@pushary/agent-hooks 1.2.0 → 1.3.1

package/dist/bin/pushary-transcript-register.js

@@ -1,31 +1,31 @@
 #!/usr/bin/env node
 import {
   registerTranscript
-} from "../chunk-PCT2MYG5.js";
-import "../chunk-YKLCWWEI.js";
-import "../chunk-W6XVHP4U.js";
-import "../chunk-WC5PYFDK.js";
-import "../chunk-U42ES5U3.js";
-import "../chunk-C3WH44MH.js";
-import "../chunk-CVCSUAXI.js";
-import "../chunk-ERP7FOFQ.js";
-import "../chunk-VDOKRCWM.js";
-import "../chunk-6QCN5XQE.js";
+} from "../chunk-P232YODQ.js";
+import "../chunk-SGZJ5LYH.js";
+import "../chunk-REIZ5GXG.js";
+import "../chunk-FGNABUPN.js";
+import "../chunk-KLZJEMSE.js";
+import "../chunk-QOCWB4Q6.js";
+import "../chunk-6HH4IH4K.js";
+import "../chunk-KHGIM2BN.js";
+import "../chunk-EAGMQMRM.js";
+import "../chunk-CDSL3LLO.js";
 import "../chunk-EQRS3SGM.js";
-import "../chunk-KHTBSSY5.js";
+import "../chunk-YXWM4TNX.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-UWP66NDF.js";
-import "../chunk-KZPUARCU.js";
-import "../chunk-PX53RT6Q.js";
+import "../chunk-XP2KRTZD.js";
+import "../chunk-465UENKO.js";
+import "../chunk-34NNTYK6.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-7TDQ7KDY.js";
+import "../chunk-5SALHATY.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-ZFQPSGPO.js";
-import "../chunk-4LL6LG5X.js";
+import "../chunk-5WLH2ENB.js";
+import "../chunk-T7E75EKA.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-7DQVIIHX.js";
+import "../chunk-5UWDYOZX.js";
 
 // bin/pushary-transcript-register.ts
 var raw = "";

package/dist/bin/pushary-transcripts.js

@@ -3,21 +3,21 @@ import {
   clearPin,
   fingerprint,
   loadPin
-} from "../chunk-YKLCWWEI.js";
+} from "../chunk-SGZJ5LYH.js";
 import {
   transcriptsEnabled
-} from "../chunk-KHTBSSY5.js";
+} from "../chunk-YXWM4TNX.js";
 import {
   exitOnHelpFlag
 } from "../chunk-GOQHN2UH.js";
 import "../chunk-LZQVAEWP.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-7TDQ7KDY.js";
+import "../chunk-5SALHATY.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-ZFQPSGPO.js";
-import "../chunk-4LL6LG5X.js";
+import "../chunk-5WLH2ENB.js";
+import "../chunk-T7E75EKA.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-7DQVIIHX.js";
+import "../chunk-5UWDYOZX.js";
 
 // bin/pushary-transcripts.ts
 exitOnHelpFlag("transcripts");

package/dist/bin/pushary-upgrade.js

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import {
   reapplyAllAgents
-} from "../chunk-DRAATYTY.js";
-import "../chunk-JQJB7BZE.js";
+} from "../chunk-RERJ2ZDV.js";
+import "../chunk-AFKOWCMQ.js";
 import {
   waitForMachineReadiness
-} from "../chunk-YK3OU4E2.js";
-import "../chunk-PX54KULQ.js";
+} from "../chunk-5XKMOZO6.js";
+import "../chunk-SGZE2JBF.js";
 import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "../chunk-CG4ZUQ5O.js";
-import "../chunk-C3WH44MH.js";
+} from "../chunk-PHXU4NOP.js";
+import "../chunk-QOCWB4Q6.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
@@ -23,13 +23,13 @@ import {
   replaceDaemonService,
   stopDaemonService,
   waitForDaemonRemoteProof
-} from "../chunk-CVCSUAXI.js";
-import "../chunk-ERP7FOFQ.js";
+} from "../chunk-6HH4IH4K.js";
+import "../chunk-KHGIM2BN.js";
 import {
   needsShell
 } from "../chunk-XHKBHWLX.js";
-import "../chunk-UWP66NDF.js";
-import "../chunk-KZPUARCU.js";
+import "../chunk-XP2KRTZD.js";
+import "../chunk-465UENKO.js";
 import {
   claudeJson,
   codexConfigToml,
@@ -39,7 +39,7 @@ import {
   npmErrorMessage,
   resolveGlobalBinary,
   vscodePluginDir
-} from "../chunk-PX53RT6Q.js";
+} from "../chunk-34NNTYK6.js";
 import {
   exitOnHelpFlag
 } from "../chunk-GOQHN2UH.js";
@@ -49,14 +49,14 @@ import {
 } from "../chunk-DINDL2CF.js";
 import {
   readControlMode
-} from "../chunk-7TDQ7KDY.js";
+} from "../chunk-5SALHATY.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-ZFQPSGPO.js";
-import "../chunk-4LL6LG5X.js";
+import "../chunk-5WLH2ENB.js";
+import "../chunk-T7E75EKA.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
-import "../chunk-7DQVIIHX.js";
+import "../chunk-5UWDYOZX.js";
 
 // bin/pushary-upgrade.ts
 import { existsSync } from "fs";

package/dist/bin/pushary-wait.js

@@ -4,8 +4,8 @@ import {
 } from "../chunk-CVWG2N3Y.js";
 import {
   exitOnFailedResponse
-} from "../chunk-VE2ZWUML.js";
-import "../chunk-RN6ZWIAC.js";
+} from "../chunk-NDSOOJDX.js";
+import "../chunk-TW7KA27C.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
@@ -28,7 +28,7 @@ import {
   getApiKey,
   getBaseUrl
 } from "../chunk-2UMNXADU.js";
-import "../chunk-7DQVIIHX.js";
+import "../chunk-5UWDYOZX.js";
 
 // bin/pushary-wait.ts
 exitOnHelpFlag("wait");

package/dist/{chunk-PX53RT6Q.js → chunk-34NNTYK6.js}

@@ -2,7 +2,7 @@ import {
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY,
   withHookHoldBudget
-} from "./chunk-7DQVIIHX.js";
+} from "./chunk-5UWDYOZX.js";
 
 // src/npm.ts
 import { execFileSync, execSync } from "child_process";

package/dist/{chunk-7ERWAYVV.js → chunk-35RPUNYU.js}

@@ -1,6 +1,6 @@
 import {
   readConfigFileKey
-} from "./chunk-7TDQ7KDY.js";
+} from "./chunk-5SALHATY.js";
 
 // src/bell/fleet.ts
 import { closeSync, constants, futimesSync, lstatSync, mkdirSync, openSync, readdirSync, unlinkSync } from "fs";

package/dist/{chunk-KZPUARCU.js → chunk-465UENKO.js}

@@ -1,9 +1,9 @@
 import {
   pusharyDir
-} from "./chunk-PX53RT6Q.js";
+} from "./chunk-34NNTYK6.js";
 import {
   writeFileAtomic
-} from "./chunk-4LL6LG5X.js";
+} from "./chunk-T7E75EKA.js";
 
 // src/identity.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-7TDQ7KDY.js → chunk-5SALHATY.js}

@@ -1,12 +1,12 @@
 import {
   resolveInstallSourceFor
-} from "./chunk-ZFQPSGPO.js";
+} from "./chunk-5WLH2ENB.js";
 import {
   backupFile,
   readJsonSafe,
   writeFileAtomic,
   writeJsonAtomic
-} from "./chunk-4LL6LG5X.js";
+} from "./chunk-T7E75EKA.js";
 import {
   configFilePath
 } from "./chunk-2UMNXADU.js";

package/dist/{chunk-7DQVIIHX.js → chunk-5UWDYOZX.js}

@@ -154,6 +154,7 @@ var AGENTS = {
     ...defaults,
     label: "Qwen Code",
     hookSource: "qwen",
+    bridged: true,
     policyAgent: "qwen_code",
     repoAware: true,
     disconnectable: true,
@@ -166,6 +167,7 @@ var AGENTS = {
     ...defaults,
     label: "CodeBuddy",
     hookSource: "codebuddy",
+    bridged: true,
     policyAgent: "codebuddy",
     repoAware: true,
     disconnectable: true,
@@ -178,6 +180,7 @@ var AGENTS = {
     ...defaults,
     label: "Qoder",
     hookSource: "qoder",
+    bridged: true,
     policyAgent: "qoder",
     repoAware: true,
     disconnectable: true,
@@ -191,6 +194,7 @@ var AGENTS = {
     ...defaults,
     label: "Droid",
     hookSource: "droid",
+    bridged: true,
     policyAgent: "droid",
     repoAware: true,
     disconnectable: true,
@@ -204,6 +208,7 @@ var AGENTS = {
     ...defaults,
     label: "Devin CLI",
     hookSource: "devin",
+    bridged: true,
     policyAgent: "devin",
     repoAware: true,
     disconnectable: true,
@@ -436,6 +441,18 @@ var compatibleTargetFiles = (profile) => {
   return [...seen.values()];
 };
 
+// ../contracts/src/degraded.ts
+var DEGRADED_PREFIX = "[degraded]";
+var degradedPayload = (subsystem, report) => ({
+  subsystem,
+  reason: report.reason,
+  fallback: report.fallback,
+  ...report.siteId ? { siteId: report.siteId } : {},
+  ...report.sessionId ? { sessionId: report.sessionId } : {},
+  ...report.event ? { event: report.event } : {}
+});
+var degradedLine = (subsystem, report) => `${DEGRADED_PREFIX} ${JSON.stringify(degradedPayload(subsystem, report))}`;
+
 // ../contracts/src/index.ts
 var KEY_SCOPES = ["full_access", "agent", "connector", "bound"];
 var normalizeKeyScope = (value) => typeof value === "string" && KEY_SCOPES.includes(value) ? value : null;
@@ -718,6 +735,7 @@ var shellCommandSegments = (command) => {
         index += 1;
         continue;
       }
+      if (quote === SHELL_DOUBLE_QUOTE && (char === "`" || char === SHELL_SUBSTITUTION_SIGIL && next === SHELL_GROUP_OPEN)) return null;
       if (char === quote) quote = null;
       current += char;
       continue;
@@ -1066,7 +1084,7 @@ var verdictForPolicy = (policy) => {
   if (isAutoApprove(policy)) return "allow";
   return "requires_human";
 };
-var policyIntent = (policy) => policy.timeoutAction === "deny" ? PATTERN_INTENT.restrict : PATTERN_INTENT.grant;
+var policyIntent = (policy) => isAutoApprove(policy) ? PATTERN_INTENT.grant : PATTERN_INTENT.restrict;
 var selectGoverningRule = (policies, toolName, args, repoKey, sessionId) => {
   let best;
   let bestWeight = 0;
@@ -1325,6 +1343,8 @@ var ANSWER_SOURCES = [
   "sandbox"
 ];
 var isAnswerSource = (value) => typeof value === "string" && ANSWER_SOURCES.includes(value);
+var SETTLED_OUTCOMES = ["approve", "deny"];
+var isSettledOutcome = (value) => typeof value === "string" && SETTLED_OUTCOMES.includes(value);
 var classifyDecisionRisk = (toolName, toolTarget) => {
   const parts = [toolName, toolTarget ?? ""];
   const matchesAny = (patterns) => parts.some((part) => patterns.some((re) => re.test(part)));
@@ -1372,6 +1392,13 @@ var CAPABILITY_PATTERNS = {
 };
 var DECISION_EPISODE_SCHEMA_VERSION = 1;
 var DECISION_FEATURE_EXTRACTOR = `pushary-hooks/schema-${DECISION_EPISODE_SCHEMA_VERSION}`;
+var DECISION_ORIGIN = {
+  human: "human",
+  autopilot: "autopilot",
+  safeReadonly: "safe_readonly",
+  policyTimeout: "policy_timeout",
+  killSwitch: "kill_switch"
+};
 var EPISODE_CAPABILITIES = [...POLICY_CAPABILITIES, "other"];
 var NETWORK_COMMAND_PATTERNS = [
   /\bcurl\b/i,
@@ -1445,9 +1472,8 @@ var deriveBlastRadius = (capability, riskClass, targetClass) => {
   return "low";
 };
 var deriveLabelTier = (origin, decision) => {
-  if (origin === "autopilot") return "none";
-  if (origin === "human" && (decision === "approve" || decision === "deny")) return "bronze";
-  return "bronze";
+  if (origin !== DECISION_ORIGIN.human) return "none";
+  return isSettledOutcome(decision) ? "bronze" : "none";
 };
 var buildDecisionEpisodeFeatures = (input) => {
   const isCommand = isCommandTool(input.toolName);
@@ -1539,9 +1565,9 @@ var resolveAutoResolveOrigin = (config, toolName, toolInput, cwd, repoKey, sessi
   const match = selectGoverningRule(config.policies, toolName, args, repoKey, sessionId);
   const governedBySpecificRule = match?.rank === "exact" || match?.rank === "prefix";
   if (!governedBySpecificRule && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg)) {
-    return "safe_readonly";
+    return DECISION_ORIGIN.safeReadonly;
   }
-  return "policy_timeout";
+  return DECISION_ORIGIN.autopilot;
 };
 var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
   const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
@@ -1991,6 +2017,7 @@ export {
   hookCompatibleProfile,
   hookCompatibleProfileBySource,
   compatibleTargetFiles,
+  degradedLine,
   hookWritePath,
   isHookActivationReport,
   hookActivationResult,

package/dist/{chunk-ZFQPSGPO.js → chunk-5WLH2ENB.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-2UMNXADU.js";
 import {
   normalizeInstallSource
-} from "./chunk-7DQVIIHX.js";
+} from "./chunk-5UWDYOZX.js";
 
 // src/install-source.ts
 import { readFileSync } from "fs";

package/dist/{chunk-YK3OU4E2.js → chunk-5XKMOZO6.js}

@@ -2,24 +2,24 @@ import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "./chunk-CG4ZUQ5O.js";
+} from "./chunk-PHXU4NOP.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   hasDaemonServiceDefinition,
   readDaemonNeedsLogin,
   readDaemonStatus
-} from "./chunk-CVCSUAXI.js";
+} from "./chunk-6HH4IH4K.js";
 import {
   getMachineId
-} from "./chunk-KZPUARCU.js";
+} from "./chunk-465UENKO.js";
 import {
   getPackageVersion
 } from "./chunk-DINDL2CF.js";
 import {
   readControlMode,
   readKeySource
-} from "./chunk-7TDQ7KDY.js";
+} from "./chunk-5SALHATY.js";
 import {
   getBaseUrl
 } from "./chunk-2UMNXADU.js";

package/dist/{chunk-CVCSUAXI.js → chunk-6HH4IH4K.js}

@@ -4,23 +4,23 @@ import {
 } from "./chunk-XHKBHWLX.js";
 import {
   getMachineId
-} from "./chunk-KZPUARCU.js";
+} from "./chunk-465UENKO.js";
 import {
   pusharyDir,
   resolveGlobalBinary
-} from "./chunk-PX53RT6Q.js";
+} from "./chunk-34NNTYK6.js";
 import {
   getPackageVersion
 } from "./chunk-DINDL2CF.js";
 import {
   readControlMode
-} from "./chunk-7TDQ7KDY.js";
+} from "./chunk-5SALHATY.js";
 import {
   readJsonSafe,
   writeFileAtomic,
   writeJsonAtomic,
   writeJsonAtomicDurable
-} from "./chunk-4LL6LG5X.js";
+} from "./chunk-T7E75EKA.js";
 import {
   getApiKey
 } from "./chunk-2UMNXADU.js";

package/dist/{chunk-JQJB7BZE.js → chunk-AFKOWCMQ.js}

@@ -1,6 +1,6 @@
 import {
   parseVersion
-} from "./chunk-ERP7FOFQ.js";
+} from "./chunk-KHGIM2BN.js";
 
 // src/setup/agent-probe.ts
 import { execSync } from "child_process";

package/dist/{chunk-JOTV75GX.js → chunk-AFOTOA24.js}

@@ -1,6 +1,6 @@
 import {
   resolvePathBinary
-} from "./chunk-PX53RT6Q.js";
+} from "./chunk-34NNTYK6.js";
 
 // src/hermes-config.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-6QCN5XQE.js → chunk-CDSL3LLO.js}

@@ -1,6 +1,6 @@
 import {
   redactSecrets
-} from "./chunk-7DQVIIHX.js";
+} from "./chunk-5UWDYOZX.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";

package/dist/{chunk-4UT44NRP.js → chunk-CKLWJ6EL.js}

@@ -1,6 +1,9 @@
 import {
   registerTranscript
-} from "./chunk-PCT2MYG5.js";
+} from "./chunk-P232YODQ.js";
+import {
+  degradedLine
+} from "./chunk-5UWDYOZX.js";
 
 // src/admission.ts
 import { readFileSync } from "fs";
@@ -40,7 +43,12 @@ var matches = (rule, source, event) => {
 var isAdmitted = (rules, source, event) => !rules.disabled.some((rule) => matches(rule, source, event));
 var readHookInput = async (source, fallbackEvent = "", stdin = process.stdin) => {
   if (source === null) {
-    process.stderr.write("[pushary] unrecognised --agent, standing aside rather than acting as another agent\n");
+    process.stderr.write(`${degradedLine("hook", {
+      reason: "unknown_agent",
+      fallback: "stood aside, so nothing is gated or reported for this call",
+      event: fallbackEvent
+    })}
+`);
     return null;
   }
   let raw = "";

package/dist/{chunk-VDOKRCWM.js → chunk-EAGMQMRM.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-PX53RT6Q.js";
+} from "./chunk-34NNTYK6.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-WC5PYFDK.js → chunk-FGNABUPN.js}

@@ -7,7 +7,7 @@ import {
 import {
   COMPATIBLE_AGENT_TYPES,
   isValidApiKey
-} from "./chunk-7DQVIIHX.js";
+} from "./chunk-5UWDYOZX.js";
 
 // src/setup/options.ts
 var AGENT_CHOICES = ["claude_code", "codex", "gemini_cli", "hermes", "cursor", "vscode", "opencode", ...COMPATIBLE_AGENT_TYPES, "custom"];

package/dist/{chunk-BXLFUTSD.js → chunk-HCTSTMDD.js}

@@ -1,17 +1,17 @@
 import {
   canonicalGateInputs
-} from "./chunk-5AATCXJN.js";
+} from "./chunk-WOBHHXW5.js";
 import {
   canonicalJson
-} from "./chunk-PX53RT6Q.js";
+} from "./chunk-34NNTYK6.js";
 import {
   writeFileAtomic
-} from "./chunk-4LL6LG5X.js";
+} from "./chunk-T7E75EKA.js";
 import {
   BLOCKED_ACTION_GRANT_TTL_SECONDS,
   blockedActionIdentity,
   shouldDeferToNativeMode
-} from "./chunk-7DQVIIHX.js";
+} from "./chunk-5UWDYOZX.js";
 
 // src/native-defer.ts
 var nativeDeferOptions = () => {

package/dist/{chunk-KODKICKJ.js → chunk-I2OLM3DM.js}

@@ -1,17 +1,17 @@
 import {
   activeIdentity
-} from "./chunk-YT6H7BB5.js";
+} from "./chunk-LWT34GSY.js";
 import {
   blockedActionFingerprint,
   defersToNativeMode,
   forgetBlockedActionHint,
   hasBlockedActionHint,
   recordBlockedActionHint
-} from "./chunk-BXLFUTSD.js";
+} from "./chunk-HCTSTMDD.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-2DT7STR5.js";
+} from "./chunk-OMP3KDDU.js";
 import {
   denyReasonFrom,
   isDeferAnswer
@@ -34,7 +34,7 @@ import {
   scopePathFor,
   settleQuestionsForToolUse,
   throttlePass
-} from "./chunk-5AATCXJN.js";
+} from "./chunk-WOBHHXW5.js";
 import {
   DECISION_STOP_REASON,
   askUser,
@@ -49,7 +49,7 @@ import {
 } from "./chunk-LGXUGYUH.js";
 import {
   getMachineId
-} from "./chunk-KZPUARCU.js";
+} from "./chunk-465UENKO.js";
 import {
   getApiKey,
   getBaseUrl
@@ -73,7 +73,7 @@ import {
   parseAgentQuestions,
   resolveGate,
   stoppedOutput
-} from "./chunk-7DQVIIHX.js";
+} from "./chunk-5UWDYOZX.js";
 
 // src/decision-episode.ts
 var EPISODE_PATH = "/api/agent/decision-episode";
@@ -450,19 +450,25 @@ var handleKeyless = (input) => {
   }
   return void 0;
 };
-var claudeGateInput = (modeState, config, input) => {
-  const scopePath = modeState.scope ? scopePathFor(input.tool_name, input.tool_input, input.cwd) : void 0;
+var claudeGateInput = (modeState, config, input, canonical) => {
+  const toolName = canonical?.toolName ?? input.tool_name;
+  const toolInputs = canonical?.toolInputs ?? [input.tool_input ?? {}];
   return {
     modeState,
     config,
-    toolName: input.tool_name,
-    toolInputs: [input.tool_input ?? {}],
-    scopePaths: scopePath ? [scopePath] : [],
+    toolName,
+    toolInputs,
+    scopePaths: modeState.scope ? toolInputs.flatMap((args) => {
+      const path = scopePathFor(toolName, args, input.cwd);
+      return path ? [path] : [];
+    }) : [],
     cwd: input.cwd,
     repoKey: repoKeyFor(input.cwd),
     sessionId: input.session_id
   };
 };
+var unreadableReason = "Pushary could not read every target of this call. Use a supported command or a single-file edit.";
+var batchScopeReason = "This patch exceeds the agreed scope. Split it into single-file edits so each additional path can be approved.";
 var BLOCKED_ACTION_GATE_TIMEOUT_MS = 15e3;
 var BLOCKED_ACTION_CLAIM_TIMEOUT_MS = 4e3;
 var BLOCKED_ACTION_ALLOW_REASON = "Approved from Pushary after auto mode blocked it";
@@ -502,7 +508,7 @@ var claimedBlockedActionRetry = async (apiKey, input) => {
     return false;
   }
 };
-var handlePreToolUse = async (input) => {
+var handlePreToolUse = async (input, canonical) => {
   if (isPusharyOwnTool(input.tool_name)) return void 0;
   let apiKey;
   try {
@@ -513,9 +519,11 @@ var handlePreToolUse = async (input) => {
   try {
     const modeState = await fetchModeState(apiKey, input.session_id);
     const policy = await getPolicy(apiKey, modeState.policyVersion, ACTIVE_AGENT.type, true, input.session_id);
-    const verdict = resolveGate(claudeGateInput(modeState, policy, input));
+    const verdict = resolveGate(claudeGateInput(modeState, policy, input, canonical));
     if (verdict.kind === "kill") return halted(verdict.reason);
     if (verdict.kind === "deny") return deny(verdict.reason);
+    if (canonical === null) return deny(unreadableReason);
+    if (verdict.kind === "gate" && verdict.scopeReason && (canonical?.toolInputs.length ?? 0) > 1) return deny(batchScopeReason);
     if (input.tool_name === "AskUserQuestion") {
       return handleAskUserQuestion(apiKey, input, modeState);
     }
@@ -523,7 +531,7 @@ var handlePreToolUse = async (input) => {
       return handleExitPlanMode(apiKey, input);
     }
     if (await claimedBlockedActionRetry(apiKey, input)) return allow(BLOCKED_ACTION_ALLOW_REASON);
-    if (shouldDeferToNativeMode(input.permission_mode, input.tool_name)) {
+    if (!(verdict.kind === "gate" && verdict.scopeReason) && shouldDeferToNativeMode(input.permission_mode, input.tool_name)) {
       return void 0;
     }
     switch (verdict.kind) {
@@ -553,8 +561,8 @@ var toPermissionRequestOutput = (hookOutput) => {
   if (d.permissionDecision === "deny") return permReqDeny(d.permissionDecisionReason);
   return void 0;
 };
-var handlePermissionRequest = async (input) => {
-  if (isPermissionRequestOwnedByPreToolUse(input.tool_name, input.permission_mode, shouldDeferToNativeMode)) return void 0;
+var handlePermissionRequest = async (input, canonical) => {
+  if (canonical === void 0 && isPermissionRequestOwnedByPreToolUse(input.tool_name, input.permission_mode, shouldDeferToNativeMode)) return void 0;
   if (isPusharyOwnTool(input.tool_name)) return void 0;
   let apiKey;
   try {
@@ -565,14 +573,15 @@ var handlePermissionRequest = async (input) => {
   try {
     const modeState = await fetchModeState(apiKey, input.session_id);
     const policy = await getPolicy(apiKey, modeState.policyVersion, ACTIVE_AGENT.type, true, input.session_id);
-    const verdict = resolveGate(claudeGateInput(modeState, policy, input));
+    const verdict = resolveGate(claudeGateInput(modeState, policy, input, canonical));
+    if (verdict.kind === "kill") return permReqHalted(verdict.reason);
+    if (verdict.kind === "deny") return permReqDeny(verdict.reason);
+    if (canonical === null) return permReqDeny(unreadableReason);
+    if (verdict.kind === "gate" && verdict.scopeReason && (canonical?.toolInputs.length ?? 0) > 1) return permReqDeny(batchScopeReason);
+    if (!(verdict.kind === "gate" && verdict.scopeReason) && isPermissionRequestOwnedByPreToolUse(input.tool_name, input.permission_mode, shouldDeferToNativeMode)) return void 0;
     switch (verdict.kind) {
-      case "kill":
-        return permReqHalted(verdict.reason);
       case "allow":
         return permReqAllow();
-      case "deny":
-        return permReqDeny(verdict.reason);
       // No opinion, so Claude Code's own dialog shows.
       case "defer":
         return void 0;

package/dist/{chunk-LGO7U23Z.js → chunk-JZA2JOGO.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_HOLD_BUDGET_ENV,
   hookHoldBudgetProof
-} from "./chunk-7DQVIIHX.js";
+} from "./chunk-5UWDYOZX.js";
 
 // src/hold-budget.ts
 var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {