@pushary/agent-hooks 1.7.3 → 1.8.1

package/dist/{chunk-62VT3BPH.js → chunk-HQRCVEI2.js}

@@ -1,19 +1,15 @@
 import {
   activeHookSource,
   activeIdentity
-} from "./chunk-UOQRM7JQ.js";
+} from "./chunk-QB6QYZ6B.js";
 import {
-  blockedActionFingerprint,
   defersToNativeMode,
-  forgetBlockedActionHint,
-  hasBlockedActionHint,
-  recordBlockedActionHint,
   reportMachineDenial
-} from "./chunk-5GB22QYL.js";
+} from "./chunk-5DGNEUXK.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-IRZG3HEU.js";
+} from "./chunk-7ITOAMCD.js";
 import {
   announceSubscriptionRequired,
   denyReasonFrom,
@@ -22,6 +18,8 @@ import {
 } from "./chunk-5OP5MQI7.js";
 import {
   UNNAMED_ACTION,
+  approvalAwaitingRetry,
+  blockedActionFingerprint,
   claimThrottle,
   deriveAction,
   deriveActionBody,
@@ -29,15 +27,19 @@ import {
   deriveToolTarget,
   describeToolCall,
   fetchModeState,
+  forgetBlockedActionHint,
   getPolicy,
+  hasBlockedActionHint,
+  markApprovalReminded,
   permissionDeniedAction,
   readLastPrompt,
   readLastUserPrompt,
+  recordBlockedActionHint,
   repoKeyFor,
   reportEvent,
   scopePathFor,
   settleQuestionsForToolUse
-} from "./chunk-U6RVDUJ5.js";
+} from "./chunk-F6NTWZZC.js";
 import {
   DEFAULT_SESSION
 } from "./chunk-N6IOSZOE.js";
@@ -53,17 +55,20 @@ import {
   requestGate,
   sendNotification,
   waitForQuestion
-} from "./chunk-YC27PROF.js";
+} from "./chunk-MMVCI6DT.js";
 import {
   SubscriptionRequiredError
-} from "./chunk-VE7TXLR4.js";
+} from "./chunk-I4HKMUZQ.js";
 import {
   getMachineId
-} from "./chunk-OVC5QXN5.js";
+} from "./chunk-4A3UQERT.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-R6OYCUNK.js";
+} from "./chunk-ON5JW2HP.js";
+import {
+  NPX_LATEST_COMMAND
+} from "./chunk-35X5UDML.js";
 import {
   AGENT_QUESTION_STRATEGY,
   GATE_BLOCK_REASON_MAX_LENGTH,
@@ -91,7 +96,7 @@ import {
   parseAgentQuestions,
   resolveGate,
   stoppedOutput
-} from "./chunk-G4GLCLKK.js";
+} from "./chunk-5YY3IJT4.js";
 
 // src/claude-permission-rules.ts
 import { readFileSync, statSync } from "fs";
@@ -354,7 +359,7 @@ var announceWait = (waitSeconds, answerUrl, sessionId) => {
   } catch {
   }
 };
-var KEYLESS_NOTICE = "[pushary] Not connected (no API key), so your agent runs untouched. Approval moments are counted locally; see them with: npx @pushary/agent-hooks@latest stats. Connect: https://pushary.com/sign-up?utm_source=cli&utm_medium=keyless-hook";
+var KEYLESS_NOTICE = `[pushary] Not connected (no API key), so your agent runs untouched. Approval moments are counted locally; see them with: ${NPX_LATEST_COMMAND} stats. Connect: https://pushary.com/sign-up?utm_source=cli&utm_medium=keyless-hook`;
 var keylessNoticeOnce = (sessionId) => {
   try {
     if (!oncePerSession("keyless", sessionId)) return;
@@ -530,6 +535,7 @@ var batchScopeReason = "This patch exceeds the agreed scope. Split it into singl
 var BLOCKED_ACTION_GATE_TIMEOUT_MS = 15e3;
 var BLOCKED_ACTION_CLAIM_TIMEOUT_MS = 4e3;
 var BLOCKED_ACTION_ALLOW_REASON = "Approved from Pushary after auto mode blocked it";
+var BLOCKED_ACTION_CHANGED_RETRY_REASON = "This is not the call the person allowed from Pushary, so their approval does not cover it. Send the call auto mode blocked again, exactly as it was with nothing changed, to use their approval.";
 var blockReasonOf = (reason) => typeof reason === "string" ? reason.trim().slice(0, GATE_BLOCK_REASON_MAX_LENGTH).trim() || void 0 : void 0;
 var blockedActionFingerprintFor = (input) => blockedActionFingerprint({
   sessionId: input.session_id,
@@ -566,6 +572,13 @@ var claimedBlockedActionRetry = async (apiKey, input) => {
     return false;
   }
 };
+var remindedOfApprovedRetry = (input) => {
+  const approval = approvalAwaitingRetry(input.session_id);
+  if (!approval || approval.reminded || approval.toolName !== input.tool_name) return false;
+  if (approval.fingerprint === blockedActionFingerprintFor(input)) return false;
+  markApprovalReminded(approval);
+  return true;
+};
 var handlePreToolUse = async (input, canonical) => {
   if (isPusharyOwnTool(input.tool_name)) return void 0;
   let apiKey;
@@ -597,6 +610,7 @@ var handlePreToolUse = async (input, canonical) => {
       return handleExitPlanMode(apiKey, input);
     }
     if (await claimedBlockedActionRetry(apiKey, input)) return allow(BLOCKED_ACTION_ALLOW_REASON);
+    if (remindedOfApprovedRetry(input)) return deny(BLOCKED_ACTION_CHANGED_RETRY_REASON);
     if (!(verdict.kind === "gate" && verdict.scopeReason) && shouldDeferToNativeMode(input.permission_mode, input.tool_name)) {
       return void 0;
     }
@@ -709,11 +723,12 @@ var isRetryOutput = (output) => {
     return false;
   }
 };
-var retryOnce = (fingerprint) => recordBlockedActionHint(fingerprint) ? claudePermissionDeniedOutput("allow") : void 0;
+var approvedCallOf = (input) => input.session_id ? { sessionId: input.session_id, toolName: input.tool_name } : void 0;
+var retryOnce = (fingerprint, input) => recordBlockedActionHint(fingerprint, approvedCallOf(input)) ? claudePermissionDeniedOutput("allow") : void 0;
 var askAboutBlockedAction = async (apiKey, input, fingerprint, holdEndsAt) => {
   const reply = await requestGate(apiKey, blockedActionGateRequest(input, "PermissionDenied"), BLOCKED_ACTION_GATE_TIMEOUT_MS);
   if (!reply) return void 0;
-  if (reply.kind === "no_opinion") return isRetryOutput(reply.output) ? retryOnce(fingerprint) : void 0;
+  if (reply.kind === "no_opinion") return isRetryOutput(reply.output) ? retryOnce(fingerprint, input) : void 0;
   if (reply.kind !== "ask" || !reply.correlationId || reply.deadlineSeconds === void 0) return void 0;
   if (reply.noDevices) {
     await cancelQuestion(apiKey, reply.correlationId, AbortSignal.timeout(4e3)).catch(() => void 0);
@@ -721,7 +736,7 @@ var askAboutBlockedAction = async (apiKey, input, fingerprint, holdEndsAt) => {
   }
   const deadline = Math.min(hookWaitDeadline(START_MS, reply.deadlineSeconds, "claude", Date.now()), holdEndsAt);
   const answer = await pollForAnswer(apiKey, reply.correlationId, deadline);
-  return isAffirmativeAnswer(answer) ? retryOnce(fingerprint) : void 0;
+  return isAffirmativeAnswer(answer) ? retryOnce(fingerprint, input) : void 0;
 };
 var handlePermissionDenied = async (input, holdBudgetSeconds) => {
   await reportPermissionDenied(input);

package/dist/{chunk-MIXWMA73.js → chunk-HTEGMMT3.js}

@@ -1,16 +1,16 @@
 import {
   NOTIFICATION_MATCHED_TYPES,
   POSTTOOLUSE_MIRRORED_TOOLS
-} from "./chunk-EUGNVLMG.js";
+} from "./chunk-VFFHQC7W.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-MZBRL5H5.js";
+} from "./chunk-UPLV5AJF.js";
 import {
   CLAUDE_PRETOOLUSE_MATCHER,
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY
-} from "./chunk-G4GLCLKK.js";
+} from "./chunk-5YY3IJT4.js";
 
 // src/gemini-config.ts
 var GEMINI_HOOK_BINARY = "pushary-gemini-hook";

package/dist/{chunk-BIH2Y2HP.js → chunk-HVDMGDYV.js}

@@ -3,11 +3,11 @@ import {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-P2VIBGXA.js";
+} from "./chunk-URNXU3FO.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-WPX67AKT.js";
+} from "./chunk-UMMCHS6P.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;

package/dist/{chunk-VE7TXLR4.js → chunk-I4HKMUZQ.js}

@@ -1,12 +1,12 @@
 import {
   keyCheckFromResponse
-} from "./chunk-EEEJ2JIL.js";
+} from "./chunk-DVW2MYCM.js";
 import {
   installNetworkDefaults
-} from "./chunk-DUQO4C4I.js";
+} from "./chunk-2SLCHCVN.js";
 import {
   getBaseUrl
-} from "./chunk-R6OYCUNK.js";
+} from "./chunk-ON5JW2HP.js";
 
 // src/retry.ts
 var isRetryable = (err) => {

package/dist/{chunk-YPUBA2FL.js → chunk-INSMZNS7.js}

@@ -14,17 +14,17 @@ import {
 } from "./chunk-U4TMAANR.js";
 import {
   callMcpTool
-} from "./chunk-VE7TXLR4.js";
+} from "./chunk-I4HKMUZQ.js";
 import {
   reportedInstallSource
-} from "./chunk-62CVUUNU.js";
+} from "./chunk-5Y2DY6X4.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-YYCTF4Q5.js";
+} from "./chunk-35X5UDML.js";
 import {
   PAIR_TTL_SECONDS,
   isAnswerSource
-} from "./chunk-G4GLCLKK.js";
+} from "./chunk-5YY3IJT4.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {
@@ -71,7 +71,7 @@ var describeAppRepair = (verdict) => {
     case "nobody":
       return [
         "Open the Pushary app, sign in, and allow notifications.",
-        "If this terminal was never paired with your phone, run: npx @pushary/agent-hooks@latest setup --connect app"
+        `If this terminal was never paired with your phone, run: ${NPX_LATEST_COMMAND} setup --connect app`
       ];
     case "others":
       return [

package/dist/{chunk-G3OMOTJ4.js → chunk-JRQRNNGA.js}

@@ -1,17 +1,17 @@
 import {
   CLAUDE_HOOK_EVENTS,
   supportedClaudeEvents
-} from "./chunk-MIXWMA73.js";
+} from "./chunk-HTEGMMT3.js";
 import {
   guardBinary,
   holdBudgetOf,
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-MZBRL5H5.js";
+} from "./chunk-UPLV5AJF.js";
 import {
   HOOK_LOCATOR_BINARY,
   withHookHoldBudget
-} from "./chunk-G4GLCLKK.js";
+} from "./chunk-5YY3IJT4.js";
 
 // src/claude-config.ts
 import { join } from "path";

package/dist/{chunk-N5MZH5A6.js → chunk-KB2FTO4O.js}

@@ -4,18 +4,18 @@ import {
 } from "./chunk-POFBE6ZY.js";
 import {
   isNetworkFailure
-} from "./chunk-DUQO4C4I.js";
+} from "./chunk-2SLCHCVN.js";
 import {
   clientReportClaims
-} from "./chunk-MZBRL5H5.js";
+} from "./chunk-UPLV5AJF.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-R6OYCUNK.js";
+} from "./chunk-ON5JW2HP.js";
 import {
   CLIENT_REPORT_PATH,
   degradedLine
-} from "./chunk-G4GLCLKK.js";
+} from "./chunk-5YY3IJT4.js";
 
 // src/client-report-claim.ts
 import { createHash } from "crypto";

package/dist/{chunk-O3JDWNLU.js → chunk-LK2S5XIV.js}

@@ -1,16 +1,28 @@
 import {
   MCP_BRIDGE_BINARY
-} from "./chunk-7OA34PNW.js";
+} from "./chunk-T55H6YEP.js";
 import {
   openCodeConfigDirFrom
-} from "./chunk-KEL5MXRL.js";
+} from "./chunk-NOLPURUI.js";
 import {
+  KEY_FILE_MODE
+} from "./chunk-TJMAXQ5Q.js";
+import {
+  NpmMissingError,
   codexHomeFrom,
   resolvePathBinary
-} from "./chunk-MZBRL5H5.js";
+} from "./chunk-UPLV5AJF.js";
+import {
+  readJsonSafe,
+  writeFileAtomic,
+  writeJsonAtomic
+} from "./chunk-T7E75EKA.js";
+import {
+  NPX_LATEST_COMMAND
+} from "./chunk-35X5UDML.js";
 import {
   HOOK_COMPATIBLE_PROFILES
-} from "./chunk-G4GLCLKK.js";
+} from "./chunk-5YY3IJT4.js";
 
 // src/hermes-config.ts
 import { execFileSync } from "child_process";
@@ -680,6 +692,154 @@ var fxIgnoresInstructionsFile = (path, fxDir) => {
   }
 };
 
+// src/setup/agent-failure.ts
+var AgentConfigError = class extends Error {
+  kind;
+  filePath;
+  constructor(kind, filePath, message) {
+    super(message);
+    this.name = "AgentConfigError";
+    this.kind = kind;
+    this.filePath = filePath;
+  }
+};
+var configFailureKind = (readFailure) => readFailure === "unparseable" ? "config-unparseable" : "config-unreadable";
+var AGENT_FAILURE_DETAILS = {
+  "not-wired": "reported success but its config is not there.",
+  "app-account-mismatch": "Mac app hooks kept, but their Pushary account could not be matched to this setup."
+};
+var describedAgentFailure = (agent, kind) => ({
+  agent,
+  kind,
+  detail: AGENT_FAILURE_DETAILS[kind],
+  remedy: "retry-agent"
+});
+var agentFailureFromError = (agent, error, describeError) => ({
+  agent,
+  kind: error instanceof AgentConfigError ? error.kind : "installer-error",
+  detail: describeError(error),
+  remedy: error instanceof NpmMissingError ? "install-node" : "retry-agent"
+});
+var retryAgentCommand = (agent) => `${NPX_LATEST_COMMAND} setup --agents ${agent}`;
+var REMAINING_AGENTS_CONTINUE = "Other agents will continue. Re-run setup to retry.";
+var afterAgentFailureNote = (agentsStillToSetUp) => agentsStillToSetUp > 0 ? REMAINING_AGENTS_CONTINUE : null;
+var failedAgentsContext = (configuredAgentNames) => configuredAgentNames.length > 0 ? `(configured: ${configuredAgentNames.join(", ")})` : null;
+var agentFailureWire = (failures) => failures.map(({ agent, kind }) => ({ agent, kind }));
+
+// src/fx-lifecycle.ts
+import { existsSync as existsSync3 } from "fs";
+var fxRetryHint = () => `Fix it, then run ${retryAgentCommand("fx")}.`;
+var readFxProfileForSetup = (filePath) => {
+  const read = readFxFile(filePath, readFxProfile);
+  if (read.kind === "profile") return read.profile;
+  if (read.kind === "missing") return {};
+  if (read.kind === "unreadable") {
+    throw new AgentConfigError(configFailureKind("unreadable"), filePath, `${filePath} could not be read, so it was left untouched. ${fxRetryHint()}`);
+  }
+  throw new AgentConfigError(
+    configFailureKind("unparseable"),
+    filePath,
+    `${filePath} ${FX_PROFILE_REFUSALS[read.reason]}, so it was left untouched. ${fxRetryHint()}`
+  );
+};
+var writeFxProfile = (filePath, profile) => {
+  const rendered = fxProfileText(profile);
+  if (rendered.kind === "refused") {
+    throw new Error(`${filePath} would grow past the size fx reads, so it was left untouched. ${fxRetryHint()}`);
+  }
+  writeFileAtomic(filePath, rendered.text, KEY_FILE_MODE);
+};
+var fxSettingsReadRefusal = (filePath, read) => {
+  if (read.kind === "unreadable") return `${filePath} could not be read`;
+  if (read.kind === "refused") return `${filePath} ${FX_SETTINGS_REFUSALS[read.reason]}`;
+  return null;
+};
+var recordFxQuestionRule = (receiptPath) => {
+  try {
+    if (!existsSync3(receiptPath)) writeJsonAtomic(receiptPath, FX_QUESTION_RULE_RECEIPT, 384);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var configureFxSettings = (filePath, receiptPath, environment) => {
+  const read = readFxFile(filePath, readFxSettings);
+  const refusal = fxSettingsReadRefusal(filePath, read);
+  if (refusal) return { kind: "refused", detail: refusal };
+  const allowed = withPusharyToolsAllowed(read.kind === "settings" ? read.settings : {});
+  const routed = withQuestionsRoutedToPushary(allowed.settings);
+  const written = {
+    kind: "written",
+    toolsChange: allowed.change,
+    questionChange: routed.change,
+    questionRouting: fxQuestionRouting(routed.settings, environment),
+    workspacesWithOwnRules: [.../* @__PURE__ */ new Set([...workspacesOverridingPusharyRule(routed.settings), ...workspacesShowingQuestionTool(routed.settings)])],
+    ruleRecorded: true
+  };
+  if (allowed.change !== "added" && routed.change !== "added") return written;
+  const rendered = fxSettingsText(routed.settings);
+  if (rendered.kind === "refused") return { kind: "refused", detail: `${filePath} would grow past the 64 KiB fx reads` };
+  try {
+    writeFileAtomic(filePath, rendered.text, KEY_FILE_MODE);
+  } catch (err) {
+    return { kind: "refused", detail: `${filePath} could not be written (${err instanceof Error ? err.message : String(err)})` };
+  }
+  return { ...written, ruleRecorded: routed.change !== "added" || recordFxQuestionRule(receiptPath) };
+};
+var inspectFxInstallation = (profilePath, settingsPath, environment) => {
+  const profile = readFxFile(profilePath, readFxProfile);
+  const entry = profile.kind === "profile" ? fxPusharyEntryOf(profile.profile) : void 0;
+  const settingsRead = readFxFile(settingsPath, readFxSettings);
+  const settings = settingsRead.kind === "settings" ? settingsRead.settings : {};
+  const settingsProblem = settingsRead.kind === "missing" ? `${settingsPath} is missing, so fx runs with no Pushary rules; re-run ${retryAgentCommand("fx")}` : fxSettingsReadRefusal(settingsPath, settingsRead);
+  return {
+    profile,
+    configured: isFxPusharyEntry(entry),
+    bridge: fxBridgeTargetOf(entry),
+    settingsProblem,
+    toolsAllowed: pusharyToolsAllowed(settings),
+    questionRouting: fxQuestionRouting(settings, environment),
+    workspacesShowingQuestions: workspacesShowingQuestionTool(settings)
+  };
+};
+var removalWrite = (path, rendered, label) => rendered.kind === "refused" ? { kind: "kept", label, detail: `${path} would grow past the size fx reads; left untouched` } : { kind: "write", path, text: rendered.text, label };
+var FX_QUESTION_RULE_KEPT = {
+  "not-ours": "no setup record says Pushary added it, so it may be yours; left as it is",
+  "changed-after-setup": "changed after setup; left as it is"
+};
+var planFxRemoval = (profilePath, settingsPath, receiptPath) => {
+  const actions = [];
+  const profile = readFxFile(profilePath, readFxProfile);
+  if (profile.kind === "profile") {
+    const result = withoutFxPusharyServer(profile.profile);
+    actions.push(result.removed ? removalWrite(profilePath, fxProfileText(result.profile), "fx MCP") : { kind: "kept", label: "fx MCP", detail: "no pushary entry" });
+  } else {
+    let detail = "not found";
+    if (profile.kind === "unreadable") detail = `${profilePath} could not be read; left untouched`;
+    if (profile.kind === "refused") detail = `${profilePath} ${FX_PROFILE_REFUSALS[profile.reason]}; left untouched`;
+    actions.push({ kind: "kept", label: "fx MCP", detail });
+  }
+  const read = readFxFile(settingsPath, readFxSettings);
+  const problem = fxSettingsReadRefusal(settingsPath, read);
+  if (problem) return [...actions, { kind: "kept", label: "fx settings", detail: `${problem}; left untouched` }];
+  if (read.kind === "settings") {
+    const rawReceipt = readJsonSafe(receiptPath);
+    const receipt = rawReceipt.kind === "ok" && isFxQuestionRuleReceipt(rawReceipt.value) ? rawReceipt.value : null;
+    const tools = withoutPusharyToolsAllowed(read.settings);
+    const question = withoutQuestionsRoutedToPushary(tools.settings, receipt);
+    if (tools.removed || question.outcome === "removed") {
+      const write = removalWrite(settingsPath, fxSettingsText(question.settings), "fx permission rules");
+      actions.push(write);
+      if (write.kind === "kept") return actions;
+    }
+    if (question.outcome === "not-ours" || question.outcome === "changed-after-setup") {
+      actions.push({ kind: "kept", label: "fx question rule", detail: FX_QUESTION_RULE_KEPT[question.outcome] });
+    }
+  }
+  if (existsSync3(receiptPath)) actions.push({ kind: "remove-receipt", path: receiptPath });
+  return actions;
+};
+
 // src/vscode-config.ts
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
@@ -828,7 +988,7 @@ var vscodeSettingsTargets = (exists, home, platform) => {
 
 // src/setup/detect.ts
 import { execSync } from "child_process";
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { homedir as homedir3 } from "os";
 import { dirname, join as join3 } from "path";
 var whichCommand = () => process.platform === "win32" ? "where" : "which";
@@ -840,7 +1000,7 @@ var binaryOnPath = (binary) => {
     return false;
   }
 };
-var defaultDeps = { onPath: binaryOnPath, exists: existsSync3 };
+var defaultDeps = { onPath: binaryOnPath, exists: existsSync4 };
 var detectAgent = (probe, deps = defaultDeps) => {
   const checked = [];
   if (probe.binary) {
@@ -943,7 +1103,7 @@ var describeDetection = (result, home) => {
 };
 
 // src/instruction-file.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync, rmSync as rmSync2 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync, rmSync as rmSync2 } from "fs";
 import { dirname as dirname2 } from "path";
 var PUSHARY_BEGIN = "<!-- BEGIN PUSHARY (managed by @pushary/agent-hooks; do not edit this block) -->";
 var PUSHARY_END = "<!-- END PUSHARY -->";
@@ -963,6 +1123,7 @@ You have Pushary MCP tools that reach the user on their phone. Use them proactiv
 - Respect the user's Pushary delivery mode: it decides where an approval is surfaced (phone, terminal, or awareness only), not whether it is required. In Terminal mode do not expect a phone answer; the approval waits in the terminal. If the Pushary hook already gated an action, a single approval is enough, do not ask again.
 
 Pass \`agentName\` as "${label} - <project folder name>" so the user knows which session is asking. If a question times out, follow \`handoffAction\` when present, otherwise \`nextAction\`: poll once, then cancel a live phone question before asking in the current client. If cancellation returns \`handoffAction: "stop"\`, stop. Otherwise, if cancellation returns false, poll once for 1 second and honor the answer that won the race.`;
+var SHARED_AGENTS_MD_LABEL = "<your agent's name, such as Codex or Hermes>";
 var renderAgentInstructions = (label) => instructionBody(label);
 var KEYLESS_FALLBACK_LINE = "This repo uses Pushary phone approvals. Your teammates get agent questions on their lock screens; you do not have a key yet, so questions will fall back to the terminal. Get your own key (3-day trial): https://pushary.com/sign-up?utm_source=agents-md&utm_medium=teammate";
 var renderProjectAgentInstructions = (label) => `${instructionBody(label)}
@@ -973,7 +1134,7 @@ ${body}
 ${PUSHARY_END}`;
 var writeInstructionBlock = (filePath, body) => {
   const dir = dirname2(filePath);
-  if (!existsSync4(dir)) mkdirSync(dir, { recursive: true });
+  if (!existsSync5(dir)) mkdirSync(dir, { recursive: true });
   let existing = "";
   try {
     existing = readFileSync3(filePath, "utf-8");
@@ -1028,30 +1189,23 @@ export {
   FX_PUSHARY_TOOLS_RULE,
   FX_TOOL_DISCOVERY_NOTE,
   FX_PROFILE_REFUSALS,
-  FX_SETTINGS_REFUSALS,
-  readFxProfile,
   fxPusharyEntry,
   withFxPusharyServer,
-  withoutFxPusharyServer,
-  isFxPusharyEntry,
-  fxPusharyEntryOf,
-  fxBridgeTargetOf,
-  fxProfileText,
-  fxSettingsText,
-  readFxSettings,
-  withPusharyToolsAllowed,
-  withoutPusharyToolsAllowed,
-  pusharyToolsAllowed,
-  workspacesOverridingPusharyRule,
   FX_QUESTION_TOOL,
-  FX_QUESTION_RULE_RECEIPT,
-  isFxQuestionRuleReceipt,
-  fxQuestionRouting,
-  withQuestionsRoutedToPushary,
-  withoutQuestionsRoutedToPushary,
-  workspacesShowingQuestionTool,
-  readFxFile,
   fxIgnoresInstructionsFile,
+  AgentConfigError,
+  configFailureKind,
+  describedAgentFailure,
+  agentFailureFromError,
+  retryAgentCommand,
+  afterAgentFailureNote,
+  failedAgentsContext,
+  agentFailureWire,
+  readFxProfileForSetup,
+  writeFxProfile,
+  configureFxSettings,
+  inspectFxInstallation,
+  planFxRemoval,
   registerPluginLocation,
   unregisterPluginLocation,
   isPluginRegistered,
@@ -1063,6 +1217,7 @@ export {
   isDetected,
   shortenHome,
   describeDetection,
+  SHARED_AGENTS_MD_LABEL,
   renderAgentInstructions,
   renderProjectAgentInstructions,
   writeInstructionBlock,

package/dist/{chunk-YC27PROF.js → chunk-MMVCI6DT.js}

@@ -1,17 +1,23 @@
 import {
   clientErrorKindOf,
   reportClientError
-} from "./chunk-N5MZH5A6.js";
+} from "./chunk-KB2FTO4O.js";
 import {
   SubscriptionRequiredError,
   callMcpTool
-} from "./chunk-VE7TXLR4.js";
+} from "./chunk-I4HKMUZQ.js";
 import {
   installNetworkDefaults
-} from "./chunk-DUQO4C4I.js";
+} from "./chunk-2SLCHCVN.js";
 import {
   getBaseUrl
-} from "./chunk-R6OYCUNK.js";
+} from "./chunk-ON5JW2HP.js";
+import {
+  ASK_AGENT_NAME_MAX,
+  ASK_QUESTION_MAX,
+  DECISION_LINE_MAX,
+  truncateLine
+} from "./chunk-5YY3IJT4.js";
 
 // src/api.ts
 import { randomUUID } from "crypto";
@@ -59,9 +65,18 @@ var unavailableQuestionUnlessSubscriptionRequired = (error) => {
   if (error instanceof SubscriptionRequiredError) throw error;
   return { correlationId: "", status: "unavailable" };
 };
+var truncateOptional = (text, max) => text === void 0 ? void 0 : truncateLine(text, max);
+var withinAskUserLimits = (params) => ({
+  ...params,
+  question: truncateLine(params.question, ASK_QUESTION_MAX),
+  agentName: truncateOptional(params.agentName, ASK_AGENT_NAME_MAX),
+  intent: truncateOptional(params.intent, DECISION_LINE_MAX),
+  action: truncateOptional(params.action, DECISION_LINE_MAX),
+  blocker: truncateOptional(params.blocker, DECISION_LINE_MAX)
+});
 var askUser = async (apiKey, params, timeoutMs = 15e3) => {
   const identified = params.toolUseId || params.requestId ? params : { ...params, requestId: randomUUID() };
-  const result = await callMcpTool(apiKey, "ask_user", { ...identified, wait: false }, { maxRetries: 3, timeoutMs });
+  const result = await callMcpTool(apiKey, "ask_user", { ...withinAskUserLimits(identified), wait: false }, { maxRetries: 3, timeoutMs });
   if (!isAskUserResponse(result)) throw new Error("Invalid ask_user response");
   return result;
 };

package/dist/{chunk-3EUBQARL.js → chunk-MYHG7PX2.js}

@@ -1,6 +1,6 @@
 import {
   HOOK_LOCATOR_BINARY
-} from "./chunk-G4GLCLKK.js";
+} from "./chunk-5YY3IJT4.js";
 
 // src/diagnostics/bridge.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-EADXTSHE.js → chunk-N6JJJTPH.js}

@@ -1,12 +1,15 @@
 import {
   SETUP_FLAGS
-} from "./chunk-BGBLLHZ4.js";
+} from "./chunk-DLEKCAQL.js";
 import {
   parseFlags
 } from "./chunk-GMXKITVA.js";
 import {
   UsageError
 } from "./chunk-7QLSKOSU.js";
+import {
+  NPX_LATEST_COMMAND
+} from "./chunk-35X5UDML.js";
 import {
   CLAUDE_CONNECTOR_GUIDE,
   CLAUDE_CONNECTOR_STEPS,
@@ -14,7 +17,7 @@ import {
   CLAUDE_CONNECTOR_URL,
   COWORK_CONNECTOR_LIMIT,
   COWORK_STANDING_INSTRUCTIONS
-} from "./chunk-G4GLCLKK.js";
+} from "./chunk-5YY3IJT4.js";
 
 // src/cli/cowork.ts
 import { readFileSync } from "fs";
@@ -63,7 +66,7 @@ var coworkOutput = (format) => {
         if (error.code !== "ENOENT") throw error;
       }
     }
-    throw new Error("Packaged Cowork skill is missing. Reinstall @pushary/agent-hooks.");
+    throw new Error(`Packaged Cowork skill is missing. Run ${NPX_LATEST_COMMAND} cowork --skill to read it from a fresh copy.`);
   }
   return renderCoworkSetup();
 };

package/dist/{chunk-PRNFSORD.js → chunk-NHCUXTEM.js}

@@ -4,7 +4,7 @@ import {
 import {
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-EEEJ2JIL.js";
+} from "./chunk-DVW2MYCM.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";

package/dist/{chunk-KEL5MXRL.js → chunk-NOLPURUI.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_BUDGETS,
   OPENCODE_APPROVAL_EVENT
-} from "./chunk-G4GLCLKK.js";
+} from "./chunk-5YY3IJT4.js";
 
 // src/opencode-plugin.ts
 var OPENCODE_PLUGIN_MARKER = "pushary-opencode-plugin w1";