@pushary/agent-hooks 1.7.0 → 1.7.2

package/dist/{chunk-L4H2Q2S4.js → chunk-SKMWPXGV.js}

@@ -1,15 +1,322 @@
 import {
   MCP_BRIDGE_BINARY
-} from "./chunk-YYINL576.js";
+} from "./chunk-TVJYGZXB.js";
 import {
   openCodeConfigDirFrom
-} from "./chunk-B3YQANFN.js";
+} from "./chunk-SKEW3TQX.js";
 import {
-  codexHomeFrom
-} from "./chunk-DNJUSFBL.js";
+  codexHomeFrom,
+  resolvePathBinary
+} from "./chunk-NYBZJ44G.js";
 import {
   HOOK_COMPATIBLE_PROFILES
-} from "./chunk-YROGUPOZ.js";
+} from "./chunk-WWTLAZQA.js";
+
+// src/hermes-config.ts
+import { execFileSync } from "child_process";
+import { existsSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { homedir, tmpdir } from "os";
+import { join } from "path";
+var isRecord = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+var isSnapshot = (value) => isRecord(value) && typeof value.present === "boolean" && Object.hasOwn(value, "value");
+var isHermesConfigReceipt = (value) => {
+  if (!isRecord(value)) return false;
+  return ["security", "approval", "transport", "fallback", "plugins", "enabled", "agent", "disabled"].every((key) => isSnapshot(value[key])) && typeof value.pushary_enabled === "boolean" && typeof value.clarify_disabled === "boolean";
+};
+var HERMES_PIP_PACKAGE = "hermes-plugin-pushary";
+var HERMES_PLUGIN_NAME = "pushary";
+var HERMES_CONFIG_SCRIPT = String.raw`
+import copy, importlib.util, json, os, sys
+from hermes_cli.config import load_config, save_config
+
+PUSHARY_TRANSPORT = "pushary"
+PUSHARY_FALLBACK = "builtin"
+PUSHARY_PLUGIN = "pushary"
+PUSHARY_PLUGIN_MODULE = "pushary_plugin"
+QUESTION_TOOLSET = "clarify"
+
+mode = sys.argv[1]
+receipt_path = sys.argv[2] if len(sys.argv) > 2 else None
+c = load_config()
+original = copy.deepcopy(c)
+
+def section(obj, key):
+    value = obj.get(key)
+    return value if isinstance(value, dict) else {}
+
+def members(obj, key):
+    value = obj.get(key)
+    return value if isinstance(value, list) else []
+
+if mode == "status":
+    print(json.dumps({
+        "plugin_installed": importlib.util.find_spec(PUSHARY_PLUGIN_MODULE) is not None,
+        "plugin_enabled": PUSHARY_PLUGIN in members(section(c, "plugins"), "enabled"),
+        "approvals_routed": section(section(c, "security"), "approval").get("transport") == PUSHARY_TRANSPORT,
+        "questions_routed": QUESTION_TOOLSET in members(section(c, "agent"), "disabled_toolsets"),
+    }))
+    sys.exit(0)
+
+def recorded(snapshot, value):
+    return bool(snapshot.get("present")) and snapshot.get("value") == value
+
+def pop_if(obj, key, value):
+    if obj.get(key) == value:
+        obj.pop(key, None)
+
+def snap(obj, key):
+    return {"present": key in obj, "value": obj.get(key)}
+
+restore_conflicts = []
+
+def restore(obj, key, before, ours):
+    if before.get("present") and before.get("value") == ours:
+        return
+    if before.get("present"):
+        if key in obj and obj.get(key) == before.get("value"):
+            return
+    elif key not in obj:
+        return
+    if obj.get(key) != ours:
+        restore_conflicts.append(key)
+        return
+    if before.get("present"):
+        obj[key] = before.get("value")
+    else:
+        obj.pop(key, None)
+
+def restore_container(obj, key, before, current, changed):
+    raw = obj.get(key)
+    if isinstance(before.get("value"), dict):
+        if not isinstance(raw, dict):
+            if changed:
+                restore_conflicts.append(key)
+            return
+        if current or before.get("present"):
+            obj[key] = current
+        else:
+            obj.pop(key, None)
+    elif isinstance(raw, dict) and current:
+        restore_conflicts.append(key)
+    else:
+        restore(obj, key, before, {})
+
+def restore_list_member(obj, key, before, ours, ours_before):
+    raw = obj.get(key)
+    if isinstance(before.get("value"), list):
+        if ours_before:
+            return
+        if not isinstance(raw, list):
+            restore_conflicts.append(key)
+            return
+        remaining = [item for item in raw if item != ours]
+        if remaining or before.get("present"):
+            obj[key] = remaining
+        else:
+            obj.pop(key, None)
+        return
+    if before.get("present") and raw == before.get("value"):
+        return
+    if not before.get("present") and key not in obj:
+        return
+    if not isinstance(raw, list):
+        restore_conflicts.append(key)
+        return
+    remaining = [item for item in raw if item != ours]
+    if remaining:
+        restore_conflicts.append(key)
+    else:
+        restore(obj, key, before, raw)
+
+def valid_snapshot(value):
+    return isinstance(value, dict) and isinstance(value.get("present"), bool) and "value" in value
+
+def valid_receipt(value):
+    snapshots = ["security", "approval", "transport", "fallback", "plugins", "enabled", "agent", "disabled"]
+    return (isinstance(value, dict)
+        and all(valid_snapshot(value.get(key)) for key in snapshots)
+        and isinstance(value.get("pushary_enabled"), bool)
+        and isinstance(value.get("clarify_disabled"), bool))
+
+if mode == "setup":
+    security_before = snap(c, "security")
+    s = section(c, "security")
+    approval_before = snap(s, "approval")
+    ap = section(s, "approval")
+    plugins_before = snap(c, "plugins")
+    p = section(c, "plugins")
+    agent_before = snap(c, "agent")
+    a = section(c, "agent")
+    enabled = members(p, "enabled")
+    disabled = members(a, "disabled_toolsets")
+    receipt = {
+        "security": security_before,
+        "approval": approval_before,
+        "transport": snap(ap, "transport"),
+        "fallback": snap(ap, "transport_fallback"),
+        "plugins": plugins_before,
+        "enabled": snap(p, "enabled"),
+        "pushary_enabled": PUSHARY_PLUGIN in enabled,
+        "agent": agent_before,
+        "disabled": snap(a, "disabled_toolsets"),
+        "clarify_disabled": QUESTION_TOOLSET in disabled,
+    }
+    if os.path.exists(receipt_path):
+        with open(receipt_path, encoding="utf-8") as handle:
+            existing_receipt = json.load(handle)
+        if not valid_receipt(existing_receipt):
+            raise ValueError("invalid Pushary Hermes setup receipt")
+    else:
+        os.makedirs(os.path.dirname(receipt_path), exist_ok=True)
+        temp = receipt_path + ".tmp"
+        with open(temp, "x", encoding="utf-8") as handle:
+            json.dump(receipt, handle)
+        os.chmod(temp, 0o600)
+        os.replace(temp, receipt_path)
+    ap["transport"] = PUSHARY_TRANSPORT
+    ap["transport_fallback"] = PUSHARY_FALLBACK
+    s["approval"] = ap
+    c["security"] = s
+    p["enabled"] = enabled if PUSHARY_PLUGIN in enabled else enabled + [PUSHARY_PLUGIN]
+    c["plugins"] = p
+    a["disabled_toolsets"] = disabled if QUESTION_TOOLSET in disabled else disabled + [QUESTION_TOOLSET]
+    c["agent"] = a
+else:
+    receipt_exists = os.path.exists(receipt_path)
+    try:
+        with open(receipt_path, encoding="utf-8") as handle:
+            receipt = json.load(handle)
+    except (OSError, ValueError):
+        if receipt_exists:
+            raise
+        receipt = None
+    s = section(c, "security")
+    ap = section(s, "approval")
+    if receipt:
+        if not valid_receipt(receipt):
+            raise ValueError("invalid Pushary Hermes setup receipt")
+        approval_changed = (not receipt["transport"].get("present")
+            or receipt["transport"].get("value") != PUSHARY_TRANSPORT
+            or not receipt["fallback"].get("present")
+            or receipt["fallback"].get("value") != PUSHARY_FALLBACK)
+        plugins_changed = not (isinstance(receipt["enabled"].get("value"), list)
+            and receipt["pushary_enabled"])
+        agent_changed = not (isinstance(receipt["disabled"].get("value"), list)
+            and receipt["clarify_disabled"])
+        transport_left_over = recorded(receipt["transport"], PUSHARY_TRANSPORT)
+        if transport_left_over:
+            pop_if(ap, "transport", PUSHARY_TRANSPORT)
+        else:
+            restore(ap, "transport", receipt["transport"], PUSHARY_TRANSPORT)
+        if transport_left_over and recorded(receipt["fallback"], PUSHARY_FALLBACK):
+            pop_if(ap, "transport_fallback", PUSHARY_FALLBACK)
+        else:
+            restore(ap, "transport_fallback", receipt["fallback"], PUSHARY_FALLBACK)
+    else:
+        pop_if(ap, "transport", PUSHARY_TRANSPORT)
+        pop_if(ap, "transport_fallback", PUSHARY_FALLBACK)
+    if receipt:
+        restore_container(s, "approval", receipt["approval"], ap, approval_changed)
+        restore_container(c, "security", receipt["security"], s, approval_changed)
+    else:
+        if ap: s["approval"] = ap
+        else: s.pop("approval", None)
+        if s: c["security"] = s
+        else: c.pop("security", None)
+
+    p = section(c, "plugins")
+    if receipt:
+        restore_list_member(p, "enabled", receipt["enabled"], PUSHARY_PLUGIN, False)
+        restore_container(c, "plugins", receipt["plugins"], p, plugins_changed)
+    else:
+        enabled = [item for item in members(p, "enabled") if item != PUSHARY_PLUGIN]
+        if enabled: p["enabled"] = enabled
+        else: p.pop("enabled", None)
+        if p: c["plugins"] = p
+        else: c.pop("plugins", None)
+
+    a = section(c, "agent")
+    if receipt:
+        clarify_was_users = receipt["clarify_disabled"] and not recorded(receipt["transport"], PUSHARY_TRANSPORT)
+        restore_list_member(a, "disabled_toolsets", receipt["disabled"], QUESTION_TOOLSET, clarify_was_users)
+        restore_container(c, "agent", receipt["agent"], a, agent_changed)
+    else:
+        disabled = [item for item in members(a, "disabled_toolsets") if item != QUESTION_TOOLSET]
+        if disabled: a["disabled_toolsets"] = disabled
+        else: a.pop("disabled_toolsets", None)
+        if a: c["agent"] = a
+        else: c.pop("agent", None)
+
+    if receipt and restore_conflicts:
+        raise ValueError("Hermes config changed after Pushary setup")
+
+changed = c != original
+if changed and mode != "clean-preview":
+    save_config(c)
+print(json.dumps({"changed": changed}))
+`;
+var resolveHermesPython = () => {
+  const launcher = resolvePathBinary("hermes");
+  if (launcher && process.platform !== "win32") {
+    try {
+      const shebang = readFileSync(launcher, "utf-8").split("\n", 1)[0];
+      const interpreter = shebang?.startsWith("#!") ? shebang.slice(2).trim().split(/\s+/)[0] : void 0;
+      if (interpreter && /python/i.test(interpreter) && existsSync(interpreter)) return interpreter;
+    } catch {
+    }
+  }
+  const root = join(homedir(), ".hermes", "hermes-agent", "venv");
+  const candidates = process.platform === "win32" ? [join(root, "Scripts", "python.exe"), join(root, "Scripts", "python3.exe")] : [join(root, "bin", "python3"), join(root, "bin", "python")];
+  return candidates.find(existsSync) ?? null;
+};
+var HERMES_SCRIPT_TIMEOUT_MS = 15e3;
+var runPythonScript = (python, script, args) => {
+  const path = join(tmpdir(), `pushary-hermes-${process.pid}-${Date.now()}.py`);
+  try {
+    writeFileSync(path, script, { encoding: "utf-8", mode: 384 });
+    return execFileSync(python, [path, ...args], {
+      env: { ...process.env },
+      encoding: "utf-8",
+      stdio: "pipe",
+      timeout: HERMES_SCRIPT_TIMEOUT_MS
+    });
+  } catch {
+    return null;
+  } finally {
+    try {
+      rmSync(path, { force: true });
+    } catch {
+    }
+  }
+};
+var lastReport = (stdout) => {
+  const line = stdout.trim().split("\n").at(-1) ?? "";
+  try {
+    return JSON.parse(line);
+  } catch {
+    return void 0;
+  }
+};
+var configRunFrom = (stdout) => {
+  const report = stdout === null ? void 0 : lastReport(stdout);
+  if (!isRecord(report) || typeof report.changed !== "boolean") return "failed";
+  return report.changed ? "changed" : "unchanged";
+};
+var runHermesConfigScript = (python, mode, receiptPath) => configRunFrom(runPythonScript(python, HERMES_CONFIG_SCRIPT, [mode, receiptPath]));
+var HERMES_STATUS_FIELDS = ["plugin_installed", "plugin_enabled", "approvals_routed", "questions_routed"];
+var isHermesStatusReport = (value) => isRecord(value) && HERMES_STATUS_FIELDS.every((field) => typeof value[field] === "boolean");
+var hermesWiredByPushary = (status, setupRecorded) => setupRecorded || status.pluginEnabled || status.approvalsRouted;
+var readHermesStatus = (python) => {
+  const stdout = runPythonScript(python, HERMES_CONFIG_SCRIPT, ["status"]);
+  const report = stdout === null ? void 0 : lastReport(stdout);
+  if (!isHermesStatusReport(report)) return null;
+  return {
+    pluginInstalled: report.plugin_installed,
+    pluginEnabled: report.plugin_enabled,
+    approvalsRouted: report.approvals_routed,
+    questionsRouted: report.questions_routed
+  };
+};
 
 // src/fx-config.ts
 var FX_SERVER_NAME = "pushary";
@@ -17,7 +324,7 @@ var FX_OPERATION_TIMEOUT_MS = 75e3;
 var FX_PROFILE_MAX_BYTES = 1024 * 1024 - 1;
 var FX_SETTINGS_MAX_BYTES = 64 * 1024;
 var FX_PUSHARY_TOOLS_RULE = "mcp_pushary_*";
-var FX_TOOL_DISCOVERY_NOTE = 'In fx, these tools are named mcp_pushary_ask_user, mcp_pushary_send_notification, mcp_pushary_wait_for_answer and mcp_pushary_cancel_question. They are not loaded at the start of a turn: find them with capability_search (query "pushary") or select one with mcp_select_tool. When the user may be away from this terminal, use mcp_pushary_ask_user rather than your built-in question prompt.';
+var FX_TOOL_DISCOVERY_NOTE = 'In fx, these tools are named mcp_pushary_ask_user, mcp_pushary_send_notification, mcp_pushary_wait_for_answer, mcp_pushary_cancel_question and mcp_pushary_propose_scope. fx does not load them at the start of a turn: call mcp_select_tool with the exact name, for example {"name": "mcp_pushary_ask_user"}, then call the tool. For fx this replaces the guidance above to ask the whole round in the terminal while the user is there: ask every question through mcp_pushary_ask_user, even while the user is at this terminal, rather than through ask_user_question. fx cannot show its own question prompt in the Mac notch or on the phone, so a question asked there waits unseen once the user steps away. Ask in your reply instead only when a Pushary handoffAction tells you to ask here, or when mcp_pushary_ask_user is unavailable or fails without one.';
 var ALLOW_ACTION = "allow";
 var PERMISSION_KEY = "permission";
 var WORKSPACES_KEY = "workspaces";
@@ -50,7 +357,9 @@ var FX_PROFILE_REFUSALS = {
 };
 var FX_SETTINGS_REFUSALS = {
   ...FX_JSON_REFUSALS,
-  "permission-not-object": 'has a "permission" value that is not an object'
+  "permission-not-object": 'has a "permission" value that is not an object',
+  "invalid-permission-rule": "has a permission rule fx rejects, so fx ignores the whole file",
+  "invalid-permission-mode": "has a permission_mode fx does not recognise, so fx ignores the whole file"
 };
 var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 var stringTokenEnd = (text, start) => {
@@ -182,6 +491,8 @@ var fxSettingsText = (settings) => fxFileText(settings, FX_SETTINGS_MAX_BYTES);
 var readFxSettings = (text) => {
   const read = readFxJsonObject(text, FX_SETTINGS_MAX_BYTES);
   if (read.kind === "refused") return read;
+  const invalid = fxSettingsRejection(read.value);
+  if (invalid) return { kind: "refused", reason: invalid };
   const permission = read.value[PERMISSION_KEY];
   if (permission !== void 0 && !asRecord(permission)) return { kind: "refused", reason: "permission-not-object" };
   return { kind: "settings", settings: read.value };
@@ -196,15 +507,15 @@ var withPusharyToolsAllowed = (settings) => {
     change: "added"
   };
 };
+var withoutPermissionRule = (settings, permission, rule) => {
+  const remaining = Object.fromEntries(Object.entries(permission).filter(([name]) => name !== rule));
+  const withoutPermission = Object.fromEntries(Object.entries(settings).filter(([key]) => key !== PERMISSION_KEY));
+  return Object.keys(remaining).length === 0 ? withoutPermission : { ...settings, [PERMISSION_KEY]: remaining };
+};
 var withoutPusharyToolsAllowed = (settings) => {
   const permission = asRecord(settings[PERMISSION_KEY]);
-  if (permission?.[FX_PUSHARY_TOOLS_RULE] !== ALLOW_ACTION) return { settings, removed: false };
-  const remaining = Object.fromEntries(Object.entries(permission).filter(([rule]) => rule !== FX_PUSHARY_TOOLS_RULE));
-  const withoutPermission = Object.fromEntries(Object.entries(settings).filter(([key]) => key !== PERMISSION_KEY));
-  return {
-    settings: Object.keys(remaining).length === 0 ? withoutPermission : { ...settings, [PERMISSION_KEY]: remaining },
-    removed: true
-  };
+  if (!permission || permission[FX_PUSHARY_TOOLS_RULE] !== ALLOW_ACTION) return { settings, removed: false };
+  return { settings: withoutPermissionRule(settings, permission, FX_PUSHARY_TOOLS_RULE), removed: true };
 };
 var pusharyToolsAllowed = (settings) => asRecord(settings[PERMISSION_KEY])?.[FX_PUSHARY_TOOLS_RULE] === ALLOW_ACTION;
 var overridesPusharyRule = (workspace) => {
@@ -212,15 +523,144 @@ var overridesPusharyRule = (workspace) => {
   return permission !== void 0 && !(FX_PUSHARY_TOOLS_RULE in permission);
 };
 var workspacesOverridingPusharyRule = (settings) => Object.entries(asRecord(settings[WORKSPACES_KEY]) ?? {}).filter(([, workspace]) => overridesPusharyRule(workspace)).map(([path]) => path);
+var FX_QUESTION_TOOL = "ask_user_question";
+var DENY_ACTION = "deny";
+var GLOBAL_TARGET_PATTERN = "*";
+var PERMISSION_MODE_KEY = "permission_mode";
+var FX_PERMISSION_MODE_ENV = "FX_PERMISSION_MODE";
+var FX_DEFAULT_PERMISSION_MODE = "auto";
+var FX_PERMISSION_MODE_SPELLINGS = {
+  ask: "ask",
+  auto: "auto",
+  "full-access": "full-access",
+  "full access": "full-access",
+  yolo: "full-access"
+};
+var FX_RULE_WHITESPACE = /^[ \t\r\n]+|[ \t\r\n]+$/g;
+var FX_QUESTION_RULE_RECEIPT = { rule: FX_QUESTION_TOOL, action: DENY_ACTION };
+var isFxQuestionRuleReceipt = (value) => {
+  const receipt = asRecord(value);
+  return receipt?.rule === FX_QUESTION_TOOL && receipt.action === DENY_ACTION;
+};
+var isFxRuleAction = (value) => value === "allow" || value === "ask" || value === DENY_ACTION;
+var fxRuleAction = (value) => {
+  if (typeof value !== "string") return null;
+  const action = value.toLowerCase();
+  return isFxRuleAction(action) ? action : null;
+};
+var parseFxPermissionMode = (value) => typeof value === "string" ? FX_PERMISSION_MODE_SPELLINGS[value.toLowerCase()] ?? null : null;
+var trimFxRuleText = (text) => text.replace(FX_RULE_WHITESPACE, "");
+var isValidPatternMap = (value) => {
+  const patterns = asRecord(value);
+  return patterns !== void 0 && Object.values(patterns).every((action) => fxRuleAction(action) !== null);
+};
+var isValidPermissionValue = (value) => {
+  if (fxRuleAction(value) !== null) return true;
+  const permission = asRecord(value);
+  return permission !== void 0 && Object.entries(permission).every(([name, rule]) => trimFxRuleText(name).length > 0 && (fxRuleAction(rule) !== null || isValidPatternMap(rule)));
+};
+var permissionScopeRejection = (scope) => {
+  if (scope[PERMISSION_KEY] !== void 0 && !isValidPermissionValue(scope[PERMISSION_KEY])) return "invalid-permission-rule";
+  if (scope[PERMISSION_MODE_KEY] !== void 0 && parseFxPermissionMode(scope[PERMISSION_MODE_KEY]) === null) return "invalid-permission-mode";
+  return null;
+};
+var workspaceScopes = (settings) => Object.values(asRecord(settings[WORKSPACES_KEY]) ?? {}).flatMap((workspace) => {
+  const scope = asRecord(workspace);
+  return scope ? [scope] : [];
+});
+var fxSettingsRejection = (settings) => [settings, ...workspaceScopes(settings)].map(permissionScopeRejection).find((rejection) => rejection !== null) ?? null;
+var rulesOfPermissionEntry = ([name, value]) => {
+  const permission = trimFxRuleText(name);
+  const action = fxRuleAction(value);
+  if (action) return [{ permission, pattern: GLOBAL_TARGET_PATTERN, action }];
+  return Object.entries(asRecord(value) ?? {}).flatMap(([pattern, target]) => {
+    const targetAction = fxRuleAction(target);
+    return targetAction ? [{ permission, pattern: trimFxRuleText(pattern), action: targetAction }] : [];
+  });
+};
+var fxPermissionRules = (permission) => {
+  const everything = fxRuleAction(permission);
+  if (everything) return [{ permission: GLOBAL_TARGET_PATTERN, pattern: GLOBAL_TARGET_PATTERN, action: everything }];
+  return Object.entries(asRecord(permission) ?? {}).flatMap(rulesOfPermissionEntry);
+};
+var fxWildcardMatch = (pattern, candidate) => {
+  let patternIndex = 0;
+  let candidateIndex = 0;
+  let starIndex = null;
+  let starCandidateIndex = 0;
+  while (candidateIndex < candidate.length) {
+    if (patternIndex < pattern.length && (pattern[patternIndex] === "?" || pattern[patternIndex] === candidate[candidateIndex])) {
+      patternIndex += 1;
+      candidateIndex += 1;
+    } else if (patternIndex < pattern.length && pattern[patternIndex] === "*") {
+      starIndex = patternIndex;
+      patternIndex += 1;
+      starCandidateIndex = candidateIndex;
+    } else if (starIndex === null) {
+      return false;
+    } else {
+      starCandidateIndex += 1;
+      candidateIndex = starCandidateIndex;
+      patternIndex = starIndex + 1;
+    }
+  }
+  while (pattern[patternIndex] === "*") patternIndex += 1;
+  return patternIndex === pattern.length;
+};
+var DIRECTORY_TREE_SUFFIX = "/**";
+var directoryTreeMatches = (pattern, candidate) => {
+  if (!pattern.endsWith(DIRECTORY_TREE_SUFFIX)) return false;
+  const directory = pattern.slice(0, -DIRECTORY_TREE_SUFFIX.length);
+  return candidate === directory || candidate.startsWith(directory) && candidate[directory.length] === "/";
+};
+var targetMatches = (pattern, candidate) => directoryTreeMatches(pattern, candidate) || fxWildcardMatch(pattern, candidate);
+var isGlobalTargetPattern = (pattern) => /^\*+$/.test(pattern);
+var decisionForTarget = (rules, target) => rules.filter((rule) => targetMatches(rule.pattern, target)).at(-1)?.action ?? null;
+var reopensTool = (rules, rule) => rule.action !== DENY_ACTION && decisionForTarget(rules, rule.pattern) !== DENY_ACTION && decisionForTarget(rules, rule.pattern) !== null;
+var fxRulesHideTool = (rules, toolName) => {
+  const matching = rules.filter((rule) => fxWildcardMatch(rule.permission, toolName));
+  const lastGlobalRule = matching.filter((rule) => isGlobalTargetPattern(rule.pattern)).at(-1);
+  if (lastGlobalRule?.action !== DENY_ACTION) return false;
+  return !matching.slice(matching.lastIndexOf(lastGlobalRule) + 1).some((rule) => reopensTool(matching, rule));
+};
+var effectivePermissionMode = (scope, environment) => parseFxPermissionMode(environment[FX_PERMISSION_MODE_ENV]) ?? parseFxPermissionMode(scope[PERMISSION_MODE_KEY]) ?? FX_DEFAULT_PERMISSION_MODE;
+var fxRunsWithoutRules = (settings, environment) => effectivePermissionMode(settings, environment) === "full-access";
+var fxQuestionToolHidden = (permission) => fxRulesHideTool(fxPermissionRules(permission), FX_QUESTION_TOOL);
+var fxQuestionRouting = (settings, environment) => {
+  if (fxRunsWithoutRules(settings, environment)) return "full-access";
+  return fxQuestionToolHidden(settings[PERMISSION_KEY]) ? "routed" : "overridden";
+};
+var withQuestionsRoutedToPushary = (settings) => {
+  const permission = asRecord(settings[PERMISSION_KEY]) ?? {};
+  const existing = permission[FX_QUESTION_TOOL];
+  if (existing === void 0) {
+    return { settings: { ...settings, [PERMISSION_KEY]: { ...permission, [FX_QUESTION_TOOL]: DENY_ACTION } }, change: "added" };
+  }
+  return { settings, change: fxRuleAction(existing) === DENY_ACTION ? "present" : "user-rule-kept" };
+};
+var withoutQuestionsRoutedToPushary = (settings, receipt) => {
+  const permission = asRecord(settings[PERMISSION_KEY]);
+  if (!permission || permission[FX_QUESTION_TOOL] === void 0) return { settings, outcome: "absent" };
+  if (!receipt) return { settings, outcome: "not-ours" };
+  if (fxRuleAction(permission[FX_QUESTION_TOOL]) !== DENY_ACTION) return { settings, outcome: "changed-after-setup" };
+  return { settings: withoutPermissionRule(settings, permission, FX_QUESTION_TOOL), outcome: "removed" };
+};
+var workspaceShowsQuestionTool = (workspace) => {
+  const scope = asRecord(workspace);
+  if (!scope) return false;
+  if (parseFxPermissionMode(scope[PERMISSION_MODE_KEY]) === "full-access") return true;
+  return scope[PERMISSION_KEY] !== void 0 && !fxQuestionToolHidden(scope[PERMISSION_KEY]);
+};
+var workspacesShowingQuestionTool = (settings) => Object.entries(asRecord(settings[WORKSPACES_KEY]) ?? {}).filter(([, workspace]) => workspaceShowsQuestionTool(workspace)).map(([path]) => path);
 
 // src/fx-files.ts
-import { existsSync, lstatSync, readFileSync, realpathSync } from "fs";
+import { existsSync as existsSync2, lstatSync, readFileSync as readFileSync2, realpathSync } from "fs";
 import { relative, isAbsolute } from "path";
 var readFxFile = (path, read) => {
-  if (!existsSync(path)) return { kind: "missing" };
+  if (!existsSync2(path)) return { kind: "missing" };
   let text;
   try {
-    text = readFileSync(path, "utf-8");
+    text = readFileSync2(path, "utf-8");
   } catch {
     return { kind: "unreadable" };
   }
@@ -241,8 +681,8 @@ var fxIgnoresInstructionsFile = (path, fxDir) => {
 };
 
 // src/vscode-config.ts
-import { homedir } from "os";
-import { join } from "path";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
 var PLUGIN_LOCATIONS_KEY = "chat.pluginLocations";
 var blankJsonComments = (text) => {
   let out = "";
@@ -372,13 +812,13 @@ var pluginLocationSnippet = (pluginDir) => `"${PLUGIN_LOCATIONS_KEY}": {
 }`;
 var VSCODE_PRODUCTS = ["Code", "Code - Insiders"];
 var settingsRoot = (home, platform) => {
-  if (platform === "darwin") return join(home, "Library", "Application Support");
-  if (platform === "win32") return process.env.APPDATA?.trim() || join(home, "AppData", "Roaming");
-  return process.env.XDG_CONFIG_HOME?.trim() || join(home, ".config");
+  if (platform === "darwin") return join2(home, "Library", "Application Support");
+  if (platform === "win32") return process.env.APPDATA?.trim() || join2(home, "AppData", "Roaming");
+  return process.env.XDG_CONFIG_HOME?.trim() || join2(home, ".config");
 };
-var vscodeSettingsCandidates = (home = homedir(), platform = process.platform) => {
+var vscodeSettingsCandidates = (home = homedir2(), platform = process.platform) => {
   const root = settingsRoot(home, platform);
-  return VSCODE_PRODUCTS.map((product) => join(root, product, "User", "settings.json"));
+  return VSCODE_PRODUCTS.map((product) => join2(root, product, "User", "settings.json"));
 };
 var vscodeSettingsTargets = (exists, home, platform) => {
   const candidates = vscodeSettingsCandidates(home, platform);
@@ -388,9 +828,9 @@ var vscodeSettingsTargets = (exists, home, platform) => {
 
 // src/setup/detect.ts
 import { execSync } from "child_process";
-import { existsSync as existsSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname, join as join2 } from "path";
+import { existsSync as existsSync3 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname, join as join3 } from "path";
 var whichCommand = () => process.platform === "win32" ? "where" : "which";
 var binaryOnPath = (binary) => {
   try {
@@ -400,7 +840,7 @@ var binaryOnPath = (binary) => {
     return false;
   }
 };
-var defaultDeps = { onPath: binaryOnPath, exists: existsSync2 };
+var defaultDeps = { onPath: binaryOnPath, exists: existsSync3 };
 var detectAgent = (probe, deps = defaultDeps) => {
   const checked = [];
   if (probe.binary) {
@@ -422,12 +862,12 @@ var detectAgent = (probe, deps = defaultDeps) => {
   }
   return { kind: "not-found", checked };
 };
-var agentProbes = (home = homedir2()) => ({
+var agentProbes = (home = homedir3()) => ({
   claude_code: {
     binary: "claude",
     // The native installer puts it here, outside a default non-login PATH.
-    paths: [join2(home, ".local", "bin", "claude")],
-    configMarkers: [join2(home, ".claude")]
+    paths: [join3(home, ".local", "bin", "claude")],
+    configMarkers: [join3(home, ".claude")]
   },
   codex: {
     binary: "codex",
@@ -437,25 +877,25 @@ var agentProbes = (home = homedir2()) => ({
   gemini_cli: {
     binary: "gemini",
     paths: [],
-    configMarkers: [join2(home, ".gemini")]
+    configMarkers: [join3(home, ".gemini")]
   },
   hermes: {
     binary: "hermes",
     paths: [],
-    configMarkers: [join2(home, ".hermes")]
+    configMarkers: [join3(home, ".hermes")]
   },
   cursor: {
     // GUI editor. `cursor` on PATH only exists if the user ran "Install 'cursor'
     // command in PATH" from the command palette, which most never do.
     binary: "cursor",
-    paths: process.platform === "darwin" ? ["/Applications/Cursor.app"] : process.platform === "win32" ? [join2(process.env.LOCALAPPDATA ?? join2(home, "AppData", "Local"), "Programs", "cursor")] : ["/usr/share/cursor", join2(home, ".local", "share", "cursor")],
-    configMarkers: [join2(home, ".cursor")]
+    paths: process.platform === "darwin" ? ["/Applications/Cursor.app"] : process.platform === "win32" ? [join3(process.env.LOCALAPPDATA ?? join3(home, "AppData", "Local"), "Programs", "cursor")] : ["/usr/share/cursor", join3(home, ".local", "share", "cursor")],
+    configMarkers: [join3(home, ".cursor")]
   },
   vscode: {
     // Like Cursor, a GUI editor: `code` on PATH only exists if the user ran
     // "Shell Command: Install 'code' command in PATH", which on macOS is opt-in.
     binary: "code",
-    paths: process.platform === "darwin" ? ["/Applications/Visual Studio Code.app"] : process.platform === "win32" ? [join2(process.env.LOCALAPPDATA ?? join2(home, "AppData", "Local"), "Programs", "Microsoft VS Code")] : ["/usr/share/code", join2(home, ".local", "share", "code")],
+    paths: process.platform === "darwin" ? ["/Applications/Visual Studio Code.app"] : process.platform === "win32" ? [join3(process.env.LOCALAPPDATA ?? join3(home, "AppData", "Local"), "Programs", "Microsoft VS Code")] : ["/usr/share/code", join3(home, ".local", "share", "code")],
     // The settings directory rather than ~/.vscode, because the settings
     // directory is what this installer actually writes to. Insiders counts:
     // someone running only Insiders still has VS Code.
@@ -471,7 +911,7 @@ var agentProbes = (home = homedir2()) => ({
   },
   fx: {
     binary: null,
-    paths: [join2(home, ".fx", "settings.json"), join2(home, ".fx", "sessions"), join2(home, ".fx", "history.jsonl")],
+    paths: [join3(home, ".fx", "settings.json"), join3(home, ".fx", "sessions"), join3(home, ".fx", "history.jsonl")],
     configMarkers: []
   },
   ...compatibleProbes(),
@@ -495,7 +935,7 @@ var detectAllAgents = (deps = defaultDeps, home) => {
   }));
 };
 var isDetected = (result) => result.kind === "installed";
-var shortenHome = (path, home = homedir2()) => home && path.startsWith(home) ? `~${path.slice(home.length)}` : path;
+var shortenHome = (path, home = homedir3()) => home && path.startsWith(home) ? `~${path.slice(home.length)}` : path;
 var describeDetection = (result, home) => {
   if (result.kind !== "installed") return null;
   const evidence = shortenHome(result.evidence, home);
@@ -503,7 +943,7 @@ var describeDetection = (result, home) => {
 };
 
 // src/instruction-file.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync, mkdirSync, rmSync } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync, rmSync as rmSync2 } from "fs";
 import { dirname as dirname2 } from "path";
 var PUSHARY_BEGIN = "<!-- BEGIN PUSHARY (managed by @pushary/agent-hooks; do not edit this block) -->";
 var PUSHARY_END = "<!-- END PUSHARY -->";
@@ -533,10 +973,10 @@ ${body}
 ${PUSHARY_END}`;
 var writeInstructionBlock = (filePath, body) => {
   const dir = dirname2(filePath);
-  if (!existsSync3(dir)) mkdirSync(dir, { recursive: true });
+  if (!existsSync4(dir)) mkdirSync(dir, { recursive: true });
   let existing = "";
   try {
-    existing = readFileSync2(filePath, "utf-8");
+    existing = readFileSync3(filePath, "utf-8");
   } catch {
   }
   const block = wrap(body);
@@ -549,12 +989,12 @@ var writeInstructionBlock = (filePath, body) => {
     const prefix = existing.trim() ? existing.replace(/\s*$/, "") + "\n\n" : "";
     next = prefix + block + "\n";
   }
-  writeFileSync(filePath, next, "utf-8");
+  writeFileSync2(filePath, next, "utf-8");
 };
 var removeInstructionBlock = (filePath) => {
   let existing = "";
   try {
-    existing = readFileSync2(filePath, "utf-8");
+    existing = readFileSync3(filePath, "utf-8");
   } catch {
     return false;
   }
@@ -563,21 +1003,28 @@ var removeInstructionBlock = (filePath) => {
   if (start === -1 || end === -1 || end < start) return false;
   const remaining = (existing.slice(0, start) + existing.slice(end + PUSHARY_END.length)).trim();
   if (remaining === "") {
-    rmSync(filePath, { force: true });
+    rmSync2(filePath, { force: true });
   } else {
-    writeFileSync(filePath, remaining + "\n", "utf-8");
+    writeFileSync2(filePath, remaining + "\n", "utf-8");
   }
   return true;
 };
 var hasInstructionBlock = (filePath) => {
   try {
-    return readFileSync2(filePath, "utf-8").includes(PUSHARY_BEGIN);
+    return readFileSync3(filePath, "utf-8").includes(PUSHARY_BEGIN);
   } catch {
     return false;
   }
 };
 
 export {
+  isHermesConfigReceipt,
+  HERMES_PIP_PACKAGE,
+  HERMES_PLUGIN_NAME,
+  resolveHermesPython,
+  runHermesConfigScript,
+  hermesWiredByPushary,
+  readHermesStatus,
   FX_PUSHARY_TOOLS_RULE,
   FX_TOOL_DISCOVERY_NOTE,
   FX_PROFILE_REFUSALS,
@@ -596,6 +1043,13 @@ export {
   withoutPusharyToolsAllowed,
   pusharyToolsAllowed,
   workspacesOverridingPusharyRule,
+  FX_QUESTION_TOOL,
+  FX_QUESTION_RULE_RECEIPT,
+  isFxQuestionRuleReceipt,
+  fxQuestionRouting,
+  withQuestionsRoutedToPushary,
+  withoutQuestionsRoutedToPushary,
+  workspacesShowingQuestionTool,
   readFxFile,
   fxIgnoresInstructionsFile,
   registerPluginLocation,