@pushary/agent-hooks 1.9.12 → 1.9.13

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 1.9.13
+
+- `pushary setup` makes Pushary the only gate for Antigravity CLI. When `~/.gemini/antigravity-cli/settings.json` has no `toolPermission`, setup sets it to `always-proceed`, so plain `agy` no longer asks in its own prompt and approvals from your phone take effect. A mode you chose yourself, such as `strict`, is left alone, and setup says agy will still ask in its own prompt.
+- `pushary disconnect antigravity` and `pushary clean` put `toolPermission` back, but only if Pushary set it and only once no Pushary hook is left in `~/.gemini/config/hooks.json`. A value you set or changed is never touched.
+- An Antigravity CLI call that Pushary cannot decide is now blocked with a reason instead of running unasked: when Pushary is signed out, cannot be reached, or cannot establish its policy. Other agents are unchanged and still fall back to their own prompts.
+- If the Pushary CLI is uninstalled while agy is still connected, agy's approval hook blocks each call and says how to undo the setup, instead of exiting silently and letting the call run.
+
+## 1.9.12
+
+- An Antigravity CLI tool call that failed is recorded as failed in the session, where it used to show as completed.
+- `pushary disconnect fx` is recorded in `~/.pushary/declined-agents.json`, so Pushary.app versions that read that file leave fx off until you connect it again.
+
 ## 1.9.11
 
 - `pushary setup` connects Antigravity CLI (`agy`). Pick it in setup or pass `--agents antigravity_cli`. Setup adds a hook named `pushary` to `~/.gemini/config/hooks.json` for `PreToolUse`, `PostToolUse` and `Stop`, and the Pushary MCP server to `~/.gemini/config/mcp_config.json`. Before agy runs a shell command, writes or edits a file, or calls an MCP tool, your policy decides, and the risky ones wait for your answer on your phone or your Mac. Pushary answers agy only with allow or deny: a denial, or no answer before your policy's wait ends, blocks the call with a reason the model sees.

package/data/cursor-plugin/scripts/pushary-gate.mjs

@@ -35,6 +35,10 @@ const unresolved = (verdict) => genericToolHook && verdict?.reason === 'not_gate
   ? ALLOW
   : ask(genericToolHook ? 'Pushary could not reach a verdict for this change. Retry shortly.' : undefined)
 
+const approvalModeWithoutLocalPrompt = (mode) => mode === 'push_first' ? 'push_only' : mode
+const deliveryModeForThisHook = (mode) => genericToolHook ? approvalModeWithoutLocalPrompt(mode) : mode
+const localSurfaceHint = () => genericToolHook ? { localSurfaceAvailable: false } : {}
+
 let activeQuestion
 let done = false
 const respond = (decision) => {
@@ -377,6 +381,7 @@ const askArgs = (request, project, ident) => ({
   ...(request.scopePath ? { scopePath: request.scopePath } : {}),
   ...(request.scopeReason ? { blocker: request.scopeReason } : {}),
   actionBody: deriveActionBody(request.display),
+  ...localSurfaceHint(),
   wait: false,
   waitEndsAt: new Date(Date.now() + MAX_BLOCK_MS).toISOString(),
 })
@@ -694,7 +699,7 @@ setTimeout(async () => {
     Object.assign(request, scopeFromVerdict(verdict))
     const tool = verdict.policy
 
-    switch (tool.mode) {
+    switch (deliveryModeForThisHook(tool.mode)) {
       case 'terminal_only':
         return respond(handBack())
       case 'notify_only':
@@ -713,7 +718,7 @@ setTimeout(async () => {
 
 // Exported for scripts/pushary-gate.test.mjs. main() only runs when the gate is
 // executed directly, so importing this file for a test does not read stdin.
-export { normalizeRepoRemote, deriveRepoKey, describeRequest, handlePushOnly, handlePushFirst, withdraw }
+export { normalizeRepoRemote, deriveRepoKey, describeRequest, handlePushOnly, handlePushFirst, withdraw, approvalModeWithoutLocalPrompt }
 
 const isDirectRun = process.argv[1] && import.meta.url === `file://${process.argv[1]}`
 if (!isDirectRun) {

package/dist/bin/pushary-bell-hook.js

@@ -1,41 +1,41 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-5HPC3RNE.js";
+} from "../chunk-5QTQI3HL.js";
 import {
   readHookInput
-} from "../chunk-5VUB6VVO.js";
-import "../chunk-CXKY5FGY.js";
+} from "../chunk-7VWIBIDK.js";
+import "../chunk-LHLUKFJV.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-2QJ6K2SR.js";
-import "../chunk-PKQ435Z2.js";
-import "../chunk-ZHF4JDVE.js";
-import "../chunk-M2P3HQA3.js";
+import "../chunk-43IDNI4X.js";
+import "../chunk-RI5E5JQS.js";
+import "../chunk-3EOXZYUE.js";
+import "../chunk-G54VGPRX.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-BOHDM4T7.js";
-import "../chunk-SJ7M37RL.js";
-import "../chunk-KXCWWHYO.js";
-import "../chunk-NDZKDJQU.js";
-import "../chunk-JNDELCH5.js";
+import "../chunk-3VSMTCXV.js";
+import "../chunk-226PID65.js";
+import "../chunk-4EAILOOQ.js";
+import "../chunk-6MGD24SH.js";
+import "../chunk-FWAXBC3P.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-3VPS7JPH.js";
-import "../chunk-7U26QSMF.js";
-import "../chunk-JKGTASA2.js";
-import "../chunk-DWHCF4RH.js";
+import "../chunk-S2LDTUHS.js";
+import "../chunk-6NL3LYUM.js";
+import "../chunk-JRKUJOZL.js";
+import "../chunk-JVUK5YFM.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-CATIBZQH.js";
-import "../chunk-CMZ4CW5J.js";
-import "../chunk-WBSL4FBX.js";
-import "../chunk-2NKTEA42.js";
+import "../chunk-LYDO2SS6.js";
+import "../chunk-U6QEHPEF.js";
+import "../chunk-LUYAXSUS.js";
+import "../chunk-43ORAXAL.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-WKP2KRTU.js";
-import "../chunk-AWD2SLNA.js";
+import "../chunk-NPRFA7YM.js";
+import "../chunk-WP57USIT.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-ZC6EVOX6.js";
-import "../chunk-RYBAJXV4.js";
-import "../chunk-QOBOIFGG.js";
+import "../chunk-7JM6TCMA.js";
+import "../chunk-4ATFPZ6X.js";
+import "../chunk-TVDI7SX2.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,37 +5,37 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-5HPC3RNE.js";
+} from "../chunk-5QTQI3HL.js";
 import {
   createIo
 } from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-GTM7C36Y.js";
+} from "../chunk-MWP65CZ3.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-JNDELCH5.js";
+} from "../chunk-FWAXBC3P.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-3VPS7JPH.js";
+import "../chunk-S2LDTUHS.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-WKP2KRTU.js";
+import "../chunk-NPRFA7YM.js";
 import {
   claudeSettings
-} from "../chunk-AWD2SLNA.js";
+} from "../chunk-WP57USIT.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-T7E75EKA.js";
-import "../chunk-ZC6EVOX6.js";
-import "../chunk-RYBAJXV4.js";
-import "../chunk-QOBOIFGG.js";
+import "../chunk-7JM6TCMA.js";
+import "../chunk-4ATFPZ6X.js";
+import "../chunk-TVDI7SX2.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,39 +8,39 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-GP44LTXN.js";
+} from "../chunk-TDSLVFG6.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-CPUEZAE2.js";
+} from "../chunk-GYR4G4WO.js";
 import {
   claudeTranscriptPath,
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-CXKY5FGY.js";
+} from "../chunk-LHLUKFJV.js";
 import "../chunk-SGZJ5LYH.js";
 import {
   ensureDaemonRunning
-} from "../chunk-2QJ6K2SR.js";
+} from "../chunk-43IDNI4X.js";
 import {
   encryptRecord
-} from "../chunk-PKQ435Z2.js";
-import "../chunk-ZHF4JDVE.js";
+} from "../chunk-RI5E5JQS.js";
+import "../chunk-3EOXZYUE.js";
 import {
   transcriptsEnabled
-} from "../chunk-M2P3HQA3.js";
+} from "../chunk-G54VGPRX.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
-import "../chunk-SJ7M37RL.js";
-import "../chunk-KXCWWHYO.js";
-import "../chunk-NDZKDJQU.js";
-import "../chunk-JNDELCH5.js";
+import "../chunk-226PID65.js";
+import "../chunk-4EAILOOQ.js";
+import "../chunk-6MGD24SH.js";
+import "../chunk-FWAXBC3P.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-3VPS7JPH.js";
+import "../chunk-S2LDTUHS.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -58,8 +58,8 @@ import {
   reportEvent,
   savePendingCommand,
   scopePathFor
-} from "../chunk-7U26QSMF.js";
-import "../chunk-JKGTASA2.js";
+} from "../chunk-6NL3LYUM.js";
+import "../chunk-JRKUJOZL.js";
 import {
   askUser,
   cancelQuestion,
@@ -68,35 +68,35 @@ import {
   nextLongPollMs,
   waitForAnswer,
   withdrawQuestion
-} from "../chunk-DWHCF4RH.js";
+} from "../chunk-JVUK5YFM.js";
 import "../chunk-POFBE6ZY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-CATIBZQH.js";
-import "../chunk-CMZ4CW5J.js";
-import "../chunk-WBSL4FBX.js";
+} from "../chunk-LYDO2SS6.js";
+import "../chunk-U6QEHPEF.js";
+import "../chunk-LUYAXSUS.js";
 import {
   getMachineId
-} from "../chunk-2NKTEA42.js";
+} from "../chunk-43ORAXAL.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-WKP2KRTU.js";
-import "../chunk-AWD2SLNA.js";
+import "../chunk-NPRFA7YM.js";
+import "../chunk-WP57USIT.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-ZC6EVOX6.js";
+} from "../chunk-7JM6TCMA.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-RYBAJXV4.js";
+} from "../chunk-4ATFPZ6X.js";
 import {
   DECISION_STOP_REASON,
   KILL_REASON,
   UNVERIFIABLE_APPROVAL_REASON,
   redactSecretsFromContent,
   resolveGate
-} from "../chunk-QOBOIFGG.js";
+} from "../chunk-TVDI7SX2.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {
@@ -531,7 +531,8 @@ var createRemoteApprover = (deps) => {
           machineId: deps.machineId,
           toolName,
           toolTarget,
-          repoKey: repoKeyFor(deps.cwd)
+          repoKey: repoKeyFor(deps.cwd),
+          localSurfaceAvailable: false
         });
       } catch (error) {
         if (!(error instanceof SubscriptionRequiredError)) return deny(UNVERIFIABLE_APPROVAL_REASON);

package/dist/bin/pushary-clean.js

@@ -11,8 +11,9 @@ import {
 } from "../chunk-SB2GN6OP.js";
 import {
   isCursorPluginLeftover,
+  releaseSoleGate,
   withoutPusharyCursorHooks
-} from "../chunk-PMUOEEUE.js";
+} from "../chunk-OOKRWBCG.js";
 import {
   HERMES_PIP_PACKAGE,
   readHermesStatus,
@@ -21,27 +22,27 @@ import {
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-OBGZUD73.js";
+} from "../chunk-N6XFGVNW.js";
 import {
   planFxRemoval,
   removeInstructionBlock
-} from "../chunk-BNQKHPEC.js";
-import "../chunk-LBDMCNQY.js";
+} from "../chunk-QIPDIZC5.js";
+import "../chunk-WL4PVINO.js";
 import {
   disableDaemonService
-} from "../chunk-2QJ6K2SR.js";
+} from "../chunk-43IDNI4X.js";
 import "../chunk-XHKBHWLX.js";
 import {
   APPROVAL_SETTINGS_PATH
-} from "../chunk-4DWQNP52.js";
+} from "../chunk-ZAH3CCEV.js";
 import {
   macAppKeepsMcpEntry,
   mcpServerBearer,
   pusharyKey,
   readMacAppAgentKey,
   setupReceiptKey
-} from "../chunk-TZCHW6KR.js";
-import "../chunk-SQJUXVLW.js";
+} from "../chunk-YI37QERZ.js";
+import "../chunk-UUBEEKT6.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -53,14 +54,14 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-Z6VYZSVA.js";
+} from "../chunk-6QPQG3Q5.js";
 import {
   ansiPainter,
   useColor
 } from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-GTM7C36Y.js";
+} from "../chunk-MWP65CZ3.js";
 import {
   compatibleConfigFile,
   compatibleInstructionsFile,
@@ -73,7 +74,7 @@ import {
   removePusharySettings,
   removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-BOHDM4T7.js";
+} from "../chunk-3VSMTCXV.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
@@ -81,12 +82,12 @@ import {
   resolveBridgeStub,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-SJ7M37RL.js";
+} from "../chunk-226PID65.js";
 import {
   removeGeminiSettings
-} from "../chunk-KXCWWHYO.js";
-import "../chunk-NDZKDJQU.js";
-import "../chunk-JNDELCH5.js";
+} from "../chunk-4EAILOOQ.js";
+import "../chunk-6MGD24SH.js";
+import "../chunk-FWAXBC3P.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
@@ -99,22 +100,22 @@ import {
   readConfigFileKey,
   readMacAppKeyPrefix,
   removeClaudeAlias
-} from "../chunk-3VPS7JPH.js";
-import "../chunk-7U26QSMF.js";
-import "../chunk-JKGTASA2.js";
-import "../chunk-DWHCF4RH.js";
+} from "../chunk-S2LDTUHS.js";
+import "../chunk-6NL3LYUM.js";
+import "../chunk-JRKUJOZL.js";
+import "../chunk-JVUK5YFM.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-CATIBZQH.js";
+import "../chunk-LYDO2SS6.js";
 import {
   absoluteUrl
-} from "../chunk-CMZ4CW5J.js";
-import "../chunk-WBSL4FBX.js";
-import "../chunk-2NKTEA42.js";
+} from "../chunk-U6QEHPEF.js";
+import "../chunk-LUYAXSUS.js";
+import "../chunk-43ORAXAL.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-WKP2KRTU.js";
+import "../chunk-NPRFA7YM.js";
 import {
   claudeJson,
   claudeMcpReceipt,
@@ -151,14 +152,14 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-AWD2SLNA.js";
+} from "../chunk-WP57USIT.js";
 import "../chunk-T7E75EKA.js";
 import {
   getBaseUrl
-} from "../chunk-ZC6EVOX6.js";
+} from "../chunk-7JM6TCMA.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-RYBAJXV4.js";
+} from "../chunk-4ATFPZ6X.js";
 import {
   CLI_PACKAGE_NAMES,
   HOOK_COMPATIBLE_PROFILES,
@@ -170,7 +171,7 @@ import {
   globalRootFor,
   isValidApiKey,
   redactSecrets
-} from "../chunk-QOBOIFGG.js";
+} from "../chunk-TVDI7SX2.js";
 
 // bin/pushary-clean.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync4 } from "fs";
@@ -587,7 +588,13 @@ var cleanCompatibleAgent = (profile, scope, io, home) => {
     io.writeJson(path, config);
     return { path, outcome: "cleaned" };
   });
-  return { profile, files, mcpKeptForApp, instructions: cleanInstructions(profile, scope, io, home) };
+  return {
+    profile,
+    files,
+    mcpKeptForApp,
+    instructions: cleanInstructions(profile, scope, io, home),
+    soleGate: releaseSoleGate(profile, io.soleGateFiles, home)
+  };
 };
 
 // src/cli/clean-key-revocation.ts
@@ -667,6 +674,13 @@ var codexMcpKey = (config) => {
   const auth = readCodexMcpAuth(config);
   return auth?.method === "embedded" ? pusharyKey(auth.key) : null;
 };
+var readText = (path) => {
+  try {
+    return readFileSync4(path, "utf-8");
+  } catch {
+    return null;
+  }
+};
 var readJson = (path) => {
   try {
     return JSON.parse(readFileSync4(path, "utf-8"));
@@ -1128,7 +1142,12 @@ var main = async () => {
     console.log(`  ${skip} Codex skill directory ${dim("(not found)")}`);
   }
   const compatibleScope = { keepAppWiring: keepShared, keepsMcpEntry: macAppKeeps };
-  const compatibleIo = { readJson, writeJson, removeInstructionBlock: guardedInstructionBlockRemoval };
+  const compatibleIo = {
+    readJson,
+    writeJson,
+    removeInstructionBlock: guardedInstructionBlockRemoval,
+    soleGateFiles: { read: readText, write: guardedWrite, remove: (path) => guardedRemove(path, { force: true }) }
+  };
   for (const profile of HOOK_COMPATIBLE_PROFILES) {
     const report = cleanCompatibleAgent(profile, compatibleScope, compatibleIo);
     for (const file of report.files) {
@@ -1138,6 +1157,9 @@ var main = async () => {
       else console.log(`  ${skip} ${label2} ${dim(keepShared ? "(nothing the CLI wrote)" : "(no pushary entries)")}`);
     }
     if (report.mcpKeptForApp) console.log(`  ${skip} ${profile.label} MCP server ${dim("(kept: the Mac app uses it)")}`);
+    if (report.soleGate?.kind === "restored" && profile.soleGate) {
+      console.log(`  ${check} ${profile.label} ${shortenHome(report.soleGate.path)} ${dim(dryRun ? `(would put ${profile.soleGate.key} back)` : `(put ${profile.soleGate.key} back)`)}`);
+    }
     const instructions = report.instructions;
     if (!instructions) continue;
     const label = `${profile.label} ${shortenHome(instructions.path)}`;

package/dist/bin/pushary-codex-bridge.js

@@ -5,10 +5,10 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-DYQ5QIDN.js";
+} from "../chunk-U5SXTKZV.js";
 import {
   resolveProviderBinary
-} from "../chunk-EYLQVCME.js";
+} from "../chunk-HHMMY6TB.js";
 import "../chunk-RIVNNBEK.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
@@ -16,50 +16,50 @@ import {
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-GP44LTXN.js";
-import "../chunk-PKQ435Z2.js";
-import "../chunk-ZHF4JDVE.js";
+} from "../chunk-TDSLVFG6.js";
+import "../chunk-RI5E5JQS.js";
+import "../chunk-3EOXZYUE.js";
 import {
   transcriptsEnabled
-} from "../chunk-M2P3HQA3.js";
+} from "../chunk-G54VGPRX.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-3VPS7JPH.js";
+import "../chunk-S2LDTUHS.js";
 import {
   isAskUserResponse,
   isDecisionStopped,
   isWaitForAnswerResponse,
   withdrawQuestion,
   writeDegraded
-} from "../chunk-DWHCF4RH.js";
+} from "../chunk-JVUK5YFM.js";
 import "../chunk-POFBE6ZY.js";
 import {
   callMcpTool
-} from "../chunk-CATIBZQH.js";
-import "../chunk-CMZ4CW5J.js";
-import "../chunk-WBSL4FBX.js";
+} from "../chunk-LYDO2SS6.js";
+import "../chunk-U6QEHPEF.js";
+import "../chunk-LUYAXSUS.js";
 import {
   getMachineId
-} from "../chunk-2NKTEA42.js";
+} from "../chunk-43ORAXAL.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-WKP2KRTU.js";
-import "../chunk-AWD2SLNA.js";
+import "../chunk-NPRFA7YM.js";
+import "../chunk-WP57USIT.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-ZC6EVOX6.js";
-import "../chunk-RYBAJXV4.js";
+} from "../chunk-7JM6TCMA.js";
+import "../chunk-4ATFPZ6X.js";
 import {
   elicitationContent,
   parseAgentQuestion,
   parseAgentQuestionAnswers,
   planElicitationAsk,
   readElicitationFields
-} from "../chunk-QOBOIFGG.js";
+} from "../chunk-TVDI7SX2.js";
 
 // bin/pushary-codex-bridge.ts
 import { existsSync } from "fs";