@pushary/agent-hooks 1.9.15 → 1.9.17

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 1.9.17
+
+- When Codex is set to never ask for approval (full access), a call Pushary asks about now goes to your phone every time, also while you are at the keyboard, because Codex has no prompt of its own to ask you there. The wait is your policy's timeout, also under When I'm out. If nobody answers, the call is refused with "No response within timeout". Before, the command ran once the wait ended, also a destructive one, and at the keyboard it ran without anyone being asked. A wait cut short by Codex's hook time limit and a question no phone could receive are refused the same way. In Codex's other approval modes nothing changes: the call goes back to Codex, which asks in its own prompt when the call needs it. A rule that approves on timeout still lets the call run after its full wait, and one that denies on timeout still refuses it.
+
+## 1.9.16
+
+- `pushary setup` names the account before it reuses a key: the key saved on this machine, `PUSHARY_API_KEY`, or a key found in your agent settings. At a terminal it asks `Continue as @workspace? (Y/n)`, and No connects a new key the way you asked: the Pushary app on your phone by default, or a browser sign-in with `--connect browser`. Without a terminal it names the account and prints `Wrong account? Run npx pushary@latest setup --connect app`. A key found in your agent settings is called the Pushary for Mac key only when Pushary for Mac is installed. A key on an inactive plan names its account and the same `--connect app` line instead of telling you to re-run setup with the saved key.
+- The pairing screen prints the QR code last, directly above the waiting line, so it no longer scrolls off a 24-row terminal. Above it: what to scan, the short link, the fingerprint in plain words, the app link, and where to get the app. The browser fallback is offered once, after a minute.
+- Stopping setup with SIGTERM while it waits for the phone cancels the pairing, as Ctrl-C already did. An agent whose tool call times out no longer leaves a live QR behind.
+- Setup saves a paired key as soon as the key is checked, before it asks which agents to set up. Stopping at the agent list keeps the key, and the next run does not draw a new QR.
+- When the phone answers the test question, setup ends with `You're set. Your phone answered in 3s.` and one line asking you to restart open agent sessions. The two "Agent hook activation remains unverified" lines are gone. A test nobody answered now shows `! No answer yet` instead of a tick.
+- Setup says `Signed in to @workspace (Agent plan)` instead of `Key verified (workspace · plan agent)`, and names the agents Pushary for Mac handles in plain words.
+- The transcript notice is one line: transcripts sync redacted and encrypted, your phone can decrypt them, authorized Pushary compliance admins can recover them for documented legal obligations, and the command that turns sync off. Transcript sync is still on by default.
+- The two questions after setup wires your agents say plainly what they change: a Pushary section in this folder's `CLAUDE.md` or `AGENTS.md`, and a `claude` alias in your shell profile. Both still default to No.
+- On Windows every printed `npx pushary@latest` command reads `npx.cmd pushary@latest`, which PowerShell runs without the execution policy blocking it.
+- When npm cannot install globally (EACCES or EPERM), setup says to use nvm or set an npm prefix, instead of offering a retry that fails the same way.
+- Setup prints one line before it installs the phone-start background service, with `--control off` to turn it off.
+- When Pushary for Mac is signed into a different account, setup names both accounts and the two ways out: sign Pushary for Mac into this setup's account, or take over the hooks with `--take-over-hooks`.
+- An unreachable phone is pointed at `npx pushary@latest setup --connect app` to pair the Pushary app, not at web push.
+- On an unsupported Node, `pushary` says which releases it needs, which one you have, and where to get Node.js.
+
 ## 1.9.15
 
 - Codex in Every time asks your phone only about the calls that matter. Codex raises its own approval when a command leaves its sandbox, a forced `rm` runs, an MCP tool is not marked read-only, or a patch lands outside the project, and Pushary answers that request in your mode as before. Before a call runs, Pushary now adds a question only when the call leaves the scope you agreed, a rule you wrote, a preset you picked or an approval route covers it, the command destroys, rewrites history or reaches the network, or a patch deletes a file. Commands that only build, test or read no longer reach your phone, and an MCP tool Codex asks about itself is asked once, through Codex's own request. The kill switch and your deny rules still apply to every call.
@@ -30,6 +51,7 @@
 - `rg`, `sort`, `uniq`, `sleep`, `pgrep` and `git branch --show-current` run without asking when they only read. `rg` still asks with an option that runs another program (`--pre`, `--search-zip`, `-z`), `sort` with one that writes a file (`-o`, `--output`), and `uniq` with a second file, which it writes.
 - Codex's `wait_threads` and `send_message_to_thread` run without asking, matched by exact name. The kill switch, a deny rule and a rule you wrote for the tool still win over them.
 - A deny rule now blocks read-only commands too. A bare `Bash` deny, a `*` deny or a preset that never runs the shell used to let `ls` and other reads through.
+
 ## 1.9.11
 
 - `pushary setup` connects Antigravity CLI (`agy`). Pick it in setup or pass `--agents antigravity_cli`. Setup adds a hook named `pushary` to `~/.gemini/config/hooks.json` for `PreToolUse`, `PostToolUse` and `Stop`, and the Pushary MCP server to `~/.gemini/config/mcp_config.json`. Before agy runs a shell command, writes or edits a file, or calls an MCP tool, your policy decides, and the risky ones wait for your answer on your phone or your Mac. Pushary answers agy only with allow or deny: a denial, or no answer before your policy's wait ends, blocks the call with a reason the model sees.

package/dist/bin/pushary-bell-hook.js

@@ -1,41 +1,41 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-Q4JD6WNB.js";
+} from "../chunk-5DVWWQ7H.js";
 import {
   readHookInput
-} from "../chunk-JEJSAI6Z.js";
-import "../chunk-WBQK6KD5.js";
+} from "../chunk-5SHOKE4K.js";
+import "../chunk-XTVOEEZ5.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-TFV6RATK.js";
-import "../chunk-QIOWXUFH.js";
-import "../chunk-3YCYTGGK.js";
-import "../chunk-HSVJ62BE.js";
+import "../chunk-35USDKDL.js";
+import "../chunk-QWO5UBVP.js";
+import "../chunk-IJOITMKQ.js";
+import "../chunk-D45B4GNL.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-ME55HQOI.js";
-import "../chunk-FZW7Q7GM.js";
-import "../chunk-VP6WDFVO.js";
-import "../chunk-YKYFFCB5.js";
-import "../chunk-7VOEZPJ4.js";
+import "../chunk-73NUMFZG.js";
+import "../chunk-VZA4GGXL.js";
+import "../chunk-E755IUIH.js";
+import "../chunk-MRMXB6Z6.js";
+import "../chunk-D2ZPTCAL.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-5EWNGYFD.js";
-import "../chunk-IQCNOEQL.js";
-import "../chunk-52JA2WTH.js";
-import "../chunk-YL6HU2KF.js";
+import "../chunk-TEWUZ3MT.js";
+import "../chunk-AEWPTGG2.js";
+import "../chunk-UJTQCOYP.js";
+import "../chunk-Z4M66PI6.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-SYLJL63X.js";
-import "../chunk-PSWFYNOX.js";
-import "../chunk-3FQCZSEQ.js";
-import "../chunk-NA5D62OI.js";
+import "../chunk-CUW5CPJJ.js";
+import "../chunk-Z7LEZQSY.js";
+import "../chunk-KWMZDPUJ.js";
+import "../chunk-YCBXYOPI.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-VKTDXQGH.js";
-import "../chunk-HJL5RBOU.js";
+import "../chunk-UNO3UEDW.js";
+import "../chunk-GFW4NSYW.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-HTO2XULO.js";
-import "../chunk-PNUWMEIY.js";
-import "../chunk-AYV2NRYJ.js";
+import "../chunk-KRSBK5BE.js";
+import "../chunk-YVDFJ6VV.js";
+import "../chunk-OG5HVCVG.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,37 +5,37 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-Q4JD6WNB.js";
+} from "../chunk-5DVWWQ7H.js";
 import {
   createIo
-} from "../chunk-U4TMAANR.js";
+} from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-C2OUUGCW.js";
+} from "../chunk-TY2OTJFK.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-7VOEZPJ4.js";
+} from "../chunk-D2ZPTCAL.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-5EWNGYFD.js";
+import "../chunk-TEWUZ3MT.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-VKTDXQGH.js";
+import "../chunk-UNO3UEDW.js";
 import {
   claudeSettings
-} from "../chunk-HJL5RBOU.js";
+} from "../chunk-GFW4NSYW.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-T7E75EKA.js";
-import "../chunk-HTO2XULO.js";
-import "../chunk-PNUWMEIY.js";
-import "../chunk-AYV2NRYJ.js";
+import "../chunk-KRSBK5BE.js";
+import "../chunk-YVDFJ6VV.js";
+import "../chunk-OG5HVCVG.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,39 +8,39 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-5LQ7QUVF.js";
+} from "../chunk-AVNOQUNA.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-6GRUERVL.js";
+} from "../chunk-YJCNFRKV.js";
 import {
   claudeTranscriptPath,
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-WBQK6KD5.js";
+} from "../chunk-XTVOEEZ5.js";
 import "../chunk-SGZJ5LYH.js";
 import {
   ensureDaemonRunning
-} from "../chunk-TFV6RATK.js";
+} from "../chunk-35USDKDL.js";
 import {
   encryptRecord
-} from "../chunk-QIOWXUFH.js";
-import "../chunk-3YCYTGGK.js";
+} from "../chunk-QWO5UBVP.js";
+import "../chunk-IJOITMKQ.js";
 import {
   transcriptsEnabled
-} from "../chunk-HSVJ62BE.js";
+} from "../chunk-D45B4GNL.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
-import "../chunk-FZW7Q7GM.js";
-import "../chunk-VP6WDFVO.js";
-import "../chunk-YKYFFCB5.js";
-import "../chunk-7VOEZPJ4.js";
+import "../chunk-VZA4GGXL.js";
+import "../chunk-E755IUIH.js";
+import "../chunk-MRMXB6Z6.js";
+import "../chunk-D2ZPTCAL.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-5EWNGYFD.js";
+import "../chunk-TEWUZ3MT.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -58,8 +58,8 @@ import {
   reportEvent,
   savePendingCommand,
   scopePathFor
-} from "../chunk-IQCNOEQL.js";
-import "../chunk-52JA2WTH.js";
+} from "../chunk-AEWPTGG2.js";
+import "../chunk-UJTQCOYP.js";
 import {
   askUser,
   cancelQuestion,
@@ -68,35 +68,35 @@ import {
   nextLongPollMs,
   waitForAnswer,
   withdrawQuestion
-} from "../chunk-YL6HU2KF.js";
+} from "../chunk-Z4M66PI6.js";
 import "../chunk-POFBE6ZY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-SYLJL63X.js";
-import "../chunk-PSWFYNOX.js";
-import "../chunk-3FQCZSEQ.js";
+} from "../chunk-CUW5CPJJ.js";
+import "../chunk-Z7LEZQSY.js";
+import "../chunk-KWMZDPUJ.js";
 import {
   getMachineId
-} from "../chunk-NA5D62OI.js";
+} from "../chunk-YCBXYOPI.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-VKTDXQGH.js";
-import "../chunk-HJL5RBOU.js";
+import "../chunk-UNO3UEDW.js";
+import "../chunk-GFW4NSYW.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-HTO2XULO.js";
+} from "../chunk-KRSBK5BE.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-PNUWMEIY.js";
+} from "../chunk-YVDFJ6VV.js";
 import {
   DECISION_STOP_REASON,
   KILL_REASON,
   UNVERIFIABLE_APPROVAL_REASON,
   redactSecretsFromContent,
   resolveGate
-} from "../chunk-AYV2NRYJ.js";
+} from "../chunk-OG5HVCVG.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {

package/dist/bin/pushary-clean.js

@@ -13,7 +13,7 @@ import {
   isCursorPluginLeftover,
   releaseSoleGate,
   withoutPusharyCursorHooks
-} from "../chunk-H5YC7H6V.js";
+} from "../chunk-GYLRXSZW.js";
 import {
   HERMES_PIP_PACKAGE,
   readHermesStatus,
@@ -22,27 +22,27 @@ import {
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-ZMUDVPOT.js";
+} from "../chunk-CSKEQDLX.js";
 import {
   planFxRemoval,
   removeInstructionBlock
-} from "../chunk-NDZBDXU3.js";
-import "../chunk-D72OJS4S.js";
+} from "../chunk-DCPJNJN3.js";
+import "../chunk-PMKC4ZYP.js";
 import {
   disableDaemonService
-} from "../chunk-TFV6RATK.js";
+} from "../chunk-35USDKDL.js";
 import "../chunk-XHKBHWLX.js";
 import {
   APPROVAL_SETTINGS_PATH
-} from "../chunk-WJO7SENK.js";
+} from "../chunk-2V4NKFHD.js";
 import {
   macAppKeepsMcpEntry,
   mcpServerBearer,
   pusharyKey,
   readMacAppAgentKey,
   setupReceiptKey
-} from "../chunk-6WECKO24.js";
-import "../chunk-3QXCTYMG.js";
+} from "../chunk-PILHK3P5.js";
+import "../chunk-B4WI4UOX.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -54,14 +54,14 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-NDKFHLJI.js";
+} from "../chunk-P76XTT2Y.js";
 import {
   ansiPainter,
   useColor
-} from "../chunk-U4TMAANR.js";
+} from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-C2OUUGCW.js";
+} from "../chunk-TY2OTJFK.js";
 import {
   compatibleConfigFile,
   compatibleInstructionsFile,
@@ -74,7 +74,7 @@ import {
   removePusharySettings,
   removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-ME55HQOI.js";
+} from "../chunk-73NUMFZG.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
@@ -82,12 +82,12 @@ import {
   resolveBridgeStub,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-FZW7Q7GM.js";
+} from "../chunk-VZA4GGXL.js";
 import {
   removeGeminiSettings
-} from "../chunk-VP6WDFVO.js";
-import "../chunk-YKYFFCB5.js";
-import "../chunk-7VOEZPJ4.js";
+} from "../chunk-E755IUIH.js";
+import "../chunk-MRMXB6Z6.js";
+import "../chunk-D2ZPTCAL.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
@@ -100,22 +100,22 @@ import {
   readConfigFileKey,
   readMacAppKeyPrefix,
   removeClaudeAlias
-} from "../chunk-5EWNGYFD.js";
-import "../chunk-IQCNOEQL.js";
-import "../chunk-52JA2WTH.js";
-import "../chunk-YL6HU2KF.js";
+} from "../chunk-TEWUZ3MT.js";
+import "../chunk-AEWPTGG2.js";
+import "../chunk-UJTQCOYP.js";
+import "../chunk-Z4M66PI6.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-SYLJL63X.js";
+import "../chunk-CUW5CPJJ.js";
 import {
   absoluteUrl
-} from "../chunk-PSWFYNOX.js";
-import "../chunk-3FQCZSEQ.js";
-import "../chunk-NA5D62OI.js";
+} from "../chunk-Z7LEZQSY.js";
+import "../chunk-KWMZDPUJ.js";
+import "../chunk-YCBXYOPI.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-VKTDXQGH.js";
+import "../chunk-UNO3UEDW.js";
 import {
   claudeJson,
   claudeMcpReceipt,
@@ -152,14 +152,14 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-HJL5RBOU.js";
+} from "../chunk-GFW4NSYW.js";
 import "../chunk-T7E75EKA.js";
 import {
   getBaseUrl
-} from "../chunk-HTO2XULO.js";
+} from "../chunk-KRSBK5BE.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-PNUWMEIY.js";
+} from "../chunk-YVDFJ6VV.js";
 import {
   CLI_PACKAGE_NAMES,
   HOOK_COMPATIBLE_PROFILES,
@@ -171,7 +171,7 @@ import {
   globalRootFor,
   isValidApiKey,
   redactSecrets
-} from "../chunk-AYV2NRYJ.js";
+} from "../chunk-OG5HVCVG.js";
 
 // bin/pushary-clean.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync4 } from "fs";

package/dist/bin/pushary-codex-bridge.js

@@ -5,10 +5,10 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-Y6KG5JZP.js";
+} from "../chunk-SRK4O45T.js";
 import {
   resolveProviderBinary
-} from "../chunk-JC3AGMOP.js";
+} from "../chunk-5Y4PJEBJ.js";
 import "../chunk-RIVNNBEK.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
@@ -16,50 +16,50 @@ import {
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-5LQ7QUVF.js";
-import "../chunk-QIOWXUFH.js";
-import "../chunk-3YCYTGGK.js";
+} from "../chunk-AVNOQUNA.js";
+import "../chunk-QWO5UBVP.js";
+import "../chunk-IJOITMKQ.js";
 import {
   transcriptsEnabled
-} from "../chunk-HSVJ62BE.js";
+} from "../chunk-D45B4GNL.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-5EWNGYFD.js";
+import "../chunk-TEWUZ3MT.js";
 import {
   isAskUserResponse,
   isDecisionStopped,
   isWaitForAnswerResponse,
   withdrawQuestion,
   writeDegraded
-} from "../chunk-YL6HU2KF.js";
+} from "../chunk-Z4M66PI6.js";
 import "../chunk-POFBE6ZY.js";
 import {
   callMcpTool
-} from "../chunk-SYLJL63X.js";
-import "../chunk-PSWFYNOX.js";
-import "../chunk-3FQCZSEQ.js";
+} from "../chunk-CUW5CPJJ.js";
+import "../chunk-Z7LEZQSY.js";
+import "../chunk-KWMZDPUJ.js";
 import {
   getMachineId
-} from "../chunk-NA5D62OI.js";
+} from "../chunk-YCBXYOPI.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-VKTDXQGH.js";
-import "../chunk-HJL5RBOU.js";
+import "../chunk-UNO3UEDW.js";
+import "../chunk-GFW4NSYW.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-HTO2XULO.js";
-import "../chunk-PNUWMEIY.js";
+} from "../chunk-KRSBK5BE.js";
+import "../chunk-YVDFJ6VV.js";
 import {
   elicitationContent,
   parseAgentQuestion,
   parseAgentQuestionAnswers,
   planElicitationAsk,
   readElicitationFields
-} from "../chunk-AYV2NRYJ.js";
+} from "../chunk-OG5HVCVG.js";
 
 // bin/pushary-codex-bridge.ts
 import { existsSync } from "fs";