;
+  const daemonFailure = daemonOk ? null : needsLogin ?? (controlUnsupported ? !controlSupported ? "install and configure a supported Claude Code, Codex or Gemini provider" : "no native background-service manager is available in this OS session" : controlPolicy === "enabled" && daemon.kind === "running" ? "the daemon has not completed an authenticated heartbeat and control poll" : controlPolicy === "disabled" ? `control is disabled but ${serviceDefined ? "the service definition remains" : `local state is ${daemon.kind}`}` : controlPolicy === "legacy" ? "a legacy service exists without a usable provider/service-manager pair" : `local state is ${daemon.kind}`);
+  const daemonDetail = daemonFailure ? needsLogin ? daemonFailure : controlUnsupported ? `${daemonFailure}; re-run setup with \`--control off\`, or repair the missing prerequisite` : controlPolicy === "disabled" ? `${daemonFailure}; re-run setup with \`--control off\`` : controlPolicy === "legacy" ? `${daemonFailure}; run setup with \`--control off\`, or repair the missing prerequisite` : `${daemonFailure}; run \`pushary daemon install\` to install or repair the background service` : controlPolicy === "disabled" ? "disabled by setup" : controlPolicy === "preserve-absent" ? "legacy absence preserved" : !controlRequired && daemon.kind === "absent" ? "managed control is unsupported on this provider or operating-system session" : null;
   check(
     daemonOk,
     "Remote-control daemon",
@@ -672,8 +708,9 @@ var main = async () => {
   } else if (serviceFile) {
     console.log(`  ${warn} Remote-control service runtime ${dim(`(could not read the node path out of ${serviceFile.path})`)}`);
   }
+  let serverProof = null;
   if (controlPolicy === "enabled" && apiKey && daemon.machineId) {
-    const serverProof = await readMachineReadiness(apiKey, ["spawn", ...controlCapabilities], {
+    serverProof = await readMachineReadiness(apiKey, ["spawn", ...controlCapabilities], {
       machineId: daemon.machineId
     });
     if (serverProof.kind === "unsupported") {
@@ -975,7 +1012,7 @@ var main = async () => {
       stdinIsTty: process.stdin.isTTY === true
     });
     const testQuestion = roundTripPlan.kind === "always" ? true : roundTripPlan.kind === "never" ? false : await confirm({
-      message: "Test question roundtrip? (sends a push notification; the only check that proves you can answer one)",
+      message: "Test a synthetic question and answer? (sends a notification; does not test agent hooks)",
       default: roundTripPlan.defaultAnswer
     });
     if (testQuestion) {
@@ -983,8 +1020,9 @@ var main = async () => {
       console.log(`  ${dim("Question Roundtrip")}`);
       console.log(`  ${dim("\u2192")} Question sent, waiting for your answer...`);
       const outcome = await verifyRoundTrip(apiKey, "Pushary Doctor");
+      roundTrip = outcome;
       const report = describeRoundTrip(outcome);
-      check(report.ok, "Answer received", outcome.kind === "answered" ? `"${outcome.value}" (${(outcome.latencyMs / 1e3).toFixed(1)}s roundtrip)` : report.message);
+      check(report.ok, "Synthetic answer test", report.message);
       for (const line of report.next) console.log(`    ${dim(line)}`);
     }
   }
@@ -1000,7 +1038,8 @@ var main = async () => {
         console.log(`  ${dim("Wait Ladder")} ${dim("(what happens when you don't answer)")}`);
         const wildcard = policy.policies?.find((p) => p.tool === "*");
         const defaultWindow = policy.defaultPushFirstSeconds ?? 20;
-        console.log(`  ${dim("\xB7")} default: ${cyan(`${defaultWindow}s`)} ${dim("\u2014")} ${wildcard ? describeWaitLadder(wildcard) : `ping your phone ${defaultWindow}s, then ask in the terminal`}`);
+        const defaultLadder = describeWaitLadder(wildcard ?? { tool: "*", mode: "push_first", pushFirstSeconds: defaultWindow, timeoutSeconds: 0, timeoutAction: "escalate" });
+        console.log(`  ${dim("\xB7")} default: ${cyan(`${defaultWindow}s`)} ${dim("\xB7")} ${defaultLadder}`);
         if (policy.modeOverride) {
           console.log(`  ${warn} mode override active: ${cyan(policy.modeOverride)} ${dim("(pushary mode status)")}`);
         }
@@ -1013,7 +1052,19 @@ var main = async () => {
     } catch {
     }
   }
+  if (options.activation) {
+    activation = apiKey ? await readHookActivation(apiKey, options.activation, options.activationTarget) : { kind: "unavailable", detail: "Sign in before reading this workspace\u2019s hook evidence." };
+    const latest = activation.kind === "ok" ? activation.report.evidence[0] : void 0;
+    hookActivation = hookActivationResult(activation.kind === "ok" ? activation.report : null);
+    const observed = hookActivation === "approved_executed" || hookActivation === "denied_observed";
+    check(observed, "Approval for the selected scratch file (last 10 minutes)", activation.kind !== "ok" ? activation.detail : activation.report.truncated ? "Too many recent decisions to establish a unique correlation. Start a quiet test session and retry." : activation.report.evidence.length > 1 ? `${hookActivation}: multiple decisions for this target. Use a new scratch file for each attempt; inspect hookActivationEvidence for all results.` : latest ? `${latest.result}; answer source: ${latest.answerSource ?? "unknown"}; decision ${latest.correlationId}; session ${latest.sessionId}; tool call ${latest.toolUseId}` : "Unverified: no recent runtime-tagged Write approval for this scratch file on this machine.");
+    const guide = AGENTS[options.activation].activationGuide;
+    console.log(`  ${dim(`Real-agent check: https://pushary.com${guide}`)}`);
+  }
+  const managedControl = readManagedControlEvidence(apiKey, configuredManagedProviders, serverProof);
+  console.log(`  ${dim(`Phone-start and steering: ${managedControl.ready ? "local and server checks passed for this run" : "unverified; hook approvals are a separate capability"}.`)}`);
   console.log();
+  if (!options.activation) console.log(`  ${dim("Agent hook activation is unverified by these checks. Use --activation claude_code --activation-target <unique scratch file> after one real approval.")}`);
   const failed = results.filter((r) => !r.passed);
   if (failed.length === 0) {
     console.log(`  ${green(bold("All checks passed."))}`);
@@ -1050,18 +1101,22 @@ var main = async () => {
     }
   }
   if (options.json) {
-    process.stdout.write(`${JSON.stringify({
+    await new Promise((resolve2, reject) => process.stdout.write(`${JSON.stringify({
       ok: exitCode === EXIT.OK,
       exitCode,
       keyCheck: keyVerdict?.kind ?? null,
+      roundTripEvidence: roundTripEvidence(roundTrip),
+      hookActivation,
+      hookActivationEvidence: activation,
       daemon,
+      managedControl,
       daemonNeedsLogin: loginBlock.kind === "blocked" ? loginBlock.record : null,
       passed: results.filter((r) => r.passed).length,
       failed: failed.length,
       checks: results.map((r) => ({ label: r.label, passed: r.passed, detail: r.detail ?? null })),
       otherHolders: otherHoldersByAgent
     }, null, 2)}
-`);
+`, (error) => error ? reject(error) : resolve2()));
   }
   process.exit(exitCode);
 };

package/dist/bin/pushary-elicitation-hook.js

@@ -1,43 +1,43 @@
 #!/usr/bin/env node
 import {
   readHookInput
-} from "../chunk-OEKFD5BC.js";
+} from "../chunk-IZVK6FKD.js";
 import {
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
-import "../chunk-4RF52LSU.js";
-import "../chunk-BMANRGJQ.js";
-import "../chunk-VOSGZ6PH.js";
-import "../chunk-2ZTL3PGN.js";
-import "../chunk-CUEZMPLJ.js";
-import "../chunk-HBHEX3JQ.js";
-import "../chunk-XLOELLAS.js";
-import "../chunk-2D7BAOMY.js";
+import "../chunk-HAXZ6CBF.js";
+import "../chunk-EMGGUO2Q.js";
+import "../chunk-WPS5IM7B.js";
+import "../chunk-XZWUOCJZ.js";
+import "../chunk-QJPYJVL3.js";
+import "../chunk-GQRU4KJF.js";
+import "../chunk-VMZ4SWQD.js";
+import "../chunk-7RNY3UHJ.js";
 import "../chunk-GOPIMNVC.js";
 import "../chunk-3AJIK5AO.js";
-import "../chunk-4PX4QK2Z.js";
+import "../chunk-SKPXQRKN.js";
 import "../chunk-EQRS3SGM.js";
-import "../chunk-OI3DJA7N.js";
+import "../chunk-VERXHIQF.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-L4ZCFMWW.js";
+import "../chunk-XUTSZYYJ.js";
 import {
   askUser,
   isDecisionStopped,
   waitForQuestion
 } from "../chunk-XS33QBJA.js";
-import "../chunk-IVQMNLSA.js";
 import {
   getMachineId
-} from "../chunk-N4VNLISN.js";
-import "../chunk-OW6AZDY2.js";
+} from "../chunk-4OSQZ5TB.js";
+import "../chunk-BGX4QUQF.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-S5CMLR35.js";
+import "../chunk-VMQU7YEJ.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-KAVDAZ7A.js";
+import "../chunk-L7NOG547.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
@@ -51,7 +51,7 @@ import {
   planElicitationAsk,
   readElicitationFields,
   renderElicitationOutput
-} from "../chunk-WDKHZRAS.js";
+} from "../chunk-MC5WUOJJ.js";
 
 // bin/pushary-elicitation-hook.ts
 import { basename } from "path";

package/dist/bin/pushary-gemini-bridge.js

@@ -5,19 +5,19 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-QHWXUNMN.js";
+} from "../chunk-FRXZMCVA.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
   describeIdleWindow,
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-QQGNFHIK.js";
-import "../chunk-4PX4QK2Z.js";
+} from "../chunk-PQGLDN4V.js";
+import "../chunk-SKPXQRKN.js";
 import "../chunk-EQRS3SGM.js";
 import {
   transcriptsEnabled
-} from "../chunk-OI3DJA7N.js";
+} from "../chunk-VERXHIQF.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
@@ -26,15 +26,15 @@ import {
 } from "../chunk-L4ZCFMWW.js";
 import {
   getMachineId
-} from "../chunk-N4VNLISN.js";
-import "../chunk-OW6AZDY2.js";
-import "../chunk-S5CMLR35.js";
-import "../chunk-KAVDAZ7A.js";
+} from "../chunk-4OSQZ5TB.js";
+import "../chunk-BGX4QUQF.js";
+import "../chunk-VMQU7YEJ.js";
+import "../chunk-L7NOG547.js";
 import {
   getApiKey,
   getBaseUrl
 } from "../chunk-2UMNXADU.js";
-import "../chunk-WDKHZRAS.js";
+import "../chunk-MC5WUOJJ.js";
 
 // bin/pushary-gemini-bridge.ts
 import { existsSync } from "fs";

package/dist/bin/pushary-gemini-hook.js

@@ -2,27 +2,27 @@
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-UCS65VVR.js";
+} from "../chunk-5GKNAQTG.js";
 import {
   readHookInput
-} from "../chunk-OEKFD5BC.js";
+} from "../chunk-IZVK6FKD.js";
 import {
   denyReasonFrom,
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
-import "../chunk-4RF52LSU.js";
-import "../chunk-BMANRGJQ.js";
-import "../chunk-VOSGZ6PH.js";
-import "../chunk-2ZTL3PGN.js";
-import "../chunk-CUEZMPLJ.js";
-import "../chunk-HBHEX3JQ.js";
-import "../chunk-XLOELLAS.js";
-import "../chunk-2D7BAOMY.js";
+import "../chunk-HAXZ6CBF.js";
+import "../chunk-EMGGUO2Q.js";
+import "../chunk-WPS5IM7B.js";
+import "../chunk-XZWUOCJZ.js";
+import "../chunk-QJPYJVL3.js";
+import "../chunk-GQRU4KJF.js";
+import "../chunk-VMZ4SWQD.js";
+import "../chunk-7RNY3UHJ.js";
 import "../chunk-GOPIMNVC.js";
 import "../chunk-3AJIK5AO.js";
-import "../chunk-4PX4QK2Z.js";
+import "../chunk-SKPXQRKN.js";
 import "../chunk-EQRS3SGM.js";
-import "../chunk-OI3DJA7N.js";
+import "../chunk-VERXHIQF.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-L4ZCFMWW.js";
 import {
@@ -38,7 +38,16 @@ import {
   readLastUserPrompt,
   repoKeyFor,
   reportEvent
-} from "../chunk-HCMM3BOW.js";
+} from "../chunk-XJQOVWBQ.js";
+import {
+  UNNAMED_ACTION,
+  deriveActionBody,
+  deriveBlocker,
+  deriveToolTarget,
+  describeToolCall,
+  scopePathFor
+} from "../chunk-Z4JVEL7R.js";
+import "../chunk-XUTSZYYJ.js";
 import {
   DECISION_STOP_REASON,
   askUser,
@@ -47,27 +56,18 @@ import {
   sendNotification,
   waitForQuestion
 } from "../chunk-XS33QBJA.js";
-import {
-  UNNAMED_ACTION,
-  deriveActionBody,
-  deriveBlocker,
-  deriveToolTarget,
-  describeToolCall,
-  scopePathFor
-} from "../chunk-BDI2MXTT.js";
-import "../chunk-IVQMNLSA.js";
 import {
   getMachineId
-} from "../chunk-N4VNLISN.js";
-import "../chunk-OW6AZDY2.js";
+} from "../chunk-4OSQZ5TB.js";
+import "../chunk-BGX4QUQF.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-S5CMLR35.js";
+import "../chunk-VMQU7YEJ.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-KAVDAZ7A.js";
+import "../chunk-L7NOG547.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
@@ -79,7 +79,7 @@ import {
   hookWaitClamped,
   hookWaitDeadline,
   resolveGate
-} from "../chunk-WDKHZRAS.js";
+} from "../chunk-MC5WUOJJ.js";
 
 // bin/pushary-gemini-hook.ts
 import { basename } from "path";
@@ -115,6 +115,30 @@ var toGeminiPolicyLookup = (toolName, toolInput, cwd, mcpContext) => {
 var geminiAllow = () => ({ kind: "allow" });
 var geminiDeny = (reason) => ({ kind: "deny", reason });
 var geminiPass = () => ({ kind: "pass" });
+var NO_LOCAL_INPUT = "This unattended Gemini session has no local approval input. Use an interactive session or Every time.";
+var NO_ANSWER_IN_TIME = "No answer from your phone in time, and this unattended Gemini session has no local approval input. Retry when you can answer on your phone.";
+var HANDLED_ON_MACHINE = "You chose to handle this on your machine, but this unattended Gemini session has no local approval input. Use an interactive session.";
+var NO_DEVICE = "No phone or other notification channel is connected to Pushary, and this unattended Gemini session has no local approval input. Connect one in Pushary, then retry.";
+var geminiLocalHandoff = (bridge, reason = NO_LOCAL_INPUT) => geminiOwnsLifecycle(bridge) ? geminiPass() : geminiDeny(reason);
+var geminiPushOnlyHandoff = (askStatus, bridge) => askStatus === "notified" || askStatus === "terminal" ? geminiLocalHandoff(bridge) : geminiPass();
+var fromPhoneAnswer = (answer) => answer.value === "yes" ? geminiAllow() : geminiDeny(denyReasonFrom(answer.value, answer.note));
+var geminiPushFirstDecision = (pushed, bridge) => {
+  if (!pushed) return geminiPass();
+  const { answer, localHandoff } = pushed;
+  if (isDecisionStopped(answer)) return geminiDeny(DECISION_STOP_REASON);
+  if (localHandoff) return geminiLocalHandoff(bridge, pushed.noDevices ? NO_DEVICE : NO_LOCAL_INPUT);
+  if (answer.answered) return isDeferAnswer(answer.value) ? geminiLocalHandoff(bridge, HANDLED_ON_MACHINE) : fromPhoneAnswer(answer);
+  return geminiLocalHandoff(bridge, NO_ANSWER_IN_TIME);
+};
+var geminiPushOnlyDecision = (pushed, timeoutAction, bridge) => {
+  if (!pushed) return geminiDeny("Pushary could not create a verifiable approval. Retry the action.");
+  const { answer, localHandoff, clampCut, askStatus } = pushed;
+  if (isDecisionStopped(answer)) return geminiDeny(DECISION_STOP_REASON);
+  if (localHandoff) return geminiPushOnlyHandoff(askStatus, bridge);
+  if (answer.answered) return isDeferAnswer(answer.value) ? geminiPass() : fromPhoneAnswer(answer);
+  if (clampCut) return geminiPass();
+  return geminiTimeoutDecision(timeoutAction);
+};
 var toGeminiWire = (decision) => {
   if (decision.kind === "pass") return null;
   return gateOutputFor(
@@ -150,12 +174,18 @@ var pushQuestion = async (apiKey, input, lookup, waitSeconds, mode, pollInterval
     blocker: deriveBlocker(mode),
     actionBody: deriveActionBody(input.tool_name ?? "", input.tool_input ?? {}),
     repoKey: repoKeyFor(input.cwd)
-  }).catch(() => ({ correlationId: "", status: "unavailable" }));
+  });
   const now = Date.now();
   const deadline = hookWaitDeadline(START_MS, waitSeconds, "gemini", now);
   const clampCut = hookWaitClamped(START_MS, waitSeconds, "gemini", now);
   const answer = await waitForQuestion(apiKey, result, deadline, pollInterval);
-  return { answer, localHandoff: !answer.answered && isLocalQuestionHandoff(result), clampCut };
+  return {
+    answer,
+    localHandoff: !answer.answered && isLocalQuestionHandoff(result),
+    clampCut,
+    askStatus: result.status,
+    noDevices: result.noDevices === true
+  };
 };
 var notifyApprovalNeeded = async (apiKey, input, lookup) => {
   try {
@@ -174,33 +204,18 @@ var handlePushOnly = async (apiKey, input, lookup, timeoutSeconds, timeoutAction
   try {
     pushed = await pushQuestion(apiKey, input, lookup, effectiveWaitSeconds(timeoutAction, timeoutSeconds, "gemini"), "push_only");
   } catch {
-    return geminiDeny("Pushary could not create a verifiable approval. Retry the action.");
-  }
-  const { answer, localHandoff, clampCut } = pushed;
-  if (isDecisionStopped(answer)) return geminiDeny(DECISION_STOP_REASON);
-  if (localHandoff) return geminiPass();
-  if (answer.answered) {
-    if (isDeferAnswer(answer.value)) return geminiPass();
-    return answer.value === "yes" ? geminiAllow() : geminiDeny(denyReasonFrom(answer.value, answer.note));
+    pushed = void 0;
   }
-  if (clampCut) return geminiPass();
-  return geminiTimeoutDecision(timeoutAction);
+  return geminiPushOnlyDecision(pushed, timeoutAction, process.env.PUSHARY_GEMINI_BRIDGE);
 };
 var handlePushFirst = async (apiKey, input, lookup, pushFirstSeconds) => {
   let pushed;
   try {
     pushed = await pushQuestion(apiKey, input, lookup, pushFirstSeconds, "push_first", 1500);
   } catch {
-    return geminiPass();
+    pushed = void 0;
   }
-  const { answer, localHandoff } = pushed;
-  if (isDecisionStopped(answer)) return geminiDeny(DECISION_STOP_REASON);
-  if (localHandoff) return geminiPass();
-  if (answer.answered) {
-    if (isDeferAnswer(answer.value)) return geminiPass();
-    return answer.value === "yes" ? geminiAllow() : geminiDeny(denyReasonFrom(answer.value, answer.note));
-  }
-  return geminiPass();
+  return geminiPushFirstDecision(pushed, process.env.PUSHARY_GEMINI_BRIDGE);
 };
 var decideBeforeTool = async (input) => {
   let apiKey;
@@ -246,12 +261,12 @@ var decideBeforeTool = async (input) => {
       case "push_only":
         return handlePushOnly(apiKey, input, lookup, toolPolicy.timeoutSeconds, toolPolicy.timeoutAction);
       case "terminal_only":
-        return geminiPass();
+        return geminiLocalHandoff(process.env.PUSHARY_GEMINI_BRIDGE);
       case "push_first":
         return handlePushFirst(apiKey, input, lookup, toolPolicy.pushFirstSeconds);
       case "notify_only":
         await notifyApprovalNeeded(apiKey, input, lookup);
-        return geminiPass();
+        return geminiLocalHandoff(process.env.PUSHARY_GEMINI_BRIDGE);
       default:
         return handlePushFirst(apiKey, input, lookup, toolPolicy.pushFirstSeconds);
     }