@pushary/agent-hooks 1.5.0 → 1.5.1

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 1.5.1
+
+- Setup no longer stops at a Codex version. It writes the Pushary hooks, asks Codex to trust them, and checks Codex's answer. It used to trust the hooks itself only up to Codex 0.155.1, and on anything newer told you to open Codex and trust them by hand.
+- Pushary asks Codex only when you run setup, upgrade or doctor yourself at a terminal, only through the `codex` command on your PATH, and only if Codex has been opened on this machine before. It never starts the Codex inside the ChatGPT app, and never while a hook is running.
+- If Codex does not accept the trust, setup says so and tells you to open Codex, run `/hooks`, and choose Trust for the Pushary hooks. When Codex is not asked, setup says why in one line and keeps the trust entries it wrote itself, as it did before.
+- `pushary upgrade` asks Codex the same way after it refreshes the Codex hooks. The daily automatic update refreshes the hooks and writes the same trust entries but does not start Codex, so an install left untrusted by the old version limit is fixed on its next update either way. Machines older than 1.5.0 do not update themselves: run `npx @pushary/agent-hooks@latest upgrade` once.
+- `pushary doctor` shows what Codex itself reports for each Pushary hook: trusted, untrusted, modified, not listed, or turned off. When Codex is not asked or cannot be asked, doctor says so and uses its own check instead.
+- Pause automatic updates on Linux to preserve phone-started sessions during daemon replacement.
+- Retry incomplete configuration and daemon refreshes after an automatic installation, including when the installed version is already current.
+
 ## 1.5.0
 
 - Pushary now updates itself in the background. When an agent session starts, it checks at most once a day for a newer version within the same major version, installs it into the global npm folder your hooks already run from, and refreshes each agent's config the way `pushary upgrade` does. The session never waits for it. A new major version is shown in `pushary doctor` and left for you to install.

package/README.md

@@ -258,7 +258,8 @@ The session does not wait for it, and the new version runs from the next hook ca
   app updates by its own route.
 - It never uses `sudo`. If npm cannot write to the global folder, the attempt is
   recorded as failed and nothing changes.
-- It does not run on Windows yet, or when `CI` is set.
+- It does not run on Windows yet, or when `CI` is set. Linux automatic updates are paused because restarting the systemd daemon can terminate phone-started sessions. On Linux, finish running sessions before upgrading manually.
+- If installation succeeds but configuration refresh fails, the next automatic check or manual upgrade retries the refresh before checking for another release.
 
 Turn it off with either of these:
 

package/dist/bin/pushary-bell-hook.js

@@ -4,23 +4,23 @@ import {
 } from "../chunk-DTQNDR7C.js";
 import {
   readHookInput
-} from "../chunk-ORLJNJEO.js";
-import "../chunk-NFKVRMTM.js";
+} from "../chunk-6QFEQIPM.js";
+import "../chunk-TZGCUNOX.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-PCGZXWGQ.js";
+import "../chunk-WNJSGZY7.js";
 import "../chunk-TFKBFQCE.js";
 import "../chunk-K3QVDAZW.js";
-import "../chunk-NTQSICPJ.js";
-import "../chunk-7XT76LWT.js";
-import "../chunk-EADZPVYW.js";
-import "../chunk-SOCEY746.js";
+import "../chunk-Z4VGIBJ7.js";
+import "../chunk-X7FESZTD.js";
+import "../chunk-2AUIEZYS.js";
+import "../chunk-5UQ5ATIE.js";
 import "../chunk-TIWURSLS.js";
 import "../chunk-66H2QQAK.js";
 import "../chunk-2QT3GCU4.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-UYDTFCHW.js";
-import "../chunk-UQHUUZ5H.js";
-import "../chunk-DYHXOXUF.js";
+import "../chunk-WOLPADR6.js";
+import "../chunk-6IU45EHE.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-USQDVBEV.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-bell.js

@@ -10,10 +10,10 @@ import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-SOCEY746.js";
+} from "../chunk-5UQ5ATIE.js";
 import {
   claudeSettings
-} from "../chunk-DYHXOXUF.js";
+} from "../chunk-6IU45EHE.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";

package/dist/bin/pushary-claude.js

@@ -8,7 +8,7 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-MYP4UUFH.js";
+} from "../chunk-M2LMXPJZ.js";
 import {
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
@@ -17,17 +17,17 @@ import {
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-NFKVRMTM.js";
+} from "../chunk-TZGCUNOX.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-PCGZXWGQ.js";
+import "../chunk-WNJSGZY7.js";
 import "../chunk-TFKBFQCE.js";
 import "../chunk-K3QVDAZW.js";
-import "../chunk-NTQSICPJ.js";
+import "../chunk-Z4VGIBJ7.js";
 import {
   ensureDaemonRunning
-} from "../chunk-7XT76LWT.js";
-import "../chunk-EADZPVYW.js";
-import "../chunk-SOCEY746.js";
+} from "../chunk-X7FESZTD.js";
+import "../chunk-2AUIEZYS.js";
+import "../chunk-5UQ5ATIE.js";
 import {
   encryptRecord
 } from "../chunk-TIWURSLS.js";
@@ -56,7 +56,7 @@ import {
   reportEvent,
   savePendingCommand,
   scopePathFor
-} from "../chunk-FDHMNT24.js";
+} from "../chunk-D573TLP6.js";
 import "../chunk-UYDTFCHW.js";
 import {
   DECISION_STOP_REASON,
@@ -70,8 +70,8 @@ import {
 } from "../chunk-PYCQXCI5.js";
 import {
   getMachineId
-} from "../chunk-UQHUUZ5H.js";
-import "../chunk-DYHXOXUF.js";
+} from "../chunk-WOLPADR6.js";
+import "../chunk-6IU45EHE.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-USQDVBEV.js";
 import "../chunk-HETOKNIL.js";

package/dist/bin/pushary-clean.js

@@ -7,14 +7,14 @@ import {
   createGuards,
   resolveHermesPython,
   runHermesPythonScript
-} from "../chunk-H5LHTC5X.js";
+} from "../chunk-YAWXKL2X.js";
 import "../chunk-P32LPT2L.js";
 import {
   removeInstructionBlock,
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-DLJN5XEU.js";
+} from "../chunk-KHXVTWYS.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -32,20 +32,20 @@ import {
   compatiblePermissionRuleFile,
   removeCompatibleHooks,
   removeCompatibleMcpServer
-} from "../chunk-JF736N4C.js";
+} from "../chunk-R5KY3PBN.js";
 import {
   isClaudeMcpSnapshot,
   removeClaudeMcpServers,
   removePusharySettings,
   removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-J4J45VPZ.js";
+} from "../chunk-4ERLRNOK.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-PCGZXWGQ.js";
+} from "../chunk-WNJSGZY7.js";
 import "../chunk-TFKBFQCE.js";
 import {
   liveBridgeProbe,
@@ -53,19 +53,19 @@ import {
 } from "../chunk-K3QVDAZW.js";
 import {
   pusharyHookExecutable
-} from "../chunk-NTQSICPJ.js";
+} from "../chunk-Z4VGIBJ7.js";
 import {
   disableDaemonService
-} from "../chunk-7XT76LWT.js";
+} from "../chunk-X7FESZTD.js";
 import {
   removeGeminiSettings
-} from "../chunk-EADZPVYW.js";
-import "../chunk-SOCEY746.js";
+} from "../chunk-2AUIEZYS.js";
+import "../chunk-5UQ5ATIE.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-FDHMNT24.js";
+import "../chunk-D573TLP6.js";
 import "../chunk-UYDTFCHW.js";
 import "../chunk-PYCQXCI5.js";
-import "../chunk-UQHUUZ5H.js";
+import "../chunk-WOLPADR6.js";
 import {
   bridgeAgentKey,
   claudeJson,
@@ -94,7 +94,7 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-DYHXOXUF.js";
+} from "../chunk-6IU45EHE.js";
 import {
   exitOnHelpFlag
 } from "../chunk-P4BNYJ5Q.js";

package/dist/bin/pushary-codex-bridge.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import "../chunk-KEOLNHR3.js";
+import "../chunk-5ZZG76S2.js";
 import {
   LiveTranscriptRelay,
   liveSessionSleep,
@@ -13,7 +13,7 @@ import {
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-MYP4UUFH.js";
+} from "../chunk-M2LMXPJZ.js";
 import "../chunk-TIWURSLS.js";
 import "../chunk-66H2QQAK.js";
 import {
@@ -28,10 +28,10 @@ import {
 } from "../chunk-PYCQXCI5.js";
 import {
   getMachineId
-} from "../chunk-UQHUUZ5H.js";
+} from "../chunk-WOLPADR6.js";
 import {
   resolveBinary
-} from "../chunk-DYHXOXUF.js";
+} from "../chunk-6IU45EHE.js";
 import "../chunk-USQDVBEV.js";
 import {
   callMcpTool

package/dist/bin/pushary-codex-hook.js

@@ -13,30 +13,30 @@ import {
   recordCodexCallDecision,
   reportMachineDenial,
   userScope
-} from "../chunk-CQYHOHOK.js";
+} from "../chunk-MDJJW3LP.js";
 import {
   triggerAutoUpdate
-} from "../chunk-OSSDK5RS.js";
+} from "../chunk-MU3WU2FO.js";
 import {
   isGatingMoment,
   recordKeylessMoment
 } from "../chunk-43ZDACBO.js";
 import {
   readHookInput
-} from "../chunk-ORLJNJEO.js";
+} from "../chunk-6QFEQIPM.js";
 import {
   denyReasonFrom,
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
-import "../chunk-NFKVRMTM.js";
+import "../chunk-TZGCUNOX.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-PCGZXWGQ.js";
+import "../chunk-WNJSGZY7.js";
 import "../chunk-TFKBFQCE.js";
 import "../chunk-K3QVDAZW.js";
-import "../chunk-NTQSICPJ.js";
-import "../chunk-7XT76LWT.js";
-import "../chunk-EADZPVYW.js";
-import "../chunk-SOCEY746.js";
+import "../chunk-Z4VGIBJ7.js";
+import "../chunk-X7FESZTD.js";
+import "../chunk-2AUIEZYS.js";
+import "../chunk-5UQ5ATIE.js";
 import "../chunk-TIWURSLS.js";
 import "../chunk-66H2QQAK.js";
 import "../chunk-2QT3GCU4.js";
@@ -76,7 +76,7 @@ import {
   toCodexWire,
   toPolicyLookup,
   toPolicyLookups
-} from "../chunk-FDHMNT24.js";
+} from "../chunk-D573TLP6.js";
 import "../chunk-UYDTFCHW.js";
 import {
   DECISION_STOP_REASON,
@@ -92,10 +92,10 @@ import {
 } from "../chunk-PYCQXCI5.js";
 import {
   getMachineId
-} from "../chunk-UQHUUZ5H.js";
+} from "../chunk-WOLPADR6.js";
 import {
   canonicalJson
-} from "../chunk-DYHXOXUF.js";
+} from "../chunk-6IU45EHE.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-USQDVBEV.js";
 import "../chunk-HETOKNIL.js";
@@ -745,7 +745,7 @@ var decidePreToolUse = async (input) => {
 };
 var repairCodexHoldsQuietly = async () => {
   try {
-    const { repairCodexHolds } = await import("../reapply-D2TFN6XK.js");
+    const { repairCodexHolds } = await import("../reapply-5CZSTJZI.js");
     repairCodexHolds();
   } catch {
     return;

package/dist/bin/pushary-codex.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   reportEvent
-} from "../chunk-FDHMNT24.js";
+} from "../chunk-D573TLP6.js";
 import "../chunk-UYDTFCHW.js";
 import {
   askUser,
@@ -10,8 +10,8 @@ import {
 } from "../chunk-PYCQXCI5.js";
 import {
   getMachineId
-} from "../chunk-UQHUUZ5H.js";
-import "../chunk-DYHXOXUF.js";
+} from "../chunk-WOLPADR6.js";
+import "../chunk-6IU45EHE.js";
 import "../chunk-HETOKNIL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-daemon.js

@@ -1,18 +1,19 @@
 #!/usr/bin/env node
 import {
   inspectConfiguredManagedProviders
-} from "../chunk-PNNBMH4E.js";
-import "../chunk-3NBODGQS.js";
+} from "../chunk-JKBDGZFL.js";
+import "../chunk-HUAOMX4U.js";
+import "../chunk-6EEANS74.js";
 import {
   HEARTBEAT_INTERVAL_MS,
   sendHeartbeat
-} from "../chunk-F57RGL7K.js";
-import "../chunk-J4J45VPZ.js";
+} from "../chunk-IV3RHICU.js";
+import "../chunk-4ERLRNOK.js";
 import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "../chunk-KEOLNHR3.js";
+} from "../chunk-5ZZG76S2.js";
 import {
   SESSION_REAP_SILENCE_MS,
   describeIdleWindow,
@@ -20,15 +21,15 @@ import {
   listProcessProofs,
   ownsLiveProcess,
   silentSpawnedProofs
-} from "../chunk-MYP4UUFH.js";
+} from "../chunk-M2LMXPJZ.js";
 import {
   startRegisteredTranscripts
-} from "../chunk-NFKVRMTM.js";
+} from "../chunk-TZGCUNOX.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-PCGZXWGQ.js";
+import "../chunk-WNJSGZY7.js";
 import "../chunk-TFKBFQCE.js";
 import "../chunk-K3QVDAZW.js";
-import "../chunk-NTQSICPJ.js";
+import "../chunk-Z4VGIBJ7.js";
 import {
   DAEMON_LEASE_RENEW_INTERVAL_MS,
   acquireDaemonLease,
@@ -45,9 +46,9 @@ import {
   requestDaemonHandoff,
   stopDaemonRunning,
   writeDaemonNeedsLogin
-} from "../chunk-7XT76LWT.js";
-import "../chunk-EADZPVYW.js";
-import "../chunk-SOCEY746.js";
+} from "../chunk-X7FESZTD.js";
+import "../chunk-2AUIEZYS.js";
+import "../chunk-5UQ5ATIE.js";
 import "../chunk-TIWURSLS.js";
 import "../chunk-66H2QQAK.js";
 import "../chunk-2QT3GCU4.js";
@@ -57,10 +58,10 @@ import {
 import "../chunk-UYDTFCHW.js";
 import {
   getMachineId
-} from "../chunk-UQHUUZ5H.js";
+} from "../chunk-WOLPADR6.js";
 import {
   resolveBinary
-} from "../chunk-DYHXOXUF.js";
+} from "../chunk-6IU45EHE.js";
 import {
   writeHuman
 } from "../chunk-QCGNGEGE.js";

package/dist/bin/pushary-disconnect.js

@@ -15,21 +15,21 @@ import {
   compatiblePermissionRuleFile,
   removeCompatibleHooks,
   removeCompatibleMcpServer
-} from "../chunk-JF736N4C.js";
+} from "../chunk-R5KY3PBN.js";
 import {
   isClaudeMcpSnapshot,
   removeClaudeMcpServers,
   removePusharySettings,
   removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-J4J45VPZ.js";
+} from "../chunk-4ERLRNOK.js";
 import {
   removeGeminiSettings
-} from "../chunk-EADZPVYW.js";
-import "../chunk-FDHMNT24.js";
+} from "../chunk-2AUIEZYS.js";
+import "../chunk-D573TLP6.js";
 import "../chunk-UYDTFCHW.js";
 import "../chunk-PYCQXCI5.js";
-import "../chunk-UQHUUZ5H.js";
+import "../chunk-WOLPADR6.js";
 import {
   claudeJson,
   claudeMcpReceipt,
@@ -43,7 +43,7 @@ import {
   geminiSettings,
   removeCodexHooks,
   removeCodexSettings
-} from "../chunk-DYHXOXUF.js";
+} from "../chunk-6IU45EHE.js";
 import {
   exitOnHelpFlag
 } from "../chunk-P4BNYJ5Q.js";

package/dist/bin/pushary-doctor.js

@@ -6,10 +6,14 @@ import {
   readServiceExecPath,
   versionManagerOf
 } from "../chunk-GU3EJCVV.js";
+import {
+  assessCodexHookTrust,
+  readCodexTrustForPusharyHooks
+} from "../chunk-6EEANS74.js";
 import {
   readMachineReadiness,
   readManagedControlEvidence
-} from "../chunk-F57RGL7K.js";
+} from "../chunk-IV3RHICU.js";
 import {
   CURSOR_GATE_SCRIPT
 } from "../chunk-P32LPT2L.js";
@@ -22,7 +26,7 @@ import {
   isPluginRegistered,
   shortenHome,
   vscodeSettingsTargets
-} from "../chunk-DLJN5XEU.js";
+} from "../chunk-KHXVTWYS.js";
 import {
   OPENCODE_PLUGIN_PLACEHOLDER,
   openCodePluginDir,
@@ -35,13 +39,13 @@ import {
   compatibleMcpFile,
   hasCompatibleHooks,
   missingCompatibleHookEvents
-} from "../chunk-JF736N4C.js";
-import "../chunk-J4J45VPZ.js";
+} from "../chunk-R5KY3PBN.js";
+import "../chunk-4ERLRNOK.js";
 import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "../chunk-KEOLNHR3.js";
+} from "../chunk-5ZZG76S2.js";
 import {
   AUTO_UPDATE_DISABLE_ENV,
   autoUpdateOffReason,
@@ -49,7 +53,7 @@ import {
   describeAutoUpdateCheck,
   readAutoUpdateState,
   takeAutoUpdateAnnouncement
-} from "../chunk-OSSDK5RS.js";
+} from "../chunk-MU3WU2FO.js";
 import {
   readLedgerSummary
 } from "../chunk-43ZDACBO.js";
@@ -75,7 +79,7 @@ import {
   geminiWired,
   holdsLong,
   pusharyHookExecutable
-} from "../chunk-NTQSICPJ.js";
+} from "../chunk-Z4VGIBJ7.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
@@ -84,19 +88,19 @@ import {
   readDaemonNeedsLogin,
   readDaemonStatus,
   readInstalledDaemonService
-} from "../chunk-7XT76LWT.js";
+} from "../chunk-X7FESZTD.js";
 import {
   GEMINI_HOOK_BINARY,
   hasGeminiHooks,
   missingGeminiHookEvents
-} from "../chunk-EADZPVYW.js";
+} from "../chunk-2AUIEZYS.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-FDHMNT24.js";
+import "../chunk-D573TLP6.js";
 import "../chunk-UYDTFCHW.js";
 import "../chunk-PYCQXCI5.js";
 import {
   getMachineId
-} from "../chunk-UQHUUZ5H.js";
+} from "../chunk-WOLPADR6.js";
 import {
   CODEX_HOOK_EVENTS,
   autoUpdateState,
@@ -121,7 +125,7 @@ import {
   pusharyConfigFile,
   readCodexMcpAuth,
   vscodePluginDir
-} from "../chunk-DYHXOXUF.js";
+} from "../chunk-6IU45EHE.js";
 import {
   describeReach,
   describeRoundTrip,
@@ -201,7 +205,8 @@ var AUTO_UPDATE_OFF = {
   disabled_by_env: `off: ${AUTO_UPDATE_DISABLE_ENV} is set`,
   disabled_by_user: "off: turn it back on with pushary upgrade --auto=on",
   ci: "off in CI",
-  windows: "not available on Windows yet"
+  windows: "not available on Windows yet",
+  linux: "paused on Linux to protect running sessions; upgrade manually after sessions finish"
 };
 var needsAttention = (input) => input.state.lastResult === "failed" || input.state.lastResult === "needs_manual" || Boolean(input.state.detail);
 var LAST_CHECK_LABEL = "Last automatic update check";
@@ -507,6 +512,21 @@ var reportOtherHolders = (agentLabel, holders) => {
   }
   console.log(`    ${dim(describeHoldSentence(agentLabel))}`);
 };
+var describeReadings = (readings) => readings.map((reading) => `${reading.event} ${reading.status}`).join(", ");
+var CODEX_NONE_LISTED = "Codex lists none of the Pushary hooks, so it runs none of them. Check [features].hooks in config.toml, then re-run setup";
+var reportCodexOwnTrust = (assessment) => {
+  if (assessment.kind === "unlisted") {
+    check(false, "Codex: hooks trusted", CODEX_NONE_LISTED);
+    return;
+  }
+  check(assessment.kind === "trusted", "Codex: hooks trusted", assessment.kind === "trusted" ? `Codex reports ${assessment.trusted} of ${assessment.total} trusted` : `Codex reports ${describeReadings(assessment.failures)}. Type /hooks in Codex and trust them, once`);
+  if (assessment.notListed.length > 0) {
+    console.log(`  ${warn} Codex: does not list ${assessment.notListed.join(", ")} ${dim("(this Codex may not support those events yet)")}`);
+  }
+  if (assessment.disabled.length > 0) {
+    console.log(`  ${warn} Codex: ${assessment.disabled.join(", ")} turned off in Codex ${dim("(turn them back on in /hooks)")}`);
+  }
+};
 var skipped = (label, why) => {
   console.log(`  ${dim("\u2013")} ${label} ${dim(`(${why})`)}`);
 };
@@ -722,16 +742,24 @@ var main = async () => {
         console.log(`  ${warn} Codex: stale legacy notify entry ${dim("(double-push risk, re-run setup to remove it)")}`);
       }
       if (hookCommand) {
+        const positions = codexHookPositions(codexHooksConfig);
         const gaps = codexTrustGaps(
           codexParsed,
           codexHooksConfig,
           codexHooksPath,
           hookCommand,
-          codexHookPositions(codexHooksConfig)
+          positions
         );
         const untrusted = gaps.filter((gap) => gap.kind === "untrusted").map((gap) => gap.event);
         const stale = gaps.filter((gap) => gap.kind === "stale").map((gap) => gap.event);
-        check(untrusted.length === 0, "Codex: hooks trusted", untrusted.length === 0 ? "all events trusted" : `untrusted (${untrusted.join(", ")}) \u2014 type /hooks in Codex and trust them, once`);
+        const codexTrust = await readCodexTrustForPusharyHooks();
+        if (codexTrust.kind === "listed") {
+          reportCodexOwnTrust(assessCodexHookTrust(Object.keys(positions), codexTrust.hooks));
+        } else {
+          const why = codexTrust.kind === "skipped" ? "did not ask" : "could not ask";
+          console.log(`  ${warn} Codex: ${why} Codex about hook trust ${dim(`(${codexTrust.reason}); checking Pushary's own record instead`)}`);
+          check(untrusted.length === 0, "Codex: hooks trusted", untrusted.length === 0 ? "all events trusted" : `untrusted (${untrusted.join(", ")}) \u2014 type /hooks in Codex and trust them, once`);
+        }
         if (stale.length > 0) {
           console.log(`  ${warn} Codex: ${stale.join(", ")} trusted at an older shape ${dim("(fires normally; re-run setup to pick up the current one)")}`);
         }

package/dist/bin/pushary-elicitation-hook.js

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 import {
   readHookInput
-} from "../chunk-ORLJNJEO.js";
+} from "../chunk-6QFEQIPM.js";
 import {
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
-import "../chunk-NFKVRMTM.js";
+import "../chunk-TZGCUNOX.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-PCGZXWGQ.js";
+import "../chunk-WNJSGZY7.js";
 import "../chunk-TFKBFQCE.js";
 import "../chunk-K3QVDAZW.js";
-import "../chunk-NTQSICPJ.js";
-import "../chunk-7XT76LWT.js";
-import "../chunk-EADZPVYW.js";
-import "../chunk-SOCEY746.js";
+import "../chunk-Z4VGIBJ7.js";
+import "../chunk-X7FESZTD.js";
+import "../chunk-2AUIEZYS.js";
+import "../chunk-5UQ5ATIE.js";
 import "../chunk-TIWURSLS.js";
 import "../chunk-66H2QQAK.js";
 import "../chunk-2QT3GCU4.js";
@@ -26,8 +26,8 @@ import {
 } from "../chunk-PYCQXCI5.js";
 import {
   getMachineId
-} from "../chunk-UQHUUZ5H.js";
-import "../chunk-DYHXOXUF.js";
+} from "../chunk-WOLPADR6.js";
+import "../chunk-6IU45EHE.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-USQDVBEV.js";
 import "../chunk-HETOKNIL.js";

package/dist/bin/pushary-gemini-bridge.js

@@ -12,7 +12,7 @@ import {
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-MYP4UUFH.js";
+} from "../chunk-M2LMXPJZ.js";
 import "../chunk-TIWURSLS.js";
 import "../chunk-66H2QQAK.js";
 import {
@@ -23,10 +23,10 @@ import {
 } from "../chunk-XHKBHWLX.js";
 import {
   getMachineId
-} from "../chunk-UQHUUZ5H.js";
+} from "../chunk-WOLPADR6.js";
 import {
   resolveBinary
-} from "../chunk-DYHXOXUF.js";
+} from "../chunk-6IU45EHE.js";
 import "../chunk-USQDVBEV.js";
 import "../chunk-HU5LSYL2.js";
 import "../chunk-T7E75EKA.js";