@pushary/agent-hooks 0.92.0 → 0.93.0

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## 0.93.0
+
+Requires Node.js 20.3.0 or newer for shared cancellation signals.
+
+- Register the expanded Claude and Codex hook coverage from the September 4 changes; preserve child-agent identity during compaction.
+- Share one deadline across mode lookup, question reconciliation, event reporting, and command acknowledgement. Retain unresolved question markers for retry.
+- Deliver queued phone instructions on UserPromptSubmit and keep observational hooks from consuming them.
+- Redact credentials in notification activity, phone pushes, and unrecognized failure messages.
+- Diagnose modified Codex hook definitions against their installed trust hashes.
+
+## 0.92.1
+
+### A rejected key is an answer, not an empty poll
+
+`pollAgent` returned `{ command: null, mode: null }` for every non-OK response,
+so a 401 was indistinguishable from a healthy poll with nothing queued. That
+landed on the success branch of `startCommandPoller`, which resets `errorStreak`
+to zero, so the backoff never engaged and the wrapper polled a dead key at the
+idle cadence forever. Because `mode` was null, `onModeState` never fired, and
+`onModeState` is the only place `dualMode` sets `killed` and stops the active
+leg. A wrapper whose key the server rejects therefore reported `kill=false` to
+itself indefinitely: remote stop could not reach it, phone messages never
+landed, and nothing was printed.
+
+`PollResult` now carries `rejected`, set only for 401 and 403, which is the same
+line `fetchModeState` already drew between an answer and a blip. A rejected poll
+takes the error path, so the existing exponential backoff applies, and the
+wrapper prints once that remote stop and phone messages are not active. A 500 or
+a dropped connection is still a blip and still retried at the normal cadence.
+
+A rejected response is also no longer trusted for its contents: neither the
+command nor the mode state it carries is applied.
+
 ## 0.92.0
 
 ### A Claude Code upgrade registers the events it just gained

package/dist/bin/pushary-bell.js

@@ -15,7 +15,7 @@ import "../chunk-EZIEXHYM.js";
 import "../chunk-L4ZCFMWW.js";
 import {
   claudeSettings
-} from "../chunk-CV2YD2JR.js";
+} from "../chunk-N3TF3RQ2.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";

package/dist/bin/pushary-claude.js

@@ -7,7 +7,7 @@ import {
 } from "../chunk-YKLCWWEI.js";
 import {
   ensureDaemonRunning
-} from "../chunk-SQYBP3QQ.js";
+} from "../chunk-TWVZHZM3.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
@@ -17,7 +17,7 @@ import {
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "../chunk-QZCFVWA7.js";
+} from "../chunk-EQRS3SGM.js";
 import {
   transcriptsEnabled
 } from "../chunk-UZNKVRLE.js";
@@ -26,7 +26,7 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-4TFXV5MW.js";
+} from "../chunk-GKMQMSTB.js";
 import {
   needsShell,
   spawnClaude
@@ -41,7 +41,7 @@ import {
   phoneDrivenEnv,
   repoKeyFor,
   reportEvent
-} from "../chunk-YXDYKECP.js";
+} from "../chunk-G5L3WVFV.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -53,21 +53,22 @@ import {
   removePendingCommand,
   savePendingCommand,
   waitForAnswer
-} from "../chunk-F7OURW3C.js";
+} from "../chunk-RER3FRTD.js";
 import {
   UNNAMED_ACTION,
   deriveToolTarget,
   describeToolCall,
   scopePathFor
-} from "../chunk-L4E2BIJ2.js";
+} from "../chunk-UAFQC35P.js";
+import "../chunk-QQSQWLFR.js";
 import {
   getMachineId
-} from "../chunk-2ACC5M7F.js";
-import "../chunk-CV2YD2JR.js";
+} from "../chunk-72FWXLW2.js";
+import "../chunk-N3TF3RQ2.js";
 import "../chunk-DINDL2CF.js";
 import "../chunk-OSALSIUF.js";
 import "../chunk-BC3VCZ3E.js";
-import "../chunk-BSZYIAZL.js";
+import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
@@ -240,7 +241,8 @@ var createSyncState = () => ({
   providerKeyId: null,
   seen: /* @__PURE__ */ new Set(),
   keyUploaded: false,
-  keyRejected: false
+  keyRejected: false,
+  keyUnavailable: false
 });
 var syncTick = async (lines, state, uploader, sessionId, machineId) => {
   if (state.keyRejected) return state;
@@ -265,6 +267,7 @@ var syncTick = async (lines, state, uploader, sessionId, machineId) => {
   const seen = new Set(state.seen);
   let keyUploaded = state.keyUploaded;
   let keyRejected = false;
+  let keyUnavailable = false;
   let rejected = 0;
   for (const chunk of chunkRecords(built.records)) {
     const result = await uploader.uploadRecords({
@@ -280,6 +283,10 @@ var syncTick = async (lines, state, uploader, sessionId, machineId) => {
       keyRejected = true;
       break;
     }
+    if (result.keyUnavailable) {
+      keyUnavailable = true;
+      break;
+    }
     if (!result.ok) break;
     for (const id of result.settledIds ?? chunk.map((r) => r.localId)) seen.add(id);
     rejected += result.rejectedIds.length;
@@ -295,7 +302,8 @@ var syncTick = async (lines, state, uploader, sessionId, machineId) => {
     providerKeyId,
     seen,
     keyUploaded,
-    keyRejected
+    keyRejected,
+    keyUnavailable
   };
 };
 var MAX_RECORDS_PER_BATCH = 200;
@@ -384,7 +392,7 @@ var startTranscriptSync = (opts) => {
       void (async () => {
         const before = state.sessionKey;
         await tick();
-        const idle = state.sessionKey === null && before === null;
+        const idle = state.sessionKey === null && before === null || state.keyUnavailable;
         schedule(nextInterval(delayMs, idle, baseIntervalMs, maxIntervalMs));
       })();
     }, delayMs);
@@ -717,6 +725,9 @@ var createRemoteApprover = (deps) => {
   };
 };
 
+// src/wrapper/authRejection.ts
+var isAuthRejection = (status) => status === 401 || status === 403;
+
 // src/wrapper/drainClient.ts
 var drainPendingCommand = async (apiKey, sessionId, signal, baseUrl = getBaseUrl()) => {
   try {
@@ -729,11 +740,12 @@ var drainPendingCommand = async (apiKey, sessionId, signal, baseUrl = getBaseUrl
       body: JSON.stringify(sessionId ? { sessionId } : {}),
       signal
     });
-    if (!response.ok) return null;
+    if (!response.ok) return { command: null, rejected: isAuthRejection(response.status) };
     const data = await response.json();
-    return typeof data.command === "string" && data.command.length > 0 ? data.command : null;
+    const command = typeof data.command === "string" && data.command.length > 0 ? data.command : null;
+    return { command, rejected: false };
   } catch {
-    return null;
+    return { command: null, rejected: false };
   }
 };
 
@@ -744,6 +756,9 @@ var FAST_DECAY_TICKS = 3;
 var MAX_ERROR_BACKOFF_MS = 12e4;
 var MAX_ERROR_STREAK = 6;
 var REQUEST_TIMEOUT_MS = 1e4;
+var PollRejectedError = class extends Error {
+};
+var EMPTY_DRAIN = { command: null, rejected: false };
 var startCommandPoller = (opts) => {
   const drain = opts.drain ?? drainPendingCommand;
   const slow = opts.slowPollMs ?? SLOW_POLL_MS;
@@ -754,6 +769,16 @@ var startCommandPoller = (opts) => {
   let inflight;
   let idleTicks = 0;
   let errorStreak = 0;
+  let authRejectionReported = false;
+  const reportAuthRejection = () => {
+    if (authRejectionReported) return;
+    authRejectionReported = true;
+    try {
+      opts.onAuthRejected?.();
+    } catch {
+      return;
+    }
+  };
   const jitter = (ms) => {
     const r = opts.jitter ? opts.jitter() : Math.random();
     return Math.max(1, Math.round(ms * (0.85 + r * 0.3)));
@@ -789,6 +814,10 @@ var startCommandPoller = (opts) => {
       let command;
       if (opts.poll) {
         const result = await opts.poll(opts.apiKey, opts.getSessionId?.(), wantCommands, controller.signal);
+        if (result.rejected) {
+          reportAuthRejection();
+          throw new PollRejectedError();
+        }
         command = result.command;
         if (result.mode && opts.onModeState) {
           try {
@@ -797,11 +826,15 @@ var startCommandPoller = (opts) => {
           }
         }
       } else {
-        ;
-        [command] = await Promise.all([
-          wantCommands ? drain(opts.apiKey, opts.getSessionId?.(), controller.signal) : Promise.resolve(null),
+        const [drained] = await Promise.all([
+          wantCommands ? drain(opts.apiKey, opts.getSessionId?.(), controller.signal) : Promise.resolve(EMPTY_DRAIN),
           fetchMode()
         ]);
+        if (drained.rejected) {
+          reportAuthRejection();
+          throw new PollRejectedError();
+        }
+        command = drained.command;
       }
       errorStreak = 0;
       if (command) {
@@ -894,7 +927,7 @@ var pollAgent = async (apiKey, sessionId, wantCommand, signal, baseUrl = getBase
       }),
       signal
     });
-    if (!response.ok) return { command: null, mode: null };
+    if (!response.ok) return { command: null, mode: null, rejected: isAuthRejection(response.status) };
     const data = await response.json();
     const claimedCommand = (id, text) => ({
       id,
@@ -923,9 +956,9 @@ var pollAgent = async (apiKey, sessionId, wantCommand, signal, baseUrl = getBase
       policyVersion: typeof data.policyVersion === "string" && data.policyVersion.length > 0 ? data.policyVersion : null,
       relayUrl: typeof data.relayUrl === "string" && data.relayUrl.length > 0 ? data.relayUrl : null
     };
-    return { command, mode };
+    return { command, mode, rejected: false };
   } catch {
-    return { command: null, mode: null };
+    return { command: null, mode: null, rejected: false };
   }
 };
 
@@ -1734,6 +1767,11 @@ var runDualMode = async (binary, args2, startingMode) => {
     // Relay-primary: idle the safety-net poll at 60s (see RELAY_FALLBACK_POLL_MS).
     // No relay advertised -> the poller IS the command path, so keep the default.
     slowPollMs: relayAdvertised ? RELAY_FALLBACK_POLL_MS : void 0,
+    onAuthRejected: () => {
+      process.stderr.write(
+        "[pushary] this key was rejected \u2014 remote stop and phone messages are NOT active; run `pushary login` to reconnect\n"
+      );
+    },
     onModeState: (state) => {
       if (state.kill && !killed) {
         killed = true;

package/dist/bin/pushary-clean.js

@@ -9,16 +9,16 @@ import {
   restoreHookTakeover,
   restoreMcpServer,
   runHermesPythonScript
-} from "../chunk-QCXKQJTG.js";
+} from "../chunk-NZQTIDXN.js";
 import {
   removeInstructionBlock,
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-3HS4YGHB.js";
+} from "../chunk-NXZYC3B3.js";
 import {
   pusharyHookExecutable
-} from "../chunk-ZMKKK6DC.js";
+} from "../chunk-6Y4IKMQT.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -35,19 +35,19 @@ import {
   removeGeminiSettings,
   removePusharySettings,
   restoreClaudeMcpServer
-} from "../chunk-I7W3UTDK.js";
-import "../chunk-2LAHXHBR.js";
+} from "../chunk-YUZYMAL7.js";
 import "../chunk-DSTLA2TC.js";
 import "../chunk-EZIEXHYM.js";
 import {
   disableDaemonService
-} from "../chunk-SQYBP3QQ.js";
+} from "../chunk-TWVZHZM3.js";
 import "../chunk-XHKBHWLX.js";
 import {
   execNpm
 } from "../chunk-L4ZCFMWW.js";
-import "../chunk-L4E2BIJ2.js";
-import "../chunk-2ACC5M7F.js";
+import "../chunk-UAFQC35P.js";
+import "../chunk-QQSQWLFR.js";
+import "../chunk-72FWXLW2.js";
 import {
   claudeJson,
   claudeMcpReceipt,
@@ -73,7 +73,7 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-CV2YD2JR.js";
+} from "../chunk-N3TF3RQ2.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";

package/dist/bin/pushary-codex-bridge.js

@@ -6,9 +6,9 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-CNPAT3HL.js";
+} from "../chunk-KHTFHUL3.js";
 import "../chunk-7FE2KABY.js";
-import "../chunk-QZCFVWA7.js";
+import "../chunk-EQRS3SGM.js";
 import {
   transcriptsEnabled
 } from "../chunk-UZNKVRLE.js";
@@ -18,7 +18,7 @@ import {
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-4TFXV5MW.js";
+} from "../chunk-GKMQMSTB.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
@@ -27,8 +27,8 @@ import {
 } from "../chunk-L4ZCFMWW.js";
 import {
   getMachineId
-} from "../chunk-2ACC5M7F.js";
-import "../chunk-CV2YD2JR.js";
+} from "../chunk-72FWXLW2.js";
+import "../chunk-N3TF3RQ2.js";
 import "../chunk-OSALSIUF.js";
 import "../chunk-BC3VCZ3E.js";
 import "../chunk-JW4KO5AF.js";

package/dist/bin/pushary-codex-hook.js

@@ -21,9 +21,11 @@ import {
   describeApplyPatch,
   fetchModeState,
   getPolicy,
+  handleCompaction,
   handlePostToolUse,
   handleSessionEnd,
   handleStop,
+  handleSubagentStop,
   handleUserPrompt,
   permissionTimeoutDecision,
   policyRequestFor,
@@ -34,7 +36,7 @@ import {
   toCodexWire,
   toPolicyLookup,
   toPolicyLookups
-} from "../chunk-YXDYKECP.js";
+} from "../chunk-G5L3WVFV.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -42,22 +44,24 @@ import {
   pollForAnswer,
   savePendingQuestion,
   sendNotification
-} from "../chunk-F7OURW3C.js";
+} from "../chunk-RER3FRTD.js";
 import {
   UNNAMED_ACTION,
   deriveActionBody,
   deriveBlocker,
   deriveToolTarget,
   describeToolCall,
-  scopePathFor
-} from "../chunk-L4E2BIJ2.js";
+  scopePathFor,
+  sessionIdentityOf
+} from "../chunk-UAFQC35P.js";
+import "../chunk-QQSQWLFR.js";
 import {
   getMachineId
-} from "../chunk-2ACC5M7F.js";
+} from "../chunk-72FWXLW2.js";
 import {
   canonicalJson
-} from "../chunk-CV2YD2JR.js";
-import "../chunk-BSZYIAZL.js";
+} from "../chunk-N3TF3RQ2.js";
+import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
@@ -388,14 +392,17 @@ var decidePreToolUse = async (input) => {
     return codexPass();
   }
 };
-var reportSessionStart = async (input) => {
+var reportSessionStart = async (input, action = "Session started") => {
   try {
     await reportEvent({
       event: "session_begin",
       agentType: CODEX_AGENT.type,
       agentName: agentNameFor(input),
-      action: "Session started",
-      sessionId: input.session_id
+      action,
+      // Not `sessionId: input.session_id`. On SubagentStart that would announce
+      // the parent session a second time under the same id; this gives the
+      // subagent its own row and names the parent beside it.
+      ...sessionIdentityOf(input)
     }, { maxAttempts: 1, timeoutMs: 5e3 });
   } catch {
   }
@@ -458,6 +465,33 @@ var main = async () => {
           reason: input.reason
         }, CODEX_AGENT, { reconcile: false, reportAttempts: 1, reportTimeoutMs: 1200 });
         break;
+      // Observability only, and none of them carries context back, so none uses
+      // emitContext. Each goes through the same handler Claude Code's own hook
+      // does, rather than a Codex-shaped copy of it, so the two agents cannot
+      // drift into reporting the same moment differently.
+      case "SubagentStart":
+        await reportSessionStart(input, "Subagent started");
+        break;
+      case "SubagentStop":
+        await handleSubagentStop({
+          hook_event_name: input.hook_event_name,
+          cwd: input.cwd,
+          session_id: input.session_id,
+          agent_id: input.agent_id,
+          agent_type: input.agent_type,
+          last_assistant_message: input.last_assistant_message
+        }, CODEX_AGENT);
+        break;
+      case "PreCompact":
+      case "PostCompact":
+        await handleCompaction({
+          hook_event_name: input.hook_event_name,
+          trigger: input.trigger,
+          cwd: input.cwd,
+          session_id: input.session_id,
+          agent_id: input.agent_id
+        }, CODEX_AGENT);
+        break;
       default:
         break;
     }

package/dist/bin/pushary-codex.js

@@ -1,17 +1,18 @@
 #!/usr/bin/env node
 import {
   reportEvent
-} from "../chunk-YXDYKECP.js";
+} from "../chunk-G5L3WVFV.js";
 import {
   askUser,
   waitForAnswer
-} from "../chunk-F7OURW3C.js";
-import "../chunk-L4E2BIJ2.js";
+} from "../chunk-RER3FRTD.js";
+import "../chunk-UAFQC35P.js";
+import "../chunk-QQSQWLFR.js";
 import {
   getMachineId
-} from "../chunk-2ACC5M7F.js";
-import "../chunk-CV2YD2JR.js";
-import "../chunk-BSZYIAZL.js";
+} from "../chunk-72FWXLW2.js";
+import "../chunk-N3TF3RQ2.js";
+import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";

package/dist/bin/pushary-connect.js

@@ -6,7 +6,7 @@ import {
   connectDevice,
   connectExistingApp,
   printConnectInstructions
-} from "../chunk-PYA4FLKI.js";
+} from "../chunk-UPCPR7QW.js";
 import "../chunk-3EGEA4KH.js";
 import {
   checkApiKey
@@ -27,7 +27,7 @@ import {
   readKeySource
 } from "../chunk-OSALSIUF.js";
 import "../chunk-BC3VCZ3E.js";
-import "../chunk-BSZYIAZL.js";
+import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import {
   UsageError

package/dist/bin/pushary-daemon.js

@@ -1,15 +1,14 @@
 #!/usr/bin/env node
 import {
   inspectConfiguredManagedProviders
-} from "../chunk-I3ORVBTP.js";
-import "../chunk-HDORB7WD.js";
+} from "../chunk-TFN7ZCTI.js";
+import "../chunk-WEDYCMHU.js";
 import {
   HEARTBEAT_INTERVAL_MS,
   sendHeartbeat
-} from "../chunk-2XQSN66Q.js";
-import "../chunk-ZMKKK6DC.js";
-import "../chunk-I7W3UTDK.js";
-import "../chunk-2LAHXHBR.js";
+} from "../chunk-T2PKGGDM.js";
+import "../chunk-6Y4IKMQT.js";
+import "../chunk-YUZYMAL7.js";
 import "../chunk-EZIEXHYM.js";
 import {
   DAEMON_LEASE_RENEW_INTERVAL_MS,
@@ -27,7 +26,7 @@ import {
   requestDaemonHandoff,
   stopDaemonRunning,
   writeDaemonNeedsLogin
-} from "../chunk-SQYBP3QQ.js";
+} from "../chunk-TWVZHZM3.js";
 import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
@@ -40,17 +39,18 @@ import {
   listProcessProofs,
   ownsLiveProcess,
   silentSpawnedProofs
-} from "../chunk-4TFXV5MW.js";
+} from "../chunk-GKMQMSTB.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import {
   resolveBinary
 } from "../chunk-L4ZCFMWW.js";
+import "../chunk-QQSQWLFR.js";
 import {
   getMachineId
-} from "../chunk-2ACC5M7F.js";
-import "../chunk-CV2YD2JR.js";
+} from "../chunk-72FWXLW2.js";
+import "../chunk-N3TF3RQ2.js";
 import {
   writeHuman
 } from "../chunk-QCGNGEGE.js";

package/dist/bin/pushary-disconnect.js

@@ -15,10 +15,10 @@ import {
   removeGeminiSettings,
   removePusharySettings,
   restoreClaudeMcpServer
-} from "../chunk-I7W3UTDK.js";
-import "../chunk-2LAHXHBR.js";
+} from "../chunk-YUZYMAL7.js";
 import "../chunk-EZIEXHYM.js";
 import "../chunk-L4ZCFMWW.js";
+import "../chunk-QQSQWLFR.js";
 import {
   claudeJson,
   claudeMcpReceipt,
@@ -32,7 +32,7 @@ import {
   geminiSettings,
   removeCodexHooks,
   removeCodexSettings
-} from "../chunk-CV2YD2JR.js";
+} from "../chunk-N3TF3RQ2.js";
 import {
   exitOnHelpFlag
 } from "../chunk-BVBEURWJ.js";