@pushary/agent-hooks 1.5.0 → 1.6.0

package/dist/{chunk-T4QY64OR.js → chunk-YFD7CRIZ.js}

@@ -614,8 +614,10 @@ var CURSOR_GATE_EVENTS = ["beforeShellExecution", "beforeMCPExecution", "preTool
 var SUPPORT_EMAIL = "business@pushary.com";
 var SUPPORT_DISCORD = "https://discord.gg/9v3VvUByrr";
 var HOOK_LOCATOR_BINARY = "pushary-bridge";
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var HOOK_BATCH_MAX_BYTES = 4 * 1024 * 1024;
 var REPO_KEY_MAX_LENGTH = 200;
+var WILDCARD_TOOL_PATTERN = "*";
 var isRepoKeyMatch = (ruleRepoKey, currentRepoKey) => {
   if (!ruleRepoKey) return true;
   return ruleRepoKey === currentRepoKey;
@@ -1121,6 +1123,280 @@ var selectGoverningRule = (policies, toolName, args, repoKey, sessionId) => {
 };
 var ARG_PREFIX_TARGET_TOOLS = Object.keys(POLICY_COMMAND_KEYS);
 var FILE_TARGET_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit"]);
+var isCoveredByPolicy = (policyPatterns, toolName, toolTarget) => {
+  const candidateWeight = matchRankWeight(toolTarget ? "prefix" : "tool");
+  return policyPatterns.some(
+    (pattern) => matchRankWeight(matchToolPattern(pattern, toolName, toolTarget ?? void 0, PATTERN_INTENT.restrict)) >= candidateWeight
+  );
+};
+var COMMAND_RUNNERS = /* @__PURE__ */ new Set([
+  "sh",
+  "bash",
+  "zsh",
+  "dash",
+  "ksh",
+  "fish",
+  "csh",
+  "tcsh",
+  "eval",
+  "exec",
+  "source",
+  ".",
+  "command",
+  "builtin",
+  "env",
+  "xargs",
+  "nohup",
+  "time",
+  "nice",
+  "timeout",
+  "watch",
+  "parallel",
+  "script",
+  "su",
+  "doas",
+  "npx",
+  "bunx",
+  "pnpx",
+  "uvx"
+]);
+var INLINE_CODE_INTERPRETERS = /* @__PURE__ */ new Set([
+  "python",
+  "python2",
+  "python3",
+  "node",
+  "deno",
+  "ruby",
+  "perl",
+  "php",
+  "lua",
+  "osascript",
+  "pwsh",
+  "powershell"
+]);
+var INLINE_CODE_LONG_FLAG = /^-{1,2}(?:eval|print|require|import|command|encodedcommand|enc|ec)(?:=|$)/i;
+var INLINE_CODE_SHORT_FLAG_LETTERS = /* @__PURE__ */ new Set(["c", "e", "E", "p", "r"]);
+var SHORT_FLAG_CLUSTER = /^-([A-Za-z]+)/;
+var INLINE_CODE_SUBCOMMAND = "eval";
+var STANDARD_INPUT_ARGUMENT = "-";
+var DESTRUCTIVE_FLAGS_BY_PROGRAM = /* @__PURE__ */ new Map([
+  ["find", /* @__PURE__ */ new Set(["-delete", "-exec", "-execdir", "-ok", "-okdir"])],
+  ["rsync", /* @__PURE__ */ new Set(["--delete", "--delete-before", "--delete-during", "--delete-after", "--delete-excluded", "--remove-source-files"])]
+]);
+var RUNNER_SUBCOMMANDS = /* @__PURE__ */ new Set(["exec", "dlx"]);
+var SUBCOMMAND_CLIS = /* @__PURE__ */ new Set([
+  "git",
+  "docker",
+  "podman",
+  "kubectl",
+  "helm",
+  "terraform",
+  "npm",
+  "pnpm",
+  "yarn",
+  "bun",
+  "cargo",
+  "pip",
+  "brew",
+  "gh",
+  "glab",
+  "aws",
+  "gcloud",
+  "gsutil",
+  "az",
+  "doctl",
+  "firebase",
+  "vercel",
+  "netlify",
+  "fly",
+  "flyctl",
+  "heroku",
+  "supabase",
+  "wrangler",
+  "railway"
+]);
+var DESTRUCTIVE_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "delete",
+  "destroy",
+  "remove",
+  "rm",
+  "rb",
+  "rmi",
+  "purge",
+  "prune",
+  "drop",
+  "terminate",
+  "uninstall",
+  "wipe",
+  "reset"
+]);
+var DATA_LOSS_COMMAND_PATTERNS = [
+  "Bash(git branch -D:*)",
+  "Bash(git branch --delete:*)",
+  "Bash(git checkout --:*)",
+  "Bash(git checkout .:*)",
+  "Bash(git restore:*)",
+  "Bash(git stash drop:*)",
+  "Bash(git stash clear:*)",
+  "Bash(git filter-branch:*)",
+  "Bash(git update-ref -d:*)",
+  "Bash(dd :*)",
+  "Bash(shred:*)",
+  "Bash(unlink:*)",
+  "Bash(crontab:*)",
+  "Bash(chmod -R:*)",
+  "Bash(chown -R:*)",
+  "Bash(kill:*)",
+  "Bash(pkill:*)",
+  "Bash(killall:*)",
+  "Bash(launchctl:*)",
+  "Bash(systemctl:*)",
+  "Bash(diskutil:*)"
+];
+var SHELL_ENV_ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+var PLAIN_PROGRAM_WORD = /^[A-Za-z0-9_./+@:-]+$/;
+var SHELL_RESERVED_WORDS = /* @__PURE__ */ new Set([
+  "if",
+  "then",
+  "elif",
+  "else",
+  "fi",
+  "case",
+  "esac",
+  "for",
+  "select",
+  "while",
+  "until",
+  "do",
+  "done",
+  "function",
+  "coproc",
+  "!",
+  "{",
+  "}",
+  "[[",
+  "]]"
+]);
+var HARMLESS_GLOBAL_FLAGS = /* @__PURE__ */ new Set(["--no-pager", "--version", "-v", "-V", "--help", "-h"]);
+var END_OF_OPTIONS = "--";
+var SUBCOMMAND_DEPTH = 3;
+var SHELL_COMMENT_MARK = "#";
+var SHELL_LINE_CONTINUATION = /\\\n/g;
+var SHELL_WORD_BREAK = /\s/;
+var DOUBLE_QUOTE_ESCAPABLE = /* @__PURE__ */ new Set([SHELL_DOUBLE_QUOTE, SHELL_ESCAPE, SHELL_SUBSTITUTION_SIGIL, "`"]);
+var shellWordsOf = (segment) => {
+  const words = [];
+  let text = "";
+  let plain = true;
+  let expands = false;
+  let comment = false;
+  let started = false;
+  let quote = null;
+  const finishWord = () => {
+    if (started) words.push({ text, plain, expands, comment });
+    text = "";
+    plain = true;
+    expands = false;
+    comment = false;
+    started = false;
+  };
+  for (let index = 0; index < segment.length; index += 1) {
+    const char = segment[index];
+    const next = segment[index + 1];
+    if (quote === "'") {
+      if (char === quote) quote = null;
+      else text += char;
+      continue;
+    }
+    if (char === SHELL_ESCAPE && next !== void 0 && (quote === null || DOUBLE_QUOTE_ESCAPABLE.has(next))) {
+      text += next;
+      plain = false;
+      started = true;
+      index += 1;
+      continue;
+    }
+    if (quote === SHELL_DOUBLE_QUOTE) {
+      if (char === quote) quote = null;
+      else text += char;
+      expands ||= char === SHELL_SUBSTITUTION_SIGIL;
+      continue;
+    }
+    if (SHELL_QUOTES.has(char)) {
+      quote = char;
+      plain = false;
+      started = true;
+      continue;
+    }
+    if (SHELL_WORD_BREAK.test(char)) {
+      finishWord();
+      continue;
+    }
+    comment ||= !started && char === SHELL_COMMENT_MARK;
+    expands ||= char === SHELL_SUBSTITUTION_SIGIL;
+    text += char;
+    started = true;
+  }
+  finishWord();
+  return words;
+};
+var invocationOf = (segment) => {
+  const [program, ...args] = shellWordsOf(segment);
+  return { program, args };
+};
+var argsAfterHarmlessGlobalFlags = (args) => {
+  const firstMeaningful = args.findIndex((arg) => !HARMLESS_GLOBAL_FLAGS.has(arg.text));
+  return firstMeaningful === -1 ? [] : args.slice(firstMeaningful);
+};
+var subcommandWordsOf = (args) => {
+  const endOfOptions = args.findIndex((arg) => arg.text === END_OF_OPTIONS);
+  const options = endOfOptions === -1 ? args : args.slice(0, endOfOptions);
+  return options.filter((arg) => !arg.text.startsWith("-")).slice(0, SUBCOMMAND_DEPTH);
+};
+var passesInlineCode = (arg) => {
+  if (arg === INLINE_CODE_SUBCOMMAND || arg === STANDARD_INPUT_ARGUMENT || INLINE_CODE_LONG_FLAG.test(arg)) return true;
+  if (arg.startsWith(END_OF_OPTIONS)) return false;
+  const cluster = SHORT_FLAG_CLUSTER.exec(arg)?.[1] ?? "";
+  return [...cluster].some((letter) => INLINE_CODE_SHORT_FLAG_LETTERS.has(letter));
+};
+var interpreterRunsUnreadableCode = (args) => args.some(passesInlineCode) || args.every((arg) => arg.startsWith("-"));
+var programHidesItsEffect = (program) => SHELL_RESERVED_WORDS.has(program.text) || !program.plain || program.expands || SHELL_ENV_ASSIGNMENT.test(program.text) || !PLAIN_PROGRAM_WORD.test(program.text) || COMMAND_RUNNERS.has(basenameOf(program.text));
+var argumentsHideTheEffect = (name, args) => {
+  const texts = args.map((arg) => arg.text);
+  if (INLINE_CODE_INTERPRETERS.has(name.replace(/\d+(?:\.\d+)*$/, "")) && interpreterRunsUnreadableCode(texts)) return true;
+  const destructiveFlags = DESTRUCTIVE_FLAGS_BY_PROGRAM.get(name);
+  if (destructiveFlags && texts.some((text) => destructiveFlags.has(text))) return true;
+  if (!SUBCOMMAND_CLIS.has(name)) return false;
+  const meaningful = argsAfterHarmlessGlobalFlags(args);
+  return (meaningful[0]?.text.startsWith("-") ?? false) || subcommandWordsOf(meaningful).some((word) => word.expands || RUNNER_SUBCOMMANDS.has(word.text));
+};
+var invocationHidesItsEffect = ({ program, args }) => program !== void 0 && ([program, ...args].some((word) => word.comment) || programHidesItsEffect(program) || argumentsHideTheEffect(basenameOf(program.text), args));
+var readableCommandSegments = (command) => shellCommandSegments(command.replace(SHELL_LINE_CONTINUATION, "").replace(SAFE_REDIRECTION, ""));
+var normalizedInvocation = ({ program, args }) => {
+  if (program === void 0) return "";
+  const name = basenameOf(program.text);
+  const kept = SUBCOMMAND_CLIS.has(name) ? argsAfterHarmlessGlobalFlags(args) : args;
+  return [name, ...kept.map((arg) => arg.text)].join(" ");
+};
+var normalizedCommand = (command) => {
+  const segments = readableCommandSegments(command);
+  return segments === null ? null : segments.map((segment) => normalizedInvocation(invocationOf(segment))).join("; ");
+};
+var subcommandDestroys = ({ program, args }) => program !== void 0 && SUBCOMMAND_CLIS.has(basenameOf(program.text)) && subcommandWordsOf(argsAfterHarmlessGlobalFlags(args)).some((word) => DESTRUCTIVE_SUBCOMMANDS.has(word.text));
+var segmentNeedsAPerson = (toolName, segment) => {
+  const invocation = invocationOf(segment);
+  const normalized = normalizedInvocation(invocation);
+  return invocationHidesItsEffect(invocation) || subcommandDestroys(invocation) || classifyDecisionRisk(toolName, normalized) !== "standard" || isCoveredByPolicy(CAPABILITY_PATTERNS.destructive, toolName, normalized) || isCoveredByPolicy(CAPABILITY_PATTERNS.network, toolName, normalized) || isCoveredByPolicy(DATA_LOSS_COMMAND_PATTERNS, toolName, normalized);
+};
+var commandNeedsAPerson = (toolName, command) => {
+  const segments = readableCommandSegments(command);
+  return segments === null || classifyDecisionRisk(toolName, command) !== "standard" || segments.some((segment) => segmentNeedsAPerson(toolName, segment));
+};
+var withoutSessionToolGrants = (config) => ({
+  ...config,
+  policies: config.policies.filter((policy) => !isSessionToolGrant(policy))
+});
+var SESSION_TOOL_GRANT_TOOLS = /* @__PURE__ */ new Set(["Bash"]);
+var isSessionToolGrant = (policy) => Boolean(policy.sessionId) && SESSION_TOOL_GRANT_TOOLS.has(policy.tool) && isAutoApprove(policy);
 var API_KEY_PATTERN = /^pk_[a-f0-9]+\.[a-f0-9]+$/;
 var isValidApiKey = (value) => API_KEY_PATTERN.test(value);
 var ACTION_BODY_MAX = 4e3;
@@ -1568,6 +1844,28 @@ var isScopeContract = (value) => {
   if (c.promises !== void 0 && !strings(c.promises)) return false;
   return strings(c.allowedPaths) && strings(c.offLimitsPaths) && typeof c.doneWhen === "string";
 };
+var findBestRoute = (routes, toolName, args, repoKey) => {
+  let best;
+  let bestWeight = 0;
+  let bestScoped = -1;
+  let bestLength = -1;
+  for (const candidate of routes) {
+    if (!isRepoKeyMatch(candidate.repoKey, repoKey)) continue;
+    const rank = matchToolPatternAny(candidate.toolPattern, toolName, args, PATTERN_INTENT.restrict);
+    if (rank === "none") continue;
+    const weight = matchRankWeight(rank);
+    const scoped = candidate.repoKey ? 1 : 0;
+    const length = rank === "prefix" ? candidate.toolPattern.length : -1;
+    const better = weight > bestWeight || weight === bestWeight && scoped > bestScoped || weight === bestWeight && scoped === bestScoped && length > bestLength;
+    if (better) {
+      best = candidate;
+      bestWeight = weight;
+      bestScoped = scoped;
+      bestLength = length;
+    }
+  }
+  return best ?? routes.find((r) => r.toolPattern === "*");
+};
 var autoApprove = (tool) => ({
   tool,
   timeoutSeconds: 0,
@@ -1585,17 +1883,21 @@ var resolveAutoResolveOrigin = (config, toolName, toolInput, cwd, repoKey, sessi
   }
   return DECISION_ORIGIN.autopilot;
 };
+var wildcardRuleOf = (pool) => {
+  const wildcard = pool.find((policy) => policy.tool === WILDCARD_TOOL_PATTERN);
+  return wildcard ? { policy: wildcard, rank: "wildcard" } : void 0;
+};
+var withSiteDelivery = (rule, siteMode) => isAutoApprove(rule.policy) || isAutoDeny(rule.policy) ? rule : { ...rule, policy: { ...rule.policy, mode: siteMode.mode, pushFirstSeconds: siteMode.pushFirstSeconds } };
 var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
   const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
   const arg = args[0];
-  const governing = (pool) => {
-    if (pool.length === 0) return void 0;
-    const rule = selectGoverningRule(pool, toolName, args, repoKey, sessionId);
-    if (rule) return rule;
-    const wildcard = pool.find((p) => p.tool === "*");
-    return wildcard ? { policy: wildcard, rank: "wildcard" } : void 0;
-  };
-  const match = governing(config.policies.filter((p) => !p.origin)) ?? governing(config.policies.filter((p) => p.origin === "preset")) ?? governing(config.policies.filter((p) => p.origin === "builtin"));
+  const specificRule = (pool) => pool.length === 0 ? void 0 : selectGoverningRule(pool, toolName, args, repoKey, sessionId);
+  const written = config.policies.filter((p) => !p.origin);
+  const presets = config.policies.filter((p) => p.origin === "preset");
+  const builtins = config.policies.filter((p) => p.origin === "builtin");
+  const siteMode = wildcardRuleOf(written);
+  const presetRule = specificRule(presets);
+  const match = specificRule(written) ?? (presetRule && siteMode ? withSiteDelivery(presetRule, siteMode.policy) : presetRule) ?? siteMode ?? wildcardRuleOf(presets) ?? specificRule(builtins) ?? wildcardRuleOf(builtins);
   let base = match?.policy ?? {
     tool: toolName,
     timeoutSeconds: config.defaultTimeoutSeconds,
@@ -1604,8 +1906,13 @@ var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, se
     pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
   };
   const governedBySpecificRule = match?.rank === "exact" || match?.rank === "prefix";
+  const governedBySessionToolGrant = match?.rank === "tool" && isSessionToolGrant(match.policy);
   const governingMode = base.mode;
-  if (!governedBySpecificRule && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg)) {
+  const approvedByReadOnlyFloor = !governedBySpecificRule && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg);
+  if (governedBySessionToolGrant && !approvedByReadOnlyFloor && typeof arg === "string" && commandNeedsAPerson(toolName, arg)) {
+    return resolvePolicy(withoutSessionToolGrants(config), toolName, modeOverride, toolInput, cwd, repoKey, sessionId);
+  }
+  if (approvedByReadOnlyFloor) {
     base = autoApprove(base.tool);
   }
   const wouldAutoApprove = isAutoApprove(base);
@@ -1756,8 +2063,63 @@ var resolveGate = (input) => {
     scopePath: scopeReason && "path" in scopeVerdict ? widenablePath(scopeVerdict.path) : void 0
   };
 };
-var editAsksAtTheAgentsPrompt = (input, verdict) => verdict.kind === "gate" && !verdict.scopeReason && (input.modeState.mode ?? input.config.modeOverride ?? null) === null && verdict.policy.origin === "builtin" && verdict.policy.mode === "push_first" && ACCEPT_EDITS_DEFER_TOOLS.has(input.toolName);
+var editAsksAtTheAgentsPrompt = (input, verdict) => verdict.kind === "gate" && !verdict.scopeReason && (input.modeState.mode ?? input.config.modeOverride ?? null) === null && !aChosenRuleGoverns(input) && verdict.policy.mode === "push_first" && ACCEPT_EDITS_DEFER_TOOLS.has(input.toolName);
 var claudePromptsBeforeAnEdit = (permissionMode) => permissionMode === "default";
+var MAX_AGENT_PERMISSION_RULES_PER_KIND = 256;
+var MAX_AGENT_PERMISSION_RULE_LENGTH = 512;
+var isAgentPermissionRule = (value) => typeof value === "string" && value.length > 0 && value.length <= MAX_AGENT_PERMISSION_RULE_LENGTH;
+var settingsPermissionList = (permissions, kind) => {
+  const list = permissions[kind];
+  return Array.isArray(list) ? list.filter(isAgentPermissionRule) : [];
+};
+var boundedUnion = (lists) => [...new Set(lists.flat())].slice(0, MAX_AGENT_PERMISSION_RULES_PER_KIND);
+var claudePermissionRulesFromSettings = (documents) => {
+  const permissionBlocks = documents.flatMap((document) => isRecord(document) && isRecord(document.permissions) ? [document.permissions] : []);
+  const collect = (kind) => boundedUnion(permissionBlocks.map((permissions) => settingsPermissionList(permissions, kind)));
+  return { allow: collect("allow"), ask: collect("ask"), deny: collect("deny") };
+};
+var claudeConsultsItsAllowlist = (permissionMode) => permissionMode === "default" || permissionMode === "acceptEdits";
+var anyRuleRestricts = (rules, toolName, args) => rules.some((rule) => matchToolPatternAny(rule, toolName, args, PATTERN_INTENT.restrict) !== "none");
+var anyRuleGrants = (rules, toolName, args) => rules.some((rule) => matchToolPatternAny(rule, toolName, args, PATTERN_INTENT.grant) !== "none");
+var everyCommandSegmentGranted = (rules, toolName, command) => {
+  const segments = readableCommandSegments(command);
+  return segments !== null && segments.every((segment) => isSafeReadOnlyCommand(segment) || anyRuleGrants(rules, toolName, [segment]));
+};
+var restrictionFormsOf = (toolName, args) => {
+  const command = toolName in POLICY_COMMAND_KEYS ? args[0] : void 0;
+  const normalized = command === void 0 ? null : normalizedCommand(command);
+  return normalized === null ? args : [...args, normalized];
+};
+var allowRulesGrant = (rules, toolName, args) => {
+  const command = args[0];
+  return toolName in POLICY_COMMAND_KEYS && command !== void 0 ? everyCommandSegmentGranted(rules, toolName, command) : anyRuleGrants(rules, toolName, args);
+};
+var inputNeedsAPerson = (toolName, toolInput) => {
+  const arg = extractPolicyArg(toolName, toolInput);
+  if (arg === void 0) return false;
+  return toolName in POLICY_COMMAND_KEYS ? commandNeedsAPerson(toolName, arg) : classifyDecisionRisk(toolName, arg) !== "standard";
+};
+var agentRulesAllowEveryInput = (rules, toolName, toolInputs, cwd) => rules.allow.length > 0 && toolInputs.length > 0 && toolInputs.every((toolInput) => {
+  const args = policyArgForms(toolName, toolInput, cwd);
+  const restrictionForms = restrictionFormsOf(toolName, args);
+  return allowRulesGrant(rules.allow, toolName, args) && !anyRuleRestricts(rules.ask, toolName, restrictionForms) && !anyRuleRestricts(rules.deny, toolName, restrictionForms) && !inputNeedsAPerson(toolName, toolInput);
+});
+var isDefaultRule = (policy) => policy.origin === "builtin" || policy.tool === WILDCARD_TOOL_PATTERN;
+var isApprovalRoutePattern = (value) => typeof value === "object" && value !== null && typeof value.toolPattern === "string" && ["string", "undefined"].includes(typeof value.repoKey);
+var approvalRoutesOf = (config) => {
+  const routes = config.approvalRoutes ?? [];
+  return Array.isArray(routes) && routes.every(isApprovalRoutePattern) ? routes : null;
+};
+var aChosenRuleGoverns = (input) => {
+  const chosen = input.config.policies.filter((policy) => !isDefaultRule(policy));
+  const routes = approvalRoutesOf(input.config);
+  if (routes === null) return true;
+  return input.toolInputs.some((toolInput) => {
+    const args = policyArgForms(input.toolName, toolInput, input.cwd);
+    return selectGoverningRule(chosen, input.toolName, args, input.repoKey, input.sessionId) !== void 0 || findBestRoute(routes, input.toolName, args, input.repoKey) !== void 0;
+  });
+};
+var claudeAllowlistOwnsCall = (input, verdict, permissionMode, rules) => rules !== null && verdict.kind === "gate" && !verdict.scopeReason && !aChosenRuleGoverns(input) && !isAskedInEveryMode(input.toolName) && claudeConsultsItsAllowlist(permissionMode) && agentRulesAllowEveryInput(rules, input.toolName, input.toolInputs, input.cwd);
 var toPolicyVersion = (value) => typeof value === "string" || typeof value === "number" ? String(value) : null;
 var modeStateFromResponse = (data) => {
   const mode = data.override?.mode;
@@ -2139,6 +2501,10 @@ export {
   resolveGate,
   editAsksAtTheAgentsPrompt,
   claudePromptsBeforeAnEdit,
+  claudePermissionRulesFromSettings,
+  claudeConsultsItsAllowlist,
+  agentRulesAllowEveryInput,
+  claudeAllowlistOwnsCall,
   modeStateFromResponse,
   GATE_WIRE,
   GATE_MAX_TOOL_INPUTS,

package/dist/{reapply-D2TFN6XK.js → reapply-RRDVJATI.js}

@@ -1,4 +1,5 @@
 import {
+  ensureCodexTrustAfterReapply,
   inspectConfiguredManagedProviders,
   reapplyAllAgents,
   reapplyClaudeForVersion,
@@ -8,17 +9,20 @@ import {
   reapplyGeminiSettings,
   reapplyVsCodePlugin,
   repairCodexHolds
-} from "./chunk-PNNBMH4E.js";
-import "./chunk-3NBODGQS.js";
-import "./chunk-J4J45VPZ.js";
-import "./chunk-NTQSICPJ.js";
-import "./chunk-EADZPVYW.js";
-import "./chunk-UYDTFCHW.js";
-import "./chunk-DYHXOXUF.js";
+} from "./chunk-OP7HFIWE.js";
+import "./chunk-NDS27FXU.js";
+import "./chunk-XQOT4CCK.js";
+import "./chunk-HWG7X3VI.js";
+import "./chunk-MOQOJOMD.js";
+import "./chunk-BK5F3FGE.js";
+import "./chunk-XHKBHWLX.js";
+import "./chunk-VZANUMIF.js";
+import "./chunk-F2OPOBRO.js";
 import "./chunk-T7E75EKA.js";
-import "./chunk-T4QY64OR.js";
+import "./chunk-YFD7CRIZ.js";
 import "./chunk-HWJW3CPO.js";
 export {
+  ensureCodexTrustAfterReapply,
   inspectConfiguredManagedProviders,
   reapplyAllAgents,
   reapplyClaudeForVersion,

package/dist/src/index.d.ts

@@ -157,6 +157,7 @@ interface AskUserParams {
     toolUseId?: string;
     waitEndsAt?: string;
     requestId?: string;
+    sessionToolAware?: true;
 }
 interface AskUserResponse {
     correlationId: string;

package/dist/src/index.js

@@ -1,12 +1,12 @@
 import {
   handlePreToolUse
-} from "../chunk-IYTQ4B5I.js";
-import "../chunk-JF736N4C.js";
-import "../chunk-J4J45VPZ.js";
-import "../chunk-CQYHOHOK.js";
-import "../chunk-43ZDACBO.js";
+} from "../chunk-644CGYOB.js";
+import "../chunk-FI3LQCUH.js";
+import "../chunk-HWG7X3VI.js";
+import "../chunk-BE4P7ERZ.js";
+import "../chunk-F4KRNFDE.js";
 import "../chunk-YHG74UFF.js";
-import "../chunk-EADZPVYW.js";
+import "../chunk-BK5F3FGE.js";
 import {
   fetchAccountPublicKey
 } from "../chunk-66H2QQAK.js";
@@ -18,20 +18,20 @@ import {
   handlePostToolUse,
   handleStop,
   reportEvent
-} from "../chunk-FDHMNT24.js";
-import "../chunk-UYDTFCHW.js";
+} from "../chunk-66BIMA62.js";
+import "../chunk-VZANUMIF.js";
 import {
   askUser,
   cancelQuestion,
   waitForAnswer
 } from "../chunk-PYCQXCI5.js";
-import "../chunk-UQHUUZ5H.js";
-import "../chunk-DYHXOXUF.js";
+import "../chunk-7JSE6JTZ.js";
+import "../chunk-F2OPOBRO.js";
 import "../chunk-HETOKNIL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-HU5LSYL2.js";
+import "../chunk-VMNI33F5.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
@@ -39,7 +39,7 @@ import {
 } from "../chunk-OSJEMXSR.js";
 import {
   resolvePolicy
-} from "../chunk-T4QY64OR.js";
+} from "../chunk-YFD7CRIZ.js";
 import "../chunk-EA3IELHP.js";
 import "../chunk-HWJW3CPO.js";
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",