@pushary/agent-hooks 1.9.36 → 1.9.38

package/dist/chunk-CHRRBADC.js

@@ -0,0 +1,184 @@
+import {
+  announceSubscriptionRequired,
+  isDeferAnswer
+} from "./chunk-W2TXFM6O.js";
+import {
+  AUTO_DECISION_WINDOW_MS,
+  DEFAULT_SESSION,
+  claimThrottle,
+  deriveToolTarget,
+  permissionDeniedAction,
+  releaseThrottle,
+  reportEvent
+} from "./chunk-L5WOYQT7.js";
+import {
+  askUser,
+  isDecisionStopped,
+  waitForQuestion
+} from "./chunk-7O5U5TED.js";
+import {
+  SubscriptionRequiredError
+} from "./chunk-ABDGTGBT.js";
+import {
+  getMachineId
+} from "./chunk-3HUHP4A4.js";
+import {
+  machineDecisionFor,
+  parseAgentQuestionAnswers,
+  shouldDeferToNativeMode,
+  wireVerdictFor
+} from "./chunk-QOUW57RT.js";
+
+// src/machine-decision-audit.ts
+import { basename } from "path";
+var reportMachineDenial = async (input, verdict, agent) => {
+  const decision = machineDecisionFor(wireVerdictFor(verdict, 0));
+  if (!decision) return;
+  const sessionKey = input.session_id || DEFAULT_SESSION;
+  const toolTarget = deriveToolTarget(input.tool_name, input.tool_input);
+  const throttleKey = `machinedecision:${agent.type}:${sessionKey}:${input.tool_name}:${decision.origin}:${toolTarget ?? ""}`;
+  const throttle = claimThrottle(throttleKey, AUTO_DECISION_WINDOW_MS);
+  if (throttle === "throttled") return;
+  if (throttle === "unavailable") {
+    console.error("[Pushary] Could not access the audit throttle; reporting this denial without deduplication.");
+  }
+  try {
+    const response = await reportEvent({
+      event: "permission_denied",
+      occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+      toolUseId: input.tool_use_id,
+      agentType: agent.type,
+      agentName: `${agent.label} - ${basename(input.cwd ?? process.cwd())}`,
+      action: permissionDeniedAction(input.tool_name),
+      sessionId: input.session_id,
+      decisionSource: "policy_auto",
+      decisionOrigin: decision.origin,
+      decisionOutcome: decision.outcome,
+      toolName: input.tool_name,
+      toolTarget
+    }, { maxAttempts: 1, timeoutMs: 800, requireOk: true, skipDrain: true });
+    if (response?.ok !== true) throw new Error("Audit delivery was not acknowledged");
+  } catch {
+    console.error("[Pushary] Could not record the machine denial. The action remains blocked; its audit delivery will be retried on the next matching denial.");
+    if (throttle === "passed") {
+      try {
+        releaseThrottle(throttleKey);
+      } catch {
+        console.error("[Pushary] Could not reset the failed audit throttle.");
+      }
+    }
+  }
+};
+
+// src/native-defer.ts
+var nativeDeferOptions = () => {
+  const respect = process.env.PUSHARY_RESPECT_PERMISSION_MODE;
+  const bypass = process.env.PUSHARY_DEFER_BYPASS;
+  return {
+    respectPermissionMode: !(respect === "0" || respect === "false"),
+    deferBypass: bypass === "1" || bypass === "true"
+  };
+};
+var defersToNativeMode = (permissionMode, toolName) => shouldDeferToNativeMode(permissionMode, toolName, nativeDeferOptions());
+
+// src/agent-question-ask.ts
+var STOPPED = { kind: "stopped" };
+var UNAVAILABLE = { kind: "unavailable" };
+var UNANSWERED = { kind: "unanswered" };
+var answeredWith = (answers) => ({ kind: "answered", answers });
+var failedAskOutcome = (error, sessionId) => outcomeOfFailedAsk(error, sessionId, UNAVAILABLE) ?? UNANSWERED;
+var withLabels = (question) => ({
+  ...question,
+  labels: question.options.map((option) => option.label)
+});
+var withoutLabels = ({ labels: _, ...question }) => question;
+var outcomeOfFailedAsk = (error, sessionId, failure) => {
+  if (!(error instanceof SubscriptionRequiredError)) return failure;
+  announceSubscriptionRequired(error.upgradeUrl, sessionId);
+  return void 0;
+};
+var storedWaitDeadline = (result, requestedDeadline) => {
+  const stored = result.waitEndsAt ? Date.parse(result.waitEndsAt) : Number.NaN;
+  return Number.isFinite(stored) ? Math.min(stored, requestedDeadline) : requestedDeadline;
+};
+var questionContext = (question, index, total, project) => {
+  const subject = question.header ? `${question.header}: your agent is asking in ${project}` : `Your agent is asking in ${project}`;
+  return total > 1 ? `${subject} (${index + 1} of ${total})` : subject;
+};
+var legacyAnswerMap = (question, value) => JSON.stringify({ [question.question]: question.multiSelect ? JSON.stringify([value]) : value });
+var askAsOneCard = async (apiKey, call, only, labelled) => {
+  let result;
+  try {
+    result = await askUser(apiKey, {
+      question: only.question,
+      type: "select",
+      options: [...only.labels],
+      questions: labelled.map(withoutLabels),
+      context: questionContext(only, 0, 1, call.projectName),
+      agentName: call.agentName,
+      sessionId: call.sessionId,
+      machineId: getMachineId(),
+      toolName: call.toolName,
+      toolUseId: call.toolUseId,
+      waitEndsAt: new Date(call.deadline).toISOString()
+    });
+  } catch (error) {
+    return failedAskOutcome(error, call.sessionId);
+  }
+  if (isDecisionStopped(result)) return STOPPED;
+  const answer = await waitForQuestion(apiKey, result, storedWaitDeadline(result, call.deadline));
+  if (isDecisionStopped(answer)) return STOPPED;
+  const values = answer.answered && answer.value ? parseAgentQuestionAnswers(labelled, answer.value) : null;
+  if (!values || isDeferAnswer(answer.value)) {
+    return UNANSWERED;
+  }
+  return answeredWith(values);
+};
+var askQuestionByQuestion = async (apiKey, call, labelled) => {
+  const answers = {};
+  for (const [index, question] of labelled.entries()) {
+    let result;
+    try {
+      result = await askUser(apiKey, {
+        question: question.question,
+        type: "select",
+        options: [...question.labels],
+        questions: [withoutLabels(question)],
+        context: questionContext(question, index, labelled.length, call.projectName),
+        agentName: call.agentName,
+        sessionId: call.sessionId,
+        machineId: getMachineId(),
+        toolName: call.toolName,
+        toolUseId: call.toolUseId ? `${call.toolUseId}#q${index}` : void 0,
+        waitEndsAt: new Date(call.deadline).toISOString()
+      });
+    } catch (error) {
+      return failedAskOutcome(error, call.sessionId);
+    }
+    if (isDecisionStopped(result)) return STOPPED;
+    const answer = await waitForQuestion(apiKey, result, storedWaitDeadline(result, call.deadline));
+    if (isDecisionStopped(answer)) return STOPPED;
+    const legacyValue = answer.answered ? answer.value?.trim() : void 0;
+    const values = legacyValue ? parseAgentQuestionAnswers([question], legacyValue) ?? parseAgentQuestionAnswers([question], legacyAnswerMap(question, legacyValue)) : null;
+    const value = values?.[question.question];
+    if (!value || isDeferAnswer(answer.value)) {
+      return UNANSWERED;
+    }
+    answers[question.question] = value;
+  }
+  return answeredWith(answers);
+};
+var askAgentQuestions = (apiKey, call, questions) => {
+  const labelled = questions.map(withLabels);
+  const [only, ...rest] = labelled;
+  if (!only) return Promise.resolve(UNANSWERED);
+  return rest.length === 0 ? askAsOneCard(apiKey, call, only, labelled) : askQuestionByQuestion(apiKey, call, labelled);
+};
+
+export {
+  reportMachineDenial,
+  defersToNativeMode,
+  outcomeOfFailedAsk,
+  storedWaitDeadline,
+  askAgentQuestions
+};

package/dist/{chunk-ML42WKI7.js → chunk-CW3IJD2H.js}

@@ -1,6 +1,6 @@
 import {
   SETUP_FLAGS
-} from "./chunk-EQXMVKKD.js";
+} from "./chunk-FZEQWY7Q.js";
 import {
   parseFlags
 } from "./chunk-GMXKITVA.js";
@@ -9,7 +9,7 @@ import {
 } from "./chunk-7QLSKOSU.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-LL256PHP.js";
+} from "./chunk-MXEDMQLC.js";
 import {
   CLAUDE_CONNECTOR_GUIDE,
   CLAUDE_CONNECTOR_STEPS,
@@ -17,7 +17,7 @@ import {
   CLAUDE_CONNECTOR_URL,
   COWORK_CONNECTOR_LIMIT,
   COWORK_STANDING_INSTRUCTIONS
-} from "./chunk-2DZBIELP.js";
+} from "./chunk-QOUW57RT.js";
 
 // src/cli/cowork.ts
 import { readFileSync } from "fs";

package/dist/{chunk-JWURAYXK.js → chunk-D2G6HWEA.js}

@@ -4,10 +4,10 @@ import {
   keyPrefix,
   readConfigFileKey,
   readMacAppKeyPrefix
-} from "./chunk-42FTY5II.js";
+} from "./chunk-JWMCGL3P.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-LL256PHP.js";
+} from "./chunk-MXEDMQLC.js";
 
 // src/key-signed-out.ts
 var VERDICT_BY_CHECK = {

package/dist/{chunk-PRKH662J.js → chunk-D322CKL2.js}

@@ -1,6 +1,6 @@
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-LL256PHP.js";
+} from "./chunk-MXEDMQLC.js";
 
 // src/config.ts
 import { readFileSync } from "fs";

package/dist/{chunk-HCKBZYBW.js → chunk-D5IAEPFA.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-POFBE6ZY.js";
 import {
   autoUpdateState
-} from "./chunk-K5X25GUV.js";
+} from "./chunk-4GEHVRV3.js";
 import {
   readJsonSafe,
   writeJsonAtomic
@@ -15,7 +15,7 @@ import {
   globalUpgradeEntry,
   isAutoUpdateResult,
   ownPackageRoot
-} from "./chunk-2DZBIELP.js";
+} from "./chunk-QOUW57RT.js";
 
 // src/auto-update.ts
 import { spawn } from "child_process";

package/dist/{chunk-QHL3Y6D2.js → chunk-DDRLK67P.js}

@@ -1,12 +1,12 @@
 import {
   pusharyDir
-} from "./chunk-K5X25GUV.js";
+} from "./chunk-4GEHVRV3.js";
 import {
   readJsonSafe
 } from "./chunk-AQFEP65J.js";
 import {
   isRecord
-} from "./chunk-2DZBIELP.js";
+} from "./chunk-QOUW57RT.js";
 
 // src/process-ownership.ts
 import { createHash, randomUUID } from "crypto";

package/dist/{chunk-TRNSODJ6.js → chunk-FLEWP4BV.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-3EGEA4KH.js";
 import {
   getBaseUrl
-} from "./chunk-PRKH662J.js";
+} from "./chunk-D322CKL2.js";
 
 // src/cli/login-ui.ts
 import { hostname } from "os";

package/dist/{chunk-EQXMVKKD.js → chunk-FZEQWY7Q.js}

@@ -10,7 +10,7 @@ import {
   isSetupConnectMode,
   isValidApiKey,
   normalizeAgentId
-} from "./chunk-2DZBIELP.js";
+} from "./chunk-QOUW57RT.js";
 
 // src/setup/options.ts
 var AGENT_CHOICES = SETUP_AGENT_CHOICES;

package/dist/{chunk-J36W6ARB.js → chunk-G3CNMCQS.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-2DZBIELP.js";
+} from "./chunk-QOUW57RT.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-ULDOQF4Q.js → chunk-GBNG6QEV.js}

@@ -5,16 +5,16 @@ import {
 import {
   NOTIFICATION_MATCHED_TYPES,
   POSTTOOLUSE_MIRRORED_TOOLS
-} from "./chunk-U2PUHT4W.js";
+} from "./chunk-IBUAVM6X.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-K5X25GUV.js";
+} from "./chunk-4GEHVRV3.js";
 import {
   CLAUDE_PRETOOLUSE_MATCHER,
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY
-} from "./chunk-2DZBIELP.js";
+} from "./chunk-QOUW57RT.js";
 
 // src/gemini-config.ts
 var GEMINI_HOOK_BINARY = "pushary-gemini-hook";

package/dist/{chunk-GTEF64CJ.js → chunk-HCXBAF43.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_HOLD_BUDGET_ENV,
   hookHoldBudgetProof
-} from "./chunk-2DZBIELP.js";
+} from "./chunk-QOUW57RT.js";
 
 // src/hold-budget.ts
 var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {

package/dist/{chunk-U2PUHT4W.js → chunk-IBUAVM6X.js}

@@ -1,6 +1,6 @@
 import {
   PRETOOLUSE_GATED_TOOLS
-} from "./chunk-2DZBIELP.js";
+} from "./chunk-QOUW57RT.js";
 
 // src/claude-tools.ts
 var POSTTOOLUSE_MIRROR_ONLY_TOOLS = ["TodoWrite", "Task", "WebFetch", "WebSearch"];

package/dist/{chunk-CHWJ7ZXI.js → chunk-J2APHNZL.js}

@@ -1,15 +1,15 @@
 import {
   compatibleConfigFile
-} from "./chunk-SHLLDMPM.js";
+} from "./chunk-7GSOIBVM.js";
 import {
   hookOwnerOf,
   hookOwnerOfCommands,
   liveBridgeProbe,
   resolveBridgeStub
-} from "./chunk-4NMDFPK7.js";
+} from "./chunk-ZFJAZBBF.js";
 import {
   AGENT_CHOICES
-} from "./chunk-EQXMVKKD.js";
+} from "./chunk-FZEQWY7Q.js";
 import {
   claudeSettings,
   codexHooksJson,
@@ -18,7 +18,7 @@ import {
   guardedArgv,
   pusharyDir,
   vscodePluginDir
-} from "./chunk-K5X25GUV.js";
+} from "./chunk-4GEHVRV3.js";
 import {
   readJsonSafe
 } from "./chunk-AQFEP65J.js";
@@ -29,7 +29,7 @@ import {
   OPENCODE_APPROVAL_EVENT,
   hookCompatibleProfile,
   isRecord
-} from "./chunk-2DZBIELP.js";
+} from "./chunk-QOUW57RT.js";
 
 // src/opencode-plugin.ts
 var OPENCODE_PLUGIN_MARKER = "pushary-opencode-plugin w1";

package/dist/{chunk-5ML6E3L7.js → chunk-JVKY6ILU.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-K5X25GUV.js";
+} from "./chunk-4GEHVRV3.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-42FTY5II.js → chunk-JWMCGL3P.js}

@@ -1,6 +1,6 @@
 import {
   resolveInstallSourceFor
-} from "./chunk-5S2P2CK6.js";
+} from "./chunk-MIENLS7P.js";
 import {
   backupFile,
   readJsonSafe,
@@ -9,11 +9,11 @@ import {
 } from "./chunk-AQFEP65J.js";
 import {
   configFilePath
-} from "./chunk-PRKH662J.js";
+} from "./chunk-D322CKL2.js";
 import {
   API_KEY_PREFIX_PATTERN,
   isRecord
-} from "./chunk-2DZBIELP.js";
+} from "./chunk-QOUW57RT.js";
 
 // src/shell-alias.ts
 import { homedir } from "os";

package/dist/{chunk-4E4PZQFE.js → chunk-K2CZJBUS.js}

@@ -2,25 +2,25 @@ import {
   SIGNED_OUT_ON_MAC_MESSAGE,
   describeSignedOutKey,
   readSignedOutDiagnosis
-} from "./chunk-JWURAYXK.js";
+} from "./chunk-D2G6HWEA.js";
 import {
   createIo
 } from "./chunk-FO3MDD26.js";
 import {
   readKeySource
-} from "./chunk-42FTY5II.js";
+} from "./chunk-JWMCGL3P.js";
 import {
   absoluteUrl,
   checkApiKey,
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-GNESC5EF.js";
+} from "./chunk-OLS4DTFN.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
 import {
   getBaseUrl
-} from "./chunk-PRKH662J.js";
+} from "./chunk-D322CKL2.js";
 
 // src/cli/report-key.ts
 var { dim, yellow } = createIo();

package/dist/{chunk-YRAPCLOB.js → chunk-KBMQYMGG.js}

@@ -3,27 +3,27 @@ import {
   expectedLaunchCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "./chunk-26AEFJSK.js";
+} from "./chunk-MBTNHQCI.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   hasDaemonServiceDefinition,
   readDaemonNeedsLogin,
   readDaemonStatus
-} from "./chunk-Y5FCB66K.js";
+} from "./chunk-AJIH4JGB.js";
 import {
   readControlMode,
   readKeySource
-} from "./chunk-42FTY5II.js";
+} from "./chunk-JWMCGL3P.js";
 import {
   getMachineId
-} from "./chunk-EGTVN6YV.js";
+} from "./chunk-3HUHP4A4.js";
 import {
   getBaseUrl
-} from "./chunk-PRKH662J.js";
+} from "./chunk-D322CKL2.js";
 import {
   getPackageVersion
-} from "./chunk-2DZBIELP.js";
+} from "./chunk-QOUW57RT.js";
 
 // src/machines.ts
 import { hostname } from "os";

package/dist/{chunk-6LKIK7V2.js → chunk-L5WOYQT7.js}

@@ -2,7 +2,7 @@ import {
   IDLE_PROMPT_NOTIFICATION,
   NOTIFICATION_PUSH_TYPES,
   POSTTOOLUSE_MIRROR_ONLY_TOOLS
-} from "./chunk-U2PUHT4W.js";
+} from "./chunk-IBUAVM6X.js";
 import {
   cancelQuestion,
   clientErrorKindOf,
@@ -10,26 +10,26 @@ import {
   reportClientError,
   sendNotification,
   waitForAnswer
-} from "./chunk-FBKGGIFB.js";
+} from "./chunk-7O5U5TED.js";
 import {
   withRetry
-} from "./chunk-BS64ZHTB.js";
+} from "./chunk-ABDGTGBT.js";
 import {
   getMachineId
-} from "./chunk-EGTVN6YV.js";
+} from "./chunk-3HUHP4A4.js";
 import {
   reportedInstallSource
-} from "./chunk-5S2P2CK6.js";
+} from "./chunk-MIENLS7P.js";
 import {
   canonicalJson
-} from "./chunk-K5X25GUV.js";
+} from "./chunk-4GEHVRV3.js";
 import {
   writeFileAtomic
 } from "./chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-PRKH662J.js";
+} from "./chunk-D322CKL2.js";
 import {
   ACTION_BODY_MAX,
   AGENTS,
@@ -64,7 +64,7 @@ import {
   toToolLookup,
   truncateLine,
   unansweredRefusalReason
-} from "./chunk-2DZBIELP.js";
+} from "./chunk-QOUW57RT.js";
 
 // ../hook-mapping/src/describe.ts
 import { isAbsolute, relative, resolve } from "path";

package/dist/{chunk-ETGGQWBR.js → chunk-LZZ3EKKI.js}

@@ -1,13 +1,13 @@
 import {
   MCP_BRIDGE_BINARY
-} from "./chunk-KCUTE3EB.js";
+} from "./chunk-VITJTFFT.js";
 import {
   KEY_FILE_MODE
-} from "./chunk-42FTY5II.js";
+} from "./chunk-JWMCGL3P.js";
 import {
   NpmMissingError,
   NpmPermissionError
-} from "./chunk-K5X25GUV.js";
+} from "./chunk-4GEHVRV3.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -15,7 +15,7 @@ import {
 } from "./chunk-AQFEP65J.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-LL256PHP.js";
+} from "./chunk-MXEDMQLC.js";
 
 // src/instruction-file.ts
 import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from "fs";

package/dist/{chunk-26AEFJSK.js → chunk-MBTNHQCI.js}

@@ -10,10 +10,10 @@ import {
   resolvePackageVersionFromBinary,
   resolvePathBinary,
   resolvePathBinaryAsync
-} from "./chunk-K5X25GUV.js";
+} from "./chunk-4GEHVRV3.js";
 import {
   MANAGED_PROVIDERS
-} from "./chunk-2DZBIELP.js";
+} from "./chunk-QOUW57RT.js";
 
 // src/setup/codex-install.ts
 var NATIVE_BINARY_MIN_BYTES = 20 * 1024 * 1024;

package/dist/{chunk-5S2P2CK6.js → chunk-MIENLS7P.js}

@@ -1,9 +1,9 @@
 import {
   configFilePath
-} from "./chunk-PRKH662J.js";
+} from "./chunk-D322CKL2.js";
 import {
   normalizeInstallSource
-} from "./chunk-2DZBIELP.js";
+} from "./chunk-QOUW57RT.js";
 
 // src/install-source.ts
 import { readFileSync } from "fs";

package/dist/{chunk-LL256PHP.js → chunk-MXEDMQLC.js}

@@ -2,7 +2,7 @@ import {
   DISCONNECT_AGENT_IDS,
   SETUP_AGENT_CHOICES,
   isApprovalMode
-} from "./chunk-2DZBIELP.js";
+} from "./chunk-QOUW57RT.js";
 
 // src/cli/mode-request.ts
 var parseDuration = (value) => {