@pushary/agent-hooks 1.9.9 → 1.9.11

package/dist/{chunk-KQFTBQ66.js → chunk-A6J5Z2HO.js}

@@ -1,49 +1,35 @@
-import {
-  DEFAULT_SESSION,
-  isDefaultSession,
-  listPendingQuestions,
-  listPendingQuestionsForToolUse,
-  markPendingCommandDelivered,
-  readPendingCommand,
-  removePendingCommand,
-  removePendingQuestion,
-  removePendingSession,
-  savePendingCommand
-} from "./chunk-N6IOSZOE.js";
 import {
   IDLE_PROMPT_NOTIFICATION,
   NOTIFICATION_PUSH_TYPES,
   POSTTOOLUSE_MIRROR_ONLY_TOOLS
-} from "./chunk-MD4SVNT6.js";
+} from "./chunk-E6YQW43K.js";
 import {
   cancelQuestion,
+  clientErrorKindOf,
   isPolicyConfig,
+  reportClientError,
   sendNotification,
   waitForAnswer
-} from "./chunk-WRPYCIV2.js";
+} from "./chunk-GUNZHSTL.js";
 import {
   withRetry
-} from "./chunk-6AYSKVLL.js";
-import {
-  clientErrorKindOf,
-  reportClientError
-} from "./chunk-UPIZSCYD.js";
+} from "./chunk-KBN3UP2R.js";
 import {
   getMachineId
-} from "./chunk-KOWFRUIT.js";
+} from "./chunk-2NAQRPZQ.js";
 import {
   reportedInstallSource
-} from "./chunk-BNSKVIAW.js";
+} from "./chunk-CBDJ2X5P.js";
 import {
   canonicalJson
-} from "./chunk-Z23ZBYDW.js";
+} from "./chunk-4FWWHCYM.js";
 import {
   writeFileAtomic
 } from "./chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-IRHABAQT.js";
+} from "./chunk-FJCOOFT7.js";
 import {
   ACTION_BODY_MAX,
   AGENT_LABELS_BY_TYPE,
@@ -60,160 +46,19 @@ import {
   gateOutputFor,
   hookCompatibleProfileBySource,
   isAutoApprove,
+  isTokenCount,
   localRepoKey,
   modeStateFromResponse,
   normalizeRepoRemote,
   pendingCommandEvents,
   redactSecrets,
   redactSecretsDeep,
+  reportableSessionId,
   resolveAutoResolveOrigin,
   resolvePolicy,
   toToolLookup,
   truncateLine
-} from "./chunk-5RGA636G.js";
-
-// src/policy.ts
-import { createHash } from "crypto";
-import { existsSync, readFileSync, writeFileSync } from "fs";
-import { join } from "path";
-import { tmpdir } from "os";
-var CACHE_TTL_MS = 60 * 1e3;
-var STALE_CACHE_MAX_MS = 12 * 60 * 60 * 1e3;
-var policyRequestFor = (agentType) => ({
-  agent: agentType,
-  repoAware: REPO_AWARE_AGENTS.includes(agentType)
-});
-var policyCacheFile = (apiKey, agent, repoAware = false) => {
-  const parts = [apiKey, agent, repoAware ? "repoAware" : void 0, "sessionToolAware"].filter(Boolean);
-  const hash = createHash("sha256").update(parts.join(":")).digest("hex").slice(0, 12);
-  return join(tmpdir(), `pushary-policy-${hash}.json`);
-};
-var fetchPolicy = async (apiKey, agent, repoAware = false, sessionId) => {
-  return withRetry(async () => {
-    const baseUrl = getBaseUrl();
-    const params = new URLSearchParams();
-    if (agent) params.set("agent", agent);
-    if (repoAware) params.set("repoAware", "1");
-    params.set("scopeAware", "1");
-    params.set("sessionToolAware", "1");
-    if (sessionId) params.set("sessionId", sessionId);
-    const query = params.toString();
-    const url = query ? `${baseUrl}/api/mcp/policy?${query}` : `${baseUrl}/api/mcp/policy`;
-    const response = await fetch(url, {
-      headers: { "Authorization": `Bearer ${apiKey}` },
-      signal: AbortSignal.timeout(1e4)
-    });
-    if (!response.ok) {
-      throw new Error(`Failed to fetch policy: ${response.status}`);
-    }
-    const raw = await response.json();
-    if (!isPolicyConfig(raw)) throw new Error("Invalid policy response");
-    return raw;
-  }, { maxAttempts: 2 });
-};
-var getPolicy = async (apiKey, expectedVersion, agent, repoAware = false, sessionId) => {
-  const path = policyCacheFile(apiKey, agent, repoAware);
-  let staleCache = null;
-  if (existsSync(path)) {
-    try {
-      const stat = readFileSync(path, "utf-8");
-      const cached = JSON.parse(stat);
-      if (!isPolicyConfig(cached)) throw new Error("Corrupted cache");
-      const versionStale = expectedVersion != null && (cached._policyVersion ?? null) !== expectedVersion;
-      const sessionStale = (cached._sessionId ?? null) !== (sessionId ?? null);
-      const age = cached._cachedAt ? Date.now() - cached._cachedAt : 0;
-      const ttlFresh = !cached._cachedAt || age < CACHE_TTL_MS;
-      if (ttlFresh && !versionStale && !sessionStale) {
-        return cached;
-      }
-      if (!sessionStale && age < STALE_CACHE_MAX_MS) staleCache = cached;
-    } catch {
-    }
-  }
-  try {
-    const policy = await fetchPolicy(apiKey, agent, repoAware, sessionId);
-    try {
-      writeFileSync(path, JSON.stringify({ ...policy, _cachedAt: Date.now(), _policyVersion: expectedVersion ?? null, _sessionId: sessionId ?? null }), { encoding: "utf-8", mode: 384 });
-    } catch {
-    }
-    return policy;
-  } catch {
-    if (staleCache) return staleCache;
-    throw new Error("Failed to fetch policy and no cached policy available");
-  }
-};
-var MODE_GRACE_MS = 60 * 1e3;
-var modeStateCacheFile = (apiKey) => {
-  const hash = createHash("sha256").update(`mode:${apiKey}`).digest("hex").slice(0, 12);
-  return join(tmpdir(), `pushary-mode-${hash}.json`);
-};
-var readLastGoodMode = (apiKey) => {
-  try {
-    const path = modeStateCacheFile(apiKey);
-    if (!existsSync(path)) return null;
-    const parsed = JSON.parse(readFileSync(path, "utf-8"));
-    if (!parsed || typeof parsed.at !== "number" || !parsed.state) return null;
-    return parsed;
-  } catch {
-    return null;
-  }
-};
-var writeLastGoodMode = (apiKey, state, sessionId) => {
-  try {
-    const cached = { state, at: Date.now(), ...sessionId ? { sessionId } : {} };
-    writeFileSync(modeStateCacheFile(apiKey), JSON.stringify(cached), { encoding: "utf-8", mode: 384 });
-  } catch {
-  }
-};
-var unknownMode = () => ({
-  mode: null,
-  kill: false,
-  policyVersion: null,
-  relayUrl: null,
-  trainingConsent: false,
-  scope: null,
-  degraded: true
-});
-var degradedFallback = (apiKey, authoritative = false) => {
-  if (authoritative) return unknownMode();
-  const last = readLastGoodMode(apiKey);
-  if (last && Date.now() - last.at < MODE_GRACE_MS) {
-    return { ...last.state, degraded: false };
-  }
-  return unknownMode();
-};
-var MODE_REUSE_MS = CACHE_TTL_MS;
-var readReusableMode = (apiKey, sessionId, maxAgeMs) => {
-  const last = readLastGoodMode(apiKey);
-  if (!last || (last.sessionId ?? null) !== (sessionId ?? null)) return null;
-  if (Date.now() - last.at >= maxAgeMs) return null;
-  return { ...last.state, degraded: false };
-};
-var fetchModeState = async (apiKey, sessionId, reuseWithinMs = 0, signal) => {
-  if (reuseWithinMs > 0) {
-    const reusable = readReusableMode(apiKey, sessionId, reuseWithinMs);
-    if (reusable) return reusable;
-  }
-  try {
-    const baseUrl = getBaseUrl();
-    const url = sessionId ? `${baseUrl}/api/mcp/mode?session=${encodeURIComponent(sessionId)}` : `${baseUrl}/api/mcp/mode`;
-    const response = await fetch(url, {
-      headers: { "Authorization": `Bearer ${apiKey}` },
-      signal: AbortSignal.any([AbortSignal.timeout(3e3), ...signal ? [signal] : []])
-    });
-    if (!response.ok) {
-      void reportClientError({ kind: "http_status", code: `mode_http_${response.status}` });
-      return degradedFallback(apiKey, response.status === 401 || response.status === 403);
-    }
-    const state = modeStateFromResponse(await response.json());
-    writeLastGoodMode(apiKey, state, sessionId);
-    return state;
-  } catch (error) {
-    void reportClientError({ kind: clientErrorKindOf(error), code: "mode_fetch_failed" });
-    return degradedFallback(apiKey);
-  }
-};
-var fetchModeOverride = async (apiKey) => (await fetchModeState(apiKey)).mode;
+} from "./chunk-VOP5U2VX.js";
 
 // ../hook-mapping/src/describe.ts
 import { isAbsolute, relative, resolve } from "path";
@@ -612,7 +457,8 @@ var AGENT_IDENTITIES = {
   codebuddy: { type: "codebuddy", label: AGENT_LABELS_BY_TYPE.codebuddy },
   qoder: { type: "qoder", label: AGENT_LABELS_BY_TYPE.qoder },
   droid: { type: "droid", label: AGENT_LABELS_BY_TYPE.droid },
-  devin: { type: "devin", label: AGENT_LABELS_BY_TYPE.devin }
+  devin: { type: "devin", label: AGENT_LABELS_BY_TYPE.devin },
+  antigravity: { type: "antigravity_cli", label: AGENT_LABELS_BY_TYPE.antigravity_cli }
 };
 var TEAMMATE_IDLE_ACTION = "A teammate went idle";
 var CLAUDE_MEANINGS = {
@@ -644,6 +490,7 @@ var MEANING_BY_HOOK = {
   qoder: compatibleMeanings("qoder"),
   droid: compatibleMeanings("droid"),
   devin: compatibleMeanings("devin"),
+  antigravity: compatibleMeanings("antigravity_cli"),
   codex: {
     PostToolUse: { kind: "tool", event: "tool_complete" },
     UserPromptSubmit: { kind: "prompt", event: "user_prompt" },
@@ -789,14 +636,7 @@ var sessionIdentityOf = (payload) => {
   return { sessionId: agentId, parentSessionId: sessionId };
 };
 
-// ../hook-mapping/src/codex-rollout.ts
-var CODEX_TURN_CONTEXT_TYPE = "turn_context";
-var CODEX_AUTO_REVIEWER = "auto_review";
-var CODEX_GUARDIAN_THREAD_SOURCE = "guardian_review";
-var CODEX_PLANNED_ACTION_MARKER = "Planned action JSON:\n";
-var CODEX_APPROVAL_REQUEST_END = ">>> APPROVAL REQUEST END";
-var CODEX_SHELL_TOOL = "exec_command";
-var CODEX_SHELL_COMMAND_FLAGS = ["-lc", "-c"];
+// ../hook-mapping/src/json-record.ts
 var asRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 var parseRecord = (text) => {
   try {
@@ -805,6 +645,15 @@ var parseRecord = (text) => {
     return null;
   }
 };
+
+// ../hook-mapping/src/codex-rollout.ts
+var CODEX_TURN_CONTEXT_TYPE = "turn_context";
+var CODEX_AUTO_REVIEWER = "auto_review";
+var CODEX_GUARDIAN_THREAD_SOURCE = "guardian_review";
+var CODEX_PLANNED_ACTION_MARKER = "Planned action JSON:\n";
+var CODEX_APPROVAL_REQUEST_END = ">>> APPROVAL REQUEST END";
+var CODEX_SHELL_TOOL = "exec_command";
+var CODEX_SHELL_COMMAND_FLAGS = ["-lc", "-c"];
 var nonEmptyString = (value) => typeof value === "string" && value.length > 0 ? value : void 0;
 var isTimestamp = (value) => typeof value === "string" && Number.isFinite(Date.parse(value));
 var readCodexTurnContext = (line) => {
@@ -888,8 +737,249 @@ var codexReviewerDenialsSince = (reviews, since) => {
   });
 };
 
+// ../hook-mapping/src/transcript-usage.ts
+var TRANSCRIPT_ASSISTANT_TYPE = "assistant";
+var TRANSCRIPT_SYNTHETIC_MODEL = "<synthetic>";
+var TRANSCRIPT_RECENT_ID_LIMIT = 200;
+var TRANSCRIPT_USAGE_EVENTS = ["PostToolUse", "Stop"];
+var TRANSCRIPT_USAGE_SOURCES = ["claude", "qwen", "codebuddy", "qoder", "droid", "devin"];
+var COST_TRACKING_ENV = "PUSHARY_COST_TRACKING";
+var COST_TRACKING_OFF = "off";
+var TURN_END_EVENT = "Stop";
+var DEFAULT_MODEL_PRICES = [
+  { match: "opus-4-1", in: 15, out: 75 },
+  { match: "opus-4-0", in: 15, out: 75 },
+  { match: "3-opus", in: 15, out: 75 },
+  { match: "opus", in: 5, out: 25 },
+  { match: "haiku", in: 1, out: 5 },
+  { match: "sonnet", in: 3, out: 15 }
+];
+var FALLBACK_MODEL_PRICE = { match: "", in: 3, out: 15 };
+var CACHE_WRITE_MULTIPLIER = 1.25;
+var CACHE_READ_MULTIPLIER = 0.1;
+var TOKENS_PER_PRICE_UNIT = 1e6;
+var isPrice = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0;
+var isModelPrice = (value) => {
+  const price = asRecord(value);
+  return price !== null && typeof price.match === "string" && isPrice(price.in) && isPrice(price.out);
+};
+var estimateMessageCostUsd = (usage, model, prices = DEFAULT_MODEL_PRICES) => {
+  const price = prices.find((candidate) => model.includes(candidate.match)) ?? FALLBACK_MODEL_PRICE;
+  const perTokenIn = price.in / TOKENS_PER_PRICE_UNIT;
+  const perTokenOut = price.out / TOKENS_PER_PRICE_UNIT;
+  return usage.inputTokens * perTokenIn + usage.outputTokens * perTokenOut + usage.cacheCreationTokens * perTokenIn * CACHE_WRITE_MULTIPLIER + usage.cacheReadTokens * perTokenIn * CACHE_READ_MULTIPLIER;
+};
+var transcriptTokensIn = (usage) => usage.inputTokens + usage.cacheCreationTokens + usage.cacheReadTokens;
+var tokenCountOf = (value) => isTokenCount(value) ? value : 0;
+var nonEmptyString2 = (value) => typeof value === "string" && value.length > 0 ? value : null;
+var readTranscriptMessageUsage = (line) => {
+  const entry = parseRecord(line);
+  if (entry?.type !== TRANSCRIPT_ASSISTANT_TYPE) return null;
+  const message = asRecord(entry.message);
+  const usage = asRecord(message?.usage);
+  if (!message || !usage) return null;
+  const model = typeof message.model === "string" ? message.model : "";
+  if (model.includes(TRANSCRIPT_SYNTHETIC_MODEL)) return null;
+  return {
+    ...typeof message.id === "string" ? { id: message.id } : {},
+    model,
+    usage: {
+      inputTokens: tokenCountOf(usage.input_tokens),
+      outputTokens: tokenCountOf(usage.output_tokens),
+      cacheCreationTokens: tokenCountOf(usage.cache_creation_input_tokens),
+      cacheReadTokens: tokenCountOf(usage.cache_read_input_tokens)
+    }
+  };
+};
+var rememberTranscriptMessage = (recentIds, id) => {
+  if (!id) return { counted: true, recentIds };
+  if (recentIds.includes(id)) return { counted: false, recentIds };
+  return { counted: true, recentIds: [...recentIds, id].slice(-TRANSCRIPT_RECENT_ID_LIMIT) };
+};
+var isTranscriptUsageEvent = (event) => TRANSCRIPT_USAGE_EVENTS.includes(event);
+var endsASubagentTurn = (hook) => hook.event === TURN_END_EVENT && nonEmptyString2(hook.payload.agent_id) !== null;
+var transcriptUsageRequest = (hook) => {
+  if (hook.costTracking === COST_TRACKING_OFF) return null;
+  if (!TRANSCRIPT_USAGE_SOURCES.includes(hook.source) || !isTranscriptUsageEvent(hook.event)) return null;
+  if (endsASubagentTurn(hook)) return null;
+  const transcriptPath = nonEmptyString2(hook.payload.transcript_path);
+  const sessionId = reportableSessionId(hook.payload.session_id);
+  return transcriptPath && sessionId ? { transcriptPath, sessionId } : null;
+};
+
+// src/pending.ts
+import { join } from "path";
+import { homedir, tmpdir } from "os";
+import { createHash } from "crypto";
+import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, renameSync, unlinkSync, rmSync, statSync } from "fs";
+var PENDING_DIR = join(tmpdir(), "pushary-pending");
+var commandRoot = () => process.env.PUSHARY_COMMAND_DIR?.trim() || join(homedir(), ".pushary", "run", "commands");
+var DEFAULT_SESSION = "_no_session";
+var GRACE_MS = 10 * 60 * 1e3;
+var sanitize = (sessionId) => sessionId.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 128) || DEFAULT_SESSION;
+var dirFor = (sessionId) => join(PENDING_DIR, sanitize(sessionId));
+var commandDirFor = (sessionId, namespace = "") => join(
+  commandRoot(),
+  createHash("sha256").update(namespace).digest("hex").slice(0, 16),
+  sanitize(sessionId)
+);
+var legacyCommandFile = (sessionId, namespace = "") => join(commandDirFor(sessionId, namespace), "command.json");
+var commandFile = (sessionId, id, namespace = "") => join(commandDirFor(sessionId, namespace), `${createHash("sha256").update(id).digest("hex")}.json`);
+var readCommandFile = (file) => {
+  try {
+    const value = JSON.parse(readFileSync(file, "utf-8"));
+    if (typeof value.id !== "string" || typeof value.text !== "string" || typeof value.expiresAtMs !== "number") return null;
+    if (value.expiresAtMs <= Date.now()) {
+      unlinkSync(file);
+      return null;
+    }
+    return {
+      ...value,
+      delivered: value.delivered === true,
+      ...value.failed === true ? { failed: true } : {}
+    };
+  } catch {
+    return null;
+  }
+};
+var readPendingCommandById = (sessionId, id, namespace = "") => {
+  const current = readCommandFile(commandFile(sessionId, id, namespace));
+  if (current?.id === id) return current;
+  const legacy = readCommandFile(legacyCommandFile(sessionId, namespace));
+  return legacy?.id === id ? legacy : null;
+};
+var pruneExpiredCommands = (dir) => {
+  let files;
+  try {
+    files = readdirSync(dir).filter((file) => file.endsWith(".json"));
+  } catch {
+    return [];
+  }
+  return files.flatMap((file) => {
+    const command = readCommandFile(join(dir, file));
+    return command ? [command] : [];
+  });
+};
+var pruneExpiredCommandStore = () => {
+  let namespaces;
+  try {
+    namespaces = readdirSync(commandRoot(), { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const namespace of namespaces.filter((entry) => entry.isDirectory())) {
+    const namespaceDir = join(commandRoot(), namespace.name);
+    let sessions;
+    try {
+      sessions = readdirSync(namespaceDir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const session of sessions.filter((entry) => entry.isDirectory())) {
+      pruneExpiredCommands(join(namespaceDir, session.name));
+    }
+  }
+};
+var readPendingCommand = (sessionId, namespace = "") => {
+  const commands = pruneExpiredCommands(commandDirFor(sessionId, namespace));
+  return commands.find((command) => !command.delivered && !command.failed) ?? commands[0] ?? null;
+};
+var savePendingCommand = (sessionId, command, namespace = "") => {
+  const dir = commandDirFor(sessionId, namespace);
+  try {
+    mkdirSync(dir, { recursive: true, mode: 448 });
+    pruneExpiredCommandStore();
+    if (readPendingCommandById(sessionId, command.id, namespace)) return false;
+    writeFileSync(commandFile(sessionId, command.id, namespace), JSON.stringify(command), { encoding: "utf-8", mode: 384, flag: "wx" });
+    return true;
+  } catch {
+    return false;
+  }
+};
+var updatePendingCommand = (sessionId, id, update, namespace = "") => {
+  const command = readPendingCommandById(sessionId, id, namespace);
+  if (!command) return false;
+  const currentFile = commandFile(sessionId, id, namespace);
+  const file = existsSync(currentFile) ? currentFile : legacyCommandFile(sessionId, namespace);
+  const temporary = `${file}.${process.pid}.tmp`;
+  try {
+    writeFileSync(temporary, JSON.stringify({ ...command, ...update, text: "" }), { encoding: "utf-8", mode: 384 });
+    renameSync(temporary, file);
+    return true;
+  } catch {
+    try {
+      unlinkSync(temporary);
+    } catch {
+    }
+    return false;
+  }
+};
+var markPendingCommandDelivered = (sessionId, id, namespace = "") => updatePendingCommand(sessionId, id, { delivered: true, failed: void 0 }, namespace);
+var markPendingCommandFailed = (sessionId, id, namespace = "") => updatePendingCommand(sessionId, id, { delivered: false, failed: true }, namespace);
+var removePendingCommand = (sessionId, id, namespace = "") => {
+  if (!readPendingCommandById(sessionId, id, namespace)) return;
+  try {
+    unlinkSync(commandFile(sessionId, id, namespace));
+  } catch {
+  }
+  try {
+    if (readCommandFile(legacyCommandFile(sessionId, namespace))?.id === id) {
+      unlinkSync(legacyCommandFile(sessionId, namespace));
+    }
+  } catch {
+  }
+};
+var isDefaultSession = (sessionId) => sanitize(sessionId) === DEFAULT_SESSION;
+var listPendingQuestionsForToolUse = (sessionId, toolUseId) => {
+  if (!toolUseId) return [];
+  const dir = dirFor(sessionId);
+  let files;
+  try {
+    files = readdirSync(dir);
+  } catch {
+    return [];
+  }
+  return files.filter((name) => {
+    try {
+      return readFileSync(join(dir, name), "utf-8") === toolUseId;
+    } catch {
+      return false;
+    }
+  });
+};
+var listPendingQuestions = (sessionId) => {
+  const dir = dirFor(sessionId);
+  let files;
+  try {
+    files = readdirSync(dir);
+  } catch {
+    return [];
+  }
+  if (!isDefaultSession(sessionId)) return files;
+  const cutoff = Date.now() - GRACE_MS;
+  return files.filter((name) => {
+    try {
+      return statSync(join(dir, name)).mtimeMs < cutoff;
+    } catch {
+      return false;
+    }
+  });
+};
+var removePendingQuestion = (sessionId, correlationId) => {
+  try {
+    unlinkSync(join(dirFor(sessionId), correlationId));
+  } catch {
+  }
+};
+var removePendingSession = (sessionId) => {
+  try {
+    rmSync(dirFor(sessionId), { recursive: true, force: true });
+  } catch {
+  }
+};
+
 // src/repo.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, statSync } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
 import { basename as basename2, dirname, isAbsolute as isAbsolute2, join as join2, resolve as resolve2 } from "path";
 var MAX_PARENT_WALK = 64;
 var GIT_FILE_PREFIX = "gitdir:";
@@ -899,7 +989,7 @@ var findGitDir = (startDir) => {
     const candidate = join2(current, ".git");
     try {
       if (existsSync2(candidate)) {
-        if (statSync(candidate).isDirectory()) return candidate;
+        if (statSync2(candidate).isDirectory()) return candidate;
         const pointer = readFileSync2(candidate, "utf-8").trim();
         if (pointer.startsWith(GIT_FILE_PREFIX)) {
           const target = pointer.slice(GIT_FILE_PREFIX.length).trim();
@@ -972,51 +1062,172 @@ var repoKeyFor = (cwd) => {
   return derived;
 };
 
-// src/usage.ts
-import { closeSync, mkdirSync, openSync, readFileSync as readFileSync3, readSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
+// src/policy.ts
 import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
 import { join as join3 } from "path";
 import { tmpdir as tmpdir2 } from "os";
-var DEFAULT_PRICES = [
-  { match: "opus-4-1", in: 15, out: 75 },
-  { match: "opus-4-0", in: 15, out: 75 },
-  { match: "3-opus", in: 15, out: 75 },
-  { match: "opus", in: 5, out: 25 },
-  { match: "haiku", in: 1, out: 5 },
-  { match: "sonnet", in: 3, out: 15 }
-];
-var FALLBACK_PRICE = { match: "", in: 3, out: 15 };
-var CACHE_WRITE_MULTIPLIER = 1.25;
-var CACHE_READ_MULTIPLIER = 0.1;
-var RECENT_ID_LIMIT = 200;
-var READ_CHUNK_BYTES = 1024 * 1024;
-var isModelPrice = (value) => {
-  if (!value || typeof value !== "object") return false;
-  const candidate = value;
-  return typeof candidate.match === "string" && typeof candidate.in === "number" && typeof candidate.out === "number";
+var CACHE_TTL_MS = 60 * 1e3;
+var STALE_CACHE_MAX_MS = 12 * 60 * 60 * 1e3;
+var policyRequestFor = (agentType) => ({
+  agent: agentType,
+  repoAware: REPO_AWARE_AGENTS.includes(agentType)
+});
+var policyCacheFile = (apiKey, agent, repoAware = false) => {
+  const parts = [apiKey, agent, repoAware ? "repoAware" : void 0, "sessionToolAware"].filter(Boolean);
+  const hash = createHash2("sha256").update(parts.join(":")).digest("hex").slice(0, 12);
+  return join3(tmpdir2(), `pushary-policy-${hash}.json`);
+};
+var fetchPolicy = async (apiKey, agent, repoAware = false, sessionId) => {
+  return withRetry(async () => {
+    const baseUrl = getBaseUrl();
+    const params = new URLSearchParams();
+    if (agent) params.set("agent", agent);
+    if (repoAware) params.set("repoAware", "1");
+    params.set("scopeAware", "1");
+    params.set("sessionToolAware", "1");
+    if (sessionId) params.set("sessionId", sessionId);
+    const query = params.toString();
+    const url = query ? `${baseUrl}/api/mcp/policy?${query}` : `${baseUrl}/api/mcp/policy`;
+    const response = await fetch(url, {
+      headers: { "Authorization": `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!response.ok) {
+      throw new Error(`Failed to fetch policy: ${response.status}`);
+    }
+    const raw = await response.json();
+    if (!isPolicyConfig(raw)) throw new Error("Invalid policy response");
+    return raw;
+  }, { maxAttempts: 2 });
+};
+var getPolicy = async (apiKey, expectedVersion, agent, repoAware = false, sessionId) => {
+  const path = policyCacheFile(apiKey, agent, repoAware);
+  let staleCache = null;
+  if (existsSync3(path)) {
+    try {
+      const stat = readFileSync3(path, "utf-8");
+      const cached = JSON.parse(stat);
+      if (!isPolicyConfig(cached)) throw new Error("Corrupted cache");
+      const versionStale = expectedVersion != null && (cached._policyVersion ?? null) !== expectedVersion;
+      const sessionStale = (cached._sessionId ?? null) !== (sessionId ?? null);
+      const age = cached._cachedAt ? Date.now() - cached._cachedAt : 0;
+      const ttlFresh = !cached._cachedAt || age < CACHE_TTL_MS;
+      if (ttlFresh && !versionStale && !sessionStale) {
+        return cached;
+      }
+      if (!sessionStale && age < STALE_CACHE_MAX_MS) staleCache = cached;
+    } catch {
+    }
+  }
+  try {
+    const policy = await fetchPolicy(apiKey, agent, repoAware, sessionId);
+    try {
+      writeFileSync2(path, JSON.stringify({ ...policy, _cachedAt: Date.now(), _policyVersion: expectedVersion ?? null, _sessionId: sessionId ?? null }), { encoding: "utf-8", mode: 384 });
+    } catch {
+    }
+    return policy;
+  } catch {
+    if (staleCache) return staleCache;
+    throw new Error("Failed to fetch policy and no cached policy available");
+  }
+};
+var MODE_GRACE_MS = 60 * 1e3;
+var modeStateCacheFile = (apiKey) => {
+  const hash = createHash2("sha256").update(`mode:${apiKey}`).digest("hex").slice(0, 12);
+  return join3(tmpdir2(), `pushary-mode-${hash}.json`);
+};
+var readLastGoodMode = (apiKey) => {
+  try {
+    const path = modeStateCacheFile(apiKey);
+    if (!existsSync3(path)) return null;
+    const parsed = JSON.parse(readFileSync3(path, "utf-8"));
+    if (!parsed || typeof parsed.at !== "number" || !parsed.state) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+};
+var writeLastGoodMode = (apiKey, state, sessionId) => {
+  try {
+    const cached = { state, at: Date.now(), ...sessionId ? { sessionId } : {} };
+    writeFileSync2(modeStateCacheFile(apiKey), JSON.stringify(cached), { encoding: "utf-8", mode: 384 });
+  } catch {
+  }
+};
+var unknownMode = () => ({
+  mode: null,
+  kill: false,
+  policyVersion: null,
+  relayUrl: null,
+  trainingConsent: false,
+  scope: null,
+  degraded: true
+});
+var degradedFallback = (apiKey, authoritative = false) => {
+  if (authoritative) return unknownMode();
+  const last = readLastGoodMode(apiKey);
+  if (last && Date.now() - last.at < MODE_GRACE_MS) {
+    return { ...last.state, degraded: false };
+  }
+  return unknownMode();
+};
+var MODE_REUSE_MS = CACHE_TTL_MS;
+var readReusableMode = (apiKey, sessionId, maxAgeMs) => {
+  const last = readLastGoodMode(apiKey);
+  if (!last || (last.sessionId ?? null) !== (sessionId ?? null)) return null;
+  if (Date.now() - last.at >= maxAgeMs) return null;
+  return { ...last.state, degraded: false };
+};
+var fetchModeState = async (apiKey, sessionId, reuseWithinMs = 0, signal) => {
+  if (reuseWithinMs > 0) {
+    const reusable = readReusableMode(apiKey, sessionId, reuseWithinMs);
+    if (reusable) return reusable;
+  }
+  try {
+    const baseUrl = getBaseUrl();
+    const url = sessionId ? `${baseUrl}/api/mcp/mode?session=${encodeURIComponent(sessionId)}` : `${baseUrl}/api/mcp/mode`;
+    const response = await fetch(url, {
+      headers: { "Authorization": `Bearer ${apiKey}` },
+      signal: AbortSignal.any([AbortSignal.timeout(3e3), ...signal ? [signal] : []])
+    });
+    if (!response.ok) {
+      void reportClientError({ kind: "http_status", code: `mode_http_${response.status}` });
+      return degradedFallback(apiKey, response.status === 401 || response.status === 403);
+    }
+    const state = modeStateFromResponse(await response.json());
+    writeLastGoodMode(apiKey, state, sessionId);
+    return state;
+  } catch (error) {
+    void reportClientError({ kind: clientErrorKindOf(error), code: "mode_fetch_failed" });
+    return degradedFallback(apiKey);
+  }
 };
+var fetchModeOverride = async (apiKey) => (await fetchModeState(apiKey)).mode;
+
+// src/usage.ts
+import { closeSync, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync4, readSync, statSync as statSync3, writeFileSync as writeFileSync3 } from "fs";
+import { createHash as createHash3 } from "crypto";
+import { join as join4 } from "path";
+import { tmpdir as tmpdir3 } from "os";
+var READ_CHUNK_BYTES = 1024 * 1024;
 var priceTable = () => {
   const raw = process.env.PUSHARY_MODEL_PRICING?.trim();
-  if (!raw) return DEFAULT_PRICES;
+  if (!raw) return DEFAULT_MODEL_PRICES;
   try {
     const parsed = JSON.parse(raw);
     if (Array.isArray(parsed) && parsed.length > 0 && parsed.every(isModelPrice)) return parsed;
   } catch {
   }
-  return DEFAULT_PRICES;
-};
-var estimateCostUsd = (usage, model) => {
-  const price = priceTable().find((p) => model.includes(p.match)) ?? FALLBACK_PRICE;
-  const perTokenIn = price.in / 1e6;
-  const perTokenOut = price.out / 1e6;
-  return usage.inputTokens * perTokenIn + usage.outputTokens * perTokenOut + usage.cacheCreationTokens * perTokenIn * CACHE_WRITE_MULTIPLIER + usage.cacheReadTokens * perTokenIn * CACHE_READ_MULTIPLIER;
+  return DEFAULT_MODEL_PRICES;
 };
-var stateDir = () => process.env.PUSHARY_USAGE_DIR?.trim() || join3(tmpdir2(), "pushary-usage");
-var stateFile = (sessionId) => join3(stateDir(), sessionId.replace(/[^a-zA-Z0-9_-]/g, "_"));
+var estimateCostUsd = (usage, model) => estimateMessageCostUsd(usage, model, priceTable());
+var stateDir = () => process.env.PUSHARY_USAGE_DIR?.trim() || join4(tmpdir3(), "pushary-usage");
+var stateFile = (sessionId) => join4(stateDir(), sessionId.replace(/[^a-zA-Z0-9_-]/g, "_"));
 var emptyState = () => ({ offset: 0, tokensIn: 0, tokensOut: 0, costUsd: 0, recentIds: [] });
 var readState = (path) => {
   try {
-    const parsed = JSON.parse(readFileSync3(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync4(path, "utf-8"));
     if (typeof parsed.offset === "number" && parsed.offset >= 0 && typeof parsed.tokensIn === "number" && typeof parsed.tokensOut === "number" && typeof parsed.costUsd === "number" && Array.isArray(parsed.recentIds)) {
       return {
         offset: parsed.offset,
@@ -1048,34 +1259,15 @@ var readRange = (path, start, end) => {
     closeSync(fd);
   }
 };
-var toCount = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : 0;
 var applyLine = (state, line) => {
-  let parsed;
-  try {
-    parsed = JSON.parse(line);
-  } catch {
-    return 0;
-  }
-  if (parsed.type !== "assistant") return 0;
-  const usage = parsed.message?.usage;
-  if (!usage || typeof usage !== "object") return 0;
-  const model = typeof parsed.message?.model === "string" ? parsed.message.model : "";
-  if (model.includes("<synthetic>")) return 0;
-  const id = typeof parsed.message?.id === "string" ? parsed.message.id : null;
-  if (id) {
-    if (state.recentIds.includes(id)) return 0;
-    state.recentIds.push(id);
-    if (state.recentIds.length > RECENT_ID_LIMIT) state.recentIds.splice(0, state.recentIds.length - RECENT_ID_LIMIT);
-  }
-  const messageUsage = {
-    inputTokens: toCount(usage.input_tokens),
-    outputTokens: toCount(usage.output_tokens),
-    cacheCreationTokens: toCount(usage.cache_creation_input_tokens),
-    cacheReadTokens: toCount(usage.cache_read_input_tokens)
-  };
-  const cost = estimateCostUsd(messageUsage, model);
-  state.tokensIn += messageUsage.inputTokens + messageUsage.cacheCreationTokens + messageUsage.cacheReadTokens;
-  state.tokensOut += messageUsage.outputTokens;
+  const message = readTranscriptMessageUsage(line);
+  if (!message) return 0;
+  const memory = rememberTranscriptMessage(state.recentIds, message.id);
+  if (!memory.counted) return 0;
+  state.recentIds = [...memory.recentIds];
+  const cost = estimateCostUsd(message.usage, message.model);
+  state.tokensIn += transcriptTokensIn(message.usage);
+  state.tokensOut += message.usage.outputTokens;
   state.costUsd += cost;
   return cost;
 };
@@ -1091,7 +1283,7 @@ var extractUserText = (content) => {
 };
 var readLastUserPrompt = (transcriptPath) => {
   try {
-    const size = statSync2(transcriptPath).size;
+    const size = statSync3(transcriptPath).size;
     const start = Math.max(0, size - USER_PROMPT_TAIL_BYTES);
     const lines = readRange(transcriptPath, start, size).toString("utf-8").split("\n");
     for (let i = lines.length - 1; i >= 0; i -= 1) {
@@ -1114,7 +1306,7 @@ var readLastUserPrompt = (transcriptPath) => {
 };
 var readNewUsage = (transcriptPath, sessionId) => {
   try {
-    const file = statSync2(transcriptPath);
+    const file = statSync3(transcriptPath);
     const size = file.size;
     const path = stateFile(sessionId);
     let state = readState(path);
@@ -1132,14 +1324,14 @@ var readNewUsage = (transcriptPath, sessionId) => {
         state.offset += lastNewline + 1;
       }
     }
-    mkdirSync(stateDir(), { recursive: true });
-    writeFileSync2(path, JSON.stringify(state), "utf-8");
+    mkdirSync2(stateDir(), { recursive: true });
+    writeFileSync3(path, JSON.stringify(state), "utf-8");
     if (state.tokensIn === 0 && state.tokensOut === 0) return null;
     return {
       // Identical cursor-range reports share an identity across transport retries.
       // Native message identity distinguishes an in-place rotation of the range.
       // This does not serialize readers of different, potentially overlapping ranges.
-      eventId: createHash2("sha256").update(JSON.stringify([
+      eventId: createHash3("sha256").update(JSON.stringify([
         sessionId,
         file.dev,
         file.ino,
@@ -1215,10 +1407,10 @@ var permissionTimeoutDecision = (timeoutAction) => {
 var preToolUseTimeoutDecision = (timeoutAction, denyReason = "No response within timeout") => timeoutAction === "deny" ? codexDeny(denyReason) : codexPass();
 
 // src/codex-call-decision.ts
-import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync4, readdirSync, rmSync, statSync as statSync3, writeFileSync as writeFileSync3 } from "fs";
-import { tmpdir as tmpdir3, userInfo } from "os";
-import { join as join4 } from "path";
+import { createHash as createHash4 } from "crypto";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync5, readdirSync as readdirSync2, rmSync as rmSync2, statSync as statSync4, writeFileSync as writeFileSync4 } from "fs";
+import { tmpdir as tmpdir4, userInfo } from "os";
+import { join as join5 } from "path";
 var CODEX_DECISION_TTL_MS = 60 * 1e3;
 var userScope = () => {
   try {
@@ -1229,8 +1421,8 @@ var userScope = () => {
     return "default";
   }
 };
-var decisionDir = () => join4(tmpdir3(), `pushary-codex-decisions-${userScope()}`);
-var decisionFile = (key) => join4(decisionDir(), key);
+var decisionDir = () => join5(tmpdir4(), `pushary-codex-decisions-${userScope()}`);
+var decisionFile = (key) => join5(decisionDir(), key);
 var PRESENTATION_ONLY_INPUT_KEYS = ["description"];
 var identifyingToolInput = (toolInput) => {
   if (!toolInput) return {};
@@ -1249,7 +1441,7 @@ var codexCallKey = (identity) => {
     identity.toolName,
     identifyingToolInput(identity.toolInput)
   ]);
-  return createHash3("sha256").update(material, "utf-8").digest("hex").slice(0, 32);
+  return createHash4("sha256").update(material, "utf-8").digest("hex").slice(0, 32);
 };
 var parseDecision = (raw) => {
   try {
@@ -1268,10 +1460,10 @@ var parseDecision = (raw) => {
 };
 var sweepExpired = (dir, nowMs) => {
   try {
-    for (const name of readdirSync(dir)) {
-      const path = join4(dir, name);
+    for (const name of readdirSync2(dir)) {
+      const path = join5(dir, name);
       try {
-        if (nowMs - statSync3(path).mtimeMs >= CODEX_DECISION_TTL_MS) rmSync(path, { force: true });
+        if (nowMs - statSync4(path).mtimeMs >= CODEX_DECISION_TTL_MS) rmSync2(path, { force: true });
       } catch {
         continue;
       }
@@ -1284,9 +1476,9 @@ var recordCodexCallDecision = (key, decision) => {
   if (!key) return;
   try {
     const dir = decisionDir();
-    if (!existsSync3(dir)) mkdirSync2(dir, { recursive: true, mode: 448 });
+    if (!existsSync4(dir)) mkdirSync3(dir, { recursive: true, mode: 448 });
     else sweepExpired(dir, Date.now());
-    writeFileSync3(decisionFile(key), JSON.stringify(decision), { encoding: "utf-8", mode: 384 });
+    writeFileSync4(decisionFile(key), JSON.stringify(decision), { encoding: "utf-8", mode: 384 });
   } catch {
     return;
   }
@@ -1295,9 +1487,9 @@ var consumeCodexCallDecision = (key) => {
   if (!key) return null;
   const path = decisionFile(key);
   try {
-    const fresh = Date.now() - statSync3(path).mtimeMs < CODEX_DECISION_TTL_MS;
-    const raw = readFileSync4(path, "utf-8");
-    rmSync(path, { force: true });
+    const fresh = Date.now() - statSync4(path).mtimeMs < CODEX_DECISION_TTL_MS;
+    const raw = readFileSync5(path, "utf-8");
+    rmSync2(path, { force: true });
     return fresh ? parseDecision(raw) : null;
   } catch {
     return null;
@@ -1314,32 +1506,32 @@ var phoneDrivenEnv = (base) => ({
 });
 
 // src/throttle.ts
-import { join as join5 } from "path";
-import { tmpdir as tmpdir4 } from "os";
-import { createHash as createHash4 } from "crypto";
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, statSync as statSync4, writeFileSync as writeFileSync4, rmSync as rmSync2 } from "fs";
-var THROTTLE_DIR = join5(tmpdir4(), "pushary-throttle");
-var markerPath = (key) => join5(THROTTLE_DIR, createHash4("sha256").update(key).digest("hex").slice(0, 16));
+import { join as join6 } from "path";
+import { tmpdir as tmpdir5 } from "os";
+import { createHash as createHash5 } from "crypto";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, statSync as statSync5, writeFileSync as writeFileSync5, rmSync as rmSync3 } from "fs";
+var THROTTLE_DIR = join6(tmpdir5(), "pushary-throttle");
+var markerPath = (key) => join6(THROTTLE_DIR, createHash5("sha256").update(key).digest("hex").slice(0, 16));
 var claimThrottle = (key, windowMs) => {
   try {
     const path = markerPath(key);
-    if (existsSync4(path) && Date.now() - statSync4(path).mtimeMs < windowMs) return "throttled";
-    mkdirSync3(THROTTLE_DIR, { recursive: true });
-    writeFileSync4(path, "", "utf-8");
+    if (existsSync5(path) && Date.now() - statSync5(path).mtimeMs < windowMs) return "throttled";
+    mkdirSync4(THROTTLE_DIR, { recursive: true });
+    writeFileSync5(path, "", "utf-8");
     return "passed";
   } catch {
     return "unavailable";
   }
 };
 var releaseThrottle = (key) => {
-  rmSync2(markerPath(key), { force: true });
+  rmSync3(markerPath(key), { force: true });
 };
 
 // src/blocked-action-hint.ts
-import { createHash as createHash5 } from "crypto";
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync5, readdirSync as readdirSync2, rmSync as rmSync3, statSync as statSync5, utimesSync } from "fs";
-import { tmpdir as tmpdir5 } from "os";
-import { join as join6 } from "path";
+import { createHash as createHash6 } from "crypto";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync6, readdirSync as readdirSync3, rmSync as rmSync4, statSync as statSync6, utimesSync } from "fs";
+import { tmpdir as tmpdir6 } from "os";
+import { join as join7 } from "path";
 var BLOCKED_ACTION_HINT_TTL_MS = BLOCKED_ACTION_GRANT_TTL_SECONDS * 1e3;
 var FINGERPRINT = /^[0-9a-f]{64}$/;
 var isFingerprint = (value) => typeof value === "string" && FINGERPRINT.test(value);
@@ -1354,17 +1546,17 @@ var blockedActionFingerprint = ({ source = "claude", sessionId, toolName, toolIn
   const [canonicalInput] = canonical.toolInputs;
   if (!canonicalInput) return null;
   const subject = blockedActionSubject(source, sessionId, canonical.toolName, canonicalInput, cwd);
-  return subject ? createHash5("sha256").update(blockedActionIdentity(subject), "utf8").digest("hex") : null;
+  return subject ? createHash6("sha256").update(blockedActionIdentity(subject), "utf8").digest("hex") : null;
 };
-var hintDir = () => join6(tmpdir5(), `pushary-blocked-action-hints-${userScope()}`);
-var hintFile = (fingerprint) => join6(hintDir(), fingerprint);
+var hintDir = () => join7(tmpdir6(), `pushary-blocked-action-hints-${userScope()}`);
+var hintFile = (fingerprint) => join7(hintDir(), fingerprint);
 var isExpired = (mtimeMs, nowMs) => nowMs - mtimeMs >= BLOCKED_ACTION_HINT_TTL_MS;
 var sweepExpired2 = (dir, nowMs) => {
   try {
-    for (const name of readdirSync2(dir)) {
-      const path = join6(dir, name);
+    for (const name of readdirSync3(dir)) {
+      const path = join7(dir, name);
       try {
-        if (isExpired(statSync5(path).mtimeMs, nowMs)) rmSync3(path, { force: true });
+        if (isExpired(statSync6(path).mtimeMs, nowMs)) rmSync4(path, { force: true });
       } catch {
         continue;
       }
@@ -1377,7 +1569,7 @@ var recordBlockedActionHint = (fingerprint, approved) => {
   if (!isFingerprint(fingerprint)) return false;
   try {
     const dir = hintDir();
-    if (!existsSync5(dir)) mkdirSync4(dir, { recursive: true, mode: 448 });
+    if (!existsSync6(dir)) mkdirSync5(dir, { recursive: true, mode: 448 });
     else sweepExpired2(dir, Date.now());
     writeFileAtomic(hintFile(fingerprint), JSON.stringify({ fingerprint, ...approved }), 384);
     return true;
@@ -1388,13 +1580,13 @@ var recordBlockedActionHint = (fingerprint, approved) => {
 var readLiveHint = (fingerprint) => {
   const path = hintFile(fingerprint);
   try {
-    const stat = statSync5(path);
+    const stat = statSync6(path);
     if (!stat.isFile()) return null;
     if (isExpired(stat.mtimeMs, Date.now())) {
-      rmSync3(path, { force: true });
+      rmSync4(path, { force: true });
       return null;
     }
-    const parsed = JSON.parse(readFileSync5(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync6(path, "utf-8"));
     return parsed?.fingerprint === fingerprint ? parsed : null;
   } catch {
     return null;
@@ -1409,7 +1601,7 @@ var approvalIn = (fingerprint, sessionId) => {
 var approvalAwaitingRetry = (sessionId) => {
   if (!sessionId) return null;
   try {
-    for (const name of readdirSync2(hintDir())) {
+    for (const name of readdirSync3(hintDir())) {
       const approval = isFingerprint(name) ? approvalIn(name, sessionId) : null;
       if (approval) return approval;
     }
@@ -1421,7 +1613,7 @@ var approvalAwaitingRetry = (sessionId) => {
 var markApprovalReminded = (approval) => {
   const path = hintFile(approval.fingerprint);
   try {
-    const { atime, mtime } = statSync5(path);
+    const { atime, mtime } = statSync6(path);
     const { fingerprint, sessionId, toolName } = approval;
     writeFileAtomic(path, JSON.stringify({ fingerprint, sessionId, toolName, reminded: true }), 384);
     utimesSync(path, atime, mtime);
@@ -1432,64 +1624,64 @@ var markApprovalReminded = (approval) => {
 var forgetBlockedActionHint = (fingerprint) => {
   if (!isFingerprint(fingerprint)) return;
   try {
-    rmSync3(hintFile(fingerprint), { force: true });
+    rmSync4(hintFile(fingerprint), { force: true });
   } catch {
     return;
   }
 };
 
 // src/background-work.ts
-import { createHash as createHash6 } from "crypto";
-import { mkdirSync as mkdirSync5, rmSync as rmSync4, statSync as statSync6, writeFileSync as writeFileSync5 } from "fs";
-import { tmpdir as tmpdir6 } from "os";
-import { join as join7 } from "path";
+import { createHash as createHash7 } from "crypto";
+import { mkdirSync as mkdirSync6, rmSync as rmSync5, statSync as statSync7, writeFileSync as writeFileSync6 } from "fs";
+import { tmpdir as tmpdir7 } from "os";
+import { join as join8 } from "path";
 var BACKGROUND_WORK_TTL_MS = 60 * 60 * 1e3;
-var backgroundWorkDir = () => join7(tmpdir6(), "pushary-background-work");
-var markerFor = (sessionKey) => join7(backgroundWorkDir(), createHash6("sha256").update(sessionKey).digest("hex"));
+var backgroundWorkDir = () => join8(tmpdir7(), "pushary-background-work");
+var markerFor = (sessionKey) => join8(backgroundWorkDir(), createHash7("sha256").update(sessionKey).digest("hex"));
 var hasRunningBackgroundTasks = (backgroundTasks) => Array.isArray(backgroundTasks) && backgroundTasks.length > 0;
 var noteBackgroundWork = (sessionKey, running) => {
   try {
     if (!running) {
-      rmSync4(markerFor(sessionKey), { force: true });
+      rmSync5(markerFor(sessionKey), { force: true });
       return;
     }
-    mkdirSync5(backgroundWorkDir(), { recursive: true, mode: 448 });
-    writeFileSync5(markerFor(sessionKey), "", { mode: 384 });
+    mkdirSync6(backgroundWorkDir(), { recursive: true, mode: 448 });
+    writeFileSync6(markerFor(sessionKey), "", { mode: 384 });
   } catch {
     return;
   }
 };
 var isWaitingOnBackgroundWork = (sessionKey, nowMs = Date.now()) => {
   try {
-    return nowMs - statSync6(markerFor(sessionKey)).mtimeMs < BACKGROUND_WORK_TTL_MS;
+    return nowMs - statSync7(markerFor(sessionKey)).mtimeMs < BACKGROUND_WORK_TTL_MS;
   } catch {
     return false;
   }
 };
 
 // src/events.ts
-import { basename as basename3, join as join8 } from "path";
-import { existsSync as existsSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync6, statSync as statSync7, writeFileSync as writeFileSync6 } from "fs";
-import { tmpdir as tmpdir7 } from "os";
-var INTENT_DIR = join8(tmpdir7(), "pushary-intent");
+import { basename as basename3, join as join9 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync7, readFileSync as readFileSync7, statSync as statSync8, writeFileSync as writeFileSync7 } from "fs";
+import { tmpdir as tmpdir8 } from "os";
+var INTENT_DIR = join9(tmpdir8(), "pushary-intent");
 var INTENT_MAX_BYTES = 2048;
 var INTENT_GRACE_MS = 10 * 60 * 1e3;
 var sanitizeSession = (sessionId) => sessionId.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 128) || DEFAULT_SESSION;
-var intentFile = (sessionId) => join8(INTENT_DIR, sanitizeSession(sessionId));
+var intentFile = (sessionId) => join9(INTENT_DIR, sanitizeSession(sessionId));
 var saveLastPrompt = (sessionId, prompt) => {
   try {
     const trimmed = prompt.replace(/\s+/g, " ").trim().slice(0, INTENT_MAX_BYTES);
     if (!trimmed) return;
-    mkdirSync6(INTENT_DIR, { recursive: true });
-    writeFileSync6(intentFile(sessionId), trimmed, "utf-8");
+    mkdirSync7(INTENT_DIR, { recursive: true });
+    writeFileSync7(intentFile(sessionId), trimmed, "utf-8");
   } catch {
   }
 };
 var readLastPrompt = (sessionId) => {
   try {
     const path = intentFile(sessionId);
-    if (isDefaultSession(sessionId) && statSync7(path).mtimeMs < Date.now() - INTENT_GRACE_MS) return void 0;
-    const value = readFileSync6(path, "utf-8").trim();
+    if (isDefaultSession(sessionId) && statSync8(path).mtimeMs < Date.now() - INTENT_GRACE_MS) return void 0;
+    const value = readFileSync7(path, "utf-8").trim();
     return value.length > 0 ? value : void 0;
   } catch {
     return void 0;
@@ -1553,8 +1745,8 @@ var POLICY_CACHE_TTL_MS = 5 * 60 * 1e3;
 var readFreshCachedPolicy = (apiKey, agentType, sessionId) => {
   const request = policyRequestFor(agentType);
   const path = policyCacheFile(apiKey, request.agent, request.repoAware);
-  if (!existsSync6(path)) return null;
-  const cached = JSON.parse(readFileSync6(path, "utf-8"));
+  if (!existsSync7(path)) return null;
+  const cached = JSON.parse(readFileSync7(path, "utf-8"));
   if (!isPolicyConfig(cached)) return null;
   if ((cached._sessionId ?? null) !== (sessionId ?? null)) return null;
   if (!cached._cachedAt || Date.now() - cached._cachedAt >= POLICY_CACHE_TTL_MS) return null;
@@ -1597,10 +1789,12 @@ var deriveAutoDecisionBeacon = (toolName, toolInput, liveMode, agentType, cwd, s
 };
 var AUTO_DECISION_WINDOW_MS = 15 * 60 * 1e3;
 var HOOK_ACTIVE_WINDOW_MS = 30 * 60 * 1e3;
-var deriveUsage = (transcriptPath, sessionId) => {
-  if (!transcriptPath || process.env.PUSHARY_COST_TRACKING === "off") return void 0;
+var deriveUsage = (payload, agent, event) => {
+  const source = HOOK_SOURCES.find((candidate) => AGENT_IDENTITIES[candidate].type === agent.type);
+  const request = source ? transcriptUsageRequest({ source, event, payload, costTracking: process.env[COST_TRACKING_ENV] }) : null;
+  if (!request) return void 0;
   try {
-    return readNewUsage(transcriptPath, sessionId || DEFAULT_SESSION) ?? void 0;
+    return readNewUsage(request.transcriptPath, request.sessionId) ?? void 0;
   } catch {
     return void 0;
   }
@@ -1789,7 +1983,7 @@ var handlePostToolUse = async (input, agent = CLAUDE_CODE_AGENT) => {
       decisionSource,
       ...beacon ? { decisionOrigin: beacon.decisionOrigin, toolName: beacon.toolName, toolTarget: beacon.toolTarget } : {},
       meta: receiptsEnabled ? deriveReceiptMeta(lookup.tool, lookup.input, toolResult, input.cwd ?? process.cwd()) : void 0,
-      usage: deriveUsage(input.transcript_path, input.session_id)
+      usage: deriveUsage(input, agent, "PostToolUse")
     }, {
       maxAttempts: 1,
       budgetMs: Math.min(DRAINING_REPORT_BUDGET_MS, Math.max(0, deadline - Date.now())),
@@ -1868,7 +2062,7 @@ var handleStop = async (input, agent = CLAUDE_CODE_AGENT) => {
         agentName: `${agent.label} - ${projectName}`,
         action: summarizeStop(input),
         ...sessionIdentityOf(input),
-        usage: deriveUsage(input.transcript_path, input.session_id)
+        usage: deriveUsage(input, agent, "Stop")
       }, { maxAttempts: 1, budgetMs: Math.min(DRAINING_REPORT_BUDGET_MS, Math.max(0, deadline - Date.now())), signal })
     ];
     if (late.length > 0) {
@@ -2053,11 +2247,6 @@ var handleStopFailure = async (input, agent = CLAUDE_CODE_AGENT) => {
 };
 
 export {
-  policyRequestFor,
-  getPolicy,
-  fetchModeState,
-  fetchModeOverride,
-  phoneDrivenEnv,
   HOOK_FALLBACK_MAX,
   UNNAMED_ACTION,
   describeToolCall,
@@ -2075,9 +2264,21 @@ export {
   isCodexGuardianRolloutHead,
   scanCodexGuardianReviews,
   codexReviewerDenialsSince,
+  phoneDrivenEnv,
+  DEFAULT_SESSION,
+  readPendingCommandById,
+  readPendingCommand,
+  savePendingCommand,
+  markPendingCommandDelivered,
+  markPendingCommandFailed,
+  removePendingCommand,
   repoKeyFor,
   claimThrottle,
   releaseThrottle,
+  policyRequestFor,
+  getPolicy,
+  fetchModeState,
+  fetchModeOverride,
   readLastUserPrompt,
   CODEX_AGENT,
   codexAllow,