@pushary/agent-hooks 0.84.0 → 0.85.0

package/CHANGELOG.md

@@ -1,5 +1,68 @@
 # Changelog
 
+## 0.85.0
+
+### A hook command that cannot outlive what it points at
+
+Every hook command written into `~/.claude/settings.json`, `~/.codex/hooks.json`
+and `~/.gemini/settings.json`, the free bell included, is now wrapped so that a missing binary, a removed
+`node`, a changed npm prefix or a moved home directory exits 0 and the agent reads
+"no opinion". Before, any of those turned every tool call into a failing hook.
+The guard is tested on every shell that can be `/bin/sh`, including dash, and with
+`node` off PATH, which used to exit 127 and print on every tool call.
+
+Codex hashes the exact command string to trust a hook, so `pushary upgrade` rewrites
+the trust entry when it re-applies the hooks.
+
+### Hooks registered for the CLI you have
+
+Claude Code events are registered from a table with a version floor per event.
+`SubagentStart`, `SubagentStop`, `PreCompact`, `PostCompact` and `TeammateIdle`
+are added on a CLI that understands them, and `pushary upgrade` re-registers
+against the CLI you have now. Disconnect removes every event in the table; a
+hand-typed list used to leave the five observability events behind.
+
+### `pushary disconnect <agent>`
+
+Removes the MCP server, the hooks, the skill and, for Codex, the trust entries and
+the API key from `config.toml`, for one agent, leaving the others alone. The bin
+map entry was written in a shape the build silently dropped, and the command read
+the dispatcher's own token as the agent name; both are fixed before this, its
+first release, and a test now holds every bin entry to the one shape tsup builds.
+
+### A kill switch per hook path
+
+`~/.pushary/admission-rules.json` (`{"version":1,"disabled":["claude:PostToolUse"]}`)
+silences one event on one agent, or one agent entirely, without a release. Every
+hook binary reads its input through this check, from the same file the macOS
+helper reads, so one file governs both transports. Deny-only: nothing in the file
+can enable a hook.
+
+### `PostToolUse` no longer pays two round trips per tool call
+
+The telemetry hooks reuse the mode state the gate fetched for the same session
+within the last 60 seconds. The gate itself still reads it live, so a remote stop
+and a scope contract are never served stale where they decide anything.
+
+## 0.84.1
+
+### Remote starts survive lost acknowledgements without double-launching
+
+A phone-started agent now claims exclusive process ownership before the provider
+starts. If the daemon restarts or the launch acknowledgement is lost, retrying the
+same request reconnects to the existing process instead of starting a second one.
+
+### Repository approval scopes reach Codex and Gemini
+
+Codex and Gemini sessions now carry their repository identity through approval
+requests, so repository-scoped rules stay inside the repository that created them.
+
+### Encrypted transcripts retry safely
+
+Transcript writers now retry while a session key is temporarily unavailable and
+stop on a real key conflict, preventing undecryptable transcript entries from being
+accepted or silently dropped.
+
 ## 0.84.0
 
 ### The phone can start an agent on a machine that is not running one

package/README.md

@@ -108,6 +108,29 @@ npx @pushary/agent-hooks@latest doctor
 
 Any other MCP client can use notify and ask by pointing at the Pushary MCP endpoint directly.
 
+## Hook events, gated by version
+
+Claude Code 2.1.239 names thirty-one hook events and the set grows release by release,
+so the ones we register are gated on the version actually installed. The version is
+read from disk and never by running the binary: `codex --version` once submitted the
+Codex CLI to XProtect, which killed it and moved the 181 MB binary to the Trash, so
+setup deleted the user's installation as a side effect of asking its version.
+
+An unreadable version registers only the events that predate gating. Each registration
+records `registered|<version>`, which is what lets an upgrade pick up newer events
+without anyone re-running setup.
+
+## Admission rules
+
+Publishing this package is a version bump merged to main, and a hook change is not
+live until that happens, so a hook that floods on one event would otherwise need a
+release to stop. `~/.pushary/admission-rules.json` can disable an `(agent, event)`
+pair as data.
+
+Deny-only by construction: a rule can silence a hook we ship, and no shape of the file
+can enable one we do not. A file that cannot be read admits everything, because
+failing closed would let one malformed download silence every hook on the machine.
+
 ## Commands
 
 <!-- Managed: every command below is declared in src/cli/commands.ts, and a test
@@ -123,6 +146,7 @@ logout       Remove the key this machine stores, and say what it does not remove
 connect      Connect a phone without re-running setup (--app for the Pushary app)
 bell         Free local bell when an agent finishes or needs you. No account, no key, no network
 doctor       Verify your Pushary installation is working
+disconnect   Turn off one agent (claude|codex|gemini|cursor)
 clean        Remove all Pushary configuration (--yes for non-interactive)
 mode         Switch approval mode (push_only, push_first, terminal_only)
 wait         Show or set the "wait for your phone" ladder (pushary wait 45)

package/dist/bin/pushary-bell-hook.js

@@ -2,6 +2,9 @@
 import {
   handleBell
 } from "../chunk-7PZPJSWI.js";
+import {
+  readHookInput
+} from "../chunk-6CUUA7HO.js";
 import "../chunk-K7CSRGKZ.js";
 import "../chunk-BC3VCZ3E.js";
 import "../chunk-6MTNS63X.js";
@@ -11,10 +14,9 @@ import "../chunk-MQMPG5X4.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {
-  let rawInput = "";
   try {
-    for await (const chunk of process.stdin) rawInput += chunk;
-    handleBell(rawInput.trim() ? JSON.parse(rawInput) : {});
+    const input = await readHookInput("claude");
+    if (input) handleBell(input);
   } catch {
   }
   process.stdout.write("{}");

package/dist/bin/pushary-bell.js

@@ -6,9 +6,13 @@ import {
   ring,
   upgradeThreshold
 } from "../chunk-7PZPJSWI.js";
+import {
+  guardBinary
+} from "../chunk-PWTKKQQI.js";
+import "../chunk-VT4IVERX.js";
 import {
   claudeSettings
-} from "../chunk-SEAHGHCE.js";
+} from "../chunk-HVZIHTOO.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
@@ -18,8 +22,8 @@ import {
 } from "../chunk-GMXKITVA.js";
 import {
   exitOnHelpFlag
-} from "../chunk-J4KFVOCQ.js";
-import "../chunk-MGJBC6DD.js";
+} from "../chunk-SQOFGPNX.js";
+import "../chunk-GOEXZ5QJ.js";
 import "../chunk-BC3VCZ3E.js";
 import "../chunk-DINDL2CF.js";
 import {
@@ -53,10 +57,7 @@ var isBellHook = (entry) => {
 var BELL_TIMEOUT_SECONDS = 5;
 var BELL_NOTIFICATION_MATCHER = "idle_prompt|agent_needs_input|agent_completed";
 var addBellHooks = (settings, binDir) => {
-  const resolve = (name) => {
-    const path = binDir ? join(binDir, name) : name;
-    return /\s/.test(path) ? `"${path}"` : path;
-  };
+  const resolve = (name) => guardBinary(binDir ? join(binDir, name) : name);
   const hooks = ensureRecord(settings, "hooks");
   const notification = (Array.isArray(hooks.Notification) ? hooks.Notification : []).filter((entry) => !isBellHook(entry));
   notification.push({

package/dist/bin/pushary-claude.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   ensureDaemonRunning
-} from "../chunk-CCH775Y6.js";
+} from "../chunk-WEAQQSHQ.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
@@ -9,21 +9,22 @@ import {
   generateSessionKey,
   uploadTranscriptRecords,
   wrapSessionKey
-} from "../chunk-NWYGW7HY.js";
+} from "../chunk-GCKAWHFP.js";
 import {
-  startProcessOwnership
-} from "../chunk-EVJ6ULHN.js";
+  startProcessOwnership,
+  withSpawnProcessOwnership
+} from "../chunk-YKW6JCWI.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import "../chunk-VT4IVERX.js";
-import "../chunk-SEAHGHCE.js";
+import "../chunk-HVZIHTOO.js";
 import {
   KILL_REASON,
   isDeferAnswer,
   resolveGate
-} from "../chunk-37AD5K7W.js";
+} from "../chunk-GXIFADGD.js";
 import {
   askUser,
   cancelQuestion,
@@ -35,7 +36,7 @@ import {
   reportEvent,
   scopePathFor,
   waitForAnswer
-} from "../chunk-OPMSMF5R.js";
+} from "../chunk-EXMUM226.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
@@ -113,9 +114,9 @@ var runLocalPassthrough = (binary, args2) => {
       cleanup();
       resolve2(127);
     });
-    child.on("exit", (code, signal) => {
+    child.on("exit", (code2, signal) => {
       cleanup();
-      if (typeof code === "number") resolve2(code);
+      if (typeof code2 === "number") resolve2(code2);
       else if (signal) resolve2(128 + (SIGNAL_NUMBERS[signal] ?? 0));
       else resolve2(0);
     });
@@ -139,9 +140,11 @@ var createSyncState = () => ({
   sessionKey: null,
   wrappedKey: null,
   seen: /* @__PURE__ */ new Set(),
-  keyUploaded: false
+  keyUploaded: false,
+  keyRejected: false
 });
 var syncTick = async (lines, state, uploader, sessionId, machineId) => {
+  if (state.keyRejected) return state;
   let sessionKey = state.sessionKey;
   let wrappedKey = state.wrappedKey;
   if (!sessionKey) {
@@ -152,9 +155,9 @@ var syncTick = async (lines, state, uploader, sessionId, machineId) => {
   }
   const built = buildTranscriptRecords(lines, sessionKey, state.seen);
   if (built.records.length === 0) {
-    return { sessionKey, wrappedKey, seen: built.seen, keyUploaded: state.keyUploaded };
+    return { ...state, sessionKey, wrappedKey, seen: built.seen };
   }
-  const ok = await uploader.uploadRecords({
+  const result = await uploader.uploadRecords({
     sessionId,
     machineId,
     dataEncryptionKey: state.keyUploaded ? void 0 : wrappedKey ?? void 0,
@@ -163,8 +166,9 @@ var syncTick = async (lines, state, uploader, sessionId, machineId) => {
   return {
     sessionKey,
     wrappedKey,
-    seen: ok ? built.seen : state.seen,
-    keyUploaded: state.keyUploaded || ok
+    seen: result.ok ? built.seen : state.seen,
+    keyUploaded: state.keyUploaded || result.keyRegistered,
+    keyRejected: result.keyConflict
   };
 };
 var readLines = (path) => {
@@ -258,7 +262,7 @@ var ensureClaudeSdk = async (log) => {
       { cwd: dir, stdio: "ignore", shell: process.platform === "win32" }
     );
     child.on("error", () => resolve2(false));
-    child.on("close", (code) => resolve2(code === 0));
+    child.on("close", (code2) => resolve2(code2 === 0));
   });
   if (!installed) {
     log?.(`[pushary] could not auto-install the SDK. Install it manually: npm i -g ${SDK_SPEC}`);
@@ -1039,13 +1043,13 @@ var runLocalLeg = (session, deps = {}) => {
       }
       finish();
     });
-    child.on("exit", (code, signal) => {
+    child.on("exit", (code2, signal) => {
       if (signal === "SIGTERM" && legAbort.signal.aborted) {
       } else if (!exitReason) {
         if (session.input.bufferedCount > 0) {
           exitReason = "switch";
-        } else if (typeof code === "number") {
-          exitReason = { type: "exit", code };
+        } else if (typeof code2 === "number") {
+          exitReason = { type: "exit", code: code2 };
         } else if (signal) {
           exitReason = { type: "exit", code: SIGNAL_EXIT_BASE + (SIGNAL_NUMBERS2[signal] ?? 0) };
         } else {
@@ -1492,10 +1496,15 @@ var runClaudeWrapper = async (args2) => {
 
 // bin/pushary-claude.ts
 var args = resolveClaudeArgs(process.argv);
-ensureDaemonRunning().then(() => runClaudeWrapper(args)).then((code) => process.exit(code)).catch((err) => {
+var spawnId = process.env.PUSHARY_SPAWN_ID?.trim() || void 0;
+var code = await withSpawnProcessOwnership(spawnId, async () => {
+  await ensureDaemonRunning();
+  return runClaudeWrapper(args);
+}).catch((err) => {
   process.stderr.write(
     `[pushary] wrapper error: ${err instanceof Error ? err.message : String(err)}
 `
   );
-  process.exit(1);
+  return 1;
 });
+process.exit(code);

package/dist/bin/pushary-clean.js

@@ -4,14 +4,15 @@ import {
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-UXWEE3QI.js";
+} from "../chunk-ADISVXZL.js";
 import {
   removeGeminiSettings
 } from "../chunk-DOXSWT4Q.js";
 import {
   removeClaudeMcpServers,
   removePusharySettings
-} from "../chunk-UKSQWTBH.js";
+} from "../chunk-64PXDATC.js";
+import "../chunk-PWTKKQQI.js";
 import {
   execNpm
 } from "../chunk-VT4IVERX.js";
@@ -32,14 +33,14 @@ import {
   pusharyDir,
   removeCodexHooks,
   vscodePluginDir
-} from "../chunk-SEAHGHCE.js";
+} from "../chunk-HVZIHTOO.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
 import {
   exitOnHelpFlag
-} from "../chunk-J4KFVOCQ.js";
-import "../chunk-MGJBC6DD.js";
+} from "../chunk-SQOFGPNX.js";
+import "../chunk-GOEXZ5QJ.js";
 import {
   removeClaudeAlias
 } from "../chunk-BC3VCZ3E.js";

package/dist/bin/pushary-codex-bridge.js

@@ -6,18 +6,19 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-YJCMI5GF.js";
-import "../chunk-NWYGW7HY.js";
+} from "../chunk-ERYKGH4J.js";
+import "../chunk-GCKAWHFP.js";
 import {
-  startProcessOwnership
-} from "../chunk-EVJ6ULHN.js";
+  startProcessOwnership,
+  withSpawnProcessOwnership
+} from "../chunk-YKW6JCWI.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import {
   resolveBinary
 } from "../chunk-VT4IVERX.js";
-import "../chunk-SEAHGHCE.js";
+import "../chunk-HVZIHTOO.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
@@ -327,7 +328,7 @@ var abort = new AbortController();
 var signals = process.platform === "win32" ? ["SIGINT", "SIGTERM"] : ["SIGINT", "SIGTERM", "SIGHUP"];
 var stop = () => abort.abort();
 for (const signal of signals) process.on(signal, stop);
-var outcome = await runCodexBridge({
+var outcome = await withSpawnProcessOwnership(spawnId, () => runCodexBridge({
   apiKey: getApiKey(),
   baseUrl: getBaseUrl(),
   machineId: getMachineId(),
@@ -343,6 +344,6 @@ var outcome = await runCodexBridge({
   },
   signal: abort.signal,
   transcripts: process.env.PUSHARY_TRANSCRIPTS === "1"
-});
+}));
 for (const signal of signals) process.off(signal, stop);
 process.exit(outcome === "stopped" ? 0 : 1);

package/dist/bin/pushary-codex-hook.js

@@ -3,12 +3,15 @@ import {
   isGatingMoment,
   recordKeylessMoment
 } from "../chunk-NJ7JT26G.js";
+import {
+  readHookInput
+} from "../chunk-6CUUA7HO.js";
 import {
   KILL_REASON,
   denyReasonFrom,
   isDeferAnswer,
   resolveGate
-} from "../chunk-37AD5K7W.js";
+} from "../chunk-GXIFADGD.js";
 import {
   CODEX_AGENT,
   DEFAULT_SESSION,
@@ -28,6 +31,7 @@ import {
   handleStop,
   handleUserPrompt,
   permissionTimeoutDecision,
+  policyRequestFor,
   preToolUseTimeoutDecision,
   readLastPrompt,
   repoKeyFor,
@@ -39,7 +43,7 @@ import {
   toPolicyLookup,
   toPolicyLookups,
   waitForAnswer
-} from "../chunk-OPMSMF5R.js";
+} from "../chunk-EXMUM226.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
@@ -143,6 +147,7 @@ var pushQuestion = async (apiKey, input, lookup, waitSeconds, mode) => {
     action: description.slice(0, DECISION_LINE_MAX),
     blocker: deriveBlocker(mode),
     actionBody: deriveActionBody(input.tool_name ?? "", input.tool_input ?? {}),
+    repoKey: repoKeyFor(input.cwd),
     // Codex has always sent this; it is what claimNotify and markApproved already
     // key on locally. Passing it through lets the server collapse a retried create
     // the same way, instead of putting the same approval on the phone twice.
@@ -177,9 +182,10 @@ var notifyApprovalNeeded = async (apiKey, input, lookup) => {
 };
 var codexGate = async (apiKey, input) => {
   const modeState = await fetchModeState(apiKey, input.session_id);
+  const policyRequest = policyRequestFor("codex");
   const lookup = toPolicyLookup(input.tool_name ?? "", input.tool_input ?? {}, input.cwd);
   const lookups = toPolicyLookups(input.tool_name ?? "", input.tool_input ?? {}, input.cwd);
-  const config = await getPolicy(apiKey, modeState.policyVersion, "codex", false, input.session_id);
+  const config = await getPolicy(apiKey, modeState.policyVersion, policyRequest.agent, policyRequest.repoAware, input.session_id);
   const verdict = resolveGate({
     modeState,
     config,
@@ -307,17 +313,8 @@ var emit = (wire) => {
   if (wire) process.stdout.write(JSON.stringify(wire));
 };
 var main = async () => {
-  let rawInput = "";
-  for await (const chunk of process.stdin) {
-    rawInput += chunk;
-  }
-  if (!rawInput.trim()) {
-    process.exit(0);
-  }
-  let input;
-  try {
-    input = JSON.parse(rawInput);
-  } catch {
+  const input = await readHookInput("codex");
+  if (!input) {
     process.exit(0);
   }
   try {

package/dist/bin/pushary-codex.js

@@ -3,7 +3,7 @@ import {
   askUser,
   reportEvent,
   waitForAnswer
-} from "../chunk-OPMSMF5R.js";
+} from "../chunk-EXMUM226.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";

package/dist/bin/pushary-connect.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
+import {
+  printKeyCheck
+} from "../chunk-FBGBJXVC.js";
 import {
   confirmAppConnection,
   connectDevice,
   printConnectInstructions
 } from "../chunk-6LC4WSCL.js";
 import "../chunk-3EGEA4KH.js";
-import {
-  printKeyCheck
-} from "../chunk-FBGBJXVC.js";
 import {
   checkApiKey
 } from "../chunk-F52SIIDG.js";
@@ -22,8 +22,8 @@ import {
 } from "../chunk-GMXKITVA.js";
 import {
   exitOnHelpFlag
-} from "../chunk-J4KFVOCQ.js";
-import "../chunk-MGJBC6DD.js";
+} from "../chunk-SQOFGPNX.js";
+import "../chunk-GOEXZ5QJ.js";
 import "../chunk-BC3VCZ3E.js";
 import "../chunk-DINDL2CF.js";
 import "../chunk-6MTNS63X.js";

package/dist/bin/pushary-daemon.js

@@ -8,15 +8,16 @@ import {
   acquireDaemonLease,
   readDaemonStatus,
   requestDaemonHandoff
-} from "../chunk-CCH775Y6.js";
+} from "../chunk-WEAQQSHQ.js";
 import {
   CODEX_BRIDGE_CAPABILITY,
   CODEX_RESUME_CAPABILITY,
   geminiLiveCapabilities
 } from "../chunk-NRGRUOAR.js";
 import {
+  findLiveProcessBySpawnId,
   ownsLiveProcess
-} from "../chunk-EVJ6ULHN.js";
+} from "../chunk-YKW6JCWI.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
@@ -25,14 +26,14 @@ import {
   resolveGlobalPackageVersion,
   resolvePackageVersionFromBinary
 } from "../chunk-VT4IVERX.js";
-import "../chunk-SEAHGHCE.js";
+import "../chunk-HVZIHTOO.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
 import {
   exitOnHelpFlag
-} from "../chunk-J4KFVOCQ.js";
-import "../chunk-MGJBC6DD.js";
+} from "../chunk-SQOFGPNX.js";
+import "../chunk-GOEXZ5QJ.js";
 import "../chunk-DINDL2CF.js";
 import "../chunk-6MTNS63X.js";
 import {
@@ -135,6 +136,23 @@ var spawnAcknowledgement = (request, machineId, outcome) => {
     }
   };
 };
+var launchSpawnClaim = async (request, runtime) => {
+  const existingPid = await runtime.findExistingPid(request.id);
+  if (existingPid !== null) {
+    await runtime.acknowledge(spawnAcknowledgement(request, runtime.machineId, { state: "started", pid: existingPid }));
+    return;
+  }
+  let pid;
+  try {
+    pid = await runtime.launch(request);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    runtime.reportLaunchError(message);
+    await runtime.acknowledge(spawnAcknowledgement(request, runtime.machineId, { state: "failed", message }));
+    return;
+  }
+  await runtime.acknowledge(spawnAcknowledgement(request, runtime.machineId, { state: "started", pid }));
+};
 var DrainError = class extends Error {
   constructor(status) {
     super(`drain ${status}`);
@@ -397,19 +415,19 @@ var runSpawnDaemon = async () => {
     }
     throw lastError ?? new Error("spawn acknowledgement stopped");
   };
-  const launchClaim = async (request) => {
-    let pid;
-    try {
-      pid = await launch(request);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      stderr(`[pushary] could not launch session: ${message}
-`);
-      await acknowledge(spawnAcknowledgement(request, machineId, { state: "failed", message }));
-      return;
-    }
-    await acknowledge(spawnAcknowledgement(request, machineId, { state: "started", pid }));
-  };
+  const launchClaim = (request) => launchSpawnClaim(request, {
+    machineId,
+    findExistingPid: async (spawnId) => {
+      for (const [pid, launchedSpawnId] of launchedProcesses) {
+        if (launchedSpawnId === spawnId) return pid;
+      }
+      return findLiveProcessBySpawnId(spawnId);
+    },
+    launch,
+    acknowledge,
+    reportLaunchError: (message) => stderr(`[pushary] could not launch session: ${message}
+`)
+  });
   const nextDelay = () => {
     if (errorStreak > 0) return Math.min(SLOW_POLL_MS * 2 ** (errorStreak - 1), MAX_ERROR_BACKOFF_MS);
     return idleTicks >= FAST_DECAY_TICKS ? SLOW_POLL_MS : FAST_POLL_MS;

package/dist/bin/pushary-disconnect.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node