@pushary/agent-hooks 0.98.0 → 0.99.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.99.0
+
+Nothing to run. This release is the part that runs itself: the repairs below happen on the next session start, on the machine that already has them wrong.
+
+- Switch on a hold that an older release registered without its proof. `PermissionDenied` and Codex's `Stop` hold only when their registration carries `--hold-budget`, and a registration written before 0.97.0 is present and looks correct, so nothing noticed it had stopped holding. Until now the repair was `pushary upgrade`, run by hand. Claude Code's registration is now checked on every session start whether or not Claude Code itself has changed, and Codex's is checked on its own session start, which had no repair of any kind before this. An auto-mode block or an auto-reviewer denial can be answered again without anyone being told to run a command.
+- Hooks the macOS app wrote are still left to the app, on both agents. It repairs its own, and rewriting them here would point them at a binary the app does not install.
+- Read a hold budget that is not this release's as no proof, which is what the Mac app has always done. `pushary doctor` says a hook "carries no current hold budget" rather than that it predates one, because now it can mean either.
+- Never replace an absolute path in a hook command with a bare name. When the bin directory cannot be found, which is what a GUI-launched agent or an nvm switch does to `npm prefix -g`, the rewrite is refused and the registration you already have is left alone. A hold that does not hold still works less well than it should; a hook command that no longer resolves does nothing at all, and the rewrite touches every event at once. `pushary upgrade` is a person at a prompt and is unchanged.
+- Write Codex's `config.toml` atomically, carrying its permissions over. It is now written from a session-start hook, and two sessions starting at once must not leave it half written. An atomic write replaces the file rather than its bytes, so the mode is copied across by hand: this file holds your API key, Codex creates it private to you, and it stays that way.
+
 ## 0.98.0
 
 Run `pushary setup` so the instruction block in Codex's AGENTS.md, GEMINI.md and OpenCode's AGENTS.md carries the new line. `pushary upgrade` rewrites hooks and trust, not instruction files.

package/dist/bin/pushary-bell-hook.js

@@ -1,32 +1,33 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-NIXVMMJM.js";
+} from "../chunk-K6BASBQJ.js";
 import {
   readHookInput
-} from "../chunk-M4TVEMLH.js";
-import "../chunk-5B5QV3KC.js";
-import "../chunk-OBYC6SN4.js";
-import "../chunk-W2MG2P46.js";
+} from "../chunk-O3LZQEQP.js";
+import "../chunk-NSFNEDCT.js";
+import "../chunk-YKLCWWEI.js";
+import "../chunk-RALVI7OF.js";
 import "../chunk-LBNAGGLV.js";
 import "../chunk-IRLTW6KF.js";
-import "../chunk-6LRGZJFB.js";
-import "../chunk-DOD3A6EU.js";
-import "../chunk-HFQ7WSHZ.js";
-import "../chunk-2GLOHBYB.js";
+import "../chunk-JXELRCU5.js";
+import "../chunk-CRFLU455.js";
+import "../chunk-PD6JY33P.js";
+import "../chunk-EXHXR2X5.js";
 import "../chunk-XPPXOKIG.js";
 import "../chunk-EQRS3SGM.js";
-import "../chunk-NQGYPTJQ.js";
+import "../chunk-ID5FDKDZ.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-OPR2BPD4.js";
-import "../chunk-WU6LSXJ6.js";
-import "../chunk-XL3RKJYQ.js";
+import "../chunk-562UJ2DA.js";
+import "../chunk-JBJBVERL.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-SJLGOVC6.js";
+import "../chunk-4PBCNVI3.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-VZD2GEKB.js";
+import "../chunk-GCD3SQSV.js";
+import "../chunk-4LL6LG5X.js";
 import "../chunk-2UMNXADU.js";
 import "../chunk-OUAE3GKO.js";
 

package/dist/bin/pushary-bell.js

@@ -5,15 +5,15 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-NIXVMMJM.js";
+} from "../chunk-K6BASBQJ.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-2GLOHBYB.js";
+} from "../chunk-EXHXR2X5.js";
 import {
   claudeSettings
-} from "../chunk-XL3RKJYQ.js";
+} from "../chunk-JBJBVERL.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
@@ -25,15 +25,16 @@ import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-SJLGOVC6.js";
+import "../chunk-4PBCNVI3.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
+import "../chunk-GCD3SQSV.js";
 import {
   readJsonSafe,
   writeJsonAtomic
-} from "../chunk-VZD2GEKB.js";
+} from "../chunk-4LL6LG5X.js";
 import "../chunk-2UMNXADU.js";
 import "../chunk-OUAE3GKO.js";
 

package/dist/bin/pushary-claude.js

@@ -8,7 +8,7 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-J44RPHUZ.js";
+} from "../chunk-6IFUXNFX.js";
 import {
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
@@ -17,24 +17,24 @@ import {
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-5B5QV3KC.js";
-import "../chunk-OBYC6SN4.js";
-import "../chunk-W2MG2P46.js";
+} from "../chunk-NSFNEDCT.js";
+import "../chunk-YKLCWWEI.js";
+import "../chunk-RALVI7OF.js";
 import "../chunk-LBNAGGLV.js";
 import "../chunk-IRLTW6KF.js";
-import "../chunk-6LRGZJFB.js";
+import "../chunk-JXELRCU5.js";
 import {
   ensureDaemonRunning
-} from "../chunk-DOD3A6EU.js";
-import "../chunk-HFQ7WSHZ.js";
-import "../chunk-2GLOHBYB.js";
+} from "../chunk-CRFLU455.js";
+import "../chunk-PD6JY33P.js";
+import "../chunk-EXHXR2X5.js";
 import {
   encryptRecord
 } from "../chunk-XPPXOKIG.js";
 import "../chunk-EQRS3SGM.js";
 import {
   transcriptsEnabled
-} from "../chunk-NQGYPTJQ.js";
+} from "../chunk-ID5FDKDZ.js";
 import {
   needsShell,
   spawnClaude
@@ -52,7 +52,7 @@ import {
   repoKeyFor,
   reportEvent,
   savePendingCommand
-} from "../chunk-YJDRHQLG.js";
+} from "../chunk-64WARXGV.js";
 import {
   UNNAMED_ACTION,
   deriveToolTarget,
@@ -72,16 +72,17 @@ import {
 } from "../chunk-LGXUGYUH.js";
 import {
   getMachineId
-} from "../chunk-WU6LSXJ6.js";
-import "../chunk-XL3RKJYQ.js";
+} from "../chunk-562UJ2DA.js";
+import "../chunk-JBJBVERL.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-SJLGOVC6.js";
+import "../chunk-4PBCNVI3.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-VZD2GEKB.js";
+import "../chunk-GCD3SQSV.js";
+import "../chunk-4LL6LG5X.js";
 import {
   getApiKey,
   getBaseUrl

package/dist/bin/pushary-clean.js

@@ -5,14 +5,14 @@ import {
   createGuards,
   resolveHermesPython,
   runHermesPythonScript
-} from "../chunk-FAJ4R7IB.js";
+} from "../chunk-3ZAEUPM4.js";
 import "../chunk-KBITFQST.js";
 import {
   removeInstructionBlock,
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-V47GITZV.js";
+} from "../chunk-V262ATS5.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -28,29 +28,29 @@ import {
   removeClaudeMcpServers,
   removePusharySettings,
   restoreClaudeMcpServer
-} from "../chunk-QXIF6R4P.js";
+} from "../chunk-QS55LDX4.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-W2MG2P46.js";
+} from "../chunk-RALVI7OF.js";
 import "../chunk-LBNAGGLV.js";
 import "../chunk-IRLTW6KF.js";
 import {
   pusharyHookExecutable
-} from "../chunk-6LRGZJFB.js";
+} from "../chunk-JXELRCU5.js";
 import {
   disableDaemonService
-} from "../chunk-DOD3A6EU.js";
+} from "../chunk-CRFLU455.js";
 import {
   removeGeminiSettings
-} from "../chunk-HFQ7WSHZ.js";
-import "../chunk-2GLOHBYB.js";
+} from "../chunk-PD6JY33P.js";
+import "../chunk-EXHXR2X5.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-A76GNRIK.js";
 import "../chunk-OPR2BPD4.js";
-import "../chunk-WU6LSXJ6.js";
+import "../chunk-562UJ2DA.js";
 import {
   bridgeAgentKey,
   claudeJson,
@@ -79,7 +79,7 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-XL3RKJYQ.js";
+} from "../chunk-JBJBVERL.js";
 import {
   exitOnHelpFlag
 } from "../chunk-GOQHN2UH.js";
@@ -90,12 +90,13 @@ import {
 import "../chunk-DINDL2CF.js";
 import {
   removeClaudeAlias
-} from "../chunk-SJLGOVC6.js";
+} from "../chunk-4PBCNVI3.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-VZD2GEKB.js";
+import "../chunk-GCD3SQSV.js";
+import "../chunk-4LL6LG5X.js";
 import "../chunk-2UMNXADU.js";
 import {
   CURSOR_GATE_EVENTS,

package/dist/bin/pushary-codex-bridge.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import "../chunk-TZHDKRMG.js";
+import "../chunk-WGV3VY7O.js";
 import {
   LiveTranscriptRelay,
   liveSessionSleep,
@@ -13,12 +13,12 @@ import {
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-J44RPHUZ.js";
+} from "../chunk-6IFUXNFX.js";
 import "../chunk-XPPXOKIG.js";
 import "../chunk-EQRS3SGM.js";
 import {
   transcriptsEnabled
-} from "../chunk-NQGYPTJQ.js";
+} from "../chunk-ID5FDKDZ.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
@@ -28,18 +28,19 @@ import {
 } from "../chunk-LGXUGYUH.js";
 import {
   getMachineId
-} from "../chunk-WU6LSXJ6.js";
+} from "../chunk-562UJ2DA.js";
 import {
   resolveBinary
-} from "../chunk-XL3RKJYQ.js";
-import "../chunk-SJLGOVC6.js";
+} from "../chunk-JBJBVERL.js";
+import "../chunk-4PBCNVI3.js";
 import {
   callMcpTool
 } from "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-VZD2GEKB.js";
+import "../chunk-GCD3SQSV.js";
+import "../chunk-4LL6LG5X.js";
 import {
   getApiKey,
   getBaseUrl

package/dist/bin/pushary-codex-hook.js

@@ -12,30 +12,30 @@ import {
   recordBlockedActionHint,
   recordCodexCallDecision,
   userScope
-} from "../chunk-53QCTSWY.js";
+} from "../chunk-6KLCP7VF.js";
 import {
   isGatingMoment,
   recordKeylessMoment
 } from "../chunk-XOOWC62T.js";
 import {
   readHookInput
-} from "../chunk-M4TVEMLH.js";
+} from "../chunk-O3LZQEQP.js";
 import {
   denyReasonFrom,
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
-import "../chunk-5B5QV3KC.js";
-import "../chunk-OBYC6SN4.js";
-import "../chunk-W2MG2P46.js";
+import "../chunk-NSFNEDCT.js";
+import "../chunk-YKLCWWEI.js";
+import "../chunk-RALVI7OF.js";
 import "../chunk-LBNAGGLV.js";
 import "../chunk-IRLTW6KF.js";
-import "../chunk-6LRGZJFB.js";
-import "../chunk-DOD3A6EU.js";
-import "../chunk-HFQ7WSHZ.js";
-import "../chunk-2GLOHBYB.js";
+import "../chunk-JXELRCU5.js";
+import "../chunk-CRFLU455.js";
+import "../chunk-PD6JY33P.js";
+import "../chunk-EXHXR2X5.js";
 import "../chunk-XPPXOKIG.js";
 import "../chunk-EQRS3SGM.js";
-import "../chunk-NQGYPTJQ.js";
+import "../chunk-ID5FDKDZ.js";
 import "../chunk-XHKBHWLX.js";
 import {
   CODEX_AGENT,
@@ -61,7 +61,7 @@ import {
   toCodexWire,
   toPolicyLookup,
   toPolicyLookups
-} from "../chunk-YJDRHQLG.js";
+} from "../chunk-64WARXGV.js";
 import {
   UNNAMED_ACTION,
   codexReviewerDenialsSince,
@@ -90,20 +90,21 @@ import {
 } from "../chunk-LGXUGYUH.js";
 import {
   getMachineId
-} from "../chunk-WU6LSXJ6.js";
+} from "../chunk-562UJ2DA.js";
 import {
   canonicalJson
-} from "../chunk-XL3RKJYQ.js";
+} from "../chunk-JBJBVERL.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-SJLGOVC6.js";
+import "../chunk-4PBCNVI3.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
+import "../chunk-GCD3SQSV.js";
 import {
   writeFileAtomic
-} from "../chunk-VZD2GEKB.js";
+} from "../chunk-4LL6LG5X.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
@@ -733,6 +734,14 @@ var decidePreToolUse = async (input) => {
     return codexPass();
   }
 };
+var repairCodexHoldsQuietly = async () => {
+  try {
+    const { repairCodexHolds } = await import("../reapply-HQ264ZTR.js");
+    repairCodexHolds();
+  } catch {
+    return;
+  }
+};
 var reportSessionStart = async (input, action = "Session started") => {
   try {
     await reportEvent({
@@ -803,6 +812,7 @@ var main = async () => {
         break;
       }
       case "SessionStart":
+        await repairCodexHoldsQuietly();
         await reportSessionStart(input);
         break;
       case "SessionEnd":

package/dist/bin/pushary-codex.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   reportEvent
-} from "../chunk-YJDRHQLG.js";
+} from "../chunk-64WARXGV.js";
 import "../chunk-A76GNRIK.js";
 import "../chunk-OPR2BPD4.js";
 import {
@@ -11,13 +11,14 @@ import {
 } from "../chunk-LGXUGYUH.js";
 import {
   getMachineId
-} from "../chunk-WU6LSXJ6.js";
-import "../chunk-XL3RKJYQ.js";
+} from "../chunk-562UJ2DA.js";
+import "../chunk-JBJBVERL.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-VZD2GEKB.js";
+import "../chunk-GCD3SQSV.js";
+import "../chunk-4LL6LG5X.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";

package/dist/bin/pushary-connect.js

@@ -6,7 +6,7 @@ import {
   connectDevice,
   connectExistingApp,
   printConnectInstructions
-} from "../chunk-LX4NNYII.js";
+} from "../chunk-4C4XFAGJ.js";
 import "../chunk-3EGEA4KH.js";
 import {
   checkApiKey
@@ -25,7 +25,7 @@ import {
 import "../chunk-DINDL2CF.js";
 import {
   readKeySource
-} from "../chunk-SJLGOVC6.js";
+} from "../chunk-4PBCNVI3.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import {
@@ -34,7 +34,8 @@ import {
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-VZD2GEKB.js";
+import "../chunk-GCD3SQSV.js";
+import "../chunk-4LL6LG5X.js";
 import "../chunk-2UMNXADU.js";
 import "../chunk-OUAE3GKO.js";
 

package/dist/bin/pushary-daemon.js

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import {
   inspectConfiguredManagedProviders
-} from "../chunk-JQU6PMH4.js";
-import "../chunk-K6CH5NVW.js";
+} from "../chunk-LWKPMSBB.js";
+import "../chunk-K4XFCEVI.js";
 import {
   HEARTBEAT_INTERVAL_MS,
   sendHeartbeat
-} from "../chunk-B35OCFXH.js";
-import "../chunk-QXIF6R4P.js";
+} from "../chunk-JL33EDN7.js";
+import "../chunk-QS55LDX4.js";
 import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "../chunk-TZHDKRMG.js";
+} from "../chunk-WGV3VY7O.js";
 import {
   SESSION_REAP_SILENCE_MS,
   describeIdleWindow,
@@ -20,15 +20,15 @@ import {
   listProcessProofs,
   ownsLiveProcess,
   silentSpawnedProofs
-} from "../chunk-J44RPHUZ.js";
+} from "../chunk-6IFUXNFX.js";
 import {
   startRegisteredTranscripts
-} from "../chunk-5B5QV3KC.js";
-import "../chunk-OBYC6SN4.js";
-import "../chunk-W2MG2P46.js";
+} from "../chunk-NSFNEDCT.js";
+import "../chunk-YKLCWWEI.js";
+import "../chunk-RALVI7OF.js";
 import "../chunk-LBNAGGLV.js";
 import "../chunk-IRLTW6KF.js";
-import "../chunk-6LRGZJFB.js";
+import "../chunk-JXELRCU5.js";
 import {
   DAEMON_LEASE_RENEW_INTERVAL_MS,
   acquireDaemonLease,
@@ -45,22 +45,22 @@ import {
   requestDaemonHandoff,
   stopDaemonRunning,
   writeDaemonNeedsLogin
-} from "../chunk-DOD3A6EU.js";
-import "../chunk-HFQ7WSHZ.js";
-import "../chunk-2GLOHBYB.js";
+} from "../chunk-CRFLU455.js";
+import "../chunk-PD6JY33P.js";
+import "../chunk-EXHXR2X5.js";
 import "../chunk-XPPXOKIG.js";
 import "../chunk-EQRS3SGM.js";
-import "../chunk-NQGYPTJQ.js";
+import "../chunk-ID5FDKDZ.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import "../chunk-OPR2BPD4.js";
 import {
   getMachineId
-} from "../chunk-WU6LSXJ6.js";
+} from "../chunk-562UJ2DA.js";
 import {
   resolveBinary
-} from "../chunk-XL3RKJYQ.js";
+} from "../chunk-JBJBVERL.js";
 import {
   writeHuman
 } from "../chunk-QCGNGEGE.js";
@@ -72,12 +72,13 @@ import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
 import {
   readControlMode
-} from "../chunk-SJLGOVC6.js";
+} from "../chunk-4PBCNVI3.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-VZD2GEKB.js";
+import "../chunk-GCD3SQSV.js";
+import "../chunk-4LL6LG5X.js";
 import {
   getApiKey,
   getBaseUrl

package/dist/bin/pushary-disconnect.js

@@ -14,10 +14,10 @@ import {
   removeClaudeMcpServers,
   removePusharySettings,
   restoreClaudeMcpServer
-} from "../chunk-QXIF6R4P.js";
+} from "../chunk-QS55LDX4.js";
 import {
   removeGeminiSettings
-} from "../chunk-HFQ7WSHZ.js";
+} from "../chunk-PD6JY33P.js";
 import "../chunk-OPR2BPD4.js";
 import {
   claudeJson,
@@ -32,7 +32,7 @@ import {
   geminiSettings,
   removeCodexHooks,
   removeCodexSettings
-} from "../chunk-XL3RKJYQ.js";
+} from "../chunk-JBJBVERL.js";
 import {
   exitOnHelpFlag
 } from "../chunk-GOQHN2UH.js";