@pushary/agent-hooks 1.9.7 → 1.9.9

package/dist/bin/pushary-wait.js

@@ -3,34 +3,37 @@ import {
   describeWaitLadder
 } from "../chunk-CVWG2N3Y.js";
 import {
-  exitOnFailedResponse
-} from "../chunk-RQSOEB4S.js";
+  exitOnFailedSettingsRequest
+} from "../chunk-HBWYMRR5.js";
+import "../chunk-Q6C6ILUS.js";
 import {
   createIo
 } from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-UFVGSEWH.js";
+} from "../chunk-TO3PS646.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-KFKL3FHS.js";
-import "../chunk-JXISQ7DT.js";
-import "../chunk-KYO45G5L.js";
+import "../chunk-REU2VQPH.js";
+import "../chunk-QRXPWW3M.js";
+import "../chunk-5N5L6DNN.js";
+import "../chunk-KOWFRUIT.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-ZUTU43FT.js";
+import "../chunk-BNSKVIAW.js";
+import "../chunk-Z23ZBYDW.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-Z6HPS67T.js";
-import "../chunk-STQRUH3S.js";
-import "../chunk-QR6VE5ME.js";
+} from "../chunk-IRHABAQT.js";
+import "../chunk-5DCDQ5VW.js";
+import "../chunk-5RGA636G.js";
 
 // bin/pushary-wait.ts
 exitOnHelpFlag("wait");
@@ -56,18 +59,18 @@ var printLadder = (data) => {
   console.log(`  ${dim("Reset it:")}              ${cyan("pushary wait clear")}`);
   console.log(`  ${dim("Per-tool rules live in the dashboard under Agent \u2192 Policies.")}`);
 };
-var fetchPolicy = async (baseUrl, headers) => {
-  const res = await fetch(`${baseUrl}/api/mcp/policy`, { headers });
-  if (!res.ok) await exitOnFailedResponse(res, baseUrl);
+var fetchPolicy = async (settings, headers) => {
+  const res = await fetch(`${settings.baseUrl}/api/mcp/policy`, { headers });
+  if (!res.ok) await exitOnFailedSettingsRequest(res, settings);
   return res.json();
 };
-var setWindow = async (baseUrl, headers, seconds) => {
-  const res = await fetch(`${baseUrl}/api/mcp/policy`, {
+var setWindow = async (settings, headers, seconds) => {
+  const res = await fetch(`${settings.baseUrl}/api/mcp/policy`, {
     method: "PATCH",
     headers,
     body: JSON.stringify({ defaultPushFirstSeconds: seconds })
   });
-  if (!res.ok) await exitOnFailedResponse(res, baseUrl);
+  if (!res.ok) await exitOnFailedSettingsRequest(res, settings);
   const data = await res.json();
   return data.defaultPushFirstSeconds;
 };
@@ -85,6 +88,7 @@ var setWindow = async (baseUrl, headers, seconds) => {
 var main = async () => {
   const apiKey = getApiKey();
   const baseUrl = getBaseUrl();
+  const settings = { request: "wait", apiKey, baseUrl };
   const headers = {
     "Authorization": `Bearer ${apiKey}`,
     "Content-Type": "application/json"
@@ -93,11 +97,11 @@ var main = async () => {
   const args = rest[0] === "wait" ? rest.slice(1) : rest;
   const arg = args[0];
   if (!arg || arg === "status") {
-    printLadder(await fetchPolicy(baseUrl, headers));
+    printLadder(await fetchPolicy(settings, headers));
     return;
   }
   if (arg === "clear" || arg === "reset") {
-    const value2 = await setWindow(baseUrl, headers, 20);
+    const value2 = await setWindow(settings, headers, 20);
     console.log(`  ${green("\u2713")} Default push window reset to ${cyan(`${value2}s`)}`);
     return;
   }
@@ -107,7 +111,7 @@ var main = async () => {
     console.log(`  ${dim("Usage: pushary wait <seconds> | status | clear")}`);
     process.exit(EXIT.USAGE);
   }
-  const value = await setWindow(baseUrl, headers, Math.trunc(seconds));
+  const value = await setWindow(settings, headers, Math.trunc(seconds));
   const ladder = describeWaitLadder({ tool: "*", mode: "push_first", pushFirstSeconds: value, timeoutSeconds: 0, timeoutAction: "escalate" });
   console.log(`  ${green("\u2713")} Default push window set to ${cyan(`${value}s`)} ${dim(`(${ladder})`)}`);
 };

package/dist/bin/pushary.js

@@ -1,23 +1,23 @@
 #!/usr/bin/env node
 import {
   installNetworkDefaults
-} from "../chunk-JXISQ7DT.js";
-import "../chunk-KYO45G5L.js";
+} from "../chunk-5N5L6DNN.js";
+import "../chunk-KOWFRUIT.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-ZUTU43FT.js";
+import "../chunk-Z23ZBYDW.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-Z6HPS67T.js";
+import "../chunk-IRHABAQT.js";
 import {
   COMMANDS,
-  isCommandName,
-  renderHelp
-} from "../chunk-STQRUH3S.js";
+  renderHelp,
+  resolveCommandName
+} from "../chunk-5DCDQ5VW.js";
 import {
   getPackageVersion
-} from "../chunk-QR6VE5ME.js";
+} from "../chunk-5RGA636G.js";
 
 // src/cli/runtime.ts
 var supportsRuntime = (version) => {
@@ -33,8 +33,8 @@ var LOADERS = {
   daemon: () => import("./pushary-daemon.js"),
   status: () => import("./pushary-status.js"),
   login: () => import("./pushary-login.js"),
-  logout: () => import("./pushary-logout.js"),
-  connect: () => import("./pushary-connect.js"),
+  "sign-out": () => import("./pushary-logout.js"),
+  pair: () => import("./pushary-connect.js"),
   bell: () => import("./pushary-bell.js"),
   doctor: () => import("./pushary-doctor.js"),
   disconnect: () => import("./pushary-disconnect.js"),
@@ -54,21 +54,22 @@ if (!supportsRuntime(process.versions.node)) {
 installNetworkDefaults();
 var argv = process.argv.slice(2);
 var command = argv[0] ?? "";
+var resolved = resolveCommandName(command);
 var wants = (...names) => argv.some((arg) => names.includes(arg));
-if (!command || wants("--help", "-h") && !isCommandName(command)) {
+if (!command || wants("--help", "-h") && resolved === null) {
   process.stdout.write(renderHelp(getPackageVersion()));
   process.exit(EXIT.OK);
 }
-if (wants("--version", "-v") && !isCommandName(command)) {
+if (wants("--version", "-v") && resolved === null) {
   process.stdout.write(`${getPackageVersion()}
 `);
   process.exit(EXIT.OK);
 }
-if (!isCommandName(command)) {
+if (resolved === null) {
   process.stderr.write(`Unknown command: ${command}
 `);
   process.stderr.write(`Run \`pushary --help\`. Available: ${COMMANDS.map((c) => c.name).join(", ")}
 `);
   process.exit(EXIT.USAGE);
 }
-await LOADERS[command]();
+await LOADERS[resolved]();

package/dist/{chunk-4FK6RZVJ.js → chunk-462EQA6K.js}

@@ -1,6 +1,6 @@
 import {
   getBaseUrl
-} from "./chunk-Z6HPS67T.js";
+} from "./chunk-IRHABAQT.js";
 
 // src/transcript-api.ts
 var fetchTranscriptRecipients = async (apiKey, baseUrl = getBaseUrl()) => {

package/dist/{chunk-STQRUH3S.js → chunk-5DCDQ5VW.js}

@@ -1,6 +1,36 @@
 import {
-  SETUP_AGENT_CHOICES
-} from "./chunk-QR6VE5ME.js";
+  DISCONNECT_AGENT_IDS,
+  SETUP_AGENT_CHOICES,
+  isApprovalMode
+} from "./chunk-5RGA636G.js";
+
+// src/cli/mode-request.ts
+var parseDuration = (value) => {
+  const match = value.match(/^(\d+)(m|h)$/);
+  if (!match) return null;
+  const amount = Number(match[1]);
+  return match[2] === "h" ? amount * 3600 : amount * 60;
+};
+var modeRequestBody = (mode, duration) => {
+  if (duration === void 0) return { mode, permanent: true };
+  const ttlSeconds = parseDuration(duration);
+  return ttlSeconds ? { mode, ttlSeconds } : null;
+};
+var UPDATES_ONLY_MODE_INPUTS = ["updates-only", "updates_only"];
+var UPDATES_ONLY_MODE = "notify_only";
+var MODE_PROSE_NAMES = {
+  [UPDATES_ONLY_MODE]: "Updates only"
+};
+var isUpdatesOnlyInput = (value) => UPDATES_ONLY_MODE_INPUTS.includes(value);
+var resolveModeInput = (value) => {
+  const name = value.trim().toLowerCase();
+  if (isUpdatesOnlyInput(name)) return UPDATES_ONLY_MODE;
+  return isApprovalMode(name) ? name : null;
+};
+var describeMode = (mode) => {
+  const prose = isApprovalMode(mode) ? MODE_PROSE_NAMES[mode] : void 0;
+  return prose === void 0 ? mode : `${prose} (${mode})`;
+};
 
 // src/cli/commands.ts
 var NPX_LATEST_COMMAND = "npx pushary@latest";
@@ -44,14 +74,16 @@ var COMMAND_LIST = [
     summary: "Sign in from this terminal, no key to copy (--with-token to pipe one in)"
   },
   {
-    name: "logout",
+    name: "sign-out",
     module: "pushary-logout",
-    summary: "Remove the key this machine stores, and say what it does not remove"
+    aliases: ["logout"],
+    summary: "Sign out: remove the key this machine stores, and say what it does not remove (also: logout)"
   },
   {
-    name: "connect",
+    name: "pair",
     module: "pushary-connect",
-    summary: "Connect a phone without re-running setup (--app for the Pushary app)"
+    aliases: ["connect"],
+    summary: "Pair a phone without re-running setup (--app for the Pushary app; also: connect)"
   },
   {
     name: "bell",
@@ -63,7 +95,7 @@ var COMMAND_LIST = [
     ]
   },
   { name: "doctor", module: "pushary-doctor", summary: "Verify your Pushary installation is working" },
-  { name: "disconnect", module: "pushary-disconnect", summary: "Turn off one agent (claude|codex|gemini|cursor)" },
+  { name: "disconnect", module: "pushary-disconnect", summary: `Turn off one agent (${DISCONNECT_AGENT_IDS.join("|")})` },
   { name: "clean", module: "pushary-clean", summary: "Remove Pushary from this machine (--everything: the Mac app's setup too, --dry-run: preview)" },
   { name: "mode", module: "pushary-mode", summary: "Choose where approval requests appear" },
   { name: "wait", module: "pushary-wait", summary: 'Show or set the "wait for your phone" ladder (pushary wait 45)' },
@@ -92,8 +124,14 @@ var COMMAND_LIST = [
   }
 ];
 var COMMANDS = COMMAND_LIST;
-var findCommand = (name) => COMMANDS.find((command) => command.name === name);
+var answersTo = (command, token) => command.name === token || (command.aliases ?? []).includes(token);
+var findCommand = (token) => COMMANDS.find((command) => answersTo(command, token));
 var isCommandName = (name) => COMMANDS.some((command) => command.name === name);
+var resolveCommandName = (token) => {
+  const name = findCommand(token)?.name;
+  return name !== void 0 && isCommandName(name) ? name : null;
+};
+var isInvocationOf = (token, name) => resolveCommandName(token) === name;
 var COMMAND_OPTIONS = {
   cowork: [
     ["--open", "Also open the setup guide in your browser"],
@@ -111,7 +149,7 @@ var COMMAND_OPTIONS = {
     ["trust --rotate", "Accept the keys the server is offering now and resume syncing"]
   ],
   mode: [
-    ["<mode>", "One of: push_only, push_first, terminal_only, notify_only"],
+    ["<mode>", `One of: push_only, push_first, terminal_only, notify_only (Updates only; also: ${UPDATES_ONLY_MODE_INPUTS.join(", ")})`],
     ["status", "Show the current override"],
     ["clear", "Drop the override and go back to per-tool policies"],
     ["--for <30m|2h>", "Expire the override after this long"]
@@ -125,7 +163,7 @@ var COMMAND_OPTIONS = {
     ["--json", "Emit the whole report as one object instead of the screen"],
     ["--devices", "Also list the machines registered to this site"]
   ],
-  logout: [
+  "sign-out": [
     ["--revoke", "Also kill the key server-side, so it stops working everywhere"],
     ["--json", "Emit the result as one object instead of the screen"]
   ],
@@ -168,10 +206,10 @@ var SETUP_OPTIONS = [
   ["--connect app", "Pair the native Pushary app, no key to paste (default)"],
   ["--connect browser", "Approve in a browser tab instead. For a machine with no app"],
   ["--connect web", "Legacy browser subscribe page"],
-  ["--connect none", "Skip the phone connect step, same as --skip-phone"],
+  ["--connect none", "Skip pairing a phone, same as --skip-phone"],
   ["--control auto|on|off", "Manage phone-start automatically (default), require it, or disable its background service"],
   ["--transcripts on|off", "Enable or disable encrypted transcript sync on this machine"],
-  ["--skip-phone", "Skip the phone connect step"],
+  ["--skip-phone", "Skip pairing a phone"],
   ["--take-over-hooks", "Replace hooks the Pushary Mac app owns with the CLI's. Without it the app's wiring is kept"],
   ["--verify roundtrip", "Send a real question and wait for you to answer it (default when a human is present)"],
   ["--verify push", "Only prove a notification was delivered. Automatic when nobody is at the terminal"],
@@ -220,8 +258,9 @@ var renderHelp = (version) => {
     ""
   ].join("\n");
 };
-var renderCommandHelp = (name, version) => {
-  const spec = findCommand(name);
+var renderCommandHelp = (token, version) => {
+  const spec = findCommand(token);
+  const name = spec?.name ?? token;
   const options = name === "setup" ? SETUP_OPTIONS : COMMAND_OPTIONS[name] ?? [];
   const width = options.length > 0 ? Math.max(...options.map(([flag]) => flag.length)) + 2 : 0;
   return [
@@ -241,9 +280,14 @@ var renderCommandHelp = (name, version) => {
 };
 
 export {
+  modeRequestBody,
+  UPDATES_ONLY_MODE_INPUTS,
+  resolveModeInput,
+  describeMode,
   NPX_LATEST_COMMAND,
   COMMANDS,
-  isCommandName,
+  resolveCommandName,
+  isInvocationOf,
   renderHelp,
   renderCommandHelp
 };

package/dist/{chunk-JXISQ7DT.js → chunk-5N5L6DNN.js}

@@ -1,16 +1,16 @@
 import {
   readExistingMachineId
-} from "./chunk-KYO45G5L.js";
+} from "./chunk-KOWFRUIT.js";
 import {
   NetworkError
 } from "./chunk-7QLSKOSU.js";
 import {
   getBaseUrl
-} from "./chunk-Z6HPS67T.js";
+} from "./chunk-IRHABAQT.js";
 import {
   clientContextHeaders,
   getPackageVersion
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-5RGA636G.js";
 
 // src/cli/net.ts
 import { createRequire } from "module";

package/dist/{chunk-QR6VE5ME.js → chunk-5RGA636G.js}

@@ -154,6 +154,7 @@ var AGENTS = {
   fx: {
     ...defaults,
     label: "fx",
+    disconnectable: true,
     connectVia: "Local MCP bridge",
     setupCommand: PUSHARY_SETUP_COMMAND,
     capabilityNote: "fx has no hooks that other tools can register, so Pushary cannot answer fx's own approval prompts. Setup turns off fx's terminal question tool so fx's agent asks through Pushary. fx's full-access mode ignores that setting; there the agent is only instructed to ask through Pushary."
@@ -196,7 +197,7 @@ var AGENTS = {
     connectVia: "Native hooks + MCP",
     setupCommand: PUSHARY_SETUP_COMMAND,
     enforcementDetail: "Shell, writes and edits through native PreToolUse hooks, plus PermissionRequest, over Qoder's superset of the Claude Code event list.",
-    capabilityNote: "Qoder documents no user-level instructions file, so the proactive-ask block is not installed. Hooks and MCP are unaffected. Like every agent in this family, the CLI wires it; the macOS app does not yet."
+    capabilityNote: "Qoder documents no user-level instructions file, so the proactive-ask block is not installed. Hooks and MCP are unaffected."
   },
   droid: {
     ...defaults,
@@ -262,10 +263,24 @@ var POLICY_AGENTS = [...Object.values(AGENTS).flatMap((agent) => agent.policyAge
 var AGENT_LABELS_BY_TYPE = Object.fromEntries(
   Object.entries(AGENTS).flatMap(([id, agent]) => agent.hasStoredIdentity ? [[id, agent.label]] : [])
 );
-var DISCONNECTABLE_AGENTS = Object.freeze(Object.values(AGENTS).flatMap((agent) => agent.disconnectable ? [agent.hookSource] : []));
+var DISCONNECTABLE_AGENTS = Object.freeze(Object.values(AGENTS).flatMap((agent) => agent.disconnectable && agent.hookSource !== null ? [agent.hookSource] : []));
 var REPO_AWARE_AGENTS = Object.freeze(Object.values(AGENTS).flatMap((agent) => agent.repoAware ? [agent.policyAgent] : []));
 var MANAGED_PROVIDERS = Object.freeze(Object.values(AGENTS).flatMap((agent) => agent.managedProvider ? [agent.hookSource] : []));
 var BRIDGE_HOOK_SOURCES = Object.freeze(Object.values(AGENTS).flatMap((agent) => agent.bridged ? [agent.hookSource] : []));
+var isAgentId = (value) => Object.keys(AGENTS).includes(value);
+var isHooklessDisconnectableAgent = (value) => isAgentId(value) && AGENTS[value].disconnectable && AGENTS[value].hookSource === null;
+var DISCONNECT_AGENT_IDS = Object.freeze([...DISCONNECTABLE_AGENTS, ...Object.keys(AGENTS).filter(isHooklessDisconnectableAgent)]);
+var agentIdCalled = (name) => isAgentId(name) ? name : Object.keys(AGENTS).filter(isAgentId).find((id) => AGENTS[id].hookSource === name) ?? null;
+var namesOfAgent = (id) => {
+  const source = AGENTS[id].hookSource;
+  return source === null ? [id] : [id, source];
+};
+var normalizeAgentId = (value, accepted) => {
+  const name = value.trim().toLowerCase();
+  const agent = agentIdCalled(name);
+  const names = agent === null ? [name] : namesOfAgent(agent);
+  return accepted.find((candidate) => names.includes(candidate)) ?? null;
+};
 
 // ../contracts/src/agent-wiring.ts
 var COMPATIBLE_AGENT_TYPES = ["qwen_code", "codebuddy", "qoder", "droid", "devin"];
@@ -718,6 +733,25 @@ var AUTH_REJECTION_REASONS = [
   ...AGENT_SITE_REJECTION_REASONS
 ];
 
+// ../contracts/src/declined-agents.ts
+var DECLINED_AGENTS_FILE = "declined-agents.json";
+var DECLINED_AGENTS_VERSION = 1;
+var isDeclinableAgent = (value) => typeof value === "string" && HOOK_SOURCES.includes(value);
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var canonicalAgents = (agents) => [...new Set(agents)].sort();
+var parseDeclinedAgents = (value) => {
+  if (!isRecord(value) || value.version !== DECLINED_AGENTS_VERSION || !Array.isArray(value.agents)) return [];
+  return canonicalAgents(value.agents.filter(isDeclinableAgent));
+};
+var declinedAgentsDocument = (agents) => ({
+  version: DECLINED_AGENTS_VERSION,
+  agents: canonicalAgents(agents)
+});
+var serializeDeclinedAgents = (agents) => `${JSON.stringify(declinedAgentsDocument(agents), null, 2)}
+`;
+var withDeclinedAgent = (agents, agent) => canonicalAgents([...agents, agent]);
+var withoutDeclinedAgent = (agents, agent) => agents.filter((candidate) => candidate !== agent);
+
 // ../contracts/src/index.ts
 var KEY_SCOPES = ["full_access", "agent", "connector", "bound"];
 var normalizeKeyScope = (value) => typeof value === "string" && KEY_SCOPES.includes(value) ? value : null;
@@ -874,7 +908,7 @@ var CURSOR_GATE_EVENTS = ["beforeShellExecution", "beforeMCPExecution", "preTool
 var SUPPORT_EMAIL = "business@pushary.com";
 var SUPPORT_DISCORD = "https://discord.gg/9v3VvUByrr";
 var HOOK_LOCATOR_BINARY = "pushary-bridge";
-var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var HOOK_BATCH_MAX_BYTES = 4 * 1024 * 1024;
 var REPO_KEY_MAX_LENGTH = 200;
 var WILDCARD_TOOL_PATTERN = "*";
@@ -2152,7 +2186,9 @@ function agentQuestionStrategy(source, event, toolName) {
   if (source !== null && event === "PreToolUse" && UPDATED_INPUT_QUESTION_SOURCES.has(source)) return AGENT_QUESTION_STRATEGY.updatedInput;
   return AGENT_QUESTION_STRATEGY.native;
 }
-var ASKED_IN_EVERY_MODE_TOOLS = [AGENT_QUESTION_TOOL, "ExitPlanMode"];
+var questionHandedToTheTerminal = (toolName, modeState) => toolName === AGENT_QUESTION_TOOL && modeState.askHandoff === true;
+var EXIT_PLAN_MODE_TOOL = "ExitPlanMode";
+var ASKED_IN_EVERY_MODE_TOOLS = [AGENT_QUESTION_TOOL, EXIT_PLAN_MODE_TOOL];
 var ASKED_IN_EVERY_MODE = new Set(ASKED_IN_EVERY_MODE_TOOLS);
 var isAskedInEveryMode = (toolName) => ASKED_IN_EVERY_MODE.has(toolName);
 var NATIVE_BLOCK_EVENTS = /* @__PURE__ */ new Set(["PermissionDenied"]);
@@ -2233,6 +2269,12 @@ var resolveGate = (input) => {
 };
 var editAsksAtTheAgentsPrompt = (input, verdict) => verdict.kind === "gate" && !verdict.scopeReason && (input.modeState.mode ?? input.config.modeOverride ?? null) === null && !aChosenRuleGoverns(input) && verdict.policy.mode === "push_first" && ACCEPT_EDITS_DEFER_TOOLS.has(input.toolName);
 var claudePromptsBeforeAnEdit = (permissionMode) => permissionMode === "default";
+var runsTheClaudeHook = (source) => source === null || source === "claude" || hookCompatibleProfileBySource(source) !== void 0;
+var agentPromptsBeforeAnEdit = ({ source, event, permissionMode }) => {
+  if (source === "codex") return event === "PermissionRequest";
+  return event === "PreToolUse" && runsTheClaudeHook(source) && claudePromptsBeforeAnEdit(permissionMode);
+};
+var editGoesToTheAgentsPrompt = (call, input, verdict) => agentPromptsBeforeAnEdit(call) && editAsksAtTheAgentsPrompt(input, verdict);
 var MAX_AGENT_PERMISSION_RULES_PER_KIND = 256;
 var MAX_AGENT_PERMISSION_RULE_LENGTH = 512;
 var isAgentPermissionRule = (value) => typeof value === "string" && value.length > 0 && value.length <= MAX_AGENT_PERMISSION_RULE_LENGTH;
@@ -2242,7 +2284,7 @@ var settingsPermissionList = (permissions, kind) => {
 };
 var boundedUnion = (lists) => [...new Set(lists.flat())].slice(0, MAX_AGENT_PERMISSION_RULES_PER_KIND);
 var claudePermissionRulesFromSettings = (documents) => {
-  const permissionBlocks = documents.flatMap((document) => isRecord(document) && isRecord(document.permissions) ? [document.permissions] : []);
+  const permissionBlocks = documents.flatMap((document) => isRecord2(document) && isRecord2(document.permissions) ? [document.permissions] : []);
   const collect = (kind) => boundedUnion(permissionBlocks.map((permissions) => settingsPermissionList(permissions, kind)));
   return { allow: collect("allow"), ask: collect("ask"), deny: collect("deny") };
 };
@@ -2403,6 +2445,7 @@ var claudePermissionRequestOutput = (decision, reason, updatedInput) => ({
     decision: decision === "allow" ? { behavior: "allow", ...updatedInput ? { updatedInput } : {} } : { behavior: "deny", ...reason ? { message: reason } : {} }
   }
 });
+var DENIED_FROM_PUSHARY_REASON = "Denied from Pushary";
 var gateOutputFor = (source, event, decision, reason) => {
   let output;
   if (source === "claude" || source === "vscode") {
@@ -2418,7 +2461,7 @@ var gateOutputFor = (source, event, decision, reason) => {
       output = {
         hookSpecificOutput: {
           hookEventName: "PermissionRequest",
-          decision: decision === "allow" ? { behavior: "allow" } : { behavior: "deny", message: reason ?? "Denied from Pushary" }
+          decision: decision === "allow" ? { behavior: "allow" } : { behavior: "deny", message: reason ?? DENIED_FROM_PUSHARY_REASON }
         }
       };
     } else if (event === "PreToolUse" && decision === "deny") {
@@ -2426,19 +2469,19 @@ var gateOutputFor = (source, event, decision, reason) => {
         hookSpecificOutput: {
           hookEventName: "PreToolUse",
           permissionDecision: "deny",
-          permissionDecisionReason: reason ?? "Denied from Pushary"
+          permissionDecisionReason: reason ?? DENIED_FROM_PUSHARY_REASON
         }
       };
     }
   } else if (source === "gemini" && event === "BeforeTool" && decision !== "ask") {
-    output = decision === "allow" ? { decision: "allow" } : { decision: "deny", reason: reason ?? "Denied from Pushary" };
+    output = decision === "allow" ? { decision: "allow" } : { decision: "deny", reason: reason ?? DENIED_FROM_PUSHARY_REASON };
   } else if (source === "opencode" && event === OPENCODE_APPROVAL_EVENT) {
-    output = decision === "deny" ? { status: "deny", reason: reason ?? "Denied from Pushary" } : { status: decision };
+    output = decision === "deny" ? { status: "deny", reason: reason ?? DENIED_FROM_PUSHARY_REASON } : { status: decision };
   } else if (source === "cursor" && CURSOR_GATE_EVENTS.includes(event)) {
     output = decision === "allow" ? { permission: "allow" } : decision === "ask" && event !== "preToolUse" ? { permission: "ask" } : {
       permission: "deny",
       user_message: "Command denied via Pushary.",
-      agent_message: reason ?? "Denied from Pushary"
+      agent_message: reason ?? DENIED_FROM_PUSHARY_REASON
     };
   } else {
     const profile = hookCompatibleProfileBySource(source);
@@ -2463,6 +2506,12 @@ var claudeElicitationOutput = (event, action, content) => ({
   }
 });
 var renderElicitationOutput = (event, action, content) => ELICITATION_EVENTS.includes(event) ? JSON.stringify(claudeElicitationOutput(event, action, content)) : void 0;
+var UNVERIFIABLE_APPROVAL_REASON = "Pushary could not create a verifiable approval. Retry the action.";
+var DECISION_STOP_REASON = "Approval was cancelled or became unavailable. Retry only after resolving it.";
+var WITHDRAWN_APPROVAL_REASON = "The phone question was withdrawn. Approve in the current client.";
+var PLAN_DECLINED_REASON = "Plan declined from the phone. Ask what to change before coding.";
+var claudeStoppedPreToolUseOutput = (reason) => stoppedOutput(claudePreToolUseOutput("deny", reason), reason);
+var claudeStoppedPermissionRequestOutput = (reason) => stoppedOutput(claudePermissionRequestOutput("deny", reason), reason);
 var ELICITATION_ANSWERABLE_MODE = "form";
 var ELICITATION_MIN_OPTIONS = 2;
 var ELICITATION_MAX_MULTI_QUESTIONS = 4;
@@ -2655,16 +2704,16 @@ var globalInstallTarget = (owner, ownName) => {
       return LEGACY_PACKAGE;
   }
 };
-var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var declaresOwnershipProbe = (bin) => isRecord2(bin) && typeof bin[OWNERSHIP_PROBE_COMMAND] === "string";
+var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var declaresOwnershipProbe = (bin) => isRecord3(bin) && typeof bin[OWNERSHIP_PROBE_COMMAND] === "string";
 var cliManifestName = (manifest) => {
-  if (!isRecord2(manifest) || !isCliPackageName(manifest.name) || !declaresOwnershipProbe(manifest.bin)) return void 0;
+  if (!isRecord3(manifest) || !isCliPackageName(manifest.name) || !declaresOwnershipProbe(manifest.bin)) return void 0;
   return manifest.name;
 };
 var classifyGlobalFolder = (name, read) => {
   if (read.kind === "unreadable") return { kind: "unseen" };
   const { manifest } = read;
-  if (!isRecord2(manifest) || cliManifestName(manifest) !== name) return { kind: "foreign" };
+  if (!isRecord3(manifest) || cliManifestName(manifest) !== name) return { kind: "foreign" };
   return { kind: "ours", installed: { name, version: typeof manifest.version === "string" ? manifest.version : void 0 } };
 };
 var classifyGlobalInstall = (installed, owner) => {
@@ -2755,6 +2804,8 @@ export {
   DISCONNECTABLE_AGENTS,
   REPO_AWARE_AGENTS,
   MANAGED_PROVIDERS,
+  DISCONNECT_AGENT_IDS,
+  normalizeAgentId,
   PHONE_ANSWERED_TOOLS,
   canonicalToolName,
   toToolLookup,
@@ -2780,7 +2831,13 @@ export {
   isSetupConnectMode,
   CLIENT_REPORT_PATH,
   clientContextHeaders,
+  DECLINED_AGENTS_FILE,
+  parseDeclinedAgents,
+  serializeDeclinedAgents,
+  withDeclinedAgent,
+  withoutDeclinedAgent,
   normalizeKeyScope,
+  isApprovalMode,
   parseAgentQuestion,
   parseAgentQuestions,
   parseAgentQuestionAnswers,
@@ -2820,6 +2877,7 @@ export {
   shouldDeferToNativeMode,
   AGENT_QUESTION_STRATEGY,
   agentQuestionStrategy,
+  questionHandedToTheTerminal,
   CODEX_RESCUE_TOOL_NAME,
   isBlockedActionRequest,
   BLOCKED_ACTION_GRANT_TTL_SECONDS,
@@ -2828,8 +2886,7 @@ export {
   isPermissionRequestOwnedByPreToolUse,
   CLAUDE_PRETOOLUSE_MATCHER,
   resolveGate,
-  editAsksAtTheAgentsPrompt,
-  claudePromptsBeforeAnEdit,
+  editGoesToTheAgentsPrompt,
   claudePermissionRulesFromSettings,
   claudeConsultsItsAllowlist,
   agentRulesAllowEveryInput,
@@ -2842,13 +2899,18 @@ export {
   machineDecisionFor,
   claudePermissionDeniedOutput,
   codexStopRescueOutput,
-  stoppedOutput,
   claudePreToolUseOutput,
   PENDING_COMMAND_PREFIX,
   pendingCommandEvents,
   claudePermissionRequestOutput,
   gateOutputFor,
   renderElicitationOutput,
+  UNVERIFIABLE_APPROVAL_REASON,
+  DECISION_STOP_REASON,
+  WITHDRAWN_APPROVAL_REASON,
+  PLAN_DECLINED_REASON,
+  claudeStoppedPreToolUseOutput,
+  claudeStoppedPermissionRequestOutput,
   ELICITATION_ANSWERABLE_MODE,
   readElicitationFields,
   planElicitationAsk,

package/dist/{chunk-L76HTPU6.js → chunk-6AYSKVLL.js}

@@ -1,12 +1,12 @@
 import {
   keyCheckFromResponse
-} from "./chunk-KFKL3FHS.js";
+} from "./chunk-QRXPWW3M.js";
 import {
   installNetworkDefaults
-} from "./chunk-JXISQ7DT.js";
+} from "./chunk-5N5L6DNN.js";
 import {
   getBaseUrl
-} from "./chunk-Z6HPS67T.js";
+} from "./chunk-IRHABAQT.js";
 
 // src/retry.ts
 var isRetryable = (err) => {