@pushary/agent-hooks 0.75.0 → 0.76.1

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## 0.76.0
+
+### A phone-supplied field could switch your approval gate off
+
+`pushary claude --remote` sessions started from the phone build their command
+line from fields the request supplies. The wrapper then read that command line
+back to learn what it had been asked to do, and it scanned every position without
+knowing which ones were a flag's **value** rather than a flag.
+
+So a prompt or a model of `--permission-mode=dontAsk` was read as a real
+permission mode. `dontAsk`, `plan` and `auto` all defer to the agent's own prompt
+unconditionally, which means the session stopped asking you for approvals
+entirely, and the decision log recorded a session that was never gated. A clean
+approval history that is not true is worse than a missing one.
+
+Flag values are now consumed with the flag that owns them, so nothing a request
+supplies can be mistaken for an instruction. A `--permission-mode` you passed
+yourself still works, in both the `--permission-mode plan` and
+`--permission-mode=plan` forms.
+
+The server that queues these sessions now also refuses flag-shaped model and
+working-directory values, so an out-of-date CLI is protected against those two.
+It cannot do the same for the prompt, which is free text you are entitled to
+start with a dash, so **updating is what closes this one properly.**
+
+Reaching it needed an authenticated session on your own account, spawning to your
+own machine, with the daemon running. It is not cross-tenant and not remote code
+execution. It matters most where the person spawning is not the person governed:
+Team approval routing, Partner, and any case where a phone session or API key has
+been compromised.
+
 ## 0.75.0
 
 ### An agent can now run the install

package/dist/bin/pushary-claude.js

@@ -1047,13 +1047,16 @@ var flagValue = (args2, index) => {
   const next = args2[index + 1];
   return next && !next.startsWith("-") ? next : void 0;
 };
+var PASS_THROUGH_VALUE_FLAGS = /* @__PURE__ */ new Set(["--model", "-m", "--cwd", "--add-dir", "--settings"]);
 var parseRemoteArgs = (args2) => {
   let initialPrompt;
   let resume;
   let permissionMode;
   for (let i = 0; i < args2.length; i++) {
     const arg = args2[i];
-    if (arg === "-p" || arg === "--print" || arg?.startsWith("--print=")) {
+    if (PASS_THROUGH_VALUE_FLAGS.has(arg ?? "")) {
+      i++;
+    } else if (arg === "-p" || arg === "--print" || arg?.startsWith("--print=")) {
       initialPrompt = flagValue(args2, i);
     } else if (arg === "-r" || arg === "--resume" || arg?.startsWith("--resume=")) {
       resume = flagValue(args2, i);

package/dist/bin/pushary-daemon.js

@@ -51,7 +51,9 @@ var isAuthFailure = (err) => {
   return candidate.status === 401 || candidate.status === 403;
 };
 var NATIVE_AGENT_BINARIES = { codex: "codex", gemini: "gemini" };
+var isFlagShapedPrompt = (prompt) => prompt.trimStart().startsWith("-");
 var buildSpawnLaunch = (req, opts) => {
+  if (isFlagShapedPrompt(req.prompt)) return null;
   const agent = req.agent === "codex" || req.agent === "gemini" ? req.agent : "claude";
   const model = typeof req.model === "string" && req.model.length > 0 ? ["--model", req.model] : [];
   if (agent === "claude") {
@@ -103,6 +105,10 @@ var runSpawnDaemon = async () => {
       pusharyBin,
       resolveNative: (name) => resolveGlobalBinary(name) ?? name
     });
+    if (!plan) {
+      stderr("[pushary] refused a phone-requested session: the prompt looks like a command-line flag\n");
+      return;
+    }
     try {
       const child = plan.direct ? spawn(plan.command, plan.args, { cwd, detached: true, stdio: "ignore", env }) : spawnClaude(plan.command, plan.args, { cwd, detached: true, stdio: "ignore", env });
       child.on("error", (err) => stderr(`[pushary] could not launch session: ${err.message}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.75.0",
+  "version": "0.76.1",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",