pushary 1.8.0

package/dist/chunk-Q7E4I6UA.js

@@ -0,0 +1,767 @@
+import {
+  activeHookSource,
+  activeIdentity
+} from "./chunk-J5TIV3J6.js";
+import {
+  defersToNativeMode,
+  reportMachineDenial
+} from "./chunk-CJVVKOSR.js";
+import {
+  isGatingMoment,
+  recordKeylessMoment
+} from "./chunk-JU6W3XAU.js";
+import {
+  announceSubscriptionRequired,
+  denyReasonFrom,
+  isDeferAnswer,
+  oncePerSession
+} from "./chunk-5OP5MQI7.js";
+import {
+  UNNAMED_ACTION,
+  approvalAwaitingRetry,
+  blockedActionFingerprint,
+  claimThrottle,
+  deriveAction,
+  deriveActionBody,
+  deriveBlocker,
+  deriveToolTarget,
+  describeToolCall,
+  fetchModeState,
+  forgetBlockedActionHint,
+  getPolicy,
+  hasBlockedActionHint,
+  markApprovalReminded,
+  permissionDeniedAction,
+  readLastPrompt,
+  readLastUserPrompt,
+  recordBlockedActionHint,
+  repoKeyFor,
+  reportEvent,
+  scopePathFor,
+  settleQuestionsForToolUse
+} from "./chunk-CULUZTWQ.js";
+import {
+  DEFAULT_SESSION
+} from "./chunk-N6IOSZOE.js";
+import {
+  DECISION_STOP_REASON,
+  UNVERIFIABLE_APPROVAL_REASON,
+  askUser,
+  cancelQuestion,
+  claimBlockedAction,
+  isDecisionStopped,
+  isLocalQuestionHandoff,
+  pollForAnswer,
+  requestGate,
+  sendNotification,
+  waitForQuestion
+} from "./chunk-NGDD6TXY.js";
+import {
+  SubscriptionRequiredError
+} from "./chunk-M5ICYGHT.js";
+import {
+  getMachineId
+} from "./chunk-LXQ5FBBD.js";
+import {
+  getApiKey,
+  getBaseUrl
+} from "./chunk-GPEGOGRJ.js";
+import {
+  AGENT_QUESTION_STRATEGY,
+  GATE_BLOCK_REASON_MAX_LENGTH,
+  GATE_WIRE,
+  agentQuestionStrategy,
+  agentRulesAllowEveryInput,
+  buildDecisionEpisodeFeatures,
+  claudeAllowlistOwnsCall,
+  claudeConsultsItsAllowlist,
+  claudePermissionDeniedOutput,
+  claudePermissionRequestOutput,
+  claudePermissionRulesFromSettings,
+  claudePreToolUseOutput,
+  claudePromptsBeforeAnEdit,
+  editAsksAtTheAgentsPrompt,
+  effectiveWaitSeconds,
+  hookHoldWindowMs,
+  hookWaitClamped,
+  hookWaitDeadline,
+  hookWritePath,
+  isBlockedActionRequest,
+  isPermissionRequestOwnedByPreToolUse,
+  isPusharyOwnTool,
+  parseAgentQuestionAnswers,
+  parseAgentQuestions,
+  resolveGate,
+  stoppedOutput
+} from "./chunk-NQTHFF4W.js";
+
+// src/claude-permission-rules.ts
+import { readFileSync, statSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var MANAGED_CLAUDE_SETTINGS_BY_PLATFORM = {
+  darwin: "/Library/Application Support/ClaudeCode/managed-settings.json",
+  linux: "/etc/claude-code/managed-settings.json",
+  win32: "C:\\ProgramData\\ClaudeCode\\managed-settings.json"
+};
+var MAX_CLAUDE_SETTINGS_BYTES = 1048576;
+var claudeSettingsLocationFor = (cwd, environment = process.env, home = homedir(), platform = process.platform) => ({
+  configDir: environment.CLAUDE_CONFIG_DIR || join(home, ".claude"),
+  projectDir: environment.CLAUDE_PROJECT_DIR || cwd || void 0,
+  managedSettingsPath: MANAGED_CLAUDE_SETTINGS_BY_PLATFORM[platform]
+});
+var claudeSettingsSources = (location) => [
+  ...location.managedSettingsPath ? [{ path: location.managedSettingsPath, trust: "grants" }] : [],
+  { path: join(location.configDir, "settings.json"), trust: "grants" },
+  ...location.projectDir ? [
+    { path: join(location.projectDir, ".claude", "settings.json"), trust: "restricts_only" },
+    { path: join(location.projectDir, ".claude", "settings.local.json"), trust: "grants" }
+  ] : []
+];
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var restrictionsOnly = (document) => {
+  if (!isRecord(document) || !isRecord(document.permissions)) return null;
+  const { ask: ask2, deny: deny2 } = document.permissions;
+  return { permissions: { ask: ask2, deny: deny2 } };
+};
+var readSettingsDocument = (path) => {
+  try {
+    const stats = statSync(path);
+    if (!stats.isFile() || stats.size > MAX_CLAUDE_SETTINGS_BYTES) return null;
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+};
+var trustedDocument = ({ path, trust }) => {
+  const document = readSettingsDocument(path);
+  return trust === "grants" ? document : restrictionsOnly(document);
+};
+var readClaudePermissionRules = (location) => claudePermissionRulesFromSettings(claudeSettingsSources(location).map(trustedDocument));
+
+// src/decision-episode.ts
+var EPISODE_PATH = "/api/agent/decision-episode";
+var EMIT_TIMEOUT_MS = 3e3;
+var buildEpisodeBody = (input) => ({
+  sessionId: input.sessionId,
+  machineId: input.machineId,
+  agentType: input.agentType,
+  features: buildDecisionEpisodeFeatures(input)
+});
+var reportDecisionEpisode = async (apiKey, input) => {
+  try {
+    const baseUrl = getBaseUrl();
+    await fetch(`${baseUrl}${EPISODE_PATH}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify(buildEpisodeBody(input)),
+      signal: AbortSignal.timeout(EMIT_TIMEOUT_MS)
+    });
+  } catch {
+  }
+};
+
+// src/hook.ts
+import { basename } from "path";
+var START_MS = Date.now();
+var ACTIVE_AGENT = activeIdentity(process.argv);
+var ACTIVE_SOURCE = activeHookSource(process.argv);
+var agentNameIn = (projectName) => `${ACTIVE_AGENT.label} - ${projectName}`;
+var allow = (reason) => claudePreToolUseOutput("allow", reason);
+var deny = (reason) => claudePreToolUseOutput("deny", reason);
+var allowWithInput = (updatedInput) => claudePreToolUseOutput("allow", void 0, updatedInput);
+var ask = (reason) => claudePreToolUseOutput("ask", reason);
+var halted = (reason) => stoppedOutput(deny(reason), reason);
+var outcomeOfFailedAsk = (error, sessionId, failure) => {
+  if (!(error instanceof SubscriptionRequiredError)) return failure;
+  announceSubscriptionRequired(error.upgradeUrl, sessionId);
+  return void 0;
+};
+var storedWaitDeadline = (result, requestedDeadline) => {
+  const stored = result.waitEndsAt ? Date.parse(result.waitEndsAt) : Number.NaN;
+  return Number.isFinite(stored) ? Math.min(stored, requestedDeadline) : requestedDeadline;
+};
+var handlePushOnly = async (apiKey, description, projectName, timeoutSeconds, timeoutAction, sessionId, machineId, toolName, toolTarget, decision, signals) => {
+  const effectiveWait = effectiveWaitSeconds(timeoutAction, timeoutSeconds, "claude");
+  const now = Date.now();
+  const requestedDeadline = hookWaitDeadline(START_MS, effectiveWait, "claude", now);
+  const clampCut = hookWaitClamped(START_MS, effectiveWait, "claude", now);
+  let result;
+  try {
+    result = await askUser(apiKey, {
+      question: `Allow ${description || UNNAMED_ACTION}?`,
+      type: "confirm",
+      context: `Agent wants to run this in ${projectName}`,
+      agentName: agentNameIn(projectName),
+      sessionId,
+      machineId,
+      toolName,
+      toolTarget,
+      waitEndsAt: timeoutAction !== "approve" && timeoutAction !== "deny" || clampCut ? new Date(requestedDeadline).toISOString() : void 0,
+      ...decision
+    });
+  } catch (error) {
+    return outcomeOfFailedAsk(error, sessionId, halted(UNVERIFIABLE_APPROVAL_REASON));
+  }
+  if (isDecisionStopped(result)) return halted(DECISION_STOP_REASON);
+  const deadline = storedWaitDeadline(result, requestedDeadline);
+  if (!isLocalQuestionHandoff(result) && !result.answered) announceWait(effectiveWait, result.answerUrl, sessionId);
+  const answer = await waitForQuestion(apiKey, result, deadline);
+  if (isDecisionStopped(answer)) return halted(DECISION_STOP_REASON);
+  if (!answer.answered && isLocalQuestionHandoff(result)) return ask("Approve in the current client.");
+  if (answer.answered) {
+    if (isDeferAnswer(answer.value)) return ask("Handling on your machine");
+    signals.humanDecision = true;
+    return answer.value === "yes" ? allow() : deny(denyReasonFrom(answer.value, answer.note));
+  }
+  if (timeoutAction === "wait" || clampCut || deadline < requestedDeadline) {
+    return ask("The phone question was withdrawn. Approve in the current client.");
+  }
+  switch (timeoutAction) {
+    case "approve":
+      return allow();
+    case "deny":
+      return deny("No response within timeout");
+    default:
+      return ask("No push response, asking in terminal");
+  }
+};
+var handleTerminalOnly = () => {
+  return ask();
+};
+var handlePushFirst = async (apiKey, description, projectName, pushFirstSeconds, sessionId, machineId, toolName, toolTarget, decision, signals) => {
+  const requestedDeadline = hookWaitDeadline(START_MS, pushFirstSeconds, "claude", Date.now());
+  let result;
+  try {
+    result = await askUser(apiKey, {
+      question: `Allow ${description || UNNAMED_ACTION}?`,
+      type: "confirm",
+      context: `Agent wants to run this in ${projectName}`,
+      agentName: agentNameIn(projectName),
+      sessionId,
+      machineId,
+      toolName,
+      toolTarget,
+      waitEndsAt: new Date(requestedDeadline).toISOString(),
+      ...decision
+    });
+  } catch (error) {
+    return outcomeOfFailedAsk(error, sessionId, halted(UNVERIFIABLE_APPROVAL_REASON));
+  }
+  if (isDecisionStopped(result)) return halted(DECISION_STOP_REASON);
+  if (!isLocalQuestionHandoff(result) && !result.answered) announceWait(pushFirstSeconds, result.answerUrl, sessionId);
+  const deadline = storedWaitDeadline(result, requestedDeadline);
+  const answer = await waitForQuestion(apiKey, result, deadline, 1500);
+  if (isDecisionStopped(answer)) return halted(DECISION_STOP_REASON);
+  if (answer.answered) {
+    if (isDeferAnswer(answer.value)) return ask("Handling on your machine");
+    signals.humanDecision = true;
+    return answer.value === "yes" ? allow() : deny(denyReasonFrom(answer.value, answer.note));
+  }
+  return ask("The phone question was withdrawn. Approve in the current client.");
+};
+var handleNotifyOnly = async (apiKey, description, projectName, sessionId, machineId) => {
+  try {
+    await sendNotification(apiKey, {
+      title: "Agent needs approval",
+      body: description,
+      agentName: agentNameIn(projectName),
+      sessionId,
+      machineId
+    });
+  } catch {
+  }
+  return ask();
+};
+var emitDecisionEpisode = (apiKey, input, toolPolicy, machineId, toolTarget, decision, result) => {
+  const verdict = result?.hookSpecificOutput?.permissionDecision;
+  const outcome = verdict === "allow" ? "approve" : verdict === "deny" ? "deny" : null;
+  if (!outcome) return;
+  const ti = input.tool_input ?? {};
+  const commandOrPath = typeof ti.command === "string" ? ti.command : typeof ti.file_path === "string" ? ti.file_path : typeof ti.path === "string" ? ti.path : void 0;
+  void reportDecisionEpisode(apiKey, {
+    toolName: input.tool_name,
+    commandOrPath,
+    intent: decision.intent,
+    toolTarget,
+    agentType: ACTIVE_AGENT.type,
+    matchedPattern: toolPolicy.tool,
+    policyMode: toolPolicy.mode,
+    timeoutSeconds: toolPolicy.timeoutSeconds,
+    timeoutAction: toolPolicy.timeoutAction,
+    // Reaching a handler means a human gate was requested (auto-allow/deny
+    // returned earlier in the caller before dispatch).
+    requestedGate: "ask",
+    decision: outcome,
+    // Truthfully human: the caller only emits when signals.humanDecision is set
+    // (a real phone answer). Bronze label until reason + execution-outcome land.
+    origin: "human",
+    latencyMs: Date.now() - START_MS,
+    sessionId: input.session_id,
+    machineId
+  });
+};
+var dispatchModeHandler = async (apiKey, input, toolPolicy, machineId, trainingConsent = false, scopeReason, scopePath) => {
+  const description = describeToolCall(input.tool_name, input.tool_input, "hook");
+  const projectName = basename(input.cwd ?? process.cwd());
+  const sessionId = input.session_id;
+  const toolTarget = deriveToolTarget(input.tool_name, input.tool_input);
+  const intent = readLastPrompt(sessionId ?? DEFAULT_SESSION) ?? (input.transcript_path ? readLastUserPrompt(input.transcript_path) : void 0);
+  const decision = {
+    toolPath: hookWritePath(input.tool_name, input.tool_input),
+    intent,
+    action: deriveAction(input.tool_name, input.tool_input),
+    blocker: scopeReason ?? deriveBlocker(toolPolicy.mode),
+    actionBody: deriveActionBody(input.tool_name, input.tool_input),
+    repoKey: repoKeyFor(input.cwd),
+    // Only when the breach is what caused the question, so an ordinary approval
+    // can never silently widen a scope.
+    scopePath: scopeReason ? scopePath : void 0,
+    // The gate asks at most one question per tool call, so the runtime's id needs
+    // no suffix here. Absent on runtimes that do not send one, and the server then
+    // creates a fresh decision exactly as before.
+    toolUseId: input.tool_use_id,
+    sessionToolAware: true
+  };
+  const signals = {};
+  const runHandler = () => {
+    switch (toolPolicy.mode) {
+      case "push_only":
+        return handlePushOnly(apiKey, description, projectName, toolPolicy.timeoutSeconds, toolPolicy.timeoutAction, sessionId, machineId, input.tool_name, toolTarget, decision, signals);
+      case "terminal_only":
+        return Promise.resolve(handleTerminalOnly());
+      case "push_first":
+        return handlePushFirst(apiKey, description, projectName, toolPolicy.pushFirstSeconds, sessionId, machineId, input.tool_name, toolTarget, decision, signals);
+      case "notify_only":
+        return handleNotifyOnly(apiKey, description, projectName, sessionId, machineId);
+      default:
+        return handlePushFirst(apiKey, description, projectName, toolPolicy.pushFirstSeconds, sessionId, machineId, input.tool_name, toolTarget, decision, signals);
+    }
+  };
+  const result = await runHandler();
+  if (trainingConsent && signals.humanDecision) {
+    emitDecisionEpisode(apiKey, input, toolPolicy, machineId, toolTarget, decision, result);
+  }
+  return result;
+};
+var announceWait = (waitSeconds, answerUrl, sessionId) => {
+  try {
+    const handoff = waitSeconds > 0 ? `Waiting ${waitSeconds}s, then this terminal takes over.` : "Waiting for your answer.";
+    process.stderr.write(`[pushary] Sent to your phone. ${handoff}
+`);
+    if (answerUrl && oncePerSession("answerurl", sessionId)) {
+      process.stderr.write(`          Answer here instead: ${answerUrl}
+`);
+    }
+  } catch {
+  }
+};
+var KEYLESS_NOTICE = "[pushary] Not connected (no API key), so your agent runs untouched. Approval moments are counted locally; see them with: npx @pushary/agent-hooks@latest stats. Connect: https://pushary.com/sign-up?utm_source=cli&utm_medium=keyless-hook";
+var keylessNoticeOnce = (sessionId) => {
+  try {
+    if (!oncePerSession("keyless", sessionId)) return;
+    process.stderr.write(`${KEYLESS_NOTICE}
+`);
+  } catch {
+  }
+};
+var shouldDeferToNativeMode = defersToNativeMode;
+var withLabels = (question) => ({
+  ...question,
+  labels: question.options.map((option) => option.label)
+});
+var withoutLabels = ({ labels: _, ...question }) => question;
+var parseQuestions = (toolInput) => parseAgentQuestions(toolInput)?.map(withLabels);
+var questionContext = (question, index, total, project) => {
+  const subject = question.header ? `${question.header}: your agent is asking in ${project}` : `Your agent is asking in ${project}`;
+  return total > 1 ? `${subject} (${index + 1} of ${total})` : subject;
+};
+var askAsOneCard = async (apiKey, input, parsed, projectName, deadline) => {
+  const only = parsed[0];
+  let result;
+  try {
+    result = await askUser(apiKey, {
+      question: only.question,
+      type: "select",
+      options: [...only.labels],
+      questions: parsed.map(withoutLabels),
+      context: questionContext(only, 0, 1, projectName),
+      agentName: agentNameIn(projectName),
+      sessionId: input.session_id,
+      machineId: getMachineId(),
+      toolName: "AskUserQuestion",
+      toolUseId: input.tool_use_id,
+      waitEndsAt: new Date(deadline).toISOString()
+    });
+  } catch (error) {
+    return outcomeOfFailedAsk(error, input.session_id, null);
+  }
+  if (isDecisionStopped(result)) return null;
+  const answer = await waitForQuestion(apiKey, result, storedWaitDeadline(result, deadline));
+  if (isDecisionStopped(answer)) return null;
+  const values = answer.answered && answer.value ? parseAgentQuestionAnswers(parsed, answer.value) : null;
+  if (!values || isDeferAnswer(answer.value)) {
+    return void 0;
+  }
+  return values;
+};
+var askQuestionByQuestion = async (apiKey, input, parsed, projectName, deadline) => {
+  const answers = {};
+  for (const [index, question] of parsed.entries()) {
+    let result;
+    try {
+      result = await askUser(apiKey, {
+        question: question.question,
+        type: "select",
+        options: [...question.labels],
+        questions: [withoutLabels(question)],
+        context: questionContext(question, index, parsed.length, projectName),
+        agentName: agentNameIn(projectName),
+        sessionId: input.session_id,
+        machineId: getMachineId(),
+        toolName: "AskUserQuestion",
+        // One AskUserQuestion call raises several questions, and their payload
+        // fingerprints are identical (same tool, no target, no body). Without the
+        // index they would all collapse onto the first decision.
+        toolUseId: input.tool_use_id ? `${input.tool_use_id}#q${index}` : void 0,
+        waitEndsAt: new Date(deadline).toISOString()
+      });
+    } catch (error) {
+      return outcomeOfFailedAsk(error, input.session_id, null);
+    }
+    if (isDecisionStopped(result)) return null;
+    const answer = await waitForQuestion(apiKey, result, storedWaitDeadline(result, deadline));
+    if (isDecisionStopped(answer)) return null;
+    const legacyValue = answer.answered ? answer.value?.trim() : void 0;
+    const values = legacyValue ? parseAgentQuestionAnswers([question], legacyValue) ?? parseAgentQuestionAnswers([question], JSON.stringify({
+      [question.question]: question.multiSelect ? JSON.stringify([legacyValue]) : legacyValue
+    })) : null;
+    const value = values?.[question.question];
+    if (!value || isDeferAnswer(answer.value)) {
+      return void 0;
+    }
+    answers[question.question] = value;
+  }
+  return answers;
+};
+var handleAskUserQuestion = async (apiKey, input, modeState) => {
+  if (modeState.askHandoff) return void 0;
+  const parsed = parseQuestions(input.tool_input ?? {});
+  if (!parsed) return void 0;
+  const projectName = basename(input.cwd ?? process.cwd());
+  const deadline = hookWaitDeadline(START_MS, effectiveWaitSeconds("wait", 0, "claude"), "claude", Date.now());
+  const answers = parsed.length === 1 ? await askAsOneCard(apiKey, input, parsed, projectName, deadline) : await askQuestionByQuestion(apiKey, input, parsed, projectName, deadline);
+  if (answers === null) return halted(DECISION_STOP_REASON);
+  if (!answers) return void 0;
+  return allowWithInput({ ...input.tool_input ?? {}, answers });
+};
+var PLAN_APPROVE = "Approve, start coding";
+var PLAN_KEEP_PLANNING = "Keep planning";
+var handleExitPlanMode = async (apiKey, input) => {
+  const toolInput = input.tool_input ?? {};
+  const projectName = basename(input.cwd ?? process.cwd());
+  const deadline = hookWaitDeadline(START_MS, effectiveWaitSeconds("wait", 0, "claude"), "claude", Date.now());
+  let result;
+  try {
+    result = await askUser(apiKey, {
+      question: `Approve the plan and start coding in ${projectName}?`,
+      type: "select",
+      options: [PLAN_APPROVE, PLAN_KEEP_PLANNING],
+      context: `Your agent finished planning in ${projectName} and is waiting to start.`,
+      agentName: agentNameIn(projectName),
+      sessionId: input.session_id,
+      machineId: getMachineId(),
+      toolName: "ExitPlanMode",
+      action: deriveAction("ExitPlanMode", toolInput),
+      // The plan markdown itself, through the same redaction and cap as any diff,
+      // so approving from a lock screen is a real decision and not a blind yes.
+      actionBody: deriveActionBody("ExitPlanMode", toolInput),
+      intent: readLastPrompt(input.session_id ?? DEFAULT_SESSION) ?? (input.transcript_path ? readLastUserPrompt(input.transcript_path) : void 0),
+      blocker: "Waiting for you to approve the plan",
+      waitEndsAt: new Date(deadline).toISOString()
+    });
+  } catch (error) {
+    return outcomeOfFailedAsk(error, input.session_id, halted(DECISION_STOP_REASON));
+  }
+  if (isDecisionStopped(result)) return halted(DECISION_STOP_REASON);
+  const answer = await waitForQuestion(apiKey, result, storedWaitDeadline(result, deadline));
+  if (isDecisionStopped(answer)) return halted(DECISION_STOP_REASON);
+  const value = answer.answered ? (answer.value ?? "").trim() : "";
+  if (!value || isDeferAnswer(answer.value)) {
+    return void 0;
+  }
+  if (value === PLAN_APPROVE) return allow();
+  return deny("Plan declined from the phone. Ask what to change before coding.");
+};
+var handleKeyless = (input) => {
+  try {
+    if (isGatingMoment(input.tool_name, input.tool_input ?? {})) {
+      recordKeylessMoment({
+        ts: Date.now(),
+        tool: input.tool_name,
+        project: basename(input.cwd ?? process.cwd()),
+        sessionId: input.session_id
+      });
+    }
+    keylessNoticeOnce(input.session_id);
+  } catch {
+  }
+  return void 0;
+};
+var claudePermissionRulesFor = (input) => ACTIVE_SOURCE === "claude" ? readClaudePermissionRules(claudeSettingsLocationFor(input.cwd)) : null;
+var claudeRulesMayCover = (input, rules) => rules !== null && claudeConsultsItsAllowlist(input.permission_mode) && agentRulesAllowEveryInput(rules, input.tool_name, [input.tool_input ?? {}], input.cwd);
+var claudeGateInput = (modeState, config, input, canonical) => {
+  const toolName = canonical?.toolName ?? input.tool_name;
+  const toolInputs = canonical?.toolInputs ?? [input.tool_input ?? {}];
+  return {
+    modeState,
+    config,
+    toolName,
+    toolInputs,
+    scopePaths: modeState.scope ? toolInputs.flatMap((args) => {
+      const path = scopePathFor(toolName, args, input.cwd);
+      return path ? [path] : [];
+    }) : [],
+    cwd: input.cwd,
+    repoKey: repoKeyFor(input.cwd),
+    sessionId: input.session_id
+  };
+};
+var unreadableReason = "Pushary could not read every target of this call. Use a supported command or a single-file edit.";
+var batchScopeReason = "This patch exceeds the agreed scope. Split it into single-file edits so each additional path can be approved.";
+var BLOCKED_ACTION_GATE_TIMEOUT_MS = 15e3;
+var BLOCKED_ACTION_CLAIM_TIMEOUT_MS = 4e3;
+var BLOCKED_ACTION_ALLOW_REASON = "Approved from Pushary after auto mode blocked it";
+var BLOCKED_ACTION_CHANGED_RETRY_REASON = "This is not the call the person allowed from Pushary, so their approval does not cover it. Send the call auto mode blocked again, exactly as it was with nothing changed, to use their approval.";
+var blockReasonOf = (reason) => typeof reason === "string" ? reason.trim().slice(0, GATE_BLOCK_REASON_MAX_LENGTH).trim() || void 0 : void 0;
+var blockedActionFingerprintFor = (input) => blockedActionFingerprint({
+  sessionId: input.session_id,
+  toolName: input.tool_name,
+  toolInput: input.tool_input,
+  cwd: input.cwd
+});
+var blockedActionGateRequest = (input, event) => ({
+  v: GATE_WIRE,
+  source: "claude",
+  event,
+  toolName: input.tool_name,
+  toolInputs: [input.tool_input ?? {}],
+  sessionId: input.session_id,
+  toolUseId: input.tool_use_id,
+  machineId: getMachineId(),
+  cwd: input.cwd,
+  repoKey: repoKeyFor(input.cwd),
+  permissionMode: input.permission_mode,
+  ...event === "PermissionDenied" ? { createDecision: true, localSurfaceAvailable: false, blockReason: blockReasonOf(input.reason) } : {}
+});
+var claimedBlockedActionRetry = async (apiKey, input) => {
+  const fingerprint = blockedActionFingerprintFor(input);
+  if (!fingerprint || !hasBlockedActionHint(fingerprint)) return false;
+  try {
+    const granted = await claimBlockedAction(
+      apiKey,
+      blockedActionGateRequest(input, "PreToolUse"),
+      BLOCKED_ACTION_CLAIM_TIMEOUT_MS
+    );
+    if (granted !== null) forgetBlockedActionHint(fingerprint);
+    return granted === true;
+  } catch {
+    return false;
+  }
+};
+var remindedOfApprovedRetry = (input) => {
+  const approval = approvalAwaitingRetry(input.session_id);
+  if (!approval || approval.reminded || approval.toolName !== input.tool_name) return false;
+  if (approval.fingerprint === blockedActionFingerprintFor(input)) return false;
+  markApprovalReminded(approval);
+  return true;
+};
+var handlePreToolUse = async (input, canonical) => {
+  if (isPusharyOwnTool(input.tool_name)) return void 0;
+  let apiKey;
+  try {
+    apiKey = getApiKey();
+  } catch {
+    return handleKeyless(input);
+  }
+  try {
+    const modeState = await fetchModeState(apiKey, input.session_id);
+    const policy = await getPolicy(apiKey, modeState.policyVersion, ACTIVE_AGENT.type, true, input.session_id);
+    const gateInput = claudeGateInput(modeState, policy, input, canonical);
+    const verdict = resolveGate(gateInput);
+    if (verdict.kind === "kill") {
+      await reportMachineDenial(input, verdict, ACTIVE_AGENT);
+      return halted(verdict.reason);
+    }
+    if (verdict.kind === "deny") {
+      await reportMachineDenial(input, verdict, ACTIVE_AGENT);
+      return deny(verdict.reason);
+    }
+    if (canonical === null) return deny(unreadableReason);
+    if (verdict.kind === "gate" && verdict.scopeReason && (canonical?.toolInputs.length ?? 0) > 1) return deny(batchScopeReason);
+    if (agentQuestionStrategy(ACTIVE_SOURCE, "PreToolUse", input.tool_name) === AGENT_QUESTION_STRATEGY.native) return void 0;
+    if (input.tool_name === "AskUserQuestion") {
+      return handleAskUserQuestion(apiKey, input, modeState);
+    }
+    if (input.tool_name === "ExitPlanMode") {
+      return handleExitPlanMode(apiKey, input);
+    }
+    if (await claimedBlockedActionRetry(apiKey, input)) return allow(BLOCKED_ACTION_ALLOW_REASON);
+    if (remindedOfApprovedRetry(input)) return deny(BLOCKED_ACTION_CHANGED_RETRY_REASON);
+    if (!(verdict.kind === "gate" && verdict.scopeReason) && shouldDeferToNativeMode(input.permission_mode, input.tool_name)) {
+      return void 0;
+    }
+    if (claudeAllowlistOwnsCall(gateInput, verdict, input.permission_mode, claudePermissionRulesFor(input))) return void 0;
+    if (claudePromptsBeforeAnEdit(input.permission_mode) && editAsksAtTheAgentsPrompt(gateInput, verdict)) return handleTerminalOnly();
+    switch (verdict.kind) {
+      case "allow":
+        return allow();
+      // No `deny` case: it is handled above the defer, and the compiler enforces
+      // that it stays there. Restoring one here would type-error as unreachable.
+      //
+      // State we could not establish, with an auto-approve on the table. No
+      // opinion, so Claude Code's own flow runs as if the hook were absent.
+      case "defer":
+        return void 0;
+      default:
+        return dispatchModeHandler(apiKey, input, verdict.policy, getMachineId(), modeState.trainingConsent, verdict.scopeReason, verdict.scopePath);
+    }
+  } catch {
+    return void 0;
+  }
+};
+var permReqAllow = (updatedInput) => claudePermissionRequestOutput("allow", void 0, updatedInput);
+var permReqDeny = (message) => claudePermissionRequestOutput("deny", message);
+var permReqHalted = (reason) => stoppedOutput(permReqDeny(reason), reason);
+var toPermissionRequestOutput = (hookOutput) => {
+  if (!hookOutput) return void 0;
+  const d = hookOutput.hookSpecificOutput;
+  if (d.permissionDecision === "allow") return permReqAllow(d.updatedInput);
+  if (d.permissionDecision === "deny") return permReqDeny(d.permissionDecisionReason);
+  return void 0;
+};
+var handlePermissionRequest = async (input, canonical) => {
+  const claudeRules = claudePermissionRulesFor(input);
+  if (canonical === void 0 && !claudeRulesMayCover(input, claudeRules) && isPermissionRequestOwnedByPreToolUse(input.tool_name, input.permission_mode, shouldDeferToNativeMode)) return void 0;
+  if (isPusharyOwnTool(input.tool_name)) return void 0;
+  let apiKey;
+  try {
+    apiKey = getApiKey();
+  } catch {
+    return void 0;
+  }
+  try {
+    const modeState = await fetchModeState(apiKey, input.session_id);
+    const policy = await getPolicy(apiKey, modeState.policyVersion, ACTIVE_AGENT.type, true, input.session_id);
+    const gateInput = claudeGateInput(modeState, policy, input, canonical);
+    const verdict = resolveGate(gateInput);
+    if (verdict.kind === "kill") {
+      await reportMachineDenial(input, verdict, ACTIVE_AGENT);
+      return permReqHalted(verdict.reason);
+    }
+    if (verdict.kind === "deny") {
+      await reportMachineDenial(input, verdict, ACTIVE_AGENT);
+      return permReqDeny(verdict.reason);
+    }
+    if (canonical === null) return permReqDeny(unreadableReason);
+    if (agentQuestionStrategy(ACTIVE_SOURCE, "PermissionRequest", input.tool_name) === AGENT_QUESTION_STRATEGY.native) return void 0;
+    if (verdict.kind === "gate" && verdict.scopeReason && (canonical?.toolInputs.length ?? 0) > 1) return permReqDeny(batchScopeReason);
+    if (!(verdict.kind === "gate" && verdict.scopeReason) && !claudeAllowlistOwnsCall(gateInput, verdict, input.permission_mode, claudeRules) && isPermissionRequestOwnedByPreToolUse(input.tool_name, input.permission_mode, shouldDeferToNativeMode)) return void 0;
+    switch (verdict.kind) {
+      case "allow":
+        return permReqAllow();
+      // No opinion, so Claude Code's own dialog shows.
+      case "defer":
+        return void 0;
+      default:
+        return toPermissionRequestOutput(
+          await dispatchModeHandler(apiKey, input, verdict.policy, getMachineId(), modeState.trainingConsent, verdict.scopeReason, verdict.scopePath)
+        );
+    }
+  } catch {
+    return void 0;
+  }
+};
+var reportPermissionDenied = (input) => reportEvent({
+  event: "permission_denied",
+  occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+  toolUseId: input.tool_use_id,
+  agentType: ACTIVE_AGENT.type,
+  agentName: agentNameIn(basename(input.cwd ?? process.cwd())),
+  action: permissionDeniedAction(input.tool_name),
+  sessionId: input.session_id
+  // Side report, not a command carrier. Without timeoutMs this takes the phone's
+  // queued instruction and acknowledges it delivered, and this hook can print
+  // only {retry}. 4s rather than the Notification path's 2.5s because
+  // PermissionDenied holds the agent for the full hook budget, not 10s.
+}, { timeoutMs: 4e3 }).catch(() => void 0);
+var isAffirmativeAnswer = (answer) => answer.answered && !isDecisionStopped(answer) && answer.value === "yes";
+var PERMISSION_DENIED_NOTICE_WINDOW_MS = 5 * 60 * 1e3;
+var blockedActionHoldEndsAt = (holdBudgetSeconds) => START_MS + hookHoldWindowMs("claude", holdBudgetSeconds);
+var notifyPermissionDenied = async (apiKey, input) => {
+  const sessionKey = input.session_id || DEFAULT_SESSION;
+  if (claimThrottle(`permdenied:${sessionKey}:${input.tool_name}`, PERMISSION_DENIED_NOTICE_WINDOW_MS) !== "passed") return;
+  const mode = await fetchModeState(apiKey, input.session_id).catch(() => null);
+  if (mode?.kill || mode?.mode === "terminal_only") return;
+  const projectName = basename(input.cwd ?? process.cwd());
+  await sendNotification(apiKey, {
+    title: `Auto mode blocked ${input.tool_name}`,
+    body: `Your agent was denied ${input.tool_name} in ${projectName}.`,
+    agentName: agentNameIn(projectName),
+    sessionId: input.session_id
+  }, 4e3).catch(() => void 0);
+};
+var isRetryOutput = (output) => {
+  if (!output) return false;
+  try {
+    const parsed = JSON.parse(output);
+    return parsed?.hookSpecificOutput?.hookEventName === "PermissionDenied" && parsed.hookSpecificOutput.retry === true;
+  } catch {
+    return false;
+  }
+};
+var approvedCallOf = (input) => input.session_id ? { sessionId: input.session_id, toolName: input.tool_name } : void 0;
+var retryOnce = (fingerprint, input) => recordBlockedActionHint(fingerprint, approvedCallOf(input)) ? claudePermissionDeniedOutput("allow") : void 0;
+var askAboutBlockedAction = async (apiKey, input, fingerprint, holdEndsAt) => {
+  const reply = await requestGate(apiKey, blockedActionGateRequest(input, "PermissionDenied"), BLOCKED_ACTION_GATE_TIMEOUT_MS);
+  if (!reply) return void 0;
+  if (reply.kind === "no_opinion") return isRetryOutput(reply.output) ? retryOnce(fingerprint, input) : void 0;
+  if (reply.kind !== "ask" || !reply.correlationId || reply.deadlineSeconds === void 0) return void 0;
+  if (reply.noDevices) {
+    await cancelQuestion(apiKey, reply.correlationId, AbortSignal.timeout(4e3)).catch(() => void 0);
+    return void 0;
+  }
+  const deadline = Math.min(hookWaitDeadline(START_MS, reply.deadlineSeconds, "claude", Date.now()), holdEndsAt);
+  const answer = await pollForAnswer(apiKey, reply.correlationId, deadline);
+  return isAffirmativeAnswer(answer) ? retryOnce(fingerprint, input) : void 0;
+};
+var handlePermissionDenied = async (input, holdBudgetSeconds) => {
+  await reportPermissionDenied(input);
+  if (isPusharyOwnTool(input.tool_name)) return void 0;
+  let apiKey;
+  try {
+    apiKey = getApiKey();
+  } catch {
+    return void 0;
+  }
+  try {
+    await settleQuestionsForToolUse(input.session_id || DEFAULT_SESSION, input.tool_use_id);
+    if (!isBlockedActionRequest({ source: "claude", event: "PermissionDenied", toolName: input.tool_name })) return void 0;
+    const fingerprint = blockedActionFingerprintFor(input);
+    if (!fingerprint) return void 0;
+    const holdEndsAt = blockedActionHoldEndsAt(holdBudgetSeconds);
+    if (holdEndsAt - Date.now() <= BLOCKED_ACTION_GATE_TIMEOUT_MS) {
+      await notifyPermissionDenied(apiKey, input);
+      return void 0;
+    }
+    return await askAboutBlockedAction(apiKey, input, fingerprint, holdEndsAt);
+  } catch {
+    return void 0;
+  }
+};
+
+export {
+  handlePreToolUse,
+  handlePermissionRequest,
+  handlePermissionDenied
+};