@pushary/agent-hooks 1.4.1 → 1.5.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 1.5.0
+
+- Pushary now updates itself in the background. When an agent session starts, it checks at most once a day for a newer version within the same major version, installs it into the global npm folder your hooks already run from, and refreshes each agent's config the way `pushary upgrade` does. The session never waits for it. A new major version is shown in `pushary doctor` and left for you to install.
+- Turn it off with `pushary upgrade --auto=off` (and back on with `--auto=on`), or set `PUSHARY_DISABLE_AUTOUPDATE=1` in the environment your agents start from.
+- It does not run on Windows yet, in CI, or for a copy run through `npx`, a plugin, or the Mac app. It never uses `sudo`: if npm cannot write to the global folder, the attempt is recorded as failed and nothing changes.
+- This only reaches machines on 1.5.0 or later. To get there, run `npx @pushary/agent-hooks@latest upgrade` once.
+- `pushary doctor` shows whether automatic updates are on and the result of the last check, and `setup` and `doctor` tell you once when Pushary has updated itself.
+- `pushary doctor` no longer calls a build newer than the npm release out of date.
+- The commands the CLI prints for you to copy now say `npx @pushary/agent-hooks@latest`. Without `@latest`, npx runs whatever older version is installed globally.
+- A failed npm install now reports npm's reason, such as a permission error, instead of a line like `syscall mkdir`.
+
+## 1.4.2
+
+- Setup trusts the Pushary hooks for you on Codex up to 0.155.1. It used to stop at 0.147.0, so on a newer Codex it wrote the hooks without trusting them, Codex never ran them, and setup still said it was done.
+- On a Codex newer than the last version Pushary checked, setup says so in one line and tells you to open Codex and choose Trust for the Pushary hooks.
+- The phone QR stops waiting 10 seconds before the pairing code expires, so the code is cancelled cleanly on a timeout.
+- After a minute at the QR with no scan, setup offers the browser sign-in: Ctrl-C, then `npx @pushary/agent-hooks setup --connect browser`.
+- A kill switch or standing deny on Codex now appears in your decision history, as it already did for Claude Code. If that record fails to send, it is sent again on the next matching denial.
+- `clean --everything` also removes the sign-in session the Mac app now keeps in the keychain.
+
 ## 1.4.1
 
 - `clean` masks credentials in shell lines it cannot rewrite, including output you might send to support.

package/README.md

@@ -244,6 +244,33 @@ npx @pushary/agent-hooks@latest wait 45
 npx @pushary/agent-hooks@latest clean
 ```
 
+## Updates
+
+From 1.5.0, Pushary updates itself. When an agent session starts, the session-start
+hook checks at most once a day whether a newer version is published. If one is, it
+installs that version in the background into the same global npm folder your hooks
+already run from, then refreshes each agent's config the way `pushary upgrade` does.
+The session does not wait for it, and the new version runs from the next hook call.
+
+- It stays within the same major version. A new major shows in `pushary doctor`, and
+  you move to it with `npx @pushary/agent-hooks@latest upgrade`.
+- It only updates a global npm install. A copy run through `npx`, a plugin, or the Mac
+  app updates by its own route.
+- It never uses `sudo`. If npm cannot write to the global folder, the attempt is
+  recorded as failed and nothing changes.
+- It does not run on Windows yet, or when `CI` is set.
+
+Turn it off with either of these:
+
+```bash
+pushary upgrade --auto=off           # turn it back on with --auto=on
+export PUSHARY_DISABLE_AUTOUPDATE=1  # in the environment your agents start from
+```
+
+`pushary doctor` shows whether it is on and the result of the last check. The state is
+kept in `~/.pushary/auto-update.json`, and the output of recent updates in
+`~/.pushary/logs/auto-update.log`.
+
 ## Manual MCP setup
 
 If you only want notifications and questions (no permission gating), add Pushary to your MCP config directly:

package/data/vscode-plugin/README.md

@@ -106,7 +106,7 @@ This repository uses the `.claude-plugin/plugin.json` layout, which VS Code, Git
 
 The layout is portable; this plugin is not meant to be. `hooks/hooks.json` uses VS Code's flat hook form, and the gate speaks VS Code's tool names, so treat this as a VS Code plugin that happens to sit in a portable folder shape.
 
-Claude Code users are served by `npx @pushary/agent-hooks setup --agents claude_code`, which installs a hook built for Claude Code's own tool names and matcher format. Do not install this directory as a Claude Code plugin as well: at best it duplicates the MCP server, and the two installs would fight over the same approvals.
+Claude Code users are served by `npx @pushary/agent-hooks@latest setup --agents claude_code`, which installs a hook built for Claude Code's own tool names and matcher format. Do not install this directory as a Claude Code plugin as well: at best it duplicates the MCP server, and the two installs would fight over the same approvals.
 
 ## Development
 

package/data/vscode-plugin/scripts/pushary-gate.mjs

@@ -723,9 +723,9 @@ const main = async () => {
 
   const apiKey = resolveApiKey()
   if (!apiKey) {
-    diag('no API key found (PUSHARY_API_KEY, the plugin .mcp.json, or ~/.pushary/config.json). Run: npx @pushary/agent-hooks setup')
+    diag('no API key found (PUSHARY_API_KEY, the plugin .mcp.json, or ~/.pushary/config.json). Run: npx @pushary/agent-hooks@latest setup')
     return respond(
-      unresolved(input.tool_name, 'Pushary is not configured: run `npx @pushary/agent-hooks setup` (get a key at https://pushary.com) to route this approval to your phone.')
+      unresolved(input.tool_name, 'Pushary is not configured: run `npx @pushary/agent-hooks@latest setup` (get a key at https://pushary.com) to route this approval to your phone.')
     )
   }
 

package/dist/bin/pushary-bell-hook.js

@@ -1,35 +1,36 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-BZBUPZC6.js";
+} from "../chunk-DTQNDR7C.js";
 import {
   readHookInput
-} from "../chunk-4FN6VV56.js";
-import "../chunk-TNS3YLFE.js";
+} from "../chunk-ORLJNJEO.js";
+import "../chunk-NFKVRMTM.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-KEMEBTCJ.js";
-import "../chunk-R3AMKNIW.js";
-import "../chunk-LYXX5NSB.js";
-import "../chunk-TF4IOINR.js";
-import "../chunk-3BPB2HYZ.js";
-import "../chunk-ED5TA2FJ.js";
-import "../chunk-JOVWYVSR.js";
-import "../chunk-CRNAXFQ6.js";
-import "../chunk-EQRS3SGM.js";
-import "../chunk-MN3XOVRK.js";
+import "../chunk-PCGZXWGQ.js";
+import "../chunk-TFKBFQCE.js";
+import "../chunk-K3QVDAZW.js";
+import "../chunk-NTQSICPJ.js";
+import "../chunk-7XT76LWT.js";
+import "../chunk-EADZPVYW.js";
+import "../chunk-SOCEY746.js";
+import "../chunk-TIWURSLS.js";
+import "../chunk-66H2QQAK.js";
+import "../chunk-2QT3GCU4.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-WEO5JCB4.js";
-import "../chunk-3T52B2OF.js";
-import "../chunk-SAF6NNXY.js";
+import "../chunk-UYDTFCHW.js";
+import "../chunk-UQHUUZ5H.js";
+import "../chunk-DYHXOXUF.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-DINDL2CF.js";
-import "../chunk-TI3ZWXZG.js";
+import "../chunk-USQDVBEV.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-K6I5M2ME.js";
+import "../chunk-HU5LSYL2.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-2UMNXADU.js";
-import "../chunk-FVKFDTN6.js";
+import "../chunk-OSJEMXSR.js";
+import "../chunk-T4QY64OR.js";
+import "../chunk-EA3IELHP.js";
+import "../chunk-HWJW3CPO.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,38 +5,38 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-BZBUPZC6.js";
+} from "../chunk-DTQNDR7C.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-JOVWYVSR.js";
+} from "../chunk-SOCEY746.js";
 import {
   claudeSettings
-} from "../chunk-SAF6NNXY.js";
+} from "../chunk-DYHXOXUF.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
 import {
   exitOnHelpFlag
-} from "../chunk-TWWLVOPB.js";
-import "../chunk-FAH3D74E.js";
+} from "../chunk-P4BNYJ5Q.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-DINDL2CF.js";
-import "../chunk-TI3ZWXZG.js";
+import "../chunk-USQDVBEV.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-K6I5M2ME.js";
+import "../chunk-HU5LSYL2.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-T7E75EKA.js";
-import "../chunk-2UMNXADU.js";
-import "../chunk-FVKFDTN6.js";
+import "../chunk-OSJEMXSR.js";
+import "../chunk-T4QY64OR.js";
+import "../chunk-EA3IELHP.js";
+import "../chunk-HWJW3CPO.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,7 +8,7 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-PHHGHHOW.js";
+} from "../chunk-MYP4UUFH.js";
 import {
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
@@ -17,24 +17,24 @@ import {
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-TNS3YLFE.js";
+} from "../chunk-NFKVRMTM.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-KEMEBTCJ.js";
-import "../chunk-R3AMKNIW.js";
-import "../chunk-LYXX5NSB.js";
-import "../chunk-TF4IOINR.js";
+import "../chunk-PCGZXWGQ.js";
+import "../chunk-TFKBFQCE.js";
+import "../chunk-K3QVDAZW.js";
+import "../chunk-NTQSICPJ.js";
 import {
   ensureDaemonRunning
-} from "../chunk-3BPB2HYZ.js";
-import "../chunk-ED5TA2FJ.js";
-import "../chunk-JOVWYVSR.js";
+} from "../chunk-7XT76LWT.js";
+import "../chunk-EADZPVYW.js";
+import "../chunk-SOCEY746.js";
 import {
   encryptRecord
-} from "../chunk-CRNAXFQ6.js";
-import "../chunk-EQRS3SGM.js";
+} from "../chunk-TIWURSLS.js";
+import "../chunk-66H2QQAK.js";
 import {
   transcriptsEnabled
-} from "../chunk-MN3XOVRK.js";
+} from "../chunk-2QT3GCU4.js";
 import {
   needsShell,
   spawnClaude
@@ -56,8 +56,8 @@ import {
   reportEvent,
   savePendingCommand,
   scopePathFor
-} from "../chunk-LNGYW6G4.js";
-import "../chunk-WEO5JCB4.js";
+} from "../chunk-FDHMNT24.js";
+import "../chunk-UYDTFCHW.js";
 import {
   DECISION_STOP_REASON,
   askUser,
@@ -67,29 +67,32 @@ import {
   nextLongPollMs,
   waitForAnswer,
   withdrawQuestion
-} from "../chunk-LGXUGYUH.js";
+} from "../chunk-PYCQXCI5.js";
 import {
   getMachineId
-} from "../chunk-3T52B2OF.js";
-import "../chunk-SAF6NNXY.js";
+} from "../chunk-UQHUUZ5H.js";
+import "../chunk-DYHXOXUF.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-DINDL2CF.js";
-import "../chunk-TI3ZWXZG.js";
-import "../chunk-EYRGBYZG.js";
+import "../chunk-USQDVBEV.js";
+import "../chunk-HETOKNIL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-K6I5M2ME.js";
+import "../chunk-HU5LSYL2.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-2UMNXADU.js";
+} from "../chunk-OSJEMXSR.js";
 import {
   KILL_REASON,
   redactSecrets,
   resolveGate
-} from "../chunk-FVKFDTN6.js";
+} from "../chunk-T4QY64OR.js";
+import {
+  NPX_LATEST_COMMAND
+} from "../chunk-EA3IELHP.js";
+import "../chunk-HWJW3CPO.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {
@@ -1548,7 +1551,8 @@ var runDualMode = async (binary, args2, startingMode) => {
     apiKey = getApiKey();
   } catch {
     process.stderr.write(
-      "[pushary] phone control needs an API key. Run `npx @pushary/agent-hooks setup`. Running the normal passthrough for now.\n"
+      `[pushary] phone control needs an API key. Run \`${NPX_LATEST_COMMAND} setup\`. Running the normal passthrough for now.
+`
     );
     return { implemented: false };
   }

package/dist/bin/pushary-clean.js

@@ -7,14 +7,14 @@ import {
   createGuards,
   resolveHermesPython,
   runHermesPythonScript
-} from "../chunk-37VLIYLI.js";
+} from "../chunk-H5LHTC5X.js";
 import "../chunk-P32LPT2L.js";
 import {
   removeInstructionBlock,
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-3UA6FPRC.js";
+} from "../chunk-DLJN5XEU.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -24,7 +24,7 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-VYUDGQM7.js";
+} from "../chunk-TUXFIVOH.js";
 import {
   compatibleConfigFile,
   compatibleInstructionsFile,
@@ -32,40 +32,40 @@ import {
   compatiblePermissionRuleFile,
   removeCompatibleHooks,
   removeCompatibleMcpServer
-} from "../chunk-HQLAZWJJ.js";
+} from "../chunk-JF736N4C.js";
 import {
   isClaudeMcpSnapshot,
   removeClaudeMcpServers,
   removePusharySettings,
   removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-WIOXWUUH.js";
+} from "../chunk-J4J45VPZ.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-KEMEBTCJ.js";
-import "../chunk-R3AMKNIW.js";
+} from "../chunk-PCGZXWGQ.js";
+import "../chunk-TFKBFQCE.js";
 import {
   liveBridgeProbe,
   resolveBridgeStub
-} from "../chunk-LYXX5NSB.js";
+} from "../chunk-K3QVDAZW.js";
 import {
   pusharyHookExecutable
-} from "../chunk-TF4IOINR.js";
+} from "../chunk-NTQSICPJ.js";
 import {
   disableDaemonService
-} from "../chunk-3BPB2HYZ.js";
+} from "../chunk-7XT76LWT.js";
 import {
   removeGeminiSettings
-} from "../chunk-ED5TA2FJ.js";
-import "../chunk-JOVWYVSR.js";
+} from "../chunk-EADZPVYW.js";
+import "../chunk-SOCEY746.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-LNGYW6G4.js";
-import "../chunk-WEO5JCB4.js";
-import "../chunk-LGXUGYUH.js";
-import "../chunk-3T52B2OF.js";
+import "../chunk-FDHMNT24.js";
+import "../chunk-UYDTFCHW.js";
+import "../chunk-PYCQXCI5.js";
+import "../chunk-UQHUUZ5H.js";
 import {
   bridgeAgentKey,
   claudeJson,
@@ -94,29 +94,27 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-SAF6NNXY.js";
+} from "../chunk-DYHXOXUF.js";
 import {
   exitOnHelpFlag
-} from "../chunk-TWWLVOPB.js";
-import "../chunk-FAH3D74E.js";
+} from "../chunk-P4BNYJ5Q.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-DINDL2CF.js";
 import {
   CANDIDATE_RCS,
   isDisabledExport,
   removeClaudeAlias
-} from "../chunk-TI3ZWXZG.js";
-import "../chunk-EYRGBYZG.js";
+} from "../chunk-USQDVBEV.js";
+import "../chunk-HETOKNIL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-K6I5M2ME.js";
+import "../chunk-HU5LSYL2.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-2UMNXADU.js";
+import "../chunk-OSJEMXSR.js";
 import {
   CURSOR_GATE_EVENTS,
   HOOK_COMPATIBLE_PROFILES,
@@ -125,7 +123,9 @@ import {
   SUPPORT_EMAIL,
   isValidApiKey,
   redactSecrets
-} from "../chunk-FVKFDTN6.js";
+} from "../chunk-T4QY64OR.js";
+import "../chunk-EA3IELHP.js";
+import "../chunk-HWJW3CPO.js";
 
 // bin/pushary-clean.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync3 } from "fs";
@@ -187,7 +187,11 @@ var MAC_KEYCHAIN_ACCOUNTS = [
   "pushary.site-api-key",
   "pushary.site-id",
   "clerk.device-token",
-  "clerk.session-id"
+  "clerk.session-id",
+  "clerkDeviceToken",
+  "cachedClient",
+  "cachedClientServerDate",
+  "cachedEnvironment"
 ];
 var MAC_DEFAULTS_DOMAINS = ["com.pushary.app", "pushary-bridge", "pushary.render"];
 var macLibraryState = (home = homedir()) => [

package/dist/bin/pushary-codex-bridge.js

@@ -1,54 +1,56 @@
 #!/usr/bin/env node
-import "../chunk-KI36MAT6.js";
+import "../chunk-KEOLNHR3.js";
 import {
   LiveTranscriptRelay,
   liveSessionSleep,
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-SKXLIVFM.js";
+} from "../chunk-HVBF35GT.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
   describeIdleWindow,
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-PHHGHHOW.js";
-import "../chunk-CRNAXFQ6.js";
-import "../chunk-EQRS3SGM.js";
+} from "../chunk-MYP4UUFH.js";
+import "../chunk-TIWURSLS.js";
+import "../chunk-66H2QQAK.js";
 import {
   transcriptsEnabled
-} from "../chunk-MN3XOVRK.js";
+} from "../chunk-2QT3GCU4.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import {
   isDecisionStopped,
   withdrawQuestion
-} from "../chunk-LGXUGYUH.js";
+} from "../chunk-PYCQXCI5.js";
 import {
   getMachineId
-} from "../chunk-3T52B2OF.js";
+} from "../chunk-UQHUUZ5H.js";
 import {
   resolveBinary
-} from "../chunk-SAF6NNXY.js";
-import "../chunk-TI3ZWXZG.js";
+} from "../chunk-DYHXOXUF.js";
+import "../chunk-USQDVBEV.js";
 import {
   callMcpTool
-} from "../chunk-EYRGBYZG.js";
+} from "../chunk-HETOKNIL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-K6I5M2ME.js";
+import "../chunk-HU5LSYL2.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-2UMNXADU.js";
+} from "../chunk-OSJEMXSR.js";
 import {
   parseAgentQuestion,
   parseAgentQuestionAnswers
-} from "../chunk-FVKFDTN6.js";
+} from "../chunk-T4QY64OR.js";
+import "../chunk-EA3IELHP.js";
+import "../chunk-HWJW3CPO.js";
 
 // bin/pushary-codex-bridge.ts
 import { existsSync } from "fs";

package/dist/bin/pushary-codex-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   takeHookHoldBudget
-} from "../chunk-HK3IXIQJ.js";
+} from "../chunk-5HYNICS7.js";
 import {
   blockedActionFingerprint,
   codexCallKey,
@@ -11,31 +11,35 @@ import {
   hasBlockedActionHint,
   recordBlockedActionHint,
   recordCodexCallDecision,
+  reportMachineDenial,
   userScope
-} from "../chunk-ALFT7H5B.js";
+} from "../chunk-CQYHOHOK.js";
+import {
+  triggerAutoUpdate
+} from "../chunk-OSSDK5RS.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-SWFF5U2N.js";
+} from "../chunk-43ZDACBO.js";
 import {
   readHookInput
-} from "../chunk-4FN6VV56.js";
+} from "../chunk-ORLJNJEO.js";
 import {
   denyReasonFrom,
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
-import "../chunk-TNS3YLFE.js";
+import "../chunk-NFKVRMTM.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-KEMEBTCJ.js";
-import "../chunk-R3AMKNIW.js";
-import "../chunk-LYXX5NSB.js";
-import "../chunk-TF4IOINR.js";
-import "../chunk-3BPB2HYZ.js";
-import "../chunk-ED5TA2FJ.js";
-import "../chunk-JOVWYVSR.js";
-import "../chunk-CRNAXFQ6.js";
-import "../chunk-EQRS3SGM.js";
-import "../chunk-MN3XOVRK.js";
+import "../chunk-PCGZXWGQ.js";
+import "../chunk-TFKBFQCE.js";
+import "../chunk-K3QVDAZW.js";
+import "../chunk-NTQSICPJ.js";
+import "../chunk-7XT76LWT.js";
+import "../chunk-EADZPVYW.js";
+import "../chunk-SOCEY746.js";
+import "../chunk-TIWURSLS.js";
+import "../chunk-66H2QQAK.js";
+import "../chunk-2QT3GCU4.js";
 import "../chunk-XHKBHWLX.js";
 import {
   CODEX_AGENT,
@@ -72,8 +76,8 @@ import {
   toCodexWire,
   toPolicyLookup,
   toPolicyLookups
-} from "../chunk-LNGYW6G4.js";
-import "../chunk-WEO5JCB4.js";
+} from "../chunk-FDHMNT24.js";
+import "../chunk-UYDTFCHW.js";
 import {
   DECISION_STOP_REASON,
   askUser,
@@ -85,27 +89,26 @@ import {
   requestGate,
   sendNotification,
   waitForQuestion
-} from "../chunk-LGXUGYUH.js";
+} from "../chunk-PYCQXCI5.js";
 import {
   getMachineId
-} from "../chunk-3T52B2OF.js";
+} from "../chunk-UQHUUZ5H.js";
 import {
   canonicalJson
-} from "../chunk-SAF6NNXY.js";
+} from "../chunk-DYHXOXUF.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-DINDL2CF.js";
-import "../chunk-TI3ZWXZG.js";
-import "../chunk-EYRGBYZG.js";
+import "../chunk-USQDVBEV.js";
+import "../chunk-HETOKNIL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-K6I5M2ME.js";
+import "../chunk-HU5LSYL2.js";
 import {
   writeFileAtomic
 } from "../chunk-T7E75EKA.js";
 import {
   getApiKey
-} from "../chunk-2UMNXADU.js";
+} from "../chunk-OSJEMXSR.js";
 import {
   CODEX_RESCUE_TOOL_NAME,
   DECISION_LINE_MAX,
@@ -119,7 +122,9 @@ import {
   hookWaitClamped,
   hookWaitDeadline,
   resolveGate
-} from "../chunk-FVKFDTN6.js";
+} from "../chunk-T4QY64OR.js";
+import "../chunk-EA3IELHP.js";
+import "../chunk-HWJW3CPO.js";
 
 // bin/pushary-codex-hook.ts
 import { basename } from "path";
@@ -609,8 +614,10 @@ var decidePermissionRequest = async (input) => {
   try {
     const apiKey = getApiKey();
     const { verdict, lookup, gateInput } = await codexGate(apiKey, input);
-    if (verdict.kind === "kill") return codexDeny(KILL_REASON);
-    if (verdict.kind === "deny") return codexDeny(verdict.reason);
+    if (verdict.kind === "kill" || verdict.kind === "deny") {
+      await reportMachineDenial({ ...input, tool_name: lookup.tool, tool_input: lookup.input }, verdict, CODEX_AGENT);
+      return codexDeny(verdict.kind === "kill" ? KILL_REASON : verdict.reason);
+    }
     const recorded = consumeCodexCallDecision(callKeyFor(input));
     if (recorded?.kind === "denied") return codexDeny(recorded.reason);
     if (recorded?.kind === "handled") return codexPass();
@@ -695,9 +702,11 @@ var decidePreToolUse = async (input) => {
   }
   try {
     const { verdict, lookup } = await codexGate(apiKey, input);
-    if (verdict.kind === "kill") return codexDeny(KILL_REASON);
+    if (verdict.kind === "kill" || verdict.kind === "deny") {
+      await reportMachineDenial({ ...input, tool_name: lookup.tool, tool_input: lookup.input }, verdict, CODEX_AGENT);
+      return codexDeny(verdict.kind === "kill" ? KILL_REASON : verdict.reason);
+    }
     if (verdict.kind === "allow") return codexPass();
-    if (verdict.kind === "deny") return codexDeny(verdict.reason);
     if (codexApprovalsReviewer(input) === "auto_review") return codexPass();
     if (defersToNativeMode(input.permission_mode, input.tool_name ?? "")) return codexPass();
     if (verdict.kind === "defer") return codexPass();
@@ -736,7 +745,7 @@ var decidePreToolUse = async (input) => {
 };
 var repairCodexHoldsQuietly = async () => {
   try {
-    const { repairCodexHolds } = await import("../reapply-BAWDJTG7.js");
+    const { repairCodexHolds } = await import("../reapply-D2TFN6XK.js");
     repairCodexHolds();
   } catch {
     return;
@@ -813,6 +822,7 @@ var main = async () => {
       }
       case "SessionStart":
         await repairCodexHoldsQuietly();
+        triggerAutoUpdate({ isSubagentStart: Boolean(input.agent_id) });
         await reportSessionStart(input);
         break;
       case "SessionEnd":