@pushary/agent-hooks 1.4.2 → 1.5.1

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 1.5.1
+
+- Setup no longer stops at a Codex version. It writes the Pushary hooks, asks Codex to trust them, and checks Codex's answer. It used to trust the hooks itself only up to Codex 0.155.1, and on anything newer told you to open Codex and trust them by hand.
+- Pushary asks Codex only when you run setup, upgrade or doctor yourself at a terminal, only through the `codex` command on your PATH, and only if Codex has been opened on this machine before. It never starts the Codex inside the ChatGPT app, and never while a hook is running.
+- If Codex does not accept the trust, setup says so and tells you to open Codex, run `/hooks`, and choose Trust for the Pushary hooks. When Codex is not asked, setup says why in one line and keeps the trust entries it wrote itself, as it did before.
+- `pushary upgrade` asks Codex the same way after it refreshes the Codex hooks. The daily automatic update refreshes the hooks and writes the same trust entries but does not start Codex, so an install left untrusted by the old version limit is fixed on its next update either way. Machines older than 1.5.0 do not update themselves: run `npx @pushary/agent-hooks@latest upgrade` once.
+- `pushary doctor` shows what Codex itself reports for each Pushary hook: trusted, untrusted, modified, not listed, or turned off. When Codex is not asked or cannot be asked, doctor says so and uses its own check instead.
+- Pause automatic updates on Linux to preserve phone-started sessions during daemon replacement.
+- Retry incomplete configuration and daemon refreshes after an automatic installation, including when the installed version is already current.
+
+## 1.5.0
+
+- Pushary now updates itself in the background. When an agent session starts, it checks at most once a day for a newer version within the same major version, installs it into the global npm folder your hooks already run from, and refreshes each agent's config the way `pushary upgrade` does. The session never waits for it. A new major version is shown in `pushary doctor` and left for you to install.
+- Turn it off with `pushary upgrade --auto=off` (and back on with `--auto=on`), or set `PUSHARY_DISABLE_AUTOUPDATE=1` in the environment your agents start from.
+- It does not run on Windows yet, in CI, or for a copy run through `npx`, a plugin, or the Mac app. It never uses `sudo`: if npm cannot write to the global folder, the attempt is recorded as failed and nothing changes.
+- This only reaches machines on 1.5.0 or later. To get there, run `npx @pushary/agent-hooks@latest upgrade` once.
+- `pushary doctor` shows whether automatic updates are on and the result of the last check, and `setup` and `doctor` tell you once when Pushary has updated itself.
+- `pushary doctor` no longer calls a build newer than the npm release out of date.
+- The commands the CLI prints for you to copy now say `npx @pushary/agent-hooks@latest`. Without `@latest`, npx runs whatever older version is installed globally.
+- A failed npm install now reports npm's reason, such as a permission error, instead of a line like `syscall mkdir`.
+
 ## 1.4.2
 
 - Setup trusts the Pushary hooks for you on Codex up to 0.155.1. It used to stop at 0.147.0, so on a newer Codex it wrote the hooks without trusting them, Codex never ran them, and setup still said it was done.

package/README.md

@@ -244,6 +244,34 @@ npx @pushary/agent-hooks@latest wait 45
 npx @pushary/agent-hooks@latest clean
 ```
 
+## Updates
+
+From 1.5.0, Pushary updates itself. When an agent session starts, the session-start
+hook checks at most once a day whether a newer version is published. If one is, it
+installs that version in the background into the same global npm folder your hooks
+already run from, then refreshes each agent's config the way `pushary upgrade` does.
+The session does not wait for it, and the new version runs from the next hook call.
+
+- It stays within the same major version. A new major shows in `pushary doctor`, and
+  you move to it with `npx @pushary/agent-hooks@latest upgrade`.
+- It only updates a global npm install. A copy run through `npx`, a plugin, or the Mac
+  app updates by its own route.
+- It never uses `sudo`. If npm cannot write to the global folder, the attempt is
+  recorded as failed and nothing changes.
+- It does not run on Windows yet, or when `CI` is set. Linux automatic updates are paused because restarting the systemd daemon can terminate phone-started sessions. On Linux, finish running sessions before upgrading manually.
+- If installation succeeds but configuration refresh fails, the next automatic check or manual upgrade retries the refresh before checking for another release.
+
+Turn it off with either of these:
+
+```bash
+pushary upgrade --auto=off           # turn it back on with --auto=on
+export PUSHARY_DISABLE_AUTOUPDATE=1  # in the environment your agents start from
+```
+
+`pushary doctor` shows whether it is on and the result of the last check. The state is
+kept in `~/.pushary/auto-update.json`, and the output of recent updates in
+`~/.pushary/logs/auto-update.log`.
+
 ## Manual MCP setup
 
 If you only want notifications and questions (no permission gating), add Pushary to your MCP config directly:

package/data/vscode-plugin/README.md

@@ -106,7 +106,7 @@ This repository uses the `.claude-plugin/plugin.json` layout, which VS Code, Git
 
 The layout is portable; this plugin is not meant to be. `hooks/hooks.json` uses VS Code's flat hook form, and the gate speaks VS Code's tool names, so treat this as a VS Code plugin that happens to sit in a portable folder shape.
 
-Claude Code users are served by `npx @pushary/agent-hooks setup --agents claude_code`, which installs a hook built for Claude Code's own tool names and matcher format. Do not install this directory as a Claude Code plugin as well: at best it duplicates the MCP server, and the two installs would fight over the same approvals.
+Claude Code users are served by `npx @pushary/agent-hooks@latest setup --agents claude_code`, which installs a hook built for Claude Code's own tool names and matcher format. Do not install this directory as a Claude Code plugin as well: at best it duplicates the MCP server, and the two installs would fight over the same approvals.
 
 ## Development
 

package/data/vscode-plugin/scripts/pushary-gate.mjs

@@ -723,9 +723,9 @@ const main = async () => {
 
   const apiKey = resolveApiKey()
   if (!apiKey) {
-    diag('no API key found (PUSHARY_API_KEY, the plugin .mcp.json, or ~/.pushary/config.json). Run: npx @pushary/agent-hooks setup')
+    diag('no API key found (PUSHARY_API_KEY, the plugin .mcp.json, or ~/.pushary/config.json). Run: npx @pushary/agent-hooks@latest setup')
     return respond(
-      unresolved(input.tool_name, 'Pushary is not configured: run `npx @pushary/agent-hooks setup` (get a key at https://pushary.com) to route this approval to your phone.')
+      unresolved(input.tool_name, 'Pushary is not configured: run `npx @pushary/agent-hooks@latest setup` (get a key at https://pushary.com) to route this approval to your phone.')
     )
   }
 

package/dist/bin/pushary-bell-hook.js

@@ -1,35 +1,36 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-25RTLTQD.js";
+} from "../chunk-DTQNDR7C.js";
 import {
   readHookInput
-} from "../chunk-JVTOML54.js";
-import "../chunk-UJBZIKSY.js";
+} from "../chunk-6QFEQIPM.js";
+import "../chunk-TZGCUNOX.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-4ZDKSDVW.js";
-import "../chunk-DY4ILT6L.js";
-import "../chunk-ZVY25BMK.js";
-import "../chunk-WPVHRUDT.js";
-import "../chunk-BZ4GDOJX.js";
-import "../chunk-LPYCPFBZ.js";
-import "../chunk-MW6ZPC6R.js";
-import "../chunk-GZ7E6VOB.js";
-import "../chunk-EQRS3SGM.js";
-import "../chunk-4BROEAKH.js";
+import "../chunk-WNJSGZY7.js";
+import "../chunk-TFKBFQCE.js";
+import "../chunk-K3QVDAZW.js";
+import "../chunk-Z4VGIBJ7.js";
+import "../chunk-X7FESZTD.js";
+import "../chunk-2AUIEZYS.js";
+import "../chunk-5UQ5ATIE.js";
+import "../chunk-TIWURSLS.js";
+import "../chunk-66H2QQAK.js";
+import "../chunk-2QT3GCU4.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-YXP3WPAI.js";
-import "../chunk-NHTAHAIS.js";
-import "../chunk-TRLFZKVG.js";
+import "../chunk-UYDTFCHW.js";
+import "../chunk-WOLPADR6.js";
+import "../chunk-6IU45EHE.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-DINDL2CF.js";
-import "../chunk-FU2DFEAZ.js";
+import "../chunk-USQDVBEV.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-UM5J3J4V.js";
+import "../chunk-HU5LSYL2.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-2UMNXADU.js";
-import "../chunk-SOUZBGYJ.js";
+import "../chunk-OSJEMXSR.js";
+import "../chunk-T4QY64OR.js";
+import "../chunk-EA3IELHP.js";
+import "../chunk-HWJW3CPO.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,38 +5,38 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-25RTLTQD.js";
+} from "../chunk-DTQNDR7C.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-MW6ZPC6R.js";
+} from "../chunk-5UQ5ATIE.js";
 import {
   claudeSettings
-} from "../chunk-TRLFZKVG.js";
+} from "../chunk-6IU45EHE.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
 import {
   exitOnHelpFlag
-} from "../chunk-TWWLVOPB.js";
-import "../chunk-FAH3D74E.js";
+} from "../chunk-P4BNYJ5Q.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-DINDL2CF.js";
-import "../chunk-FU2DFEAZ.js";
+import "../chunk-USQDVBEV.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-UM5J3J4V.js";
+import "../chunk-HU5LSYL2.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-T7E75EKA.js";
-import "../chunk-2UMNXADU.js";
-import "../chunk-SOUZBGYJ.js";
+import "../chunk-OSJEMXSR.js";
+import "../chunk-T4QY64OR.js";
+import "../chunk-EA3IELHP.js";
+import "../chunk-HWJW3CPO.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,7 +8,7 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-VOMOZ4D5.js";
+} from "../chunk-M2LMXPJZ.js";
 import {
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
@@ -17,24 +17,24 @@ import {
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-UJBZIKSY.js";
+} from "../chunk-TZGCUNOX.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-4ZDKSDVW.js";
-import "../chunk-DY4ILT6L.js";
-import "../chunk-ZVY25BMK.js";
-import "../chunk-WPVHRUDT.js";
+import "../chunk-WNJSGZY7.js";
+import "../chunk-TFKBFQCE.js";
+import "../chunk-K3QVDAZW.js";
+import "../chunk-Z4VGIBJ7.js";
 import {
   ensureDaemonRunning
-} from "../chunk-BZ4GDOJX.js";
-import "../chunk-LPYCPFBZ.js";
-import "../chunk-MW6ZPC6R.js";
+} from "../chunk-X7FESZTD.js";
+import "../chunk-2AUIEZYS.js";
+import "../chunk-5UQ5ATIE.js";
 import {
   encryptRecord
-} from "../chunk-GZ7E6VOB.js";
-import "../chunk-EQRS3SGM.js";
+} from "../chunk-TIWURSLS.js";
+import "../chunk-66H2QQAK.js";
 import {
   transcriptsEnabled
-} from "../chunk-4BROEAKH.js";
+} from "../chunk-2QT3GCU4.js";
 import {
   needsShell,
   spawnClaude
@@ -56,8 +56,8 @@ import {
   reportEvent,
   savePendingCommand,
   scopePathFor
-} from "../chunk-G653QPTR.js";
-import "../chunk-YXP3WPAI.js";
+} from "../chunk-D573TLP6.js";
+import "../chunk-UYDTFCHW.js";
 import {
   DECISION_STOP_REASON,
   askUser,
@@ -67,29 +67,32 @@ import {
   nextLongPollMs,
   waitForAnswer,
   withdrawQuestion
-} from "../chunk-LGXUGYUH.js";
+} from "../chunk-PYCQXCI5.js";
 import {
   getMachineId
-} from "../chunk-NHTAHAIS.js";
-import "../chunk-TRLFZKVG.js";
+} from "../chunk-WOLPADR6.js";
+import "../chunk-6IU45EHE.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-DINDL2CF.js";
-import "../chunk-FU2DFEAZ.js";
-import "../chunk-EYRGBYZG.js";
+import "../chunk-USQDVBEV.js";
+import "../chunk-HETOKNIL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-UM5J3J4V.js";
+import "../chunk-HU5LSYL2.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-2UMNXADU.js";
+} from "../chunk-OSJEMXSR.js";
 import {
   KILL_REASON,
   redactSecrets,
   resolveGate
-} from "../chunk-SOUZBGYJ.js";
+} from "../chunk-T4QY64OR.js";
+import {
+  NPX_LATEST_COMMAND
+} from "../chunk-EA3IELHP.js";
+import "../chunk-HWJW3CPO.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {
@@ -1548,7 +1551,8 @@ var runDualMode = async (binary, args2, startingMode) => {
     apiKey = getApiKey();
   } catch {
     process.stderr.write(
-      "[pushary] phone control needs an API key. Run `npx @pushary/agent-hooks setup`. Running the normal passthrough for now.\n"
+      `[pushary] phone control needs an API key. Run \`${NPX_LATEST_COMMAND} setup\`. Running the normal passthrough for now.
+`
     );
     return { implemented: false };
   }

package/dist/bin/pushary-clean.js

@@ -7,14 +7,14 @@ import {
   createGuards,
   resolveHermesPython,
   runHermesPythonScript
-} from "../chunk-Y3MM6PYN.js";
+} from "../chunk-YAWXKL2X.js";
 import "../chunk-P32LPT2L.js";
 import {
   removeInstructionBlock,
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-MUVTZNJW.js";
+} from "../chunk-KHXVTWYS.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -24,7 +24,7 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-F4UWL4NY.js";
+} from "../chunk-TUXFIVOH.js";
 import {
   compatibleConfigFile,
   compatibleInstructionsFile,
@@ -32,40 +32,40 @@ import {
   compatiblePermissionRuleFile,
   removeCompatibleHooks,
   removeCompatibleMcpServer
-} from "../chunk-VIOL2DJS.js";
+} from "../chunk-R5KY3PBN.js";
 import {
   isClaudeMcpSnapshot,
   removeClaudeMcpServers,
   removePusharySettings,
   removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-II7PUMPB.js";
+} from "../chunk-4ERLRNOK.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-4ZDKSDVW.js";
-import "../chunk-DY4ILT6L.js";
+} from "../chunk-WNJSGZY7.js";
+import "../chunk-TFKBFQCE.js";
 import {
   liveBridgeProbe,
   resolveBridgeStub
-} from "../chunk-ZVY25BMK.js";
+} from "../chunk-K3QVDAZW.js";
 import {
   pusharyHookExecutable
-} from "../chunk-WPVHRUDT.js";
+} from "../chunk-Z4VGIBJ7.js";
 import {
   disableDaemonService
-} from "../chunk-BZ4GDOJX.js";
+} from "../chunk-X7FESZTD.js";
 import {
   removeGeminiSettings
-} from "../chunk-LPYCPFBZ.js";
-import "../chunk-MW6ZPC6R.js";
+} from "../chunk-2AUIEZYS.js";
+import "../chunk-5UQ5ATIE.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-G653QPTR.js";
-import "../chunk-YXP3WPAI.js";
-import "../chunk-LGXUGYUH.js";
-import "../chunk-NHTAHAIS.js";
+import "../chunk-D573TLP6.js";
+import "../chunk-UYDTFCHW.js";
+import "../chunk-PYCQXCI5.js";
+import "../chunk-WOLPADR6.js";
 import {
   bridgeAgentKey,
   claudeJson,
@@ -94,29 +94,27 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-TRLFZKVG.js";
+} from "../chunk-6IU45EHE.js";
 import {
   exitOnHelpFlag
-} from "../chunk-TWWLVOPB.js";
-import "../chunk-FAH3D74E.js";
+} from "../chunk-P4BNYJ5Q.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-DINDL2CF.js";
 import {
   CANDIDATE_RCS,
   isDisabledExport,
   removeClaudeAlias
-} from "../chunk-FU2DFEAZ.js";
-import "../chunk-EYRGBYZG.js";
+} from "../chunk-USQDVBEV.js";
+import "../chunk-HETOKNIL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-UM5J3J4V.js";
+import "../chunk-HU5LSYL2.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-2UMNXADU.js";
+import "../chunk-OSJEMXSR.js";
 import {
   CURSOR_GATE_EVENTS,
   HOOK_COMPATIBLE_PROFILES,
@@ -125,7 +123,9 @@ import {
   SUPPORT_EMAIL,
   isValidApiKey,
   redactSecrets
-} from "../chunk-SOUZBGYJ.js";
+} from "../chunk-T4QY64OR.js";
+import "../chunk-EA3IELHP.js";
+import "../chunk-HWJW3CPO.js";
 
 // bin/pushary-clean.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync3 } from "fs";

package/dist/bin/pushary-codex-bridge.js

@@ -1,54 +1,56 @@
 #!/usr/bin/env node
-import "../chunk-TYEO6T5J.js";
+import "../chunk-5ZZG76S2.js";
 import {
   LiveTranscriptRelay,
   liveSessionSleep,
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-2V2IKOGJ.js";
+} from "../chunk-HVBF35GT.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
   describeIdleWindow,
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-VOMOZ4D5.js";
-import "../chunk-GZ7E6VOB.js";
-import "../chunk-EQRS3SGM.js";
+} from "../chunk-M2LMXPJZ.js";
+import "../chunk-TIWURSLS.js";
+import "../chunk-66H2QQAK.js";
 import {
   transcriptsEnabled
-} from "../chunk-4BROEAKH.js";
+} from "../chunk-2QT3GCU4.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import {
   isDecisionStopped,
   withdrawQuestion
-} from "../chunk-LGXUGYUH.js";
+} from "../chunk-PYCQXCI5.js";
 import {
   getMachineId
-} from "../chunk-NHTAHAIS.js";
+} from "../chunk-WOLPADR6.js";
 import {
   resolveBinary
-} from "../chunk-TRLFZKVG.js";
-import "../chunk-FU2DFEAZ.js";
+} from "../chunk-6IU45EHE.js";
+import "../chunk-USQDVBEV.js";
 import {
   callMcpTool
-} from "../chunk-EYRGBYZG.js";
+} from "../chunk-HETOKNIL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-UM5J3J4V.js";
+import "../chunk-HU5LSYL2.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-2UMNXADU.js";
+} from "../chunk-OSJEMXSR.js";
 import {
   parseAgentQuestion,
   parseAgentQuestionAnswers
-} from "../chunk-SOUZBGYJ.js";
+} from "../chunk-T4QY64OR.js";
+import "../chunk-EA3IELHP.js";
+import "../chunk-HWJW3CPO.js";
 
 // bin/pushary-codex-bridge.ts
 import { existsSync } from "fs";

package/dist/bin/pushary-codex-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   takeHookHoldBudget
-} from "../chunk-M5CTUFF3.js";
+} from "../chunk-5HYNICS7.js";
 import {
   blockedActionFingerprint,
   codexCallKey,
@@ -13,30 +13,33 @@ import {
   recordCodexCallDecision,
   reportMachineDenial,
   userScope
-} from "../chunk-SUWRZYQG.js";
+} from "../chunk-MDJJW3LP.js";
+import {
+  triggerAutoUpdate
+} from "../chunk-MU3WU2FO.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-LEAAERSQ.js";
+} from "../chunk-43ZDACBO.js";
 import {
   readHookInput
-} from "../chunk-JVTOML54.js";
+} from "../chunk-6QFEQIPM.js";
 import {
   denyReasonFrom,
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
-import "../chunk-UJBZIKSY.js";
+import "../chunk-TZGCUNOX.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-4ZDKSDVW.js";
-import "../chunk-DY4ILT6L.js";
-import "../chunk-ZVY25BMK.js";
-import "../chunk-WPVHRUDT.js";
-import "../chunk-BZ4GDOJX.js";
-import "../chunk-LPYCPFBZ.js";
-import "../chunk-MW6ZPC6R.js";
-import "../chunk-GZ7E6VOB.js";
-import "../chunk-EQRS3SGM.js";
-import "../chunk-4BROEAKH.js";
+import "../chunk-WNJSGZY7.js";
+import "../chunk-TFKBFQCE.js";
+import "../chunk-K3QVDAZW.js";
+import "../chunk-Z4VGIBJ7.js";
+import "../chunk-X7FESZTD.js";
+import "../chunk-2AUIEZYS.js";
+import "../chunk-5UQ5ATIE.js";
+import "../chunk-TIWURSLS.js";
+import "../chunk-66H2QQAK.js";
+import "../chunk-2QT3GCU4.js";
 import "../chunk-XHKBHWLX.js";
 import {
   CODEX_AGENT,
@@ -73,8 +76,8 @@ import {
   toCodexWire,
   toPolicyLookup,
   toPolicyLookups
-} from "../chunk-G653QPTR.js";
-import "../chunk-YXP3WPAI.js";
+} from "../chunk-D573TLP6.js";
+import "../chunk-UYDTFCHW.js";
 import {
   DECISION_STOP_REASON,
   askUser,
@@ -86,27 +89,26 @@ import {
   requestGate,
   sendNotification,
   waitForQuestion
-} from "../chunk-LGXUGYUH.js";
+} from "../chunk-PYCQXCI5.js";
 import {
   getMachineId
-} from "../chunk-NHTAHAIS.js";
+} from "../chunk-WOLPADR6.js";
 import {
   canonicalJson
-} from "../chunk-TRLFZKVG.js";
+} from "../chunk-6IU45EHE.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-DINDL2CF.js";
-import "../chunk-FU2DFEAZ.js";
-import "../chunk-EYRGBYZG.js";
+import "../chunk-USQDVBEV.js";
+import "../chunk-HETOKNIL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-UM5J3J4V.js";
+import "../chunk-HU5LSYL2.js";
 import {
   writeFileAtomic
 } from "../chunk-T7E75EKA.js";
 import {
   getApiKey
-} from "../chunk-2UMNXADU.js";
+} from "../chunk-OSJEMXSR.js";
 import {
   CODEX_RESCUE_TOOL_NAME,
   DECISION_LINE_MAX,
@@ -120,7 +122,9 @@ import {
   hookWaitClamped,
   hookWaitDeadline,
   resolveGate
-} from "../chunk-SOUZBGYJ.js";
+} from "../chunk-T4QY64OR.js";
+import "../chunk-EA3IELHP.js";
+import "../chunk-HWJW3CPO.js";
 
 // bin/pushary-codex-hook.ts
 import { basename } from "path";
@@ -741,7 +745,7 @@ var decidePreToolUse = async (input) => {
 };
 var repairCodexHoldsQuietly = async () => {
   try {
-    const { repairCodexHolds } = await import("../reapply-J527BCJG.js");
+    const { repairCodexHolds } = await import("../reapply-5CZSTJZI.js");
     repairCodexHolds();
   } catch {
     return;
@@ -818,6 +822,7 @@ var main = async () => {
       }
       case "SessionStart":
         await repairCodexHoldsQuietly();
+        triggerAutoUpdate({ isSubagentStart: Boolean(input.agent_id) });
         await reportSessionStart(input);
         break;
       case "SessionEnd":