@pushary/agent-hooks 0.87.3 → 0.87.4

package/data/cursor-plugin/scripts/pushary-gate.mjs

@@ -403,6 +403,15 @@ const describeRequest = (input) => {
     // same tool whichever agent called it. That portability is the only reason
     // the policy engine is server-side.
     const toolName = server ? `mcp__${server}__${tool}` : `mcp__${tool}`
+
+    // Never gate Pushary's own MCP tools. Asking Pushary to approve Pushary's
+    // ask_user call deadlocks: the approval cannot be delivered until the call
+    // it is gating goes through. The Claude hook carries the same guard, where
+    // it is a precaution because the matcher does not route these there. Here it
+    // is load-bearing: `beforeMCPExecution` is registered with NO matcher, so
+    // every MCP call reaches this gate, ours included.
+    if (toolName.startsWith('mcp__pushary__')) return null
+
     const params = typeof input.tool_input === 'string'
       ? input.tool_input
       : input.tool_input === undefined ? '' : JSON.stringify(input.tool_input)

package/data/cursor-plugin/scripts/pushary-gate.test.mjs

@@ -64,6 +64,45 @@ describe('what the gate was asked about', () => {
     assert.equal(describeRequest({ command: 'git push' }).toolName, 'Bash')
   })
 
+  /**
+   * `beforeMCPExecution` is registered with NO matcher, so every MCP call in the
+   * editor reaches this gate, ours included. Gating our own tools deadlocks: the
+   * approval for `ask_user` cannot reach the phone until the `ask_user` call it
+   * is gating goes through. With `failClosed: true` on that entry it is worse
+   * than a hang, because a timeout turns into a denial of the user's own
+   * question.
+   *
+   * The Claude hook carries this guard three times over and calls it a
+   * precaution, because its matcher does not route these there. Here it is the
+   * only thing standing between the two.
+   */
+  it('never gates Pushary\'s own MCP tools', () => {
+    for (const tool of ['ask_user', 'wait_for_answer', 'send_notification', 'propose_scope']) {
+      assert.equal(
+        describeRequest({
+          hook_event_name: 'beforeMCPExecution',
+          tool_name: tool,
+          mcp_server_name: 'pushary',
+          tool_input: '{}',
+        }),
+        null,
+        `mcp__pushary__${tool} must reach Cursor's own prompt, not ours`,
+      )
+    }
+
+    // A neighbour whose name merely starts the same way is still gated. The
+    // guard is on the `mcp__pushary__` prefix, not on "contains pushary".
+    assert.equal(
+      describeRequest({
+        hook_event_name: 'beforeMCPExecution',
+        tool_name: 'run',
+        mcp_server_name: 'pushary-clone',
+        tool_input: '{}',
+      }).toolName,
+      'mcp__pushary-clone__run',
+    )
+  })
+
   it('declines an event it does not gate rather than calling it Bash', () => {
     // beforeReadFile is registered by nobody here on purpose: its response
     // schema has no `ask`, so the no-opinion path this gate takes on every error

package/dist/bin/pushary-bell.js

@@ -12,7 +12,7 @@ import {
 import "../chunk-VT4IVERX.js";
 import {
   claudeSettings
-} from "../chunk-VL5ZNK6V.js";
+} from "../chunk-NAPRGHZ3.js";
 import "../chunk-GIRT7677.js";
 import {
   createIo

package/dist/bin/pushary-claude.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   ensureDaemonRunning
-} from "../chunk-KCAFCGGY.js";
+} from "../chunk-H5PIPIKQ.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
@@ -13,13 +13,13 @@ import {
 import {
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-LGVHYFIB.js";
+} from "../chunk-BFBAHOGR.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import "../chunk-VT4IVERX.js";
-import "../chunk-VL5ZNK6V.js";
+import "../chunk-NAPRGHZ3.js";
 import {
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";

package/dist/bin/pushary-clean.js

@@ -9,7 +9,7 @@ import {
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-DPUOW6NS.js";
+} from "../chunk-KULUNLRO.js";
 import "../chunk-ZGC3W23N.js";
 import {
   removeGeminiSettings
@@ -38,7 +38,7 @@ import {
   removeCodexHookTrust,
   removeCodexHooks,
   vscodePluginDir
-} from "../chunk-VL5ZNK6V.js";
+} from "../chunk-NAPRGHZ3.js";
 import "../chunk-GIRT7677.js";
 import "../chunk-7J67NYK4.js";
 import {

package/dist/bin/pushary-codex-bridge.js

@@ -11,14 +11,14 @@ import "../chunk-QLMX5LLV.js";
 import {
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-LGVHYFIB.js";
+} from "../chunk-BFBAHOGR.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import {
   resolveBinary
 } from "../chunk-VT4IVERX.js";
-import "../chunk-VL5ZNK6V.js";
+import "../chunk-NAPRGHZ3.js";
 import "../chunk-GIRT7677.js";
 import {
   getMachineId

package/dist/bin/pushary-daemon.js

@@ -8,7 +8,7 @@ import {
   acquireDaemonLease,
   readDaemonStatus,
   requestDaemonHandoff
-} from "../chunk-KCAFCGGY.js";
+} from "../chunk-H5PIPIKQ.js";
 import {
   CODEX_BRIDGE_CAPABILITY,
   CODEX_RESUME_CAPABILITY,
@@ -17,7 +17,7 @@ import {
 import {
   findLiveProcessBySpawnId,
   ownsLiveProcess
-} from "../chunk-LGVHYFIB.js";
+} from "../chunk-BFBAHOGR.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
@@ -26,7 +26,7 @@ import {
   resolveGlobalPackageVersion,
   resolvePackageVersionFromBinary
 } from "../chunk-VT4IVERX.js";
-import "../chunk-VL5ZNK6V.js";
+import "../chunk-NAPRGHZ3.js";
 import "../chunk-GIRT7677.js";
 import {
   getMachineId

package/dist/bin/pushary-disconnect.js

@@ -31,7 +31,7 @@ import {
   geminiSettings,
   removeCodexHooks,
   removeCodexSettings
-} from "../chunk-VL5ZNK6V.js";
+} from "../chunk-NAPRGHZ3.js";
 import "../chunk-GIRT7677.js";
 import {
   exitOnHelpFlag

package/dist/bin/pushary-doctor.js

@@ -6,10 +6,10 @@ import {
   claudeWired,
   codexWired,
   geminiWired
-} from "../chunk-TAYHEJFF.js";
+} from "../chunk-QXZ2CKRK.js";
 import {
   readDaemonStatus
-} from "../chunk-KCAFCGGY.js";
+} from "../chunk-H5PIPIKQ.js";
 import {
   CURSOR_GATE_EVENTS,
   agentProbes,
@@ -19,7 +19,7 @@ import {
   isDetected,
   isPluginRegistered,
   vscodeSettingsTargets
-} from "../chunk-DPUOW6NS.js";
+} from "../chunk-KULUNLRO.js";
 import {
   OPENCODE_PLUGIN_PLACEHOLDER,
   openCodePluginDir,
@@ -56,7 +56,7 @@ import {
   readCodexMcpAuth,
   untrustedCodexHookEvents,
   vscodePluginDir
-} from "../chunk-VL5ZNK6V.js";
+} from "../chunk-NAPRGHZ3.js";
 import {
   readLedgerSummary
 } from "../chunk-VIHRP25S.js";

package/dist/bin/pushary-gemini-bridge.js

@@ -10,14 +10,14 @@ import "../chunk-QLMX5LLV.js";
 import {
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-LGVHYFIB.js";
+} from "../chunk-BFBAHOGR.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import {
   resolveBinary
 } from "../chunk-VT4IVERX.js";
-import "../chunk-VL5ZNK6V.js";
+import "../chunk-NAPRGHZ3.js";
 import "../chunk-GIRT7677.js";
 import {
   getMachineId

package/dist/bin/pushary-logout.js

@@ -4,7 +4,7 @@ import {
   codexConfigToml,
   cursorUserMcp,
   geminiSettings
-} from "../chunk-VL5ZNK6V.js";
+} from "../chunk-NAPRGHZ3.js";
 import "../chunk-GIRT7677.js";
 import {
   createIo

package/dist/bin/pushary-setup.js

@@ -6,13 +6,13 @@ import {
   claudeWired,
   codexWired,
   geminiWired
-} from "../chunk-TAYHEJFF.js";
+} from "../chunk-QXZ2CKRK.js";
 import {
   runBrowserLogin
 } from "../chunk-Z3Z4VK5F.js";
 import {
   ensureDaemonRunning
-} from "../chunk-KCAFCGGY.js";
+} from "../chunk-H5PIPIKQ.js";
 import {
   addClaudeMcpServer,
   addPusharyHooks,
@@ -30,7 +30,7 @@ import {
   shortenHome,
   vscodeSettingsTargets,
   writeInstructionBlock
-} from "../chunk-DPUOW6NS.js";
+} from "../chunk-KULUNLRO.js";
 import {
   OPENCODE_HOOK_BINARY,
   addOpenCodeMcpServer,
@@ -80,7 +80,7 @@ import {
   geminiSettings,
   pusharyConfigFile,
   vscodePluginDir
-} from "../chunk-VL5ZNK6V.js";
+} from "../chunk-NAPRGHZ3.js";
 import "../chunk-GIRT7677.js";
 import {
   reportEvent

package/dist/bin/pushary-upgrade.js

@@ -37,7 +37,7 @@ import {
   hasCodexHooks,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-VL5ZNK6V.js";
+} from "../chunk-NAPRGHZ3.js";
 import "../chunk-GIRT7677.js";
 import {
   exitOnHelpFlag

package/dist/{chunk-LGVHYFIB.js → chunk-BFBAHOGR.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-VL5ZNK6V.js";
+} from "./chunk-NAPRGHZ3.js";
 import {
   readJsonSafe
 } from "./chunk-6MTNS63X.js";

package/dist/{chunk-KCAFCGGY.js → chunk-H5PIPIKQ.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VT4IVERX.js";
 import {
   pusharyDir
-} from "./chunk-VL5ZNK6V.js";
+} from "./chunk-NAPRGHZ3.js";
 import {
   getMachineId
 } from "./chunk-RN3NOEJF.js";

package/dist/{chunk-DPUOW6NS.js → chunk-KULUNLRO.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-ZGC3W23N.js";
 import {
   codexHomeFrom
-} from "./chunk-VL5ZNK6V.js";
+} from "./chunk-NAPRGHZ3.js";
 
 // src/vscode-config.ts
 import { homedir } from "os";

package/dist/{chunk-VL5ZNK6V.js → chunk-NAPRGHZ3.js}

@@ -228,10 +228,20 @@ var addCodexHookTrust = (config, hooksJsonPath, command, positions) => {
     const position = positions[definition.event];
     if (!position) continue;
     const key = codexHookStateKey(hooksJsonPath, definition.event, position);
+    const ours = codexHookTrustHash(definition, command);
     const existing = asRecord(state[key]) ?? {};
-    state[key] = { ...existing, trusted_hash: codexHookTrustHash(definition, command) };
+    state[key] = { ...existing, trusted_hash: ours };
+    for (const stale of staleTrustKeys(state, hooksJsonPath, definition.event, key, ours)) {
+      delete state[stale];
+    }
   }
 };
+var staleTrustKeys = (state, hooksJsonPath, event, currentKey, ourHash) => {
+  const prefix = `${hooksJsonPath}:${CODEX_EVENT_KEY[event]}:`;
+  return Object.keys(state).filter(
+    (key) => key !== currentKey && key.startsWith(prefix) && asRecord(state[key])?.trusted_hash === ourHash
+  );
+};
 
 // src/setup/paths.ts
 import { homedir as homedir2 } from "os";

package/dist/{chunk-TAYHEJFF.js → chunk-QXZ2CKRK.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-K42RXJPG.js";
 import {
   hasCodexHooks
-} from "./chunk-VL5ZNK6V.js";
+} from "./chunk-NAPRGHZ3.js";
 
 // src/diagnostics/wiring.ts
 var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.87.3",
+  "version": "0.87.4",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",