@pushary/agent-hooks 0.92.1 → 0.93.1

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.93.1
+
+- Attach stable usage report IDs and preserve the report timestamp across retries so the server counts a replay once.
+- Report restricted agent-key scope accurately and fail closed on unknown identity scopes.
+- Requires the additive server accounting and key-capability changes from #1303 before rollout.
+
+## 0.93.0
+
+Requires Node.js 20.3.0 or newer for shared cancellation signals.
+
+- Register the expanded Claude and Codex hook coverage from the September 4 changes; preserve child-agent identity during compaction.
+- Share one deadline across mode lookup, question reconciliation, event reporting, and command acknowledgement. Retain unresolved question markers for retry.
+- Deliver queued phone instructions on UserPromptSubmit and keep observational hooks from consuming them.
+- Redact credentials in notification activity, phone pushes, and unrecognized failure messages.
+- Diagnose modified Codex hook definitions against their installed trust hashes.
+
 ## 0.92.1
 
 ### A rejected key is an answer, not an empty poll

package/dist/bin/pushary-bell-hook.js

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-5NAZ7SFS.js";
+} from "../chunk-RH3TM7TO.js";
 import {
   readHookInput
 } from "../chunk-6CUUA7HO.js";
-import "../chunk-OSALSIUF.js";
+import "../chunk-6BIMJIRG.js";
 import "../chunk-BC3VCZ3E.js";
-import "../chunk-JW4KO5AF.js";
+import "../chunk-ODL52O5V.js";
 import "../chunk-4LL6LG5X.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-VNMKIJZB.js";
+import "../chunk-Z6CP5ZZD.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,7 +5,7 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-5NAZ7SFS.js";
+} from "../chunk-RH3TM7TO.js";
 import {
   addBellHooks,
   bellInstalled,
@@ -15,7 +15,7 @@ import "../chunk-EZIEXHYM.js";
 import "../chunk-L4ZCFMWW.js";
 import {
   claudeSettings
-} from "../chunk-CV2YD2JR.js";
+} from "../chunk-Y6XXFXVB.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
@@ -27,19 +27,19 @@ import {
 } from "../chunk-BVBEURWJ.js";
 import "../chunk-43GMYSS4.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-OSALSIUF.js";
+import "../chunk-6BIMJIRG.js";
 import "../chunk-BC3VCZ3E.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-JW4KO5AF.js";
+import "../chunk-ODL52O5V.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-4LL6LG5X.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-VNMKIJZB.js";
+import "../chunk-Z6CP5ZZD.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -7,26 +7,26 @@ import {
 } from "../chunk-YKLCWWEI.js";
 import {
   ensureDaemonRunning
-} from "../chunk-SQYBP3QQ.js";
+} from "../chunk-ZTJF6ANY.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "../chunk-7FE2KABY.js";
+} from "../chunk-46P3VES5.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "../chunk-QZCFVWA7.js";
+} from "../chunk-EQRS3SGM.js";
 import {
   transcriptsEnabled
-} from "../chunk-UZNKVRLE.js";
+} from "../chunk-6WYL3XIP.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-4TFXV5MW.js";
+} from "../chunk-TDUTNYAQ.js";
 import {
   needsShell,
   spawnClaude
@@ -41,7 +41,7 @@ import {
   phoneDrivenEnv,
   repoKeyFor,
   reportEvent
-} from "../chunk-YXDYKECP.js";
+} from "../chunk-5HGLZGI4.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -53,25 +53,26 @@ import {
   removePendingCommand,
   savePendingCommand,
   waitForAnswer
-} from "../chunk-F7OURW3C.js";
+} from "../chunk-RER3FRTD.js";
 import {
   UNNAMED_ACTION,
   deriveToolTarget,
   describeToolCall,
   scopePathFor
-} from "../chunk-L4E2BIJ2.js";
+} from "../chunk-4PE2SQVM.js";
+import "../chunk-Y3UGCQQC.js";
 import {
   getMachineId
-} from "../chunk-2ACC5M7F.js";
-import "../chunk-CV2YD2JR.js";
+} from "../chunk-NVPYRDCT.js";
+import "../chunk-Y6XXFXVB.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-OSALSIUF.js";
+import "../chunk-6BIMJIRG.js";
 import "../chunk-BC3VCZ3E.js";
-import "../chunk-BSZYIAZL.js";
+import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-JW4KO5AF.js";
+import "../chunk-ODL52O5V.js";
 import "../chunk-4LL6LG5X.js";
 import {
   getApiKey,
@@ -80,7 +81,7 @@ import {
 import {
   KILL_REASON,
   resolveGate
-} from "../chunk-VNMKIJZB.js";
+} from "../chunk-Z6CP5ZZD.js";
 
 // src/wrapper/claudeBinary.ts
 import { statSync } from "fs";
@@ -240,7 +241,8 @@ var createSyncState = () => ({
   providerKeyId: null,
   seen: /* @__PURE__ */ new Set(),
   keyUploaded: false,
-  keyRejected: false
+  keyRejected: false,
+  keyUnavailable: false
 });
 var syncTick = async (lines, state, uploader, sessionId, machineId) => {
   if (state.keyRejected) return state;
@@ -265,6 +267,7 @@ var syncTick = async (lines, state, uploader, sessionId, machineId) => {
   const seen = new Set(state.seen);
   let keyUploaded = state.keyUploaded;
   let keyRejected = false;
+  let keyUnavailable = false;
   let rejected = 0;
   for (const chunk of chunkRecords(built.records)) {
     const result = await uploader.uploadRecords({
@@ -280,6 +283,10 @@ var syncTick = async (lines, state, uploader, sessionId, machineId) => {
       keyRejected = true;
       break;
     }
+    if (result.keyUnavailable) {
+      keyUnavailable = true;
+      break;
+    }
     if (!result.ok) break;
     for (const id of result.settledIds ?? chunk.map((r) => r.localId)) seen.add(id);
     rejected += result.rejectedIds.length;
@@ -295,7 +302,8 @@ var syncTick = async (lines, state, uploader, sessionId, machineId) => {
     providerKeyId,
     seen,
     keyUploaded,
-    keyRejected
+    keyRejected,
+    keyUnavailable
   };
 };
 var MAX_RECORDS_PER_BATCH = 200;
@@ -384,7 +392,7 @@ var startTranscriptSync = (opts) => {
       void (async () => {
         const before = state.sessionKey;
         await tick();
-        const idle = state.sessionKey === null && before === null;
+        const idle = state.sessionKey === null && before === null || state.keyUnavailable;
         schedule(nextInterval(delayMs, idle, baseIntervalMs, maxIntervalMs));
       })();
     }, delayMs);
@@ -717,6 +725,9 @@ var createRemoteApprover = (deps) => {
   };
 };
 
+// src/wrapper/authRejection.ts
+var isAuthRejection = (status) => status === 401 || status === 403;
+
 // src/wrapper/drainClient.ts
 var drainPendingCommand = async (apiKey, sessionId, signal, baseUrl = getBaseUrl()) => {
   try {
@@ -729,11 +740,12 @@ var drainPendingCommand = async (apiKey, sessionId, signal, baseUrl = getBaseUrl
       body: JSON.stringify(sessionId ? { sessionId } : {}),
       signal
     });
-    if (!response.ok) return null;
+    if (!response.ok) return { command: null, rejected: isAuthRejection(response.status) };
     const data = await response.json();
-    return typeof data.command === "string" && data.command.length > 0 ? data.command : null;
+    const command = typeof data.command === "string" && data.command.length > 0 ? data.command : null;
+    return { command, rejected: false };
   } catch {
-    return null;
+    return { command: null, rejected: false };
   }
 };
 
@@ -746,6 +758,7 @@ var MAX_ERROR_STREAK = 6;
 var REQUEST_TIMEOUT_MS = 1e4;
 var PollRejectedError = class extends Error {
 };
+var EMPTY_DRAIN = { command: null, rejected: false };
 var startCommandPoller = (opts) => {
   const drain = opts.drain ?? drainPendingCommand;
   const slow = opts.slowPollMs ?? SLOW_POLL_MS;
@@ -813,11 +826,15 @@ var startCommandPoller = (opts) => {
           }
         }
       } else {
-        ;
-        [command] = await Promise.all([
-          wantCommands ? drain(opts.apiKey, opts.getSessionId?.(), controller.signal) : Promise.resolve(null),
+        const [drained] = await Promise.all([
+          wantCommands ? drain(opts.apiKey, opts.getSessionId?.(), controller.signal) : Promise.resolve(EMPTY_DRAIN),
           fetchMode()
         ]);
+        if (drained.rejected) {
+          reportAuthRejection();
+          throw new PollRejectedError();
+        }
+        command = drained.command;
       }
       errorStreak = 0;
       if (command) {
@@ -861,7 +878,6 @@ var startCommandPoller = (opts) => {
 
 // src/wrapper/pollClient.ts
 var APPROVAL_MODES = /* @__PURE__ */ new Set(["push_only", "terminal_only", "push_first", "notify_only"]);
-var isRejection = (status) => status === 401 || status === 403;
 var pollAgent = async (apiKey, sessionId, wantCommand, signal, baseUrl = getBaseUrl(), machineId) => {
   try {
     const sessionKey = sessionId || DEFAULT_SESSION;
@@ -911,7 +927,7 @@ var pollAgent = async (apiKey, sessionId, wantCommand, signal, baseUrl = getBase
       }),
       signal
     });
-    if (!response.ok) return { command: null, mode: null, rejected: isRejection(response.status) };
+    if (!response.ok) return { command: null, mode: null, rejected: isAuthRejection(response.status) };
     const data = await response.json();
     const claimedCommand = (id, text) => ({
       id,

package/dist/bin/pushary-clean.js

@@ -9,16 +9,16 @@ import {
   restoreHookTakeover,
   restoreMcpServer,
   runHermesPythonScript
-} from "../chunk-QCXKQJTG.js";
+} from "../chunk-FYOIW5RV.js";
 import {
   removeInstructionBlock,
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-3HS4YGHB.js";
+} from "../chunk-YANV5TGK.js";
 import {
   pusharyHookExecutable
-} from "../chunk-ZMKKK6DC.js";
+} from "../chunk-HSAVPZ46.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -28,26 +28,26 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-CELX75MW.js";
+} from "../chunk-BSEAOCCQ.js";
 import {
   isClaudeMcpSnapshot,
   removeClaudeMcpServers,
   removeGeminiSettings,
   removePusharySettings,
   restoreClaudeMcpServer
-} from "../chunk-I7W3UTDK.js";
-import "../chunk-2LAHXHBR.js";
+} from "../chunk-RX75MRGC.js";
 import "../chunk-DSTLA2TC.js";
 import "../chunk-EZIEXHYM.js";
 import {
   disableDaemonService
-} from "../chunk-SQYBP3QQ.js";
+} from "../chunk-ZTJF6ANY.js";
 import "../chunk-XHKBHWLX.js";
 import {
   execNpm
 } from "../chunk-L4ZCFMWW.js";
-import "../chunk-L4E2BIJ2.js";
-import "../chunk-2ACC5M7F.js";
+import "../chunk-4PE2SQVM.js";
+import "../chunk-Y3UGCQQC.js";
+import "../chunk-NVPYRDCT.js";
 import {
   claudeJson,
   claudeMcpReceipt,
@@ -73,7 +73,7 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-CV2YD2JR.js";
+} from "../chunk-Y6XXFXVB.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
@@ -94,7 +94,7 @@ import "../chunk-2UMNXADU.js";
 import {
   CURSOR_GATE_EVENTS,
   HOOK_LOCATOR_BINARY
-} from "../chunk-VNMKIJZB.js";
+} from "../chunk-Z6CP5ZZD.js";
 
 // bin/pushary-clean.ts
 import { existsSync, readFileSync, copyFileSync, readdirSync } from "fs";

package/dist/bin/pushary-codex-bridge.js

@@ -6,19 +6,19 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-CNPAT3HL.js";
-import "../chunk-7FE2KABY.js";
-import "../chunk-QZCFVWA7.js";
+} from "../chunk-OB4RF2TF.js";
+import "../chunk-46P3VES5.js";
+import "../chunk-EQRS3SGM.js";
 import {
   transcriptsEnabled
-} from "../chunk-UZNKVRLE.js";
+} from "../chunk-6WYL3XIP.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
   describeIdleWindow,
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-4TFXV5MW.js";
+} from "../chunk-TDUTNYAQ.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
@@ -27,17 +27,17 @@ import {
 } from "../chunk-L4ZCFMWW.js";
 import {
   getMachineId
-} from "../chunk-2ACC5M7F.js";
-import "../chunk-CV2YD2JR.js";
-import "../chunk-OSALSIUF.js";
+} from "../chunk-NVPYRDCT.js";
+import "../chunk-Y6XXFXVB.js";
+import "../chunk-6BIMJIRG.js";
 import "../chunk-BC3VCZ3E.js";
-import "../chunk-JW4KO5AF.js";
+import "../chunk-ODL52O5V.js";
 import "../chunk-4LL6LG5X.js";
 import {
   getApiKey,
   getBaseUrl
 } from "../chunk-2UMNXADU.js";
-import "../chunk-VNMKIJZB.js";
+import "../chunk-Z6CP5ZZD.js";
 
 // bin/pushary-codex-bridge.ts
 import { existsSync } from "fs";

package/dist/bin/pushary-codex-hook.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   defersToNativeMode
-} from "../chunk-I463AEG3.js";
+} from "../chunk-OYNPLEXP.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-VHWCVD42.js";
+} from "../chunk-2ORRI66J.js";
 import {
   readHookInput
 } from "../chunk-6CUUA7HO.js";
@@ -21,9 +21,11 @@ import {
   describeApplyPatch,
   fetchModeState,
   getPolicy,
+  handleCompaction,
   handlePostToolUse,
   handleSessionEnd,
   handleStop,
+  handleSubagentStop,
   handleUserPrompt,
   permissionTimeoutDecision,
   policyRequestFor,
@@ -34,7 +36,7 @@ import {
   toCodexWire,
   toPolicyLookup,
   toPolicyLookups
-} from "../chunk-YXDYKECP.js";
+} from "../chunk-5HGLZGI4.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -42,26 +44,28 @@ import {
   pollForAnswer,
   savePendingQuestion,
   sendNotification
-} from "../chunk-F7OURW3C.js";
+} from "../chunk-RER3FRTD.js";
 import {
   UNNAMED_ACTION,
   deriveActionBody,
   deriveBlocker,
   deriveToolTarget,
   describeToolCall,
-  scopePathFor
-} from "../chunk-L4E2BIJ2.js";
+  scopePathFor,
+  sessionIdentityOf
+} from "../chunk-4PE2SQVM.js";
+import "../chunk-Y3UGCQQC.js";
 import {
   getMachineId
-} from "../chunk-2ACC5M7F.js";
+} from "../chunk-NVPYRDCT.js";
 import {
   canonicalJson
-} from "../chunk-CV2YD2JR.js";
-import "../chunk-BSZYIAZL.js";
+} from "../chunk-Y6XXFXVB.js";
+import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-JW4KO5AF.js";
+import "../chunk-ODL52O5V.js";
 import "../chunk-4LL6LG5X.js";
 import {
   getApiKey
@@ -73,7 +77,7 @@ import {
   hookWaitClamped,
   hookWaitDeadline,
   resolveGate
-} from "../chunk-VNMKIJZB.js";
+} from "../chunk-Z6CP5ZZD.js";
 
 // bin/pushary-codex-hook.ts
 import { basename } from "path";
@@ -388,14 +392,17 @@ var decidePreToolUse = async (input) => {
     return codexPass();
   }
 };
-var reportSessionStart = async (input) => {
+var reportSessionStart = async (input, action = "Session started") => {
   try {
     await reportEvent({
       event: "session_begin",
       agentType: CODEX_AGENT.type,
       agentName: agentNameFor(input),
-      action: "Session started",
-      sessionId: input.session_id
+      action,
+      // Not `sessionId: input.session_id`. On SubagentStart that would announce
+      // the parent session a second time under the same id; this gives the
+      // subagent its own row and names the parent beside it.
+      ...sessionIdentityOf(input)
     }, { maxAttempts: 1, timeoutMs: 5e3 });
   } catch {
   }
@@ -458,6 +465,33 @@ var main = async () => {
           reason: input.reason
         }, CODEX_AGENT, { reconcile: false, reportAttempts: 1, reportTimeoutMs: 1200 });
         break;
+      // Observability only, and none of them carries context back, so none uses
+      // emitContext. Each goes through the same handler Claude Code's own hook
+      // does, rather than a Codex-shaped copy of it, so the two agents cannot
+      // drift into reporting the same moment differently.
+      case "SubagentStart":
+        await reportSessionStart(input, "Subagent started");
+        break;
+      case "SubagentStop":
+        await handleSubagentStop({
+          hook_event_name: input.hook_event_name,
+          cwd: input.cwd,
+          session_id: input.session_id,
+          agent_id: input.agent_id,
+          agent_type: input.agent_type,
+          last_assistant_message: input.last_assistant_message
+        }, CODEX_AGENT);
+        break;
+      case "PreCompact":
+      case "PostCompact":
+        await handleCompaction({
+          hook_event_name: input.hook_event_name,
+          trigger: input.trigger,
+          cwd: input.cwd,
+          session_id: input.session_id,
+          agent_id: input.agent_id
+        }, CODEX_AGENT);
+        break;
       default:
         break;
     }

package/dist/bin/pushary-codex.js

@@ -1,26 +1,27 @@
 #!/usr/bin/env node
 import {
   reportEvent
-} from "../chunk-YXDYKECP.js";
+} from "../chunk-5HGLZGI4.js";
 import {
   askUser,
   waitForAnswer
-} from "../chunk-F7OURW3C.js";
-import "../chunk-L4E2BIJ2.js";
+} from "../chunk-RER3FRTD.js";
+import "../chunk-4PE2SQVM.js";
+import "../chunk-Y3UGCQQC.js";
 import {
   getMachineId
-} from "../chunk-2ACC5M7F.js";
-import "../chunk-CV2YD2JR.js";
-import "../chunk-BSZYIAZL.js";
+} from "../chunk-NVPYRDCT.js";
+import "../chunk-Y6XXFXVB.js";
+import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-JW4KO5AF.js";
+import "../chunk-ODL52O5V.js";
 import "../chunk-4LL6LG5X.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
-import "../chunk-VNMKIJZB.js";
+import "../chunk-Z6CP5ZZD.js";
 
 // bin/pushary-codex.ts
 import { basename } from "path";

package/dist/bin/pushary-connect.js

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import {
   printKeyCheck
-} from "../chunk-Z6RFZKY4.js";
+} from "../chunk-WY4ALDYN.js";
 import {
   connectDevice,
   connectExistingApp,
   printConnectInstructions
-} from "../chunk-PYA4FLKI.js";
+} from "../chunk-ROHFVGXM.js";
 import "../chunk-3EGEA4KH.js";
 import {
   checkApiKey
-} from "../chunk-BXTJVM7O.js";
+} from "../chunk-UZFVNEEU.js";
 import "../chunk-QCGNGEGE.js";
 import {
   createIo
@@ -25,9 +25,9 @@ import "../chunk-43GMYSS4.js";
 import "../chunk-DINDL2CF.js";
 import {
   readKeySource
-} from "../chunk-OSALSIUF.js";
+} from "../chunk-6BIMJIRG.js";
 import "../chunk-BC3VCZ3E.js";
-import "../chunk-BSZYIAZL.js";
+import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import {
   UsageError
@@ -35,10 +35,10 @@ import {
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-JW4KO5AF.js";
+import "../chunk-ODL52O5V.js";
 import "../chunk-4LL6LG5X.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-VNMKIJZB.js";
+import "../chunk-Z6CP5ZZD.js";
 
 // bin/pushary-connect.ts
 exitOnHelpFlag("connect");