@pushary/agent-hooks 0.89.12 → 0.90.0

package/CHANGELOG.md

@@ -1,5 +1,82 @@
 # Changelog
 
+## 0.90.0
+
+### A hook that needs an answer is allowed to wait for one
+
+Claude Code hooks are now registered at the 600 second budget Claude itself
+allows, so a policy that waits two minutes for a phone approval is no longer cut
+off at 120 seconds and turned into a denial the user never saw. Anything a hook
+does that is not a decision keeps its short timeout.
+
+A phone card is now withdrawn when the tool it guarded completes or the agent's
+own client denies it, so an approval cannot arrive for something that already
+finished.
+
+### The prompts that never reached the phone
+
+Codex permission requests are no longer filtered by a shell matcher, so a browser
+use request, a managed network request and an MCP tool request all reach the
+phone the same way a shell escalation does. Codex in bypass mode now decides
+before the tool runs rather than after it, which is what push-first has always
+meant everywhere else.
+
+Gemini reports its turn boundary through AfterAgent and its teardown through
+SessionEnd, so a finished Gemini turn is a finished turn rather than a session
+that stayed open.
+
+A finished subagent now ends its own session instead of ending its parent's, and
+appears under the session that started it. Context compaction is reported as
+itself rather than as a tool that ran.
+
+Pushary's own tools are never gated by Pushary, on the server exactly as in the
+hook, so asking the user a question can no longer wait on approval to ask it.
+
+### Sessions end, and a daemon that cannot log in says so
+
+A session that goes quiet is closed rather than left standing forever, and the
+daemon reaps the sessions it started. `pushary daemon status` lists what it is
+holding, how old each one is, and how much memory it is using.
+
+A daemon whose key is rejected now records that and stops, instead of restarting
+into the same rejection until something notices. `pushary doctor` says the daemon
+needs a login, and logging in clears it.
+
+### Setup and doctor tell the truth about this machine
+
+`pushary doctor` names the other tools holding the same agent hooks and how long
+each of them waits, checks that the bridge the Mac app installed can be found,
+and reports which Node the hooks will actually run under.
+
+`pushary setup` gained `--verify none` for an unattended install, prints what it
+would also do during a dry run, offers a way out of pairing, and can take over
+hooks another tool is holding with `--take-over-hooks`. `pushary mode` now sets a
+site's mode permanently unless told how long to keep it.
+
+### Machine identity and clean
+
+`pushary clean` leaves the machine identity shared with the Mac app intact, keeps
+one entry rather than two, and treats the identity file as the CLI's to own and
+the app's to read. Transcript sync seals its recovery ledger and admits a gap
+rather than syncing bookkeeping around it.
+
+## 0.89.13
+
+### Synced transcripts survive large turns and restarts safely
+
+Oversized file reads and diffs are shortened before encryption instead of being
+rejected by the server, with the removed UTF-8 byte count recorded in the turn.
+Stable HMAC identifiers prevent transcript contents leaking through record ids,
+and a resumed session reuses its persisted encryption key rather than conflicting
+with the key already registered for that session.
+
+Transcript recipients are now pinned on first use and later key changes stop sync
+until the user explicitly runs `pushary transcripts trust --rotate`. First use
+also fails closed when that pin cannot be stored, so no session key is wrapped to
+an unrecorded recipient. New sessions can independently wrap their key for the
+owner's phone and an optional audited compliance-recovery recipient; installations
+without one remain compatible.
+
 ## 0.89.12
 
 ### Phone control installs as a native service, without a VM

package/README.md

@@ -200,6 +200,7 @@ stats        Show the approval moments your agents hit while not connected
 suggestions  List rules mined from your own approvals
 upgrade      Update the globally installed hooks to the latest version
 hook         Run as a PreToolUse hook (reads stdin, writes stdout)
+transcripts  Show or re-trust the keys this machine seals transcripts to
 ```
 
 Run `pushary <command> --help` for one command's options.

package/data/SKILL.md

@@ -348,7 +348,7 @@ else:
 
 If the user answers in chat before the push response arrives, call `cancel_question` before acting. If it returns `handoffAction: "stop"`, stop. Otherwise, if it returns false, poll once for 1 second and honor any phone answer that won the race.
 
-**A note on how long ask_user blocks:** the wait time and whether it blocks at all are governed by the site's delivery mode, which the user configures (you do not set it). In the default smart mode and push-only mode, ask_user blocks for the policy timeout; in notify-only mode it returns immediately with `answered: false` after sending the push. Always check `answered` rather than assuming the call blocked, and pass `timeoutMs` only when you need a shorter wait than the site policy.
+**A note on how long ask_user blocks:** the wait time and whether it blocks at all are governed by the site's delivery mode, which the user configures (you do not set it). The four modes are "When I'm out" (`push_first`, the default), "Every time" (`push_only`), "Updates" (`notify_only`) and "Terminal" (`terminal_only`). In When I'm out, ask_user blocks for the push-first window (45 seconds by default) and the phone is only asked when the user is away from their terminal or their Mac; in Every time it blocks for the policy timeout and the phone is always asked; in Updates it returns immediately with `answered: false` after telling the phone, because the decision belongs in the current client; in Terminal nothing reaches the phone and it also returns immediately with `answered: false`. Always check `answered` rather than assuming the call blocked, and pass `timeoutMs` only when you need a shorter wait than the site policy.
 
 ## Identifying Your Agent
 

package/data/cursor-plugin/skills/pushary/SKILL.md

@@ -341,7 +341,7 @@ else:
 
 If the user answers in chat before the push response arrives, call `cancel_question` before acting. If it returns `handoffAction: "stop"`, stop. Otherwise, if it returns false, poll once for 1 second and honor any phone answer that won the race.
 
-**A note on how long ask_user blocks:** the wait time and whether it blocks at all are governed by the site's delivery mode, which the user configures (you do not set it). In the default smart mode and push-only mode, ask_user blocks for the policy timeout; in notify-only mode it returns immediately with `answered: false` after sending the push. Always check `answered` rather than assuming the call blocked, and pass `timeoutMs` only when you need a shorter wait than the site policy.
+**A note on how long ask_user blocks:** the wait time and whether it blocks at all are governed by the site's delivery mode, which the user configures (you do not set it). The four modes are "When I'm out" (`push_first`, the default), "Every time" (`push_only`), "Updates" (`notify_only`) and "Terminal" (`terminal_only`). In When I'm out, ask_user blocks for the push-first window (45 seconds by default) and the phone is only asked when the user is away from their terminal or their Mac; in Every time it blocks for the policy timeout and the phone is always asked; in Updates it returns immediately with `answered: false` after telling the phone, because the decision belongs in the current client; in Terminal nothing reaches the phone and it also returns immediately with `answered: false`. Always check `answered` rather than assuming the call blocked, and pass `timeoutMs` only when you need a shorter wait than the site policy.
 
 ## Identifying Your Agent
 

package/data/vscode-plugin/skills/pushary/SKILL.md

@@ -341,7 +341,7 @@ else:
 
 If the user answers in chat before the push response arrives, call `cancel_question` before acting. If it returns `handoffAction: "stop"`, stop. Otherwise, if it returns false, poll once for 1 second and honor any phone answer that won the race.
 
-**A note on how long ask_user blocks:** the wait time and whether it blocks at all are governed by the site's delivery mode, which the user configures (you do not set it). In the default smart mode and push-only mode, ask_user blocks for the policy timeout; in notify-only mode it returns immediately with `answered: false` after sending the push. Always check `answered` rather than assuming the call blocked, and pass `timeoutMs` only when you need a shorter wait than the site policy.
+**A note on how long ask_user blocks:** the wait time and whether it blocks at all are governed by the site's delivery mode, which the user configures (you do not set it). The four modes are "When I'm out" (`push_first`, the default), "Every time" (`push_only`), "Updates" (`notify_only`) and "Terminal" (`terminal_only`). In When I'm out, ask_user blocks for the push-first window (45 seconds by default) and the phone is only asked when the user is away from their terminal or their Mac; in Every time it blocks for the policy timeout and the phone is always asked; in Updates it returns immediately with `answered: false` after telling the phone, because the decision belongs in the current client; in Terminal nothing reaches the phone and it also returns immediately with `answered: false`. Always check `answered` rather than assuming the call blocked, and pass `timeoutMs` only when you need a shorter wait than the site policy.
 
 ## Identifying Your Agent
 

package/dist/bin/pushary-bell-hook.js

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-VPLQFXCH.js";
+} from "../chunk-5NAZ7SFS.js";
 import {
   readHookInput
 } from "../chunk-6CUUA7HO.js";
-import "../chunk-RNKPLUWC.js";
+import "../chunk-OSALSIUF.js";
 import "../chunk-BC3VCZ3E.js";
-import "../chunk-XREW7RQ3.js";
+import "../chunk-JW4KO5AF.js";
 import "../chunk-4LL6LG5X.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-3MCEES6Z.js";
+import "../chunk-VNMKIJZB.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,14 +5,14 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-VPLQFXCH.js";
+} from "../chunk-5NAZ7SFS.js";
 import {
   guardBinary
-} from "../chunk-VF3RTVWY.js";
+} from "../chunk-EZIEXHYM.js";
 import "../chunk-L4ZCFMWW.js";
 import {
   claudeSettings
-} from "../chunk-OVEGEQSB.js";
+} from "../chunk-KUZWXPUS.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
@@ -21,22 +21,22 @@ import {
 } from "../chunk-GMXKITVA.js";
 import {
   exitOnHelpFlag
-} from "../chunk-OTPJ4FUR.js";
-import "../chunk-RLQWNEPM.js";
+} from "../chunk-BVBEURWJ.js";
+import "../chunk-43GMYSS4.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-RNKPLUWC.js";
+import "../chunk-OSALSIUF.js";
 import "../chunk-BC3VCZ3E.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-XREW7RQ3.js";
+import "../chunk-JW4KO5AF.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-4LL6LG5X.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-3MCEES6Z.js";
+import "../chunk-VNMKIJZB.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/bin/pushary-claude.js

@@ -1,24 +1,32 @@
 #!/usr/bin/env node
+import {
+  changedRecipientsMessage,
+  loadPin,
+  savePin,
+  verifyRecipients
+} from "../chunk-YKLCWWEI.js";
 import {
   ensureDaemonRunning
-} from "../chunk-PS7DQ2SU.js";
+} from "../chunk-F2ICEWZL.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "../chunk-WDVQ6O4C.js";
+} from "../chunk-7FE2KABY.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
 } from "../chunk-QZCFVWA7.js";
 import {
   transcriptsEnabled
-} from "../chunk-JJV5Q4KG.js";
+} from "../chunk-UZNKVRLE.js";
 import {
+  SESSION_IDLE_TIMEOUT_MS,
+  describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-6GU55AQQ.js";
+} from "../chunk-Y6BWPERV.js";
 import {
   needsShell,
   spawnClaude
@@ -30,9 +38,10 @@ import {
 import {
   fetchModeState,
   getPolicy,
+  phoneDrivenEnv,
   repoKeyFor,
   reportEvent
-} from "../chunk-OADGBOP7.js";
+} from "../chunk-TDZFPMSZ.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -44,25 +53,25 @@ import {
   removePendingCommand,
   savePendingCommand,
   waitForAnswer
-} from "../chunk-JHJHCMAF.js";
+} from "../chunk-FXEVRLHC.js";
 import {
   UNNAMED_ACTION,
   deriveToolTarget,
   describeToolCall,
   scopePathFor
-} from "../chunk-JVZX5YRJ.js";
+} from "../chunk-L4E2BIJ2.js";
 import {
   getMachineId
-} from "../chunk-5NDB3YOE.js";
-import "../chunk-OVEGEQSB.js";
+} from "../chunk-54ELC7D7.js";
+import "../chunk-KUZWXPUS.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-RNKPLUWC.js";
+import "../chunk-OSALSIUF.js";
 import "../chunk-BC3VCZ3E.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-XREW7RQ3.js";
+import "../chunk-JW4KO5AF.js";
 import "../chunk-4LL6LG5X.js";
 import {
   getApiKey,
@@ -71,7 +80,7 @@ import {
 import {
   KILL_REASON,
   resolveGate
-} from "../chunk-3MCEES6Z.js";
+} from "../chunk-VNMKIJZB.js";
 
 // src/wrapper/claudeBinary.ts
 import { statSync } from "fs";
@@ -147,13 +156,82 @@ var runLocalPassthrough = (binary, args2) => {
 import { basename } from "path";
 
 // src/transcript-sync.ts
+import { homedir as homedir2 } from "os";
+import { join as join3, resolve } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+
+// src/transcript-session-key.ts
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync as statSync2, writeFileSync } from "fs";
 import { homedir } from "os";
-import { join as join2, resolve } from "path";
-import { existsSync, readFileSync } from "fs";
+import { join as join2 } from "path";
+var sessionDir = () => process.env.PUSHARY_SESSION_KEY_DIR?.trim() || join2(homedir(), ".pushary", "sessions");
+var SESSION_KEY_TTL_MS = 48 * 60 * 60 * 1e3;
+var SAFE_SESSION_ID = /^[A-Za-z0-9._-]{1,128}$/;
+var fileFor = (sessionId) => SAFE_SESSION_ID.test(sessionId) ? join2(sessionDir(), `${sessionId}.json`) : null;
+var loadSessionKey = (sessionId) => {
+  const path = fileFor(sessionId);
+  if (!path || !existsSync(path)) return null;
+  try {
+    if (Date.now() - statSync2(path).mtimeMs > SESSION_KEY_TTL_MS) return null;
+    const raw = JSON.parse(readFileSync(path, "utf-8"));
+    const key = typeof raw.sessionKey === "string" ? Buffer.from(raw.sessionKey, "base64") : null;
+    if (!key || key.length !== 32) return null;
+    return {
+      sessionKey: new Uint8Array(key),
+      wrappedKey: typeof raw.wrappedKey === "string" ? raw.wrappedKey : null,
+      providerWrappedKey: typeof raw.providerWrappedKey === "string" ? raw.providerWrappedKey : null,
+      providerKeyId: typeof raw.providerKeyId === "string" ? raw.providerKeyId : null,
+      keyUploaded: raw.keyUploaded === true
+    };
+  } catch {
+    return null;
+  }
+};
+var saveSessionKey = (sessionId, value) => {
+  const path = fileFor(sessionId);
+  if (!path) return;
+  try {
+    mkdirSync(sessionDir(), { recursive: true, mode: 448 });
+    writeFileSync(
+      path,
+      JSON.stringify({
+        sessionKey: Buffer.from(value.sessionKey).toString("base64"),
+        wrappedKey: value.wrappedKey,
+        providerWrappedKey: value.providerWrappedKey,
+        providerKeyId: value.providerKeyId,
+        keyUploaded: value.keyUploaded
+      }),
+      { mode: 384 }
+    );
+  } catch {
+  }
+};
+var sweepStaleSessionKeys = (now = Date.now()) => {
+  const dir = sessionDir();
+  if (!existsSync(dir)) return 0;
+  let removed = 0;
+  try {
+    for (const name of readdirSync(dir)) {
+      if (!name.endsWith(".json")) continue;
+      const path = join2(dir, name);
+      try {
+        if (now - statSync2(path).mtimeMs <= SESSION_KEY_TTL_MS) continue;
+        rmSync(path, { force: true });
+        removed += 1;
+      } catch {
+      }
+    }
+  } catch {
+    return removed;
+  }
+  return removed;
+};
+
+// src/transcript-sync.ts
 var claudeTranscriptPath = (cwd, sessionId) => {
   const projectId = resolve(cwd).replace(/[^a-zA-Z0-9-]/g, "-");
-  const configDir = process.env.CLAUDE_CONFIG_DIR || join2(homedir(), ".claude");
-  return join2(configDir, "projects", projectId, `${sessionId}.jsonl`);
+  const configDir = process.env.CLAUDE_CONFIG_DIR || join3(homedir2(), ".claude");
+  return join3(configDir, "projects", projectId, `${sessionId}.jsonl`);
 };
 var createSyncState = () => ({
   sessionKey: null,
@@ -241,7 +319,7 @@ var chunkRecords = (records) => {
 };
 var readLines = (path) => {
   try {
-    return existsSync(path) ? readFileSync(path, "utf-8").split("\n") : [];
+    return existsSync2(path) ? readFileSync2(path, "utf-8").split("\n") : [];
   } catch {
     return [];
   }
@@ -249,19 +327,49 @@ var readLines = (path) => {
 var IDLE_CEILING_MS = 6e4;
 var nextInterval = (previousMs, idle, baseMs, maxMs) => idle ? Math.min(previousMs * 2, maxMs) : baseMs;
 var startTranscriptSync = (opts) => {
+  let warnedAboutRecipients = false;
+  const fetchPinnedRecipients = async () => {
+    const offer = await fetchTranscriptRecipients(opts.apiKey);
+    if (!offer) return null;
+    const verdict = verifyRecipients(offer, loadPin());
+    if (verdict.kind === "first-use" && !savePin(verdict.pin)) return null;
+    if (verdict.kind === "changed") {
+      if (!warnedAboutRecipients) {
+        warnedAboutRecipients = true;
+        process.stderr.write(`${changedRecipientsMessage(verdict, offer)}
+`);
+      }
+      return null;
+    }
+    return offer;
+  };
   const uploader = {
-    fetchTranscriptRecipients: () => fetchTranscriptRecipients(opts.apiKey),
+    fetchTranscriptRecipients: fetchPinnedRecipients,
     uploadRecords: (params) => uploadTranscriptRecords(opts.apiKey, params)
   };
   const path = claudeTranscriptPath(opts.cwd, opts.sessionId);
-  let state = createSyncState();
+  const persisted = loadSessionKey(opts.sessionId);
+  let state = persisted ? { ...createSyncState(), ...persisted } : createSyncState();
+  sweepStaleSessionKeys();
+  let persistedUploaded = persisted?.keyUploaded ?? false;
   let running = true;
   let inFlight = false;
   const tick = async () => {
     if (!running || inFlight) return;
     inFlight = true;
     try {
+      const before = state.sessionKey;
       state = await syncTick(readLines(path), state, uploader, opts.sessionId, opts.machineId);
+      if (state.sessionKey && (before !== state.sessionKey || state.keyUploaded !== persistedUploaded)) {
+        persistedUploaded = state.keyUploaded;
+        saveSessionKey(opts.sessionId, {
+          sessionKey: state.sessionKey,
+          wrappedKey: state.wrappedKey,
+          providerWrappedKey: state.providerWrappedKey,
+          providerKeyId: state.providerKeyId,
+          keyUploaded: state.keyUploaded
+        });
+      }
     } catch {
     } finally {
       inFlight = false;
@@ -292,9 +400,9 @@ var startTranscriptSync = (opts) => {
 
 // src/wrapper/sdkLoader.ts
 import { spawn } from "child_process";
-import { existsSync as existsSync2, mkdirSync, writeFileSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join3 } from "path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join4 } from "path";
 import { pathToFileURL } from "url";
 var userMessage = (text) => ({
   type: "user",
@@ -304,8 +412,8 @@ var userMessage = (text) => ({
 var SDK_VERSION = "0.3.207";
 var SDK_PACKAGE = "@anthropic-ai/claude-agent-sdk";
 var SDK_SPEC = `${SDK_PACKAGE}@${SDK_VERSION}`;
-var sdkCacheDir = () => process.env.PUSHARY_REMOTE_SDK_DIR?.trim() || join3(homedir2(), ".pushary", "remote-sdk");
-var cachedSdkEntry = () => join3(sdkCacheDir(), "node_modules", "@anthropic-ai", "claude-agent-sdk", "sdk.mjs");
+var sdkCacheDir = () => process.env.PUSHARY_REMOTE_SDK_DIR?.trim() || join4(homedir3(), ".pushary", "remote-sdk");
+var cachedSdkEntry = () => join4(sdkCacheDir(), "node_modules", "@anthropic-ai", "claude-agent-sdk", "sdk.mjs");
 var importSdk = async (specifierOrUrl) => {
   try {
     const mod = await import(specifierOrUrl);
@@ -320,7 +428,7 @@ var loadClaudeSdk = async () => {
   const fromResolution = await importSdk(SDK_PACKAGE);
   if (fromResolution) return fromResolution;
   const entry = cachedSdkEntry();
-  if (existsSync2(entry)) return importSdk(pathToFileURL(entry).href);
+  if (existsSync3(entry)) return importSdk(pathToFileURL(entry).href);
   return null;
 };
 var ensureClaudeSdk = async (log) => {
@@ -328,10 +436,10 @@ var ensureClaudeSdk = async (log) => {
   if (present) return present;
   const dir = sdkCacheDir();
   try {
-    mkdirSync(dir, { recursive: true });
-    const pkgJson = join3(dir, "package.json");
-    if (!existsSync2(pkgJson)) {
-      writeFileSync(pkgJson, `${JSON.stringify({ name: "pushary-remote-sdk", private: true })}
+    mkdirSync2(dir, { recursive: true });
+    const pkgJson = join4(dir, "package.json");
+    if (!existsSync3(pkgJson)) {
+      writeFileSync2(pkgJson, `${JSON.stringify({ name: "pushary-remote-sdk", private: true })}
 `);
     }
   } catch {
@@ -1262,14 +1370,30 @@ var runLocalLeg = (session, deps = {}) => {
 
 // src/wrapper/remoteLoop.ts
 var errMsg = (err) => err instanceof Error ? err.message : String(err);
+var scheduleWithTimer = (fire, delayMs) => {
+  const timer = setTimeout(fire, delayMs);
+  timer.unref?.();
+  return () => clearTimeout(timer);
+};
+var isTurnActivity = (message) => message.type !== "system" && message.type !== "result";
+var isInit = (message) => message.type === "system" && message.subtype === "init";
 var DEFAULT_MAX_RESTARTS = 5;
 var runRemoteLoop = async (deps) => {
   const maxRestarts = deps.maxRestarts ?? DEFAULT_MAX_RESTARTS;
   const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const backoff = deps.backoffMs ?? ((attempt) => Math.min(1e3 * 2 ** attempt, 15e3));
+  const idleTimeoutMs = deps.idleTimeoutMs ?? SESSION_IDLE_TIMEOUT_MS;
+  const scheduleIdle = deps.scheduleIdle ?? scheduleWithTimer;
   let resumeId = deps.initialResume;
   let totalCost = 0;
   let restarts = 0;
+  let idleExpired = false;
+  let cancelIdle;
+  const disarmIdle = () => {
+    cancelIdle?.();
+    cancelIdle = void 0;
+  };
+  const ended = (exitCode, endedBy) => ({ exitCode, totalCostUsd: totalCost, endedBy });
   while (!deps.signal.aborted) {
     deps.input.detachConsumer();
     let query;
@@ -1287,7 +1411,7 @@ var runRemoteLoop = async (deps) => {
       });
     } catch (err) {
       deps.log?.(`[pushary] remote mode: query failed to start: ${errMsg(err)}`);
-      return { exitCode: 1, totalCostUsd: totalCost };
+      return ended(1, "failed");
     }
     const onAbort = () => {
       deps.input.close();
@@ -1296,10 +1420,24 @@ var runRemoteLoop = async (deps) => {
     };
     if (deps.signal.aborted) onAbort();
     else deps.signal.addEventListener("abort", onAbort, { once: true });
+    let turnOpen = false;
+    const stillResting = (deliveredAtRest) => !turnOpen && deps.input.bufferedCount === 0 && deps.input.stats.delivered === deliveredAtRest;
+    const armIdle = () => {
+      disarmIdle();
+      const deliveredAtRest = deps.input.stats.delivered;
+      cancelIdle = scheduleIdle(() => {
+        cancelIdle = void 0;
+        if (!stillResting(deliveredAtRest)) return;
+        idleExpired = true;
+        deps.log?.(`[pushary] remote mode: no phone instruction for ${describeIdleWindow(idleTimeoutMs)}, ending the session`);
+        onAbort();
+      }, idleTimeoutMs);
+    };
+    const restsAfter = (message) => deps.input.bufferedCount === 0 && (message.type === "result" || isInit(message) && !turnOpen);
     try {
       for await (const message of query) {
         deps.onMessage?.(message);
-        if (message.type === "system" && message.subtype === "init" && typeof message.session_id === "string") {
+        if (isInit(message) && typeof message.session_id === "string") {
           resumeId = message.session_id;
           deps.onSessionId?.(resumeId);
         }
@@ -1307,16 +1445,23 @@ var runRemoteLoop = async (deps) => {
           totalCost = message.total_cost_usd;
           deps.onCost?.(totalCost);
         }
+        if (message.type === "result") turnOpen = false;
+        else if (isTurnActivity(message)) turnOpen = true;
+        if (restsAfter(message)) armIdle();
       }
+      disarmIdle();
       deps.signal.removeEventListener("abort", onAbort);
-      return { exitCode: deps.signal.aborted ? 130 : 0, totalCostUsd: totalCost };
+      if (idleExpired) return ended(0, "idle");
+      return deps.signal.aborted ? ended(130, "aborted") : ended(0, "input-closed");
     } catch (err) {
+      disarmIdle();
       deps.signal.removeEventListener("abort", onAbort);
-      if (deps.signal.aborted) return { exitCode: 130, totalCostUsd: totalCost };
+      if (idleExpired) return ended(0, "idle");
+      if (deps.signal.aborted) return ended(130, "aborted");
       restarts++;
       if (restarts > maxRestarts) {
         deps.log?.(`[pushary] remote mode: too many restarts, giving up: ${errMsg(err)}`);
-        return { exitCode: 1, totalCostUsd: totalCost };
+        return ended(1, "failed");
       }
       deps.log?.(
         `[pushary] remote mode: transient error, resuming session (attempt ${restarts}/${maxRestarts}): ${errMsg(err)}`
@@ -1324,15 +1469,18 @@ var runRemoteLoop = async (deps) => {
       await sleep(backoff(restarts));
     }
   }
-  return { exitCode: 130, totalCostUsd: totalCost };
+  return ended(130, "aborted");
 };
 
 // src/wrapper/remoteLeg.ts
 var CTRL_RIGHT_BRACKET = "";
 var CTRL_C = "";
-var runRemoteLeg = async (session, sdk) => {
+var terminalAttended = () => Boolean(process.stdin.isTTY);
+var runRemoteLeg = async (session, sdk, deps = {}) => {
   const legAbort = new AbortController();
+  const attended = deps.attended ?? terminalAttended();
   let switchBack = false;
+  let idleEnded = false;
   const control = {
     // The running query already drains the shared input queue, so a freshly pushed
     // phone command is delivered without any action here.
@@ -1367,7 +1515,7 @@ var runRemoteLeg = async (session, sdk) => {
       permissionMode: session.permissionMode,
       // The SDK REPLACES the subprocess env; spread process.env and mark the
       // recursion guard so a wrapper-spawned claude cannot re-enter the wrapper.
-      env: { ...process.env, [WRAPPER_ACTIVE_ENV]: "1" },
+      env: phoneDrivenEnv({ ...process.env, [WRAPPER_ACTIVE_ENV]: "1" }),
       cwd: process.cwd(),
       // Run the user's OWN claude (auth + version parity); Windows .cmd shims keep
       // the SDK's bundled binary since the SDK cannot spawn a shim directly.
@@ -1375,13 +1523,20 @@ var runRemoteLeg = async (session, sdk) => {
       onSessionId: (id) => session.setSessionId(id),
       onMessage: (message) => session.streamMessage(message),
       log: (message) => process.stderr.write(`${message}
-`)
+`),
+      idleTimeoutMs: deps.idleTimeoutMs,
+      scheduleIdle: deps.scheduleIdle
     });
     exitCode = result.exitCode;
+    idleEnded = result.endedBy === "idle";
   } finally {
     session.stdin.releaseToChild();
     session.setActiveLeg(null);
   }
+  if (idleEnded && attended) {
+    process.stderr.write("[pushary] handing the terminal back to local mode\n");
+    return "switch";
+  }
   return switchBack ? "switch" : { type: "exit", code: exitCode };
 };
 
@@ -1511,6 +1666,7 @@ var runDualMode = async (binary, args2, startingMode) => {
     if (!sessionId) return Promise.resolve();
     try {
       await ensureOwnership();
+      ownership?.touch();
       await reportEvent(
         { event, agentType: "claude_code", agentName, action, sessionId, machineId, pid: process.pid },
         { maxAttempts: event === "session_start" ? 4 : 2, timeoutMs: 4e3, requireOk: event === "session_start" }