@pushary/agent-hooks 1.5.1 → 1.6.1

package/dist/{chunk-PJ27EHCD.js → chunk-UJ4O22GU.js}

@@ -1,7 +1,7 @@
 import {
   activeHookSource,
   activeIdentity
-} from "./chunk-R5KY3PBN.js";
+} from "./chunk-X4G4MQEV.js";
 import {
   blockedActionFingerprint,
   defersToNativeMode,
@@ -9,11 +9,11 @@ import {
   hasBlockedActionHint,
   recordBlockedActionHint,
   reportMachineDenial
-} from "./chunk-MDJJW3LP.js";
+} from "./chunk-ZR4NP264.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-43ZDACBO.js";
+} from "./chunk-7WRJFRNF.js";
 import {
   denyReasonFrom,
   isDeferAnswer
@@ -36,7 +36,7 @@ import {
   reportEvent,
   scopePathFor,
   settleQuestionsForToolUse
-} from "./chunk-D573TLP6.js";
+} from "./chunk-ROCRCXTP.js";
 import {
   DECISION_STOP_REASON,
   askUser,
@@ -48,10 +48,10 @@ import {
   requestGate,
   sendNotification,
   waitForQuestion
-} from "./chunk-PYCQXCI5.js";
+} from "./chunk-LVHGSD5E.js";
 import {
   getMachineId
-} from "./chunk-WOLPADR6.js";
+} from "./chunk-WHOD4YGB.js";
 import {
   getApiKey,
   getBaseUrl
@@ -61,9 +61,13 @@ import {
   GATE_BLOCK_REASON_MAX_LENGTH,
   GATE_WIRE,
   agentQuestionStrategy,
+  agentRulesAllowEveryInput,
   buildDecisionEpisodeFeatures,
+  claudeAllowlistOwnsCall,
+  claudeConsultsItsAllowlist,
   claudePermissionDeniedOutput,
   claudePermissionRequestOutput,
+  claudePermissionRulesFromSettings,
   claudePreToolUseOutput,
   claudePromptsBeforeAnEdit,
   editAsksAtTheAgentsPrompt,
@@ -79,7 +83,51 @@ import {
   parseAgentQuestions,
   resolveGate,
   stoppedOutput
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-NTTMJFJU.js";
+
+// src/claude-permission-rules.ts
+import { readFileSync, statSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var MANAGED_CLAUDE_SETTINGS_BY_PLATFORM = {
+  darwin: "/Library/Application Support/ClaudeCode/managed-settings.json",
+  linux: "/etc/claude-code/managed-settings.json",
+  win32: "C:\\ProgramData\\ClaudeCode\\managed-settings.json"
+};
+var MAX_CLAUDE_SETTINGS_BYTES = 1048576;
+var claudeSettingsLocationFor = (cwd, environment = process.env, home = homedir(), platform = process.platform) => ({
+  configDir: environment.CLAUDE_CONFIG_DIR || join(home, ".claude"),
+  projectDir: environment.CLAUDE_PROJECT_DIR || cwd || void 0,
+  managedSettingsPath: MANAGED_CLAUDE_SETTINGS_BY_PLATFORM[platform]
+});
+var claudeSettingsSources = (location) => [
+  ...location.managedSettingsPath ? [{ path: location.managedSettingsPath, trust: "grants" }] : [],
+  { path: join(location.configDir, "settings.json"), trust: "grants" },
+  ...location.projectDir ? [
+    { path: join(location.projectDir, ".claude", "settings.json"), trust: "restricts_only" },
+    { path: join(location.projectDir, ".claude", "settings.local.json"), trust: "grants" }
+  ] : []
+];
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var restrictionsOnly = (document) => {
+  if (!isRecord(document) || !isRecord(document.permissions)) return null;
+  const { ask: ask2, deny: deny2 } = document.permissions;
+  return { permissions: { ask: ask2, deny: deny2 } };
+};
+var readSettingsDocument = (path) => {
+  try {
+    const stats = statSync(path);
+    if (!stats.isFile() || stats.size > MAX_CLAUDE_SETTINGS_BYTES) return null;
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+};
+var trustedDocument = ({ path, trust }) => {
+  const document = readSettingsDocument(path);
+  return trust === "grants" ? document : restrictionsOnly(document);
+};
+var readClaudePermissionRules = (location) => claudePermissionRulesFromSettings(claudeSettingsSources(location).map(trustedDocument));
 
 // src/decision-episode.ts
 var EPISODE_PATH = "/api/agent/decision-episode";
@@ -104,7 +152,7 @@ var reportDecisionEpisode = async (apiKey, input) => {
 };
 
 // src/hook.ts
-import { basename, join } from "path";
+import { basename, join as join2 } from "path";
 import { tmpdir } from "os";
 import { existsSync, writeFileSync } from "fs";
 var START_MS = Date.now();
@@ -259,7 +307,8 @@ var dispatchModeHandler = async (apiKey, input, toolPolicy, machineId, trainingC
     // The gate asks at most one question per tool call, so the runtime's id needs
     // no suffix here. Absent on runtimes that do not send one, and the server then
     // creates a fresh decision exactly as before.
-    toolUseId: input.tool_use_id
+    toolUseId: input.tool_use_id,
+    sessionToolAware: true
   };
   const signals = {};
   const runHandler = () => {
@@ -298,7 +347,7 @@ var KEYLESS_NOTICE = "[pushary] Not connected (no API key), so your agent runs u
 var oncePerSession = (kind, sessionId) => {
   try {
     const key = (sessionId || DEFAULT_SESSION).replace(/[^a-zA-Z0-9_-]/g, "");
-    const marker = join(tmpdir(), `pushary-${kind}-${key}`);
+    const marker = join2(tmpdir(), `pushary-${kind}-${key}`);
     if (existsSync(marker)) return false;
     writeFileSync(marker, "1", "utf-8");
     return true;
@@ -457,6 +506,8 @@ var handleKeyless = (input) => {
   }
   return void 0;
 };
+var claudePermissionRulesFor = (input) => ACTIVE_SOURCE === "claude" ? readClaudePermissionRules(claudeSettingsLocationFor(input.cwd)) : null;
+var claudeRulesMayCover = (input, rules) => rules !== null && claudeConsultsItsAllowlist(input.permission_mode) && agentRulesAllowEveryInput(rules, input.tool_name, [input.tool_input ?? {}], input.cwd);
 var claudeGateInput = (modeState, config, input, canonical) => {
   const toolName = canonical?.toolName ?? input.tool_name;
   const toolInputs = canonical?.toolInputs ?? [input.tool_input ?? {}];
@@ -549,6 +600,7 @@ var handlePreToolUse = async (input, canonical) => {
     if (!(verdict.kind === "gate" && verdict.scopeReason) && shouldDeferToNativeMode(input.permission_mode, input.tool_name)) {
       return void 0;
     }
+    if (claudeAllowlistOwnsCall(gateInput, verdict, input.permission_mode, claudePermissionRulesFor(input))) return void 0;
     if (claudePromptsBeforeAnEdit(input.permission_mode) && editAsksAtTheAgentsPrompt(gateInput, verdict)) return handleTerminalOnly();
     switch (verdict.kind) {
       case "allow":
@@ -578,7 +630,8 @@ var toPermissionRequestOutput = (hookOutput) => {
   return void 0;
 };
 var handlePermissionRequest = async (input, canonical) => {
-  if (canonical === void 0 && isPermissionRequestOwnedByPreToolUse(input.tool_name, input.permission_mode, shouldDeferToNativeMode)) return void 0;
+  const claudeRules = claudePermissionRulesFor(input);
+  if (canonical === void 0 && !claudeRulesMayCover(input, claudeRules) && isPermissionRequestOwnedByPreToolUse(input.tool_name, input.permission_mode, shouldDeferToNativeMode)) return void 0;
   if (isPusharyOwnTool(input.tool_name)) return void 0;
   let apiKey;
   try {
@@ -589,7 +642,8 @@ var handlePermissionRequest = async (input, canonical) => {
   try {
     const modeState = await fetchModeState(apiKey, input.session_id);
     const policy = await getPolicy(apiKey, modeState.policyVersion, ACTIVE_AGENT.type, true, input.session_id);
-    const verdict = resolveGate(claudeGateInput(modeState, policy, input, canonical));
+    const gateInput = claudeGateInput(modeState, policy, input, canonical);
+    const verdict = resolveGate(gateInput);
     if (verdict.kind === "kill") {
       await reportMachineDenial(input, verdict, ACTIVE_AGENT);
       return permReqHalted(verdict.reason);
@@ -601,7 +655,7 @@ var handlePermissionRequest = async (input, canonical) => {
     if (canonical === null) return permReqDeny(unreadableReason);
     if (agentQuestionStrategy(ACTIVE_SOURCE, "PermissionRequest", input.tool_name) === AGENT_QUESTION_STRATEGY.native) return void 0;
     if (verdict.kind === "gate" && verdict.scopeReason && (canonical?.toolInputs.length ?? 0) > 1) return permReqDeny(batchScopeReason);
-    if (!(verdict.kind === "gate" && verdict.scopeReason) && isPermissionRequestOwnedByPreToolUse(input.tool_name, input.permission_mode, shouldDeferToNativeMode)) return void 0;
+    if (!(verdict.kind === "gate" && verdict.scopeReason) && !claudeAllowlistOwnsCall(gateInput, verdict, input.permission_mode, claudeRules) && isPermissionRequestOwnedByPreToolUse(input.tool_name, input.permission_mode, shouldDeferToNativeMode)) return void 0;
     switch (verdict.kind) {
       case "allow":
         return permReqAllow();

package/dist/{chunk-4ERLRNOK.js → chunk-UMVM4HVV.js}

@@ -1,17 +1,17 @@
 import {
   CLAUDE_HOOK_EVENTS,
   supportedClaudeEvents
-} from "./chunk-2AUIEZYS.js";
+} from "./chunk-3TKMWW34.js";
 import {
   guardBinary,
   holdBudgetOf,
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-6IU45EHE.js";
+} from "./chunk-L2FPZQQM.js";
 import {
   HOOK_LOCATOR_BINARY,
   withHookHoldBudget
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-NTTMJFJU.js";
 
 // src/claude-config.ts
 import { join } from "path";

package/dist/{chunk-K3QVDAZW.js → chunk-VT5TVFM3.js}

@@ -1,6 +1,6 @@
 import {
   HOOK_LOCATOR_BINARY
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-NTTMJFJU.js";
 
 // src/diagnostics/bridge.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-TIWURSLS.js → chunk-VT63XWPR.js}

@@ -1,6 +1,6 @@
 import {
   redactSecrets
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-NTTMJFJU.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";

package/dist/{chunk-3ZSGKLSO.js → chunk-W5JUN4TF.js}

@@ -1,6 +1,6 @@
 import {
   SETUP_FLAGS
-} from "./chunk-TFKBFQCE.js";
+} from "./chunk-MK7ZJ2JN.js";
 import {
   parseFlags
 } from "./chunk-GMXKITVA.js";
@@ -14,7 +14,7 @@ import {
   CLAUDE_CONNECTOR_URL,
   COWORK_CONNECTOR_LIMIT,
   COWORK_STANDING_INSTRUCTIONS
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-NTTMJFJU.js";
 
 // src/cli/cowork.ts
 import { readFileSync } from "fs";

package/dist/{chunk-2QT3GCU4.js → chunk-WBWF7WU7.js}

@@ -1,6 +1,6 @@
 import {
   readTranscriptPreference
-} from "./chunk-USQDVBEV.js";
+} from "./chunk-OLD4YGZR.js";
 
 // src/transcript-setting.ts
 var transcriptEnvironmentPreference = () => {

package/dist/{chunk-WOLPADR6.js → chunk-WHOD4YGB.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-6IU45EHE.js";
+} from "./chunk-L2FPZQQM.js";
 import {
   writeFileAtomic
 } from "./chunk-T7E75EKA.js";

package/dist/{chunk-R5KY3PBN.js → chunk-X4G4MQEV.js}

@@ -3,28 +3,28 @@ import {
   addPusharyToolPermissions,
   isPusharyHook,
   removeClaudeMcpServers
-} from "./chunk-4ERLRNOK.js";
+} from "./chunk-UMVM4HVV.js";
 import {
   CLAUDE_HOOK_EVENTS,
   addGeminiMcpServer,
   removeGeminiMcpServer
-} from "./chunk-2AUIEZYS.js";
+} from "./chunk-3TKMWW34.js";
 import {
   CLAUDE_CODE_AGENT,
   parseApplyPatchFiles
-} from "./chunk-D573TLP6.js";
+} from "./chunk-ROCRCXTP.js";
 import {
   guardBinary,
   holdBudgetOf,
   registerHookEntry
-} from "./chunk-6IU45EHE.js";
+} from "./chunk-L2FPZQQM.js";
 import {
   PHONE_ANSWERED_TOOLS,
   hookCompatibleProfile,
   hookCompatibleProfileBySource,
   toToolLookup,
   withHookHoldBudget
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-NTTMJFJU.js";
 
 // src/compatible-config.ts
 import { homedir } from "os";

package/dist/{chunk-IV3RHICU.js → chunk-XTXCQ4QE.js}

@@ -2,21 +2,21 @@ import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "./chunk-5ZZG76S2.js";
+} from "./chunk-GE64YOTX.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   hasDaemonServiceDefinition,
   readDaemonNeedsLogin,
   readDaemonStatus
-} from "./chunk-X7FESZTD.js";
+} from "./chunk-2PHHXWA4.js";
 import {
   getMachineId
-} from "./chunk-WOLPADR6.js";
+} from "./chunk-WHOD4YGB.js";
 import {
   readControlMode,
   readKeySource
-} from "./chunk-USQDVBEV.js";
+} from "./chunk-OLD4YGZR.js";
 import {
   getBaseUrl
 } from "./chunk-OSJEMXSR.js";

package/dist/{chunk-MDJJW3LP.js → chunk-ZR4NP264.js}

@@ -7,10 +7,10 @@ import {
   permissionDeniedAction,
   releaseThrottle,
   reportEvent
-} from "./chunk-D573TLP6.js";
+} from "./chunk-ROCRCXTP.js";
 import {
   canonicalJson
-} from "./chunk-6IU45EHE.js";
+} from "./chunk-L2FPZQQM.js";
 import {
   writeFileAtomic
 } from "./chunk-T7E75EKA.js";
@@ -20,7 +20,7 @@ import {
   machineDecisionFor,
   shouldDeferToNativeMode,
   wireVerdictFor
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-NTTMJFJU.js";
 
 // src/machine-decision-audit.ts
 import { basename } from "path";

package/dist/{reapply-5CZSTJZI.js → reapply-GGHT2YJX.js}

@@ -9,17 +9,17 @@ import {
   reapplyGeminiSettings,
   reapplyVsCodePlugin,
   repairCodexHolds
-} from "./chunk-JKBDGZFL.js";
-import "./chunk-HUAOMX4U.js";
-import "./chunk-6EEANS74.js";
-import "./chunk-4ERLRNOK.js";
-import "./chunk-Z4VGIBJ7.js";
-import "./chunk-2AUIEZYS.js";
+} from "./chunk-CNJWNFBL.js";
+import "./chunk-5TRIYAHM.js";
+import "./chunk-45BA4RL6.js";
+import "./chunk-UMVM4HVV.js";
+import "./chunk-NYFBIXA7.js";
+import "./chunk-3TKMWW34.js";
 import "./chunk-XHKBHWLX.js";
-import "./chunk-UYDTFCHW.js";
-import "./chunk-6IU45EHE.js";
+import "./chunk-MR2GHF3F.js";
+import "./chunk-L2FPZQQM.js";
 import "./chunk-T7E75EKA.js";
-import "./chunk-T4QY64OR.js";
+import "./chunk-NTTMJFJU.js";
 import "./chunk-HWJW3CPO.js";
 export {
   ensureCodexTrustAfterReapply,

package/dist/src/index.d.ts

@@ -157,6 +157,7 @@ interface AskUserParams {
     toolUseId?: string;
     waitEndsAt?: string;
     requestId?: string;
+    sessionToolAware?: true;
 }
 interface AskUserResponse {
     correlationId: string;

package/dist/src/index.js

@@ -1,12 +1,12 @@
 import {
   handlePreToolUse
-} from "../chunk-PJ27EHCD.js";
-import "../chunk-R5KY3PBN.js";
-import "../chunk-4ERLRNOK.js";
-import "../chunk-MDJJW3LP.js";
-import "../chunk-43ZDACBO.js";
+} from "../chunk-UJ4O22GU.js";
+import "../chunk-X4G4MQEV.js";
+import "../chunk-UMVM4HVV.js";
+import "../chunk-ZR4NP264.js";
+import "../chunk-7WRJFRNF.js";
 import "../chunk-YHG74UFF.js";
-import "../chunk-2AUIEZYS.js";
+import "../chunk-3TKMWW34.js";
 import {
   fetchAccountPublicKey
 } from "../chunk-66H2QQAK.js";
@@ -18,20 +18,20 @@ import {
   handlePostToolUse,
   handleStop,
   reportEvent
-} from "../chunk-D573TLP6.js";
-import "../chunk-UYDTFCHW.js";
+} from "../chunk-ROCRCXTP.js";
+import "../chunk-MR2GHF3F.js";
 import {
   askUser,
   cancelQuestion,
   waitForAnswer
-} from "../chunk-PYCQXCI5.js";
-import "../chunk-WOLPADR6.js";
-import "../chunk-6IU45EHE.js";
+} from "../chunk-LVHGSD5E.js";
+import "../chunk-WHOD4YGB.js";
+import "../chunk-L2FPZQQM.js";
 import "../chunk-HETOKNIL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-HU5LSYL2.js";
+import "../chunk-IEXXFXSP.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
@@ -39,7 +39,7 @@ import {
 } from "../chunk-OSJEMXSR.js";
 import {
   resolvePolicy
-} from "../chunk-T4QY64OR.js";
+} from "../chunk-NTTMJFJU.js";
 import "../chunk-EA3IELHP.js";
 import "../chunk-HWJW3CPO.js";
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "1.5.1",
+  "version": "1.6.1",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",