@pushary/agent-hooks 0.87.2 → 0.87.4

package/data/cursor-plugin/hooks/hooks.json

@@ -8,6 +8,13 @@
         "timeout": 60,
         "failClosed": true
       }
+    ],
+    "beforeMCPExecution": [
+      {
+        "command": "node ./scripts/pushary-gate.mjs",
+        "timeout": 60,
+        "failClosed": true
+      }
     ]
   }
 }

package/data/cursor-plugin/scripts/pushary-gate.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// Pushary gate — Cursor `beforeShellExecution` hook.
+// Pushary gate — Cursor `beforeShellExecution` and `beforeMCPExecution` hooks.
 //
 // Routes risky shell commands through your Pushary permission policy before they
 // run. Which commands reach this gate is the `matcher` in ../hooks/hooks.json; what
@@ -16,7 +16,9 @@
 // Self-contained: no dependencies, uses the global fetch (Node 18+).
 //
 // Contract (https://cursor.com/docs/hooks):
-//   stdin  : { "command": string, "cwd": string, "conversation_id": string, ... }
+//   stdin  : { "hook_event_name": string, "cwd": string, "conversation_id": string, ... }
+//            beforeShellExecution adds { "command": string }
+//            beforeMCPExecution   adds { "tool_name", "tool_input", "mcp_server_name" }
 //   stdout : { "permission": "allow" | "deny" | "ask", "user_message"?, "agent_message"? }
 //
 // Failure model: every handled path writes a decision and exits 0. Network/parse
@@ -245,12 +247,12 @@ const callTool = async (apiKey, name, args) => {
 const GATE_TIMEOUT_MS = 5000
 
 /**
- * The verdict for one command, or null if we could not get one.
+ * The verdict for one request, or null if we could not get one.
  *
  * Null is not a denial and not an approval: every failure here hands the call
  * back to Cursor's own prompt, exactly as if this gate were not installed.
  */
-const decide = async (apiKey, command, cwd, sessionId) => {
+const decide = async (apiKey, request, cwd, sessionId) => {
   try {
     const response = await fetch(`${BASE_URL}/api/agent/gate`, {
       method: 'POST',
@@ -258,8 +260,8 @@ const decide = async (apiKey, command, cwd, sessionId) => {
       body: JSON.stringify({
         v: 1,
         source: 'cursor',
-        toolName: 'Bash',
-        toolInputs: [{ command }],
+        toolName: request.toolName,
+        toolInputs: request.toolInputs,
         cwd,
         repoKey: deriveRepoKey(cwd),
         sessionId,
@@ -341,16 +343,16 @@ const deriveActionBody = (command) => capActionBody(redactSecretsDeep(command))
 // lock screen ungated.
 const commandHead = (command) => command.trim().split(/\s+/).slice(0, 2).join(' ').slice(0, 120)
 
-const askArgs = (command, project, ident) => ({
-  question: `Allow this command?\n\n${redactSecrets(command)}`,
+const askArgs = (request, project, ident) => ({
+  question: `${request.prompt}\n\n${redactSecrets(request.display)}`,
   type: 'confirm',
-  context: `Cursor agent wants to run this in ${project}`,
+  context: `Cursor agent wants to ${request.verb} in ${project}`,
   agentName: ident.agentName,
   sessionId: ident.sessionId,
   machineId: ident.machineId,
-  toolName: 'Bash',
-  toolTarget: commandHead(command),
-  actionBody: deriveActionBody(command),
+  toolName: request.toolName,
+  toolTarget: request.toolTarget,
+  actionBody: deriveActionBody(request.display),
   wait: false,
 })
 
@@ -374,13 +376,77 @@ const pollForAnswer = async (apiKey, correlationId, deadlineMs) => {
 const fromTimeoutAction = (action, deniedReason) =>
   action === 'approve' ? ALLOW : action === 'deny' ? deny(deniedReason) : ask()
 
-const DENIED = 'The user denied this command via a Pushary push approval. Do not run it — propose an alternative or ask how to proceed.'
+const denialFor = (noun) =>
+  `The user denied this ${noun} via a Pushary push approval. Do not run it — propose an alternative or ask how to proceed.`
+
+/**
+ * What this hook is being asked about, in the one shape the rest of the gate
+ * reads.
+ *
+ * Cursor sends a different payload per event and the gate used to know only one
+ * of them: it read `input.command`, called everything "Bash", and any event that
+ * was not a shell execution fell out at the empty-command guard as `ask`. That
+ * was correct while `beforeShellExecution` was the only thing registered.
+ *
+ * Returns null when there is nothing to gate, which the caller answers with
+ * Cursor's own prompt.
+ */
+const describeRequest = (input) => {
+  const event = typeof input.hook_event_name === 'string' ? input.hook_event_name : ''
+
+  if (event === 'beforeMCPExecution') {
+    const tool = typeof input.tool_name === 'string' ? input.tool_name.trim() : ''
+    if (!tool) return null
+    const server = typeof input.mcp_server_name === 'string' ? input.mcp_server_name.trim() : ''
+    // `mcp__<server>__<tool>`, the same spelling Claude Code uses and the one
+    // `validateToolPattern` accepts, so a policy someone wrote once matches the
+    // same tool whichever agent called it. That portability is the only reason
+    // the policy engine is server-side.
+    const toolName = server ? `mcp__${server}__${tool}` : `mcp__${tool}`
+
+    // Never gate Pushary's own MCP tools. Asking Pushary to approve Pushary's
+    // ask_user call deadlocks: the approval cannot be delivered until the call
+    // it is gating goes through. The Claude hook carries the same guard, where
+    // it is a precaution because the matcher does not route these there. Here it
+    // is load-bearing: `beforeMCPExecution` is registered with NO matcher, so
+    // every MCP call reaches this gate, ours included.
+    if (toolName.startsWith('mcp__pushary__')) return null
+
+    const params = typeof input.tool_input === 'string'
+      ? input.tool_input
+      : input.tool_input === undefined ? '' : JSON.stringify(input.tool_input)
+    return {
+      toolName,
+      toolInputs: [{ tool: toolName, params }],
+      display: params ? `${toolName}\n${params}` : toolName,
+      toolTarget: toolName.slice(0, 120),
+      prompt: 'Allow this tool call?',
+      verb: 'call this tool',
+      denied: denialFor('tool call'),
+    }
+  }
+
+  // Shell is also the fallback for a payload with no event name: a `command` is
+  // what `beforeShellExecution` has always been recognised by, and an older
+  // Cursor that omits `hook_event_name` must keep working exactly as before.
+  const command = typeof input.command === 'string' ? input.command.trim() : ''
+  if (!command || (event && event !== 'beforeShellExecution')) return null
+  return {
+    toolName: 'Bash',
+    toolInputs: [{ command }],
+    display: command,
+    toolTarget: commandHead(command),
+    prompt: 'Allow this command?',
+    verb: 'run this',
+    denied: denialFor('command'),
+  }
+}
 
 // push_only: wait up to the policy timeout, then apply the timeout action.
-const handlePushOnly = async (apiKey, command, project, ident, timeoutSeconds, timeoutAction) => {
+const handlePushOnly = async (apiKey, request, project, ident, timeoutSeconds, timeoutAction) => {
   let asked
   try {
-    asked = await withRetry(() => callTool(apiKey, 'ask_user', askArgs(command, project, ident)), 3)
+    asked = await withRetry(() => callTool(apiKey, 'ask_user', askArgs(request, project, ident)), 3)
   } catch {
     return fromTimeoutAction(timeoutAction, 'Push notification failed; denied per your Pushary policy.')
   }
@@ -389,7 +455,7 @@ const handlePushOnly = async (apiKey, command, project, ident, timeoutSeconds, t
   const realMs = Math.max(timeoutSeconds, 1) * 1000
   const cap = Math.min(realMs, MAX_BLOCK_MS)
   const answer = await pollForAnswer(apiKey, asked.correlationId, Date.now() + cap)
-  if (answer.answered) return answer.value === 'yes' ? ALLOW : deny(DENIED)
+  if (answer.answered) return answer.value === 'yes' ? ALLOW : deny(request.denied)
 
   // If Cursor's hook limit cut us off before the configured timeout, hand off to
   // Cursor's own prompt rather than misapplying the policy's timeout action.
@@ -398,10 +464,10 @@ const handlePushOnly = async (apiKey, command, project, ident, timeoutSeconds, t
 }
 
 // push_first: race the push for a short window, then fall back to Cursor's prompt.
-const handlePushFirst = async (apiKey, command, project, ident, pushFirstSeconds) => {
+const handlePushFirst = async (apiKey, request, project, ident, pushFirstSeconds) => {
   let asked
   try {
-    asked = await withRetry(() => callTool(apiKey, 'ask_user', askArgs(command, project, ident)), 3)
+    asked = await withRetry(() => callTool(apiKey, 'ask_user', askArgs(request, project, ident)), 3)
   } catch {
     return ask()
   }
@@ -409,16 +475,16 @@ const handlePushFirst = async (apiKey, command, project, ident, pushFirstSeconds
 
   const cap = Math.min(Math.max(pushFirstSeconds, 1) * 1000, MAX_BLOCK_MS)
   const answer = await pollForAnswer(apiKey, asked.correlationId, Date.now() + cap)
-  if (answer.answered) return answer.value === 'yes' ? ALLOW : deny(DENIED)
+  if (answer.answered) return answer.value === 'yes' ? ALLOW : deny(request.denied)
   return ask('Sent to your phone via Pushary — you can also approve here.')
 }
 
 // notify_only: fire an awareness notification, let Cursor's prompt decide.
-const handleNotifyOnly = async (apiKey, command, project, ident) => {
+const handleNotifyOnly = async (apiKey, request, project, ident) => {
   try {
     await callTool(apiKey, 'send_notification', {
       title: 'Agent needs approval',
-      body: redactSecrets(command).slice(0, 180),
+      body: redactSecrets(request.display).slice(0, 180),
       agentName: ident.agentName,
       sessionId: ident.sessionId,
       machineId: ident.machineId,
@@ -436,8 +502,8 @@ const main = async () => {
     return respond(ask())
   }
 
-  const command = typeof input.command === 'string' ? input.command.trim() : ''
-  if (!command) return respond(ask())
+  const request = describeRequest(input)
+  if (!request) return respond(ask())
 
   const apiKey = resolveApiKey()
   if (!apiKey) {
@@ -451,7 +517,7 @@ const main = async () => {
   const ident = { agentName: `Cursor - ${project}`, sessionId, machineId: getMachineId() }
 
   try {
-    const verdict = await decide(apiKey, command, input.cwd, sessionId)
+    const verdict = await decide(apiKey, request, input.cwd, sessionId)
 
     // No verdict, or one that says nothing: Cursor's own prompt decides, exactly
     // as if this gate were not installed. Never a forced denial on an outage.
@@ -467,12 +533,12 @@ const main = async () => {
       case 'terminal_only':
         return respond(ask())
       case 'notify_only':
-        return respond(await handleNotifyOnly(apiKey, command, project, ident))
+        return respond(await handleNotifyOnly(apiKey, request, project, ident))
       case 'push_only':
-        return respond(await handlePushOnly(apiKey, command, project, ident, tool.timeoutSeconds, tool.timeoutAction))
+        return respond(await handlePushOnly(apiKey, request, project, ident, tool.timeoutSeconds, tool.timeoutAction))
       case 'push_first':
       default:
-        return respond(await handlePushFirst(apiKey, command, project, ident, tool.pushFirstSeconds))
+        return respond(await handlePushFirst(apiKey, request, project, ident, tool.pushFirstSeconds))
     }
   } catch (error) {
     process.stderr.write(`[pushary-gate] ${error?.message ?? error}\n`)
@@ -482,7 +548,7 @@ const main = async () => {
 
 // Exported for scripts/pushary-gate.test.mjs. main() only runs when the gate is
 // executed directly, so importing this file for a test does not read stdin.
-export { normalizeRepoRemote, deriveRepoKey }
+export { normalizeRepoRemote, deriveRepoKey, describeRequest }
 
 const isDirectRun = process.argv[1] && import.meta.url === `file://${process.argv[1]}`
 if (!isDirectRun) {

package/data/cursor-plugin/scripts/pushary-gate.test.mjs

@@ -14,7 +14,7 @@
 
 import assert from 'node:assert/strict'
 import { describe, it } from 'node:test'
-import { normalizeRepoRemote } from './pushary-gate.mjs'
+import { describeRequest, normalizeRepoRemote } from './pushary-gate.mjs'
 
 describe('repo identity', () => {
   it('collapses the forms of one remote', () => {
@@ -33,3 +33,83 @@ describe('repo identity', () => {
     for (const r of ['', '../rel', 'file:///Users/dev/repo']) assert.equal(normalizeRepoRemote(r), undefined, r)
   })
 })
+
+// The gate answers two Cursor events now, and they arrive on the same stdin with
+// different fields. What each one turns into is the only thing standing between
+// an MCP call and being gated as if it were a shell command.
+describe('what the gate was asked about', () => {
+  it('names an MCP call the way every other agent names one', () => {
+    const request = describeRequest({
+      hook_event_name: 'beforeMCPExecution',
+      tool_name: 'create_issue',
+      mcp_server_name: 'github',
+      tool_input: '{"title":"x"}',
+    })
+
+    // `mcp__<server>__<tool>` is what `validateToolPattern` accepts and what
+    // Claude Code sends, so one policy rule covers the tool on both agents. A
+    // Cursor-only spelling would silently miss every rule a user already wrote.
+    assert.equal(request.toolName, 'mcp__github__create_issue')
+    assert.deepEqual(request.toolInputs, [{ tool: 'mcp__github__create_issue', params: '{"title":"x"}' }])
+    assert.match(request.display, /create_issue/)
+  })
+
+  it('still reads a shell command, including from a payload with no event name', () => {
+    const named = describeRequest({ hook_event_name: 'beforeShellExecution', command: '  rm -rf /tmp/x  ' })
+    assert.equal(named.toolName, 'Bash')
+    assert.equal(named.toolTarget, 'rm -rf')
+
+    // An older Cursor that omits `hook_event_name` must keep working exactly as
+    // it did when shell was the only registered event.
+    assert.equal(describeRequest({ command: 'git push' }).toolName, 'Bash')
+  })
+
+  /**
+   * `beforeMCPExecution` is registered with NO matcher, so every MCP call in the
+   * editor reaches this gate, ours included. Gating our own tools deadlocks: the
+   * approval for `ask_user` cannot reach the phone until the `ask_user` call it
+   * is gating goes through. With `failClosed: true` on that entry it is worse
+   * than a hang, because a timeout turns into a denial of the user's own
+   * question.
+   *
+   * The Claude hook carries this guard three times over and calls it a
+   * precaution, because its matcher does not route these there. Here it is the
+   * only thing standing between the two.
+   */
+  it('never gates Pushary\'s own MCP tools', () => {
+    for (const tool of ['ask_user', 'wait_for_answer', 'send_notification', 'propose_scope']) {
+      assert.equal(
+        describeRequest({
+          hook_event_name: 'beforeMCPExecution',
+          tool_name: tool,
+          mcp_server_name: 'pushary',
+          tool_input: '{}',
+        }),
+        null,
+        `mcp__pushary__${tool} must reach Cursor's own prompt, not ours`,
+      )
+    }
+
+    // A neighbour whose name merely starts the same way is still gated. The
+    // guard is on the `mcp__pushary__` prefix, not on "contains pushary".
+    assert.equal(
+      describeRequest({
+        hook_event_name: 'beforeMCPExecution',
+        tool_name: 'run',
+        mcp_server_name: 'pushary-clone',
+        tool_input: '{}',
+      }).toolName,
+      'mcp__pushary-clone__run',
+    )
+  })
+
+  it('declines an event it does not gate rather than calling it Bash', () => {
+    // beforeReadFile is registered by nobody here on purpose: its response
+    // schema has no `ask`, so the no-opinion path this gate takes on every error
+    // has nothing to return. If one ever arrives, it must not be mistaken for a
+    // shell command carrying no command.
+    assert.equal(describeRequest({ hook_event_name: 'beforeReadFile', file_path: '/etc/passwd' }), null)
+    assert.equal(describeRequest({ hook_event_name: 'beforeMCPExecution' }), null)
+    assert.equal(describeRequest({}), null)
+  })
+})

package/dist/bin/pushary-bell-hook.js

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-2T3GX7WG.js";
+} from "../chunk-YYTLTEGU.js";
 import {
   readHookInput
 } from "../chunk-6CUUA7HO.js";
-import "../chunk-OT4YD54Q.js";
+import "../chunk-YX6ZKCC5.js";
 import "../chunk-BC3VCZ3E.js";
 import "../chunk-6MTNS63X.js";
-import "../chunk-Y3UTTFTZ.js";
+import "../chunk-KBS53WOE.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-7YJS2VTG.js";
+import "../chunk-DMW54VWK.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,18 +5,19 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-2T3GX7WG.js";
+} from "../chunk-YYTLTEGU.js";
 import {
   guardBinary
-} from "../chunk-M7RYIZX6.js";
+} from "../chunk-B7ZBHWOW.js";
 import "../chunk-VT4IVERX.js";
 import {
   claudeSettings
-} from "../chunk-B3V2H6SA.js";
+} from "../chunk-NAPRGHZ3.js";
+import "../chunk-GIRT7677.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
-import "../chunk-OT4YD54Q.js";
+import "../chunk-YX6ZKCC5.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
@@ -30,13 +31,13 @@ import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-6MTNS63X.js";
-import "../chunk-Y3UTTFTZ.js";
+import "../chunk-KBS53WOE.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-7YJS2VTG.js";
+import "../chunk-DMW54VWK.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/bin/pushary-claude.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   ensureDaemonRunning
-} from "../chunk-SJVLFIYP.js";
+} from "../chunk-H5PIPIKQ.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
@@ -9,34 +9,37 @@ import {
   generateSessionKey,
   uploadTranscriptRecords,
   wrapSessionKey
-} from "../chunk-ECEUMWBH.js";
+} from "../chunk-QLMX5LLV.js";
 import {
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-QBWYNVKY.js";
+} from "../chunk-BFBAHOGR.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import "../chunk-VT4IVERX.js";
-import "../chunk-B3V2H6SA.js";
+import "../chunk-NAPRGHZ3.js";
 import {
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
+import "../chunk-GIRT7677.js";
 import {
-  deriveToolTarget,
-  describeToolCall,
   fetchModeState,
   getPolicy,
   repoKeyFor,
-  reportEvent,
-  scopePathFor
-} from "../chunk-V2XPF77V.js";
+  reportEvent
+} from "../chunk-VOE4SYPR.js";
 import {
   askUser,
   cancelQuestion,
   waitForAnswer
 } from "../chunk-J3YDT4HM.js";
+import {
+  deriveToolTarget,
+  describeToolCall,
+  scopePathFor
+} from "../chunk-7J67NYK4.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
@@ -44,7 +47,7 @@ import "../chunk-DINDL2CF.js";
 import "../chunk-6MTNS63X.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
-import "../chunk-Y3UTTFTZ.js";
+import "../chunk-KBS53WOE.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
 import {
@@ -54,7 +57,7 @@ import {
 import {
   KILL_REASON,
   resolveGate
-} from "../chunk-7YJS2VTG.js";
+} from "../chunk-DMW54VWK.js";
 
 // src/wrapper/claudeBinary.ts
 import { statSync } from "fs";

package/dist/bin/pushary-clean.js

@@ -2,18 +2,20 @@
 import {
   removeClaudeMcpServers,
   removePusharySettings
-} from "../chunk-5646VKR4.js";
+} from "../chunk-2JYQAW4B.js";
 import {
+  CURSOR_GATE_EVENTS,
   removeInstructionBlock,
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-LT2VLPUK.js";
+} from "../chunk-KULUNLRO.js";
+import "../chunk-ZGC3W23N.js";
 import {
   removeGeminiSettings
-} from "../chunk-ZZE6FN7T.js";
+} from "../chunk-K42RXJPG.js";
 import "../chunk-ATBKJNWS.js";
-import "../chunk-M7RYIZX6.js";
+import "../chunk-B7ZBHWOW.js";
 import {
   execNpm
 } from "../chunk-VT4IVERX.js";
@@ -24,6 +26,7 @@ import {
   claudeSkillDir,
   codexAgentsMd,
   codexConfigToml,
+  codexHookPositions,
   codexHooksJson,
   codexSkillDir,
   cursorPluginDir,
@@ -32,9 +35,12 @@ import {
   geminiMd,
   geminiSettings,
   pusharyDir,
+  removeCodexHookTrust,
   removeCodexHooks,
   vscodePluginDir
-} from "../chunk-B3V2H6SA.js";
+} from "../chunk-NAPRGHZ3.js";
+import "../chunk-GIRT7677.js";
+import "../chunk-7J67NYK4.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
@@ -50,7 +56,7 @@ import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-7YJS2VTG.js";
+import "../chunk-DMW54VWK.js";
 
 // bin/pushary-clean.ts
 import { existsSync, readFileSync, copyFileSync, readdirSync } from "fs";
@@ -157,11 +163,16 @@ var removeCursorUserHook = () => {
   }
   if (!parsed || typeof parsed !== "object") return "failed";
   const hooks = parsed.hooks ?? {};
-  const existing = Array.isArray(hooks.beforeShellExecution) ? hooks.beforeShellExecution : [];
-  const others = existing.filter((h) => !String(h.command ?? "").includes("pushary-gate"));
-  if (others.length === existing.length) return "absent";
-  if (others.length === 0) delete hooks.beforeShellExecution;
-  else hooks.beforeShellExecution = others;
+  let removedAny = false;
+  for (const event of CURSOR_GATE_EVENTS) {
+    const existing = Array.isArray(hooks[event]) ? hooks[event] : [];
+    const others = existing.filter((h) => !String(h.command ?? "").includes("pushary-gate"));
+    if (others.length === existing.length) continue;
+    removedAny = true;
+    if (others.length === 0) delete hooks[event];
+    else hooks[event] = others;
+  }
+  if (!removedAny) return "absent";
   parsed.hooks = hooks;
   try {
     writeJson(CURSOR_USER_HOOKS, parsed);
@@ -171,10 +182,12 @@ var removeCursorUserHook = () => {
   if (dryRun) return "removed";
   try {
     const after = JSON.parse(readFileSync(CURSOR_USER_HOOKS, "utf-8"));
-    const stillThere = after?.hooks?.beforeShellExecution ?? [];
-    if (Array.isArray(stillThere) && stillThere.some((h) => String(h.command ?? "").includes("pushary-gate"))) {
-      return "failed";
-    }
+    const afterHooks = after?.hooks ?? {};
+    const stillThere = CURSOR_GATE_EVENTS.some((event) => {
+      const entries = afterHooks[event];
+      return Array.isArray(entries) && entries.some((h) => String(h?.command ?? "").includes("pushary-gate"));
+    });
+    if (stillThere) return "failed";
   } catch {
     return "failed";
   }
@@ -297,11 +310,15 @@ var main = async () => {
     console.log(`  ${skip} Skill directory ${dim("(not found)")}`);
   }
   const codexConfig = codexConfigToml();
+  const codexHooksJson2 = codexHooksJson();
+  const codexHooksData = readJson(codexHooksJson2);
+  const codexPositions = codexHookPositions(codexHooksData ?? void 0);
   try {
     const config = readFileSync(codexConfig, "utf-8");
+    const parsed = parseTOML(config);
+    const trustRemoved = removeCodexHookTrust(parsed, codexHooksJson2, codexPositions);
     const hadPushary = config.includes("pushary");
-    if (hadPushary) {
-      const parsed = parseTOML(config);
+    if (hadPushary || trustRemoved) {
       const mcpServers = parsed.mcp_servers ?? {};
       delete mcpServers.pushary;
       if (Object.keys(mcpServers).length === 0) delete parsed.mcp_servers;
@@ -311,15 +328,14 @@ var main = async () => {
         if (parsed.notify.length === 0) delete parsed.notify;
       }
       guardedWrite(codexConfig, stringifyTOML(parsed));
-      console.log(`  ${check} Codex config ${dim(did("cleaned"))}`);
+      const what = trustRemoved ? "cleaned, hook trust removed" : "cleaned";
+      console.log(`  ${check} Codex config ${dim(did(what))}`);
     } else {
       console.log(`  ${skip} Codex config ${dim("(no pushary entries)")}`);
     }
   } catch {
     console.log(`  ${skip} Codex config ${dim("(not found)")}`);
   }
-  const codexHooksJson2 = codexHooksJson();
-  const codexHooksData = readJson(codexHooksJson2);
   if (codexHooksData) {
     if (removeCodexHooks(codexHooksData)) {
       writeJson(codexHooksJson2, codexHooksData);

package/dist/bin/pushary-codex-bridge.js

@@ -6,19 +6,20 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-WLLBFDVY.js";
-import "../chunk-ECEUMWBH.js";
+} from "../chunk-TV3UFGT7.js";
+import "../chunk-QLMX5LLV.js";
 import {
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-QBWYNVKY.js";
+} from "../chunk-BFBAHOGR.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import {
   resolveBinary
 } from "../chunk-VT4IVERX.js";
-import "../chunk-B3V2H6SA.js";
+import "../chunk-NAPRGHZ3.js";
+import "../chunk-GIRT7677.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
@@ -27,7 +28,7 @@ import {
   getApiKey,
   getBaseUrl
 } from "../chunk-2UMNXADU.js";
-import "../chunk-7YJS2VTG.js";
+import "../chunk-DMW54VWK.js";
 
 // bin/pushary-codex-bridge.ts
 import { existsSync } from "fs";