@pushary/agent-hooks 1.7.0 → 1.7.2

package/dist/bin/pushary-doctor.js

@@ -6,27 +6,30 @@ import {
   readServiceExecPath,
   retryAgentCommand,
   versionManagerOf
-} from "../chunk-S3UD4V6W.js";
+} from "../chunk-INR3RVQ3.js";
 import {
   assessCodexHookTrust,
   readCodexTrustForPusharyHooks
-} from "../chunk-7OS4IHGI.js";
+} from "../chunk-5GIBNUBD.js";
 import {
   readMachineReadiness,
   readManagedControlEvidence
-} from "../chunk-4F46VIEE.js";
-import {
-  CURSOR_GATE_SCRIPT
-} from "../chunk-P32LPT2L.js";
+} from "../chunk-YU54LNC6.js";
 import {
   FX_PROFILE_REFUSALS,
   FX_PUSHARY_TOOLS_RULE,
+  FX_QUESTION_TOOL,
+  FX_SETTINGS_REFUSALS,
+  HERMES_PIP_PACKAGE,
+  HERMES_PLUGIN_NAME,
   agentProbes,
   detectAgent,
   detectAllAgents,
   fxBridgeTargetOf,
   fxPusharyEntryOf,
+  fxQuestionRouting,
   hasInstructionBlock,
+  hermesWiredByPushary,
   isDetected,
   isFxPusharyEntry,
   isPluginRegistered,
@@ -34,29 +37,32 @@ import {
   readFxFile,
   readFxProfile,
   readFxSettings,
+  readHermesStatus,
+  resolveHermesPython,
   shortenHome,
-  vscodeSettingsTargets
-} from "../chunk-L4H2Q2S4.js";
-import "../chunk-YYINL576.js";
+  vscodeSettingsTargets,
+  workspacesShowingQuestionTool
+} from "../chunk-SKMWPXGV.js";
+import "../chunk-TVJYGZXB.js";
 import {
   OPENCODE_PLUGIN_PLACEHOLDER,
   openCodePluginDir,
   openCodePluginFile,
   openCodeWired
-} from "../chunk-B3YQANFN.js";
+} from "../chunk-SKEW3TQX.js";
 import {
   compatibleConfigFile,
   compatibleInstructionsFile,
   compatibleMcpFile,
   hasCompatibleHooks,
   missingCompatibleHookEvents
-} from "../chunk-WUNZAE7I.js";
-import "../chunk-KYQXUGH7.js";
+} from "../chunk-T3PRPFDY.js";
+import "../chunk-KAJT6HPI.js";
 import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "../chunk-JXUAXO74.js";
+} from "../chunk-YNJ2H2FD.js";
 import {
   AUTO_UPDATE_DISABLE_ENV,
   autoUpdateOffReason,
@@ -64,16 +70,16 @@ import {
   describeAutoUpdateCheck,
   readAutoUpdateState,
   takeAutoUpdateAnnouncement
-} from "../chunk-BWYJ6AAF.js";
+} from "../chunk-YU4222G2.js";
 import {
   readLedgerSummary
-} from "../chunk-2C7CCWVX.js";
+} from "../chunk-F6BMJOSW.js";
 import {
   describeBridgeResolution,
   isBridgeLocator,
   liveBridgeProbe,
   resolveBridgeStub
-} from "../chunk-5HLTWFJ6.js";
+} from "../chunk-JMSB6CJT.js";
 import {
   claudeOtherHolders,
   claudeUnprovenHolds,
@@ -90,7 +96,7 @@ import {
   geminiWired,
   holdsLong,
   pusharyHookExecutable
-} from "../chunk-PQ4F64M2.js";
+} from "../chunk-L6IF4JOF.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
@@ -99,17 +105,18 @@ import {
   readDaemonNeedsLogin,
   readDaemonStatus,
   readInstalledDaemonService
-} from "../chunk-73T6MSU5.js";
+} from "../chunk-4S7CCOXB.js";
 import {
   GEMINI_HOOK_BINARY,
   hasGeminiHooks,
   missingGeminiHookEvents
-} from "../chunk-ZQ7IDOKY.js";
+} from "../chunk-A6WQF7FQ.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-IJ6ECPA6.js";
-import "../chunk-DZURML2D.js";
-import "../chunk-EGKXSQCY.js";
-import "../chunk-V6QRSU2G.js";
+import "../chunk-2B4XCMH6.js";
+import "../chunk-N6IOSZOE.js";
+import "../chunk-RLRDPZG4.js";
+import "../chunk-2XOHXZRC.js";
+import "../chunk-6QZK4O36.js";
 import "../chunk-POFBE6ZY.js";
 import {
   describeReach,
@@ -118,19 +125,15 @@ import {
   reachVerdict,
   roundTripEvidence,
   verifyRoundTrip
-} from "../chunk-HDRNWNVP.js";
+} from "../chunk-YLCSKVQQ.js";
 import "../chunk-3EGEA4KH.js";
-import {
-  checkApiKey,
-  describeKeyCheck
-} from "../chunk-X6KDKOV5.js";
 import "../chunk-QCGNGEGE.js";
 import {
   createIo
-} from "../chunk-5RUIFDTP.js";
+} from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-2PS6QWDW.js";
+} from "../chunk-6NHXKTQU.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
@@ -138,22 +141,26 @@ import {
   keyPrefix,
   readControlMode,
   readKeySource
-} from "../chunk-UOAQ6QMP.js";
+} from "../chunk-VSGKQ3HI.js";
 import {
   callMcpTool,
   sendMcpRequest
-} from "../chunk-JNXVOU6Y.js";
-import "../chunk-KW2RRR7D.js";
+} from "../chunk-D4OGEWLH.js";
+import {
+  checkApiKey,
+  describeKeyCheck
+} from "../chunk-VQDJ6KB3.js";
+import "../chunk-UFNBKYWT.js";
 import {
   getMachineId
-} from "../chunk-XNCMT7YY.js";
+} from "../chunk-HOIGXMI7.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-ROQK7IN3.js";
+import "../chunk-LI3C2IQY.js";
 import {
   CODEX_HOOK_EVENTS,
   autoUpdateState,
@@ -176,19 +183,21 @@ import {
   geminiMd,
   geminiSettings,
   hasCodexHooks,
+  hermesConfig,
+  hermesConfigReceipt,
   missingCodexHookEvents,
   pusharyConfigFile,
   readCodexMcpAuth,
   resolvePathBinary,
   vscodePluginDir
-} from "../chunk-DNJUSFBL.js";
+} from "../chunk-NYBZJ44G.js";
 import "../chunk-T7E75EKA.js";
 import {
   getBaseUrl
-} from "../chunk-V4AQBAVG.js";
+} from "../chunk-SJN64NJX.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-B3UXMSMW.js";
+} from "../chunk-65RN6ZCO.js";
 import {
   AGENTS,
   CURSOR_GATE_EVENTS,
@@ -202,7 +211,7 @@ import {
   hookCompatibleProfile,
   isHookActivationReport,
   isNewerVersion
-} from "../chunk-YROGUPOZ.js";
+} from "../chunk-WWTLAZQA.js";
 
 // bin/pushary-doctor.ts
 import { existsSync, readFileSync, writeFileSync } from "fs";
@@ -367,6 +376,9 @@ function inertRegistrations(configs, resolves) {
 var describeInertRegistration = ({ named }) => `hooks here are registered for "${named}", which this CLI has no profile for, so every one of them stands aside`;
 var inertRegistrationRemedy = () => "Upgrade with npx @pushary/agent-hooks@latest upgrade, or re-run setup to rewrite them for an agent this version knows";
 
+// src/hooks-spec.ts
+var CURSOR_GATE_SCRIPT = "pushary-gate.mjs";
+
 // src/diagnostics/activation.ts
 var readHookActivation = async (apiKey, agentType, target, deps = {}) => {
   const machineId = deps.machineId ?? getMachineId();
@@ -455,9 +467,31 @@ var CLAUDE_SETTINGS = claudeSettings();
 var registeredConfigs = () => [CLAUDE_SETTINGS, codexHooksJson(), ...HOOK_COMPATIBLE_PROFILES.map((profile) => compatibleConfigFile(profile))].filter(existsSync).map((file) => ({ file, contents: readFileSync(file, "utf-8") }));
 var SKILL_PATH = join(claudeSkillDir(), "SKILL.md");
 var SHELL_FILES = [".zshrc", ".zprofile", ".bashrc", ".bash_profile"].map((f) => join(homedir2(), f));
-var fxAllowsPusharyTools = () => {
-  const read = readFxFile(fxSettings(), readFxSettings);
-  return read.kind === "settings" && pusharyToolsAllowed(read.settings);
+var reportFxQuestionRouting = (routing) => {
+  if (routing === "routed") {
+    check(true, "fx: questions go through Pushary", `${FX_QUESTION_TOOL} is off in ${fxSettings()}`);
+    return;
+  }
+  console.log(`  ${warn} fx: questions can still stop in the terminal ${dim(`(${FX_QUESTION_ROUTING_WARNINGS[routing]})`)}`);
+};
+var reportHermesStatus = (status) => {
+  const config = hermesConfig();
+  check(status.pluginInstalled, "Hermes: plugin installed", status.pluginInstalled ? HERMES_PIP_PACKAGE : `${HERMES_PIP_PACKAGE} is not installed in Hermes' Python \u2014 run ${retryAgentCommand("hermes")}`);
+  check(status.pluginEnabled, "Hermes: plugin enabled", status.pluginEnabled ? config : `"${HERMES_PLUGIN_NAME}" is missing from plugins.enabled in ${config} \u2014 run ${retryAgentCommand("hermes")}`);
+  if (status.approvalsRouted) check(true, "Hermes: approvals go through Pushary", `security.approval.transport in ${config}`);
+  else console.log(`  ${warn} Hermes: approvals stay in the terminal ${dim(`(security.approval.transport is not "pushary" in ${config})`)}`);
+  if (status.questionsRouted) check(true, "Hermes: questions go through Pushary", `clarify is off in ${config}`);
+  else console.log(`  ${warn} Hermes: questions can stop in the terminal ${dim(`(clarify is not in agent.disabled_toolsets in ${config})`)}`);
+};
+var fxSettingsProblem = (read) => {
+  if (read.kind === "missing") return `${fxSettings()} is missing, so fx runs with no Pushary rules; re-run ${retryAgentCommand("fx")}`;
+  if (read.kind === "unreadable") return `${fxSettings()} could not be read`;
+  if (read.kind === "refused") return `${fxSettings()} ${FX_SETTINGS_REFUSALS[read.reason]}`;
+  return null;
+};
+var FX_QUESTION_ROUTING_WARNINGS = {
+  "full-access": "full-access mode ignores permission rules, so fx's terminal question tool stays on; its instructions ask it to use Pushary instead",
+  overridden: `a rule in ${fxSettings()} keeps ${FX_QUESTION_TOOL} on; make "${FX_QUESTION_TOOL}": "deny" the last rule that matches it`
 };
 var fxBridgeFound = (target) => target.includes("/") ? existsSync(target) : resolvePathBinary(target) !== void 0;
 var readJson = (path) => {
@@ -1088,14 +1122,36 @@ var main = async () => {
       const found = fxBridgeFound(bridge);
       check(found, "fx: bridge binary resolves", found ? bridge : `${bridge} is not installed or not on PATH \u2014 re-run ${retryAgentCommand("fx")}`);
     }
-    if (!fxAllowsPusharyTools()) {
+    const fxSettingsRead = readFxFile(fxSettings(), readFxSettings);
+    const settingsProblem = fxSettingsProblem(fxSettingsRead);
+    const fxSettings2 = fxSettingsRead.kind === "settings" ? fxSettingsRead.settings : {};
+    if (settingsProblem) {
+      console.log(`  ${warn} fx: Pushary tools are not auto-allowed and questions can still stop in the terminal ${dim(`(${settingsProblem})`)}`);
+    } else if (!pusharyToolsAllowed(fxSettings2)) {
       console.log(`  ${warn} fx: Pushary tools are not auto-allowed ${dim(`(fx will review or prompt for each call; add "${FX_PUSHARY_TOOLS_RULE}": "allow" to permission in ${fxSettings()})`)}`);
     }
+    const questionRouting = fxQuestionRouting(fxSettings2, process.env);
+    if (settingsProblem === null) reportFxQuestionRouting(questionRouting);
+    const workspacesShowingQuestions = workspacesShowingQuestionTool(fxSettings2);
+    if (workspacesShowingQuestions.length > 0) {
+      console.log(`  ${warn} fx: ${workspacesShowingQuestions.length} workspace(s) replace the global rules and keep ${FX_QUESTION_TOOL} on ${dim(`(add "${FX_QUESTION_TOOL}": "deny" to their permission rules in ${fxSettings()})`)}`);
+    }
   } else if (fxProfile.kind === "refused" && installed("fx")) {
     check(false, "fx: MCP profile", `${fxMcpProfile()} ${FX_PROFILE_REFUSALS[fxProfile.reason]} \u2014 fix it, then run ${retryAgentCommand("fx")}`);
   } else {
     skipped("fx", installed("fx") ? "installed, but Pushary is not set up for it" : "not installed");
   }
+  const hermesPython = resolveHermesPython();
+  const hermesStatus = hermesPython ? readHermesStatus(hermesPython) : null;
+  const hermesSetupRecorded = existsSync(hermesConfigReceipt());
+  if (hermesStatus && hermesWiredByPushary(hermesStatus, hermesSetupRecorded)) {
+    checking("Hermes");
+    reportHermesStatus(hermesStatus);
+  } else if (hermesPython && hermesStatus === null && hermesSetupRecorded) {
+    check(false, "Hermes: config readable", `${hermesConfig()} could not be read with Hermes' Python \u2014 run ${retryAgentCommand("hermes")}`);
+  } else {
+    skipped("Hermes", installed("hermes") ? "installed, but Pushary is not set up for it" : "not installed");
+  }
   if (bridgeStub) {
     const resolution = resolveBridgeStub(bridgeStub, liveBridgeProbe());
     check(resolution.kind === "bundle", "Mac app behind pushary-bridge", describeBridgeResolution(resolution));

package/dist/bin/pushary-elicitation-hook.js

@@ -1,47 +1,52 @@
 #!/usr/bin/env node
 import {
   readHookInput
-} from "../chunk-UC65FJJT.js";
+} from "../chunk-3RO2UWJQ.js";
 import {
+  announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-YHG74UFF.js";
-import "../chunk-EAQMWJPG.js";
+} from "../chunk-5OP5MQI7.js";
+import "../chunk-ZMWX5SDA.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-R2XCLT6I.js";
-import "../chunk-CVALVGA7.js";
-import "../chunk-5HLTWFJ6.js";
-import "../chunk-PQ4F64M2.js";
-import "../chunk-73T6MSU5.js";
-import "../chunk-ZQ7IDOKY.js";
-import "../chunk-VKVIAZQO.js";
-import "../chunk-BH2SKSSK.js";
-import "../chunk-KXMZMZD3.js";
-import "../chunk-B76WVEDX.js";
+import "../chunk-E3PLF7YB.js";
+import "../chunk-I7B2DNVU.js";
+import "../chunk-JMSB6CJT.js";
+import "../chunk-L6IF4JOF.js";
+import "../chunk-4S7CCOXB.js";
+import "../chunk-A6WQF7FQ.js";
+import "../chunk-KLXYMPTM.js";
+import "../chunk-R7ZETVNR.js";
+import "../chunk-QSZ37ROP.js";
+import "../chunk-Q7CDBJXU.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-DZURML2D.js";
+import "../chunk-N6IOSZOE.js";
+import "../chunk-RLRDPZG4.js";
 import {
   askUser,
   isDecisionStopped,
   waitForQuestion
-} from "../chunk-EGKXSQCY.js";
-import "../chunk-V6QRSU2G.js";
+} from "../chunk-2XOHXZRC.js";
+import "../chunk-6QZK4O36.js";
 import "../chunk-POFBE6ZY.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-UOAQ6QMP.js";
-import "../chunk-JNXVOU6Y.js";
-import "../chunk-KW2RRR7D.js";
+import "../chunk-VSGKQ3HI.js";
+import {
+  SubscriptionRequiredError
+} from "../chunk-D4OGEWLH.js";
+import "../chunk-VQDJ6KB3.js";
+import "../chunk-UFNBKYWT.js";
 import {
   getMachineId
-} from "../chunk-XNCMT7YY.js";
+} from "../chunk-HOIGXMI7.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-ROQK7IN3.js";
-import "../chunk-DNJUSFBL.js";
+import "../chunk-LI3C2IQY.js";
+import "../chunk-NYBZJ44G.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey
-} from "../chunk-V4AQBAVG.js";
-import "../chunk-B3UXMSMW.js";
+} from "../chunk-SJN64NJX.js";
+import "../chunk-65RN6ZCO.js";
 import {
   ELICITATION_ANSWERABLE_MODE,
   effectiveWaitSeconds,
@@ -52,7 +57,7 @@ import {
   planElicitationAsk,
   readElicitationFields,
   renderElicitationOutput
-} from "../chunk-YROGUPOZ.js";
+} from "../chunk-WWTLAZQA.js";
 
 // bin/pushary-elicitation-hook.ts
 import { basename } from "path";
@@ -105,7 +110,11 @@ var main = async () => {
     let created;
     try {
       created = await askUser(apiKey, { ...common, ...prompt });
-    } catch {
+    } catch (error) {
+      if (error instanceof SubscriptionRequiredError) {
+        announceSubscriptionRequired(error.upgradeUrl, input.session_id);
+        return;
+      }
       process.stdout.write(renderElicitationOutput(input.hook_event_name ?? "Elicitation", "cancel") ?? "");
       return;
     }

package/dist/bin/pushary-gemini-bridge.js

@@ -5,37 +5,37 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-SQRWHALT.js";
+} from "../chunk-WXIVUIXA.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
   describeIdleWindow,
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-LEZFOTMI.js";
-import "../chunk-BH2SKSSK.js";
-import "../chunk-KXMZMZD3.js";
+} from "../chunk-PWNQGITG.js";
+import "../chunk-R7ZETVNR.js";
+import "../chunk-QSZ37ROP.js";
 import {
   transcriptsEnabled
-} from "../chunk-B76WVEDX.js";
+} from "../chunk-Q7CDBJXU.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
-import "../chunk-UOAQ6QMP.js";
+import "../chunk-VSGKQ3HI.js";
 import {
   getMachineId
-} from "../chunk-XNCMT7YY.js";
-import "../chunk-ROQK7IN3.js";
+} from "../chunk-HOIGXMI7.js";
+import "../chunk-LI3C2IQY.js";
 import {
   resolveBinary
-} from "../chunk-DNJUSFBL.js";
+} from "../chunk-NYBZJ44G.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-V4AQBAVG.js";
-import "../chunk-B3UXMSMW.js";
-import "../chunk-YROGUPOZ.js";
+} from "../chunk-SJN64NJX.js";
+import "../chunk-65RN6ZCO.js";
+import "../chunk-WWTLAZQA.js";
 
 // bin/pushary-gemini-bridge.ts
 import { existsSync } from "fs";

package/dist/bin/pushary-gemini-hook.js

@@ -1,33 +1,33 @@
 #!/usr/bin/env node
 import {
   triggerAutoUpdate
-} from "../chunk-BWYJ6AAF.js";
+} from "../chunk-YU4222G2.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-2C7CCWVX.js";
+} from "../chunk-F6BMJOSW.js";
 import {
   readHookInput
-} from "../chunk-UC65FJJT.js";
+} from "../chunk-3RO2UWJQ.js";
 import {
+  announceSubscriptionRequired,
   denyReasonFrom,
   isDeferAnswer
-} from "../chunk-YHG74UFF.js";
-import "../chunk-EAQMWJPG.js";
+} from "../chunk-5OP5MQI7.js";
+import "../chunk-ZMWX5SDA.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-R2XCLT6I.js";
-import "../chunk-CVALVGA7.js";
-import "../chunk-5HLTWFJ6.js";
-import "../chunk-PQ4F64M2.js";
-import "../chunk-73T6MSU5.js";
-import "../chunk-ZQ7IDOKY.js";
-import "../chunk-VKVIAZQO.js";
-import "../chunk-BH2SKSSK.js";
-import "../chunk-KXMZMZD3.js";
-import "../chunk-B76WVEDX.js";
+import "../chunk-E3PLF7YB.js";
+import "../chunk-I7B2DNVU.js";
+import "../chunk-JMSB6CJT.js";
+import "../chunk-L6IF4JOF.js";
+import "../chunk-4S7CCOXB.js";
+import "../chunk-A6WQF7FQ.js";
+import "../chunk-KLXYMPTM.js";
+import "../chunk-R7ZETVNR.js";
+import "../chunk-QSZ37ROP.js";
+import "../chunk-Q7CDBJXU.js";
 import "../chunk-XHKBHWLX.js";
 import {
-  DEFAULT_SESSION,
   UNNAMED_ACTION,
   deriveActionBody,
   deriveBlocker,
@@ -45,38 +45,45 @@ import {
   repoKeyFor,
   reportEvent,
   scopePathFor
-} from "../chunk-IJ6ECPA6.js";
-import "../chunk-DZURML2D.js";
+} from "../chunk-2B4XCMH6.js";
+import {
+  DEFAULT_SESSION
+} from "../chunk-N6IOSZOE.js";
+import "../chunk-RLRDPZG4.js";
 import {
   DECISION_STOP_REASON,
+  UNVERIFIABLE_APPROVAL_REASON,
   askUser,
   isDecisionStopped,
   isLocalQuestionHandoff,
   sendNotification,
   waitForQuestion
-} from "../chunk-EGKXSQCY.js";
+} from "../chunk-2XOHXZRC.js";
 import {
   exitAfterClientReports
-} from "../chunk-V6QRSU2G.js";
+} from "../chunk-6QZK4O36.js";
 import "../chunk-POFBE6ZY.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-UOAQ6QMP.js";
-import "../chunk-JNXVOU6Y.js";
-import "../chunk-KW2RRR7D.js";
+import "../chunk-VSGKQ3HI.js";
+import {
+  SubscriptionRequiredError
+} from "../chunk-D4OGEWLH.js";
+import "../chunk-VQDJ6KB3.js";
+import "../chunk-UFNBKYWT.js";
 import {
   getMachineId
-} from "../chunk-XNCMT7YY.js";
+} from "../chunk-HOIGXMI7.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-ROQK7IN3.js";
-import "../chunk-DNJUSFBL.js";
+import "../chunk-LI3C2IQY.js";
+import "../chunk-NYBZJ44G.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey
-} from "../chunk-V4AQBAVG.js";
-import "../chunk-B3UXMSMW.js";
+} from "../chunk-SJN64NJX.js";
+import "../chunk-65RN6ZCO.js";
 import {
   DECISION_LINE_MAX,
   KILL_REASON,
@@ -85,7 +92,7 @@ import {
   hookWaitClamped,
   hookWaitDeadline,
   resolveGate
-} from "../chunk-YROGUPOZ.js";
+} from "../chunk-WWTLAZQA.js";
 
 // bin/pushary-gemini-hook.ts
 import { basename } from "path";
@@ -125,7 +132,9 @@ var NO_LOCAL_INPUT = "This unattended Gemini session has no local approval input
 var NO_ANSWER_IN_TIME = "No answer from your phone in time, and this unattended Gemini session has no local approval input. Retry when you can answer on your phone.";
 var HANDLED_ON_MACHINE = "You chose to handle this on your machine, but this unattended Gemini session has no local approval input. Use an interactive session.";
 var NO_DEVICE = "No phone or other notification channel is connected to Pushary, and this unattended Gemini session has no local approval input. Connect one in Pushary, then retry.";
+var SUBSCRIPTION_REQUIRED = "Your Pushary workspace has no active subscription, so approvals cannot reach your phone, and this unattended Gemini session has no local approval input. Renew Pushary, then retry.";
 var geminiLocalHandoff = (bridge, reason = NO_LOCAL_INPUT) => geminiOwnsLifecycle(bridge) ? geminiPass() : geminiDeny(reason);
+var geminiSubscriptionRequiredDecision = (bridge) => geminiLocalHandoff(bridge, SUBSCRIPTION_REQUIRED);
 var geminiPushOnlyHandoff = (askStatus, bridge) => askStatus === "notified" || askStatus === "terminal" ? geminiLocalHandoff(bridge) : geminiPass();
 var fromPhoneAnswer = (answer) => answer.value === "yes" ? geminiAllow() : geminiDeny(denyReasonFrom(answer.value, answer.note));
 var geminiPushFirstDecision = (pushed, bridge) => {
@@ -137,7 +146,7 @@ var geminiPushFirstDecision = (pushed, bridge) => {
   return geminiLocalHandoff(bridge, NO_ANSWER_IN_TIME);
 };
 var geminiPushOnlyDecision = (pushed, timeoutAction, bridge) => {
-  if (!pushed) return geminiDeny("Pushary could not create a verifiable approval. Retry the action.");
+  if (!pushed) return geminiDeny(UNVERIFIABLE_APPROVAL_REASON);
   const { answer, localHandoff, clampCut, askStatus } = pushed;
   if (isDecisionStopped(answer)) return geminiDeny(DECISION_STOP_REASON);
   if (localHandoff) return geminiPushOnlyHandoff(askStatus, bridge);
@@ -205,11 +214,16 @@ var notifyApprovalNeeded = async (apiKey, input, lookup) => {
   } catch {
   }
 };
+var geminiStepsAside = (error, input) => {
+  announceSubscriptionRequired(error.upgradeUrl, input.session_id);
+  return geminiSubscriptionRequiredDecision(process.env.PUSHARY_GEMINI_BRIDGE);
+};
 var handlePushOnly = async (apiKey, input, lookup, timeoutSeconds, timeoutAction) => {
   let pushed;
   try {
     pushed = await pushQuestion(apiKey, input, lookup, effectiveWaitSeconds(timeoutAction, timeoutSeconds, "gemini"), "push_only");
-  } catch {
+  } catch (error) {
+    if (error instanceof SubscriptionRequiredError) return geminiStepsAside(error, input);
     pushed = void 0;
   }
   return geminiPushOnlyDecision(pushed, timeoutAction, process.env.PUSHARY_GEMINI_BRIDGE);
@@ -218,7 +232,8 @@ var handlePushFirst = async (apiKey, input, lookup, pushFirstSeconds) => {
   let pushed;
   try {
     pushed = await pushQuestion(apiKey, input, lookup, pushFirstSeconds, "push_first", 1500);
-  } catch {
+  } catch (error) {
+    if (error instanceof SubscriptionRequiredError) return geminiStepsAside(error, input);
     pushed = void 0;
   }
   return geminiPushFirstDecision(pushed, process.env.PUSHARY_GEMINI_BRIDGE);