@pushary/agent-hooks 1.3.0 → 1.4.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 1.4.0
+
+- `pushary clean --everything` removes what the Mac app set up as well as what the CLI did. It quits the app, then removes its keychain items, preferences and caches, the editor extension it installs in Cursor and VS Code, and the skill's registration in `~/.agents`. A plain `clean` still leaves an installed Mac app alone, and now says so instead of printing "Clean complete." over a key it kept.
+- `clean` tells you to run `unset PUSHARY_API_KEY` when your terminal still exports the key. Without it, `setup` in the same terminal signed you straight back in as the account you had just removed.
+- `clean` no longer leaves your key behind in its own backup of your shell profile, in earlier copies of the Cursor plugin, or in the line `pushary logout` comments out.
+- A line in your shell profile that still sets a real key, in a form `clean` will not rewrite, is reported as left behind rather than skipped.
+- `clean`, `doctor` and `setup` name business@pushary.com and the Discord when they leave something broken.
+- A plain `clean` after you delete the Mac app removes what the app left behind. It used to take the app's leftover locator file as proof the app was still installed, and kept every hook pointing at it. In Cursor those hooks deny whatever reaches them once there is no app to answer.
+- `clean` removes the Pushary entry and its key from Claude Code's own backups of `~/.claude.json`, not only from the live file. Restoring one of those backups used to put a working key straight back. A backup from before setup keeps whatever you had there.
+- A file edit no rule was written for goes straight to the agent's own prompt instead of waiting for your phone first, in Claude Code's default mode and when Codex is about to ask. Over 35 days these were asked 224 times and answered from a phone twice. A rule you wrote, a preset or mode you picked, and a scope contract still reach your phone, and runs that bypass permissions are unchanged, because there is no prompt to fall back to.
+- A kill switch or a standing deny enforced on this machine now appears in your decision history, as it already did through the Mac app. Only what the machine allowed was recorded before.
+- Qwen Code, CodeBuddy and Qoder keep the answer you give on a permission prompt. Devin's patch and MCP calls reach the gate that was installed for them. A hook naming an agent Pushary does not recognise with `--source` stands aside, as it already did with `--agent`, rather than acting as Claude Code.
+- `doctor` reads hook commands written in quotes or with `--source`, and tells a malformed MCP registration apart from a configured server.
+- A hook payload that is not the shape it claims to be is refused before it can change anything.
+
+## 1.3.1
+
+- Keep human-review policies effective inside shell chains, and refuse automatic approval of quoted command substitutions.
+- Check kill switches and standing denials before rejecting unreadable tool targets. Check every file in a patch; ask the agent to split a batch that crosses scope.
+- Preserve symlinked agent configuration files during atomic updates.
+- The installed skill recognizes file-edit capabilities across agents, including Codex patches.
+- `pushary doctor` warns when hooks are registered for an agent this version has no profile for. Every one of them stands aside, so nothing on that agent is gated or recorded until you upgrade.
+- A hook that stands aside because it cannot resolve `--agent` says so in the documented `[degraded]` shape, so a stand-aside is countable instead of invisible.
+
 ## 1.2.0
 
 Nothing to run. These are the gate's own rules, tightened where they were guessing.

package/README.md

@@ -194,7 +194,7 @@ connect      Connect a phone without re-running setup (--app for the Pushary app
 bell         Free local bell when an agent finishes or needs you. No account, no key, no network
 doctor       Verify your Pushary installation is working
 disconnect   Turn off one agent (claude|codex|gemini|cursor)
-clean        Remove all Pushary configuration (--yes for non-interactive)
+clean        Remove Pushary from this machine (--everything: the Mac app's setup too, --dry-run: preview)
 mode         Choose where approval requests appear
 wait         Show or set the "wait for your phone" ladder (pushary wait 45)
 stats        Show the approval moments your agents hit while not connected

package/data/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pushary
-version: 0.11.0
+version: 0.11.1
 description: Push notifications and human-in-the-loop for AI agents. Use this whenever a running agent needs a human and nobody is at the terminal, such as before an irreversible or destructive action, before spending money, deploying, force-pushing or deleting, when blocked on a decision outside your authority, when running unattended and you hit a genuine ambiguity, when another skill's workflow says to confirm with the user, and when a long task finishes or fails with nobody watching. Also use it when the user says things like keep going and ping me on my phone if you need anything, notify me when my agent needs me, approve from my phone, ask me questions while I am away from the terminal, run this overnight, keep working while I am in a meeting, I am stepping away, do not wait for me, or wants a long task to run unattended. Send alerts when tasks finish or fail, ask questions (yes/no, multiple choice, or free text) via push, and get answers from their connected devices. Use these tools proactively - do not wait for the user to ask for notifications. Every question and answer is recorded, so an unattended run stays reviewable afterwards. Works with Claude Code, Codex, Cursor, VS Code, Windsurf, Hermes, Lovable, or any MCP client; no Claude Max subscription required. Pushary is a hosted service, $9.99/mo after a 3-day card-first trial.
 metadata:
   hermes:
@@ -448,7 +448,7 @@ Propose the boundary of this run and block until the user agrees to it. Call it
 
 The user sees three things: the paths you will change, the paths you promise to leave alone, and your definition of done. The user agrees to all three in one tap.
 
-**Before you call this, look at your own tool list.** If you hold no `Edit`, `Write` or `MultiEdit`, this run changes no files, and a path contract here enforces nothing. Use shape 3 below. This one check decides everything else in this section, and it costs no tool calls.
+**Before you call this, identify the file-editing capabilities you will use.** Native names differ: Codex uses `apply_patch`, VS Code also uses patch and replacement tools, and other agents expose `Edit`, `Write` or `MultiEdit`. These can carry enforceable paths. Use shape 3 only when this run has no file boundary to enforce. Read the returned `enforces` and `hookSeen` fields to confirm what is actually checked; tool names alone do not prove enforcement.
 
 **A boundary makes a question. It never makes an approval.** After the user agrees, a rule that already asked still asks. A scope can only turn an automatic approval into a question.
 
@@ -456,7 +456,7 @@ The user sees three things: the paths you will change, the paths you promise to
 
 The gate reads one thing from the contract: the path of a file you are about to change. It compares that path with `allowedPaths` and `offLimitsPaths`.
 
-- **Enforced.** `Edit`, `Write` and `MultiEdit`, and the same calls under other agent names. A file outside the agreed paths stops being auto-approvable and becomes a new question. Approving it widens the scope by that exact path.
+- **Enforced.** `Edit`, `Write`, `MultiEdit` and supported aliases, including Codex `apply_patch` and VS Code patch/replacement tools. A file outside the agreed paths stops being auto-approvable and becomes a new question. Approving it widens the scope by that exact path.
 - **Not enforced.** Shell commands. `Read`. Web requests. Every MCP tool. These carry no file path, so the gate has no path to judge and reads them as inside the scope. The permission policy still governs them.
 - **`doneWhen` and `promises` are not enforced.** The user reads them. No code checks them.
 

package/data/cursor-plugin/skills/pushary/SKILL.md

@@ -441,7 +441,7 @@ Propose the boundary of this run and block until the user agrees to it. Call it
 
 The user sees three things: the paths you will change, the paths you promise to leave alone, and your definition of done. The user agrees to all three in one tap.
 
-**Before you call this, look at your own tool list.** If you hold no `Edit`, `Write` or `MultiEdit`, this run changes no files, and a path contract here enforces nothing. Use shape 3 below. This one check decides everything else in this section, and it costs no tool calls.
+**Before you call this, identify the file-editing capabilities you will use.** Native names differ: Codex uses `apply_patch`, VS Code also uses patch and replacement tools, and other agents expose `Edit`, `Write` or `MultiEdit`. These can carry enforceable paths. Use shape 3 only when this run has no file boundary to enforce. Read the returned `enforces` and `hookSeen` fields to confirm what is actually checked; tool names alone do not prove enforcement.
 
 **A boundary makes a question. It never makes an approval.** After the user agrees, a rule that already asked still asks. A scope can only turn an automatic approval into a question.
 
@@ -449,7 +449,7 @@ The user sees three things: the paths you will change, the paths you promise to
 
 The gate reads one thing from the contract: the path of a file you are about to change. It compares that path with `allowedPaths` and `offLimitsPaths`.
 
-- **Enforced.** `Edit`, `Write` and `MultiEdit`, and the same calls under other agent names. A file outside the agreed paths stops being auto-approvable and becomes a new question. Approving it widens the scope by that exact path.
+- **Enforced.** `Edit`, `Write`, `MultiEdit` and supported aliases, including Codex `apply_patch` and VS Code patch/replacement tools. A file outside the agreed paths stops being auto-approvable and becomes a new question. Approving it widens the scope by that exact path.
 - **Not enforced.** Shell commands. `Read`. Web requests. Every MCP tool. These carry no file path, so the gate has no path to judge and reads them as inside the scope. The permission policy still governs them.
 - **`doneWhen` and `promises` are not enforced.** The user reads them. No code checks them.
 

package/data/vscode-plugin/skills/pushary/SKILL.md

@@ -441,7 +441,7 @@ Propose the boundary of this run and block until the user agrees to it. Call it
 
 The user sees three things: the paths you will change, the paths you promise to leave alone, and your definition of done. The user agrees to all three in one tap.
 
-**Before you call this, look at your own tool list.** If you hold no `Edit`, `Write` or `MultiEdit`, this run changes no files, and a path contract here enforces nothing. Use shape 3 below. This one check decides everything else in this section, and it costs no tool calls.
+**Before you call this, identify the file-editing capabilities you will use.** Native names differ: Codex uses `apply_patch`, VS Code also uses patch and replacement tools, and other agents expose `Edit`, `Write` or `MultiEdit`. These can carry enforceable paths. Use shape 3 only when this run has no file boundary to enforce. Read the returned `enforces` and `hookSeen` fields to confirm what is actually checked; tool names alone do not prove enforcement.
 
 **A boundary makes a question. It never makes an approval.** After the user agrees, a rule that already asked still asks. A scope can only turn an automatic approval into a question.
 
@@ -449,7 +449,7 @@ The user sees three things: the paths you will change, the paths you promise to
 
 The gate reads one thing from the contract: the path of a file you are about to change. It compares that path with `allowedPaths` and `offLimitsPaths`.
 
-- **Enforced.** `Edit`, `Write` and `MultiEdit`, and the same calls under other agent names. A file outside the agreed paths stops being auto-approvable and becomes a new question. Approving it widens the scope by that exact path.
+- **Enforced.** `Edit`, `Write`, `MultiEdit` and supported aliases, including Codex `apply_patch` and VS Code patch/replacement tools. A file outside the agreed paths stops being auto-approvable and becomes a new question. Approving it widens the scope by that exact path.
 - **Not enforced.** Shell commands. `Read`. Web requests. Every MCP tool. These carry no file path, so the gate has no path to judge and reads them as inside the scope. The permission policy still governs them.
 - **`doneWhen` and `promises` are not enforced.** The user reads them. No code checks them.
 

package/dist/bin/pushary-bell-hook.js

@@ -1,35 +1,35 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-EJZCV5G4.js";
+} from "../chunk-VENQSVKA.js";
 import {
   readHookInput
-} from "../chunk-N43EQPJK.js";
-import "../chunk-EU6JH7KU.js";
-import "../chunk-YKLCWWEI.js";
-import "../chunk-XEXOHUJ6.js";
-import "../chunk-BYGEZI7B.js";
-import "../chunk-JYEGOYQC.js";
-import "../chunk-DVO4SZMJ.js";
-import "../chunk-KS4P6F3R.js";
-import "../chunk-OE6U2AXM.js";
-import "../chunk-2PLEJ7SY.js";
-import "../chunk-B3S4SF3D.js";
+} from "../chunk-ZIGGEKZW.js";
+import "../chunk-ESLLVHDY.js";
+import "../chunk-SGZJ5LYH.js";
+import "../chunk-UTYTPDWN.js";
+import "../chunk-5MSBI6NP.js";
+import "../chunk-YYRZPEMA.js";
+import "../chunk-O6RN46OS.js";
+import "../chunk-RGZY77CD.js";
+import "../chunk-A7XIL2WD.js";
+import "../chunk-7PQZYCEP.js";
+import "../chunk-S3EUZZJB.js";
 import "../chunk-EQRS3SGM.js";
-import "../chunk-A2URMNFM.js";
+import "../chunk-BYAXXBNO.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-IAEVVUXO.js";
-import "../chunk-K7UIAE7I.js";
-import "../chunk-RHLUJE4H.js";
+import "../chunk-KZIXHLPQ.js";
+import "../chunk-RQM5SMMR.js";
+import "../chunk-UCGQEAKZ.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-XBO42HKH.js";
+import "../chunk-NYHNLMQO.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-POAFXBNH.js";
-import "../chunk-4LL6LG5X.js";
+import "../chunk-P4JVVJ2D.js";
+import "../chunk-T7E75EKA.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-WPJS3OZH.js";
+import "../chunk-7IEB2GV4.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,38 +5,38 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-EJZCV5G4.js";
+} from "../chunk-VENQSVKA.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-2PLEJ7SY.js";
+} from "../chunk-7PQZYCEP.js";
 import {
   claudeSettings
-} from "../chunk-RHLUJE4H.js";
+} from "../chunk-UCGQEAKZ.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
 import {
   exitOnHelpFlag
-} from "../chunk-GOQHN2UH.js";
-import "../chunk-LZQVAEWP.js";
+} from "../chunk-TWWLVOPB.js";
+import "../chunk-FAH3D74E.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-XBO42HKH.js";
+import "../chunk-NYHNLMQO.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-POAFXBNH.js";
+import "../chunk-P4JVVJ2D.js";
 import {
   readJsonSafe,
   writeJsonAtomic
-} from "../chunk-4LL6LG5X.js";
+} from "../chunk-T7E75EKA.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-WPJS3OZH.js";
+import "../chunk-7IEB2GV4.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,7 +8,7 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-MU275U5A.js";
+} from "../chunk-GIXLZFEY.js";
 import {
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
@@ -17,24 +17,24 @@ import {
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-EU6JH7KU.js";
-import "../chunk-YKLCWWEI.js";
-import "../chunk-XEXOHUJ6.js";
-import "../chunk-BYGEZI7B.js";
-import "../chunk-JYEGOYQC.js";
-import "../chunk-DVO4SZMJ.js";
+} from "../chunk-ESLLVHDY.js";
+import "../chunk-SGZJ5LYH.js";
+import "../chunk-UTYTPDWN.js";
+import "../chunk-5MSBI6NP.js";
+import "../chunk-YYRZPEMA.js";
+import "../chunk-O6RN46OS.js";
 import {
   ensureDaemonRunning
-} from "../chunk-KS4P6F3R.js";
-import "../chunk-OE6U2AXM.js";
-import "../chunk-2PLEJ7SY.js";
+} from "../chunk-RGZY77CD.js";
+import "../chunk-A7XIL2WD.js";
+import "../chunk-7PQZYCEP.js";
 import {
   encryptRecord
-} from "../chunk-B3S4SF3D.js";
+} from "../chunk-S3EUZZJB.js";
 import "../chunk-EQRS3SGM.js";
 import {
   transcriptsEnabled
-} from "../chunk-A2URMNFM.js";
+} from "../chunk-BYAXXBNO.js";
 import {
   needsShell,
   spawnClaude
@@ -56,8 +56,8 @@ import {
   reportEvent,
   savePendingCommand,
   scopePathFor
-} from "../chunk-WXXDHGTZ.js";
-import "../chunk-IAEVVUXO.js";
+} from "../chunk-IF46POXX.js";
+import "../chunk-KZIXHLPQ.js";
 import {
   DECISION_STOP_REASON,
   askUser,
@@ -70,17 +70,17 @@ import {
 } from "../chunk-LGXUGYUH.js";
 import {
   getMachineId
-} from "../chunk-K7UIAE7I.js";
-import "../chunk-RHLUJE4H.js";
+} from "../chunk-RQM5SMMR.js";
+import "../chunk-UCGQEAKZ.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-XBO42HKH.js";
+import "../chunk-NYHNLMQO.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-POAFXBNH.js";
-import "../chunk-4LL6LG5X.js";
+import "../chunk-P4JVVJ2D.js";
+import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
@@ -89,7 +89,7 @@ import {
   KILL_REASON,
   redactSecrets,
   resolveGate
-} from "../chunk-WPJS3OZH.js";
+} from "../chunk-7IEB2GV4.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {