@pushary/agent-hooks 1.9.18 → 1.9.19

package/CHANGELOG.md

@@ -1,12 +1,27 @@
 # Changelog
 
+## 1.9.19
+
+- When nobody has answered the last 3 approvals in one agent session, Pushary stops sending that session's approvals to your phone. Each further call ends at once, exactly as it would have if nobody had answered it for the whole wait: under When I'm out Claude Code asks in its own prompt, a rule that refuses on timeout refuses it, a rule that approves on timeout runs it at once with nobody asked, and Codex set to never ask for approval refuses it. Nothing is sent, and the paused approval does not appear on your phone or in the Mac app. A command that deletes, rewrites history or reaches the network, such as `git push`, `rm` or `dropdb`, and any call Pushary flags as destructive, is still sent to your phone.
+- Approvals go back to your phone as soon as you answer any approval in that session, send it a new prompt, or approve at your agent's own prompt a call Pushary handed there. That last one works for Claude Code and for Codex calls checked before they run, whose completion Pushary sees.
+- An approval counts as unanswered only once its wait has ended with nobody answering, so several approvals open at the same time never pause the next one. Approvals you may have answered at your terminal without Pushary seeing it, in Gemini CLI, OpenCode, Cursor's shell and MCP approvals and Codex's own approval prompt, never count, so those sessions are never paused.
+- Earlier CLI versions are paused only for Claude Code, and only where the call would have ended in Claude Code's prompt anyway. In a session started from your phone, CLI 1.9.6 to 1.9.12 refuse a paused call with their message that the remote session has no local approval UI. The Pushary Mac app keeps sending every approval to your phone for now.
+
 ## 1.9.18
 
-- `pushary disconnect cursor` preserves the plugin when its registered hooks cannot be read, so a fail-closed hook never points to a deleted gate.
+_Notes corrected on October 4, 2026. The first version described only the Cursor case and left out the setup and skill text changes._
+
+- `pushary disconnect` leaves a config file it cannot read exactly as it is and lists it as untouched, for every agent. For Cursor it also keeps the plugin folder when the hooks file that points into it cannot be read, so Cursor's gate never points at a script that was deleted.
+- After setup, the line on how to test reads "Run a command that needs approval. Away from this computer, it reaches your phone." The bundled Pushary skill now says When I'm out waits 10 seconds for your phone by default, not 45.
 
 ## 1.9.17
 
-- When Codex is set to never ask for approval (full access), a call Pushary asks about now goes to your phone every time, also while you are at the keyboard, because Codex has no prompt of its own to ask you there. The wait is your policy's timeout, also under When I'm out. If nobody answers, the call is refused with "No response within timeout". Before, the command ran once the wait ended, also a destructive one, and at the keyboard it ran without anyone being asked. A wait cut short by Codex's hook time limit and a question no phone could receive are refused the same way. In Codex's other approval modes nothing changes: the call goes back to Codex, which asks in its own prompt when the call needs it. A rule that approves on timeout still lets the call run after its full wait, and one that denies on timeout still refuses it.
+_Notes corrected on October 4, 2026. The first version said a rule that approves on timeout lets the call run under When I'm out. It does not: the call is refused._
+
+- When Codex runs with its approval policy set to never (full access), every call Pushary asks about goes to your phone, also while you are at the keyboard. Codex has no prompt of its own to ask you there. The wait is your policy's timeout, also under When I'm out.
+- If nobody answers, the call is refused with "No response within timeout". Before, the command ran once the wait ended, a destructive one too, and at the keyboard it ran without anyone being asked. A wait cut short by Codex's hook time limit, and a question no phone could receive, are refused the same way.
+- In Every time, a rule's timeout action still applies after its full wait: approve on timeout lets the call run, and deny on timeout refuses it. Under When I'm out, an unanswered call is refused whatever the rule's timeout action says.
+- In Codex's other approval modes nothing changes. The call goes back to Codex, which asks in its own prompt when the call needs it.
 
 ## 1.9.16
 
@@ -27,14 +42,17 @@
 
 ## 1.9.15
 
+_Notes corrected on October 4, 2026. "Allow for this session" for an MCP tool also reaches Claude Code questions; the first version said Codex only._
+
 - Codex in Every time asks your phone only about the calls that matter. Codex raises its own approval when a command leaves its sandbox, a forced `rm` runs, an MCP tool is not marked read-only, or a patch lands outside the project, and Pushary answers that request in your mode as before. Before a call runs, Pushary now adds a question only when the call leaves the scope you agreed, a rule you wrote, a preset you picked or an approval route covers it, the command destroys, rewrites history or reaches the network, or a patch deletes a file. Commands that only build, test or read no longer reach your phone, and an MCP tool Codex asks about itself is asked once, through Codex's own request. The kill switch and your deny rules still apply to every call.
-- In full access, where Codex asks nothing itself, every call your policy gates still comes to your phone, as before.
+- In Every time with full access, where Codex asks nothing itself, every call your policy gates still comes to your phone, as before.
 - When I'm out is unchanged for Codex, except for scope: Codex's own approval requests go to your phone first, and nothing else is asked before a call runs.
 - A Codex edit outside the scope you agreed is now asked in Every time and When I'm out, also while you are at the keyboard, because Codex has no prompt for it there. Yes lets it run. No refuses it. No answer before your policy's wait ends refuses it with the path named. In Updates and Terminal, where nobody would be asked, it is refused. A patch that leaves the scope across several files is refused with a request to split it into single-file edits, as with Claude Code. Before this release Codex applied these edits without asking.
 - In Updates, Pushary sends an update before a Codex call only for the calls above. Codex's own approval requests still send one each.
 - A patch whose `*** Delete File:` or `*** Update File:` header is indented, which Codex applies, is now read as the delete or edit it is, so your path rules and the delete question apply to it.
 - A command that deletes through a cloud CLI subcommand spelled as one word, such as `aws dynamodb delete-table`, `aws ec2 terminate-instances`, `heroku apps:destroy` or `firebase firestore:delete`, now counts as destructive for every agent. Pushary asks about it instead of leaving it to the agent's own allowlist, and an "allow Bash for this session" grant does not cover it.
-- Codex questions can offer "Allow for this session": for Bash, where risky commands still ask, and, after three approvals in a row, for one exact MCP tool. It is never offered for Pushary's own tools or for a tool whose name says it runs code, sends, merges, publishes, deploys, writes, deletes or moves money.
+- Codex questions can offer "Allow for this session" for Bash, where risky commands still ask, as Claude Code questions already did.
+- After three approvals in a row for one exact MCP tool, the question can offer "Allow for this session" for that tool, in Claude Code and in Codex. It is never offered for Pushary's own tools or for a tool whose name says it runs code, sends, merges, publishes, deploys, writes, deletes or moves money.
 
 ## 1.9.14
 
@@ -42,17 +60,22 @@
 
 ## 1.9.13
 
-- `pushary setup` makes Pushary the only gate for Antigravity CLI. When `~/.gemini/antigravity-cli/settings.json` has no `toolPermission`, setup sets it to `always-proceed`, so plain `agy` no longer asks in its own prompt and approvals from your phone take effect. A mode you chose yourself, such as `strict`, is left alone, and setup says agy will still ask in its own prompt.
+_Notes corrected on October 4, 2026. The last two bullets, the setup receipt and the Windows exception were missing when 1.9.13 shipped._
+
+- `pushary setup` makes Pushary the only gate for Antigravity CLI. When `~/.gemini/antigravity-cli/settings.json` has no `toolPermission`, setup sets it to `always-proceed`, so plain `agy` no longer asks in its own prompt and approvals from your phone take effect. A mode you chose yourself, such as `strict`, is left alone, and setup says agy will still ask in its own prompt. Setup records the change in `~/.pushary/setup/antigravity-tool-permission.json`.
 - `pushary disconnect antigravity` and `pushary clean` put `toolPermission` back, but only if Pushary set it and only once no Pushary hook is left in `~/.gemini/config/hooks.json`. A value you set or changed is never touched.
 - An Antigravity CLI call that Pushary cannot decide is now blocked with a reason instead of running unasked: when Pushary is signed out, cannot be reached, or cannot establish its policy. Other agents are unchanged and still fall back to their own prompts.
-- If the Pushary CLI is uninstalled while agy is still connected, agy's approval hook blocks each call and says how to undo the setup, instead of exiting silently and letting the call run.
+- If the Pushary CLI is uninstalled while agy is still connected, agy's approval hook blocks each call and says how to undo the setup, instead of exiting silently and letting the call run. On Windows the hook still exits silently in that case, and agy runs the call.
+- A session started from your phone asks your phone every time under When I'm out, also when this computer looks attended, and waits for your policy's timeout. Before, when another session had prompted in the last five minutes or Pushary for Mac was attended, the phone was skipped and the call was denied with "no local approval UI". Nobody was asked.
+- The Cursor plugin setup installs asks your phone about every file change under When I'm out, also while you are at the keyboard, and waits for your policy's timeout. Before, the edit was denied with "Switch to Every time" and nobody was asked, or it was denied after the 10 second push window when you were away. Shell commands and MCP calls in Cursor keep When I'm out as it was, because Cursor can prompt for those itself.
 
 ## 1.9.12
 
-- An Antigravity CLI tool call that failed is recorded as failed in the session, where it used to show as completed.
-- `pushary disconnect fx` is recorded in `~/.pushary/declined-agents.json`, so Pushary.app versions that read that file leave fx off until you connect it again.
+_Notes corrected on October 4, 2026. 1.9.12 shipped with no notes. The bullets below were added in the 1.9.13 and 1.9.15 packages, and the error text and the refused options in full were added on October 4._
 
-- `rg`, `sort`, `uniq`, `sleep`, `pgrep` and `git branch --show-current` run without asking when they only read. `rg` still asks with an option that runs another program (`--pre`, `--search-zip`, `-z`), `sort` with one that writes a file (`-o`, `--output`), and `uniq` with a second file, which it writes.
+- An Antigravity CLI tool call that failed is recorded as failed in the session, where it used to show as completed. The session now shows the call's error message: up to its first 500 characters, with secrets redacted, as for other agents.
+- `pushary disconnect fx` is recorded in `~/.pushary/declined-agents.json`, so Pushary for Mac versions that read that file leave fx off until you connect it again.
+- `rg`, `sort`, `uniq`, `sleep`, `pgrep` and `git branch --show-current` run without asking when they only read. This applies to every agent. `rg` still asks with an option that runs another program (`--pre`, `--pre-glob`, `--hostname-bin`, `--search-zip`, `-z`). `sort` still asks with an option that writes a file or runs a program (`-o`, `--output`, `-T`, `--temporary-directory`, `--compress-program`). `uniq` still asks with a second file, which it writes.
 - Codex's `wait_threads` and `send_message_to_thread` run without asking, matched by exact name. The kill switch, a deny rule and a rule you wrote for the tool still win over them.
 - A deny rule now blocks read-only commands too. A bare `Bash` deny, a `*` deny or a preset that never runs the shell used to let `ls` and other reads through.
 
@@ -66,25 +89,30 @@
 
 ## 1.9.10
 
-- `pushary setup` no longer reports Qwen Code, CodeBuddy, Qoder, Droid and Devin as an account mismatch when the Pushary Mac app connected them and the CLI's key is in the same account. Setup compares the account of the key in their MCP entry for Qwen Code, CodeBuddy and Qoder, and the account of the Mac app's own key for Droid and Devin, whose hooks run through the app. They are kept and listed as kept for the Mac app. If the app is in a different account, setup reports it and changes nothing. The CLI does not copy or save the app's key.
-- `pushary doctor` no longer fails "Global package installed" on a computer the Pushary Mac app connects, for example when run with npx. The app runs the hooks there, so doctor prints that the global package is not installed and not needed. It still fails when the CLI has its own key or owns any agent's hooks, because those hooks run the global package.
+- `pushary setup` no longer reports Qwen Code, CodeBuddy, Qoder, Droid and Devin as an account mismatch when Pushary for Mac connected them and the CLI's key is in the same account. Setup compares the account of the key in their MCP entry for Qwen Code, CodeBuddy and Qoder, and the account of the Mac app's own key for Droid and Devin, whose hooks run through the app. They are kept and listed as kept for the Mac app. If the app is in a different account, setup reports it and changes nothing. The CLI does not copy or save the app's key.
+- `pushary doctor` no longer fails "Global package installed" on a computer Pushary for Mac connects, for example when run with npx. The app runs the hooks there, so doctor prints that the global package is not installed and not needed. It still fails when the CLI has its own key or owns any agent's hooks, because those hooks run the global package.
 - `pushary clean --everything` revokes the keys the CLI wrote on pushary.com before removing them: the key in `~/.pushary/config.json`, and a different key in the `export PUSHARY_API_KEY=...` line setup writes to your shell profile. It says whether each key was revoked. A key that is only in the `PUSHARY_API_KEY` environment variable is left alone and named, because Pushary did not write it and it may be a server key you use elsewhere. If pushary.com cannot be reached, the clean still finishes and tells you where to revoke the key. `--dry-run` revokes nothing and lists the keys it would revoke. The Mac app's key is never revoked, and a plain `clean`, `disconnect` and `sign-out` without `--revoke` behave as before.
-- `pushary setup --take-over-hooks` takes over Droid's hooks from the Pushary Mac app. It used to fail with "no Mac app wiring was found", because Droid keeps its hooks at the top of `~/.factory/hooks.json`.
+- `pushary setup --take-over-hooks` takes over Droid's hooks from Pushary for Mac. It used to fail with "no Mac app wiring was found", because Droid keeps its hooks at the top of `~/.factory/hooks.json`.
 
 ## 1.9.9
 
 - The VS Code hooks setup writes now run the gate through the same shell guard as every other agent. Before, a missing Node or a deleted plugin folder made the VS Code hooks fail on every tool call; now they stay silent and VS Code carries on as if Pushary were not installed. Run setup again for VS Code to get the guarded hooks.
-- `pushary doctor`, `pushary status` and `pushary pair` recognise a computer the Pushary Mac app connects when the CLI has no key of its own. Doctor and status say the computer is connected through the Pushary Mac app instead of reporting a missing key, and pair tells you to pair a phone from the app's Settings > Phone. The CLI does not use, copy or save the app's key.
+- `pushary doctor`, `pushary status` and `pushary pair` recognise a computer Pushary for Mac connects when the CLI has no key of its own. Doctor and status say the computer is connected through Pushary for Mac instead of reporting a missing key, and pair tells you to pair a phone from the app's Settings > Phone. The CLI does not use, copy or save the app's key.
 - A default `pushary setup` turns on phone-start when `~/.pushary/config.json` exists but has no `controlMode`, as `pushary login` and the Mac app's Hermes connection leave it. Before, setup skipped phone-start on those machines. `--control off`, or a saved `controlMode` of `off`, still keeps it off, and upgrades still never add the background service on their own.
-- `pushary setup` keeps an OpenCode plugin the Pushary Mac app installed, as it already did for the other agents, and lists it as kept. It used to overwrite the app's plugin, MCP key and instructions. Pass `--take-over-hooks` if you want the CLI to own it. If the app is signed into a different account, setup reports that for OpenCode and changes nothing.
+- `pushary setup` keeps an OpenCode plugin Pushary for Mac installed, as it already did for the other agents, and lists it as kept. It used to overwrite the app's plugin, MCP key and instructions. Pass `--take-over-hooks` if you want the CLI to own it. If the app is signed into a different account, setup reports that for OpenCode and changes nothing.
 
 ## 1.9.8
 
-- `pushary upgrade` and automatic updates no longer take over agents the Pushary Mac app connected. They used to replace the app's hooks with the CLI's and overwrite its MCP key for Claude Code, Codex, Gemini CLI, VS Code and OpenCode. An agent the app owns is now left exactly as the app wrote it and listed as kept for the Mac app, using the same rule setup uses. Pass `--take-over-hooks` to setup if you want the CLI to own it.
+_Notes corrected on October 4, 2026. The first three bullets were missing when 1.9.8 shipped._
+
+- Phone pairing is now `pushary pair` and signing out is `pushary sign-out`. `pushary connect` and `pushary logout` still work as aliases, with the same flags. Setup, status, doctor and `pushary bell` say "pair a phone".
+- `pushary disconnect fx` removes what setup added for fx: the Pushary server in `~/.fx/mcp.json`, the permission rules setup recorded, that record, and the Pushary block in `AGENTS.md`. Your own entries are left alone. With nothing connected it says fx was not connected and changes nothing.
+- `pushary mode` accepts `updates-only` and `updates_only` for Updates (`notify_only`). Setup and disconnect accept both agent id forms, such as `claude_code` or `claude`, and reject an unknown id with the list of valid ones.
+- `pushary upgrade` and automatic updates no longer take over agents Pushary for Mac connected. They used to replace the app's hooks with the CLI's and overwrite its MCP key for Claude Code, Codex, Gemini CLI, VS Code and OpenCode. An agent the app owns is now left exactly as the app wrote it and listed as kept for the Mac app, using the same rule setup uses. Pass `--take-over-hooks` to setup if you want the CLI to own it.
 - `pushary clean` keeps the Mac app's wiring for Qwen Code, CodeBuddy, Qoder, Droid and Devin while the app is installed, as it already did for the other agents. `clean --everything` still removes it.
 - `pushary disconnect cursor` removes the Cursor plugin setup installed in `~/.cursor/plugins/local/pushary`, including the `mcp.json` that held your API key, and setup's leftover copies of it. The plugin is kept, and the output says so, when the gate in `~/.cursor/hooks.json` that points into it could not be removed.
 - `pushary disconnect` removes the Pushary block it wrote to `AGENTS.md` (Codex, OpenCode), `GEMINI.md`, `QWEN.md` and `CODEBUDDY.md`. Only the text between the Pushary markers is removed. Skills are left in place.
-- `pushary disconnect <agent>` is no longer undone by the Mac app. It records the agent in `~/.pushary/declined-agents.json`, and Pushary.app versions that read that file leave the agent off until you connect it again from the app or with `pushary setup`.
+- `pushary disconnect <agent>` is no longer undone by the Mac app. It records the agent in `~/.pushary/declined-agents.json`, and Pushary for Mac versions that read that file leave the agent off until you connect it again from the app or with `pushary setup`.
 - `pushary mode`, `mode clear`, `wait <seconds>` and `suggestions` no longer say "This key was rejected" when the key is fine. Keys from `pushary login`, phone pairing and the Mac app cannot change approval settings, and these commands now say so, point you to the Pushary app, your phone or the dashboard, and exit with code 2.
 - `pushary sign-out --revoke` revokes those keys too, and then checks with pushary.com and tells you whether the key still works. Before, it could not revoke them and always said the key was still valid. `--json` adds `keyStillValid`.
 - When the Mac app signs out of the key setup borrowed from it, the background service stops once instead of restarting every 10 seconds, and `pushary doctor`, `pushary status` and commands that report a rejected key say the key was signed out on this Mac, tell you to run `pushary login`, and name the shell profile line that still exports the old key. Pushary does not edit that line. A background service with no key at all also stops instead of restarting.
@@ -95,7 +123,7 @@
 - An automatic update whose configuration refresh fails now retries after 5 minutes, then after an hour, then once a day, instead of every 5 minutes. On a Mac with phone-start on, each retry restarted the background service.
 - A refresh that cannot succeed until you change something (a legacy phone-start service, phone-start turned on without a usable agent, or a config file Pushary cannot rewrite) is no longer retried automatically. `pushary doctor` shows it, and running `pushary upgrade` after the fix finishes it.
 - When a Codex approval hook is turned off in Codex, setup and upgrade tell you to enable it in `/hooks` instead of asking you to trust it. A missing or background (asynchronous) approval hook points you to setup again, as doctor does.
-- Upgrades, including automatic ones, regenerate the OpenCode plugin Pushary installed, so the active directory fix from 1.9.4 reaches existing installs without running setup again. A `pushary.js` you wrote yourself is never touched, and no plugin is added where there was none.
+- Upgrades, including automatic ones, regenerate the OpenCode plugin Pushary installed, so the 1.9.4 fix, which makes OpenCode approvals use the directory OpenCode is working in, reaches existing installs without running setup again. A `pushary.js` you wrote yourself is never touched, and no plugin is added where there was none.
 
 ## 1.9.6
 
@@ -359,7 +387,7 @@ Requires the Codex auto-reviewer handling in `POST /api/agent/gate`, Codex bodie
 
 - When Codex runs with `--approve-for-me`, stop asking you before its auto-reviewer. `PreToolUse` and `PermissionRequest` have no opinion under the reviewer, after the kill switch and a standing deny, so nothing the reviewer allows reaches your phone.
 - When the auto-reviewer denies a shell command, hold the turn end and ask once whether to allow that exact command. A yes continues the turn, Codex runs the same command again, and the retry skips the reviewer once. A no, or no answer, lets the denial stand. Denials of `apply_patch` and MCP calls are not asked about yet. The request names the session's directory as well as the command's, so the card can say where the command runs.
-- Hold a blocked call only when the hook can prove its host waits that long: the `--hold-budget=<seconds>` argument its registration now carries, or the budget the Mac app hands down in `PUSHARY_HOLD_BUDGET_SECONDS`. The hold never waits past that budget less its reserves. Without proof, which is an install registered before this release, the Claude plugin's older entry, an update that skipped `--finish-upgrade` or a Mac app built before it, a Claude block sends the "Auto mode blocked <tool>" notification instead, and a Codex turn end reads no denial, so it is still asked about once the hook is upgraded.
+- Hold a blocked call only when the hook can prove its host waits that long: the `--hold-budget=<seconds>` argument its registration now carries, or the budget the Mac app hands down in `PUSHARY_HOLD_BUDGET_SECONDS`. The hold never waits past that budget less its reserves. Without proof, which is an install registered before this release, the Claude plugin's older entry, an update that skipped `--finish-upgrade` or a Mac app built before it, a Claude block sends the `Auto mode blocked <tool>` notification instead, and a Codex turn end reads no denial, so it is still asked about once the hook is upgraded.
 - Build the `blocked-action/v2` identity for a Claude call, which includes its working directory, so the retry's hint and claim match the server's grant. A Claude call with no working directory is not asked about. Keep the retry hint for the grant's two minutes rather than ten.
 - `pushary doctor` warns when a `PermissionDenied` or Codex `Stop` registration carries no hold budget.
 

package/data/cursor-plugin/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "pushary",
   "displayName": "Pushary — Control Panel for AI Agents",
   "description": "Push notifications, human-in-the-loop questions, and permission gating for your AI coding agent. Get a push when a task finishes, answer the agent from your phone, and approve risky commands before they run.",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "author": { "name": "Pushary", "email": "business@pushary.com" },
   "homepage": "https://pushary.com",
   "repository": "https://github.com/Pushary/cursor-plugin",

package/data/cursor-plugin/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.2.5
+
+- Under When I'm out, a file change asks your phone every time, also while you are at the keyboard, and waits for your policy's timeout. Cursor's file hooks cannot show a prompt of their own. Before, the change was refused with "Switch to Every time" and nobody was asked, or it was refused after the 10 second push window when you were away. Shell commands and MCP calls keep When I'm out as it was, because Cursor prompts for those itself.
+- The bundled Pushary skill says When I'm out waits 10 seconds for your phone by default, not 45.
+
 ## 0.2.4
 
 - Stop the gated action when a question is missing after withdrawal, instead of treating it as a timeout that can approve the action.

package/dist/bin/pushary-bell-hook.js

@@ -1,41 +1,41 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-L6TIDQNU.js";
+} from "../chunk-MGW26CW7.js";
 import {
   readHookInput
-} from "../chunk-JRAQENMR.js";
-import "../chunk-EXHTATWA.js";
+} from "../chunk-T27NT7LJ.js";
+import "../chunk-XUUE6MYM.js";
 import "../chunk-6WEC3KZP.js";
-import "../chunk-JCVGBUCZ.js";
-import "../chunk-K4UPPZK4.js";
-import "../chunk-U4X3GQR2.js";
-import "../chunk-W3IBC4FG.js";
+import "../chunk-6GQDOO5P.js";
+import "../chunk-XGHXQUDG.js";
+import "../chunk-ATDOYZXC.js";
+import "../chunk-2V2CCTGQ.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-JN2PBSLX.js";
-import "../chunk-TGEOVHWA.js";
-import "../chunk-IHBVOC2Q.js";
-import "../chunk-JSD26D6B.js";
-import "../chunk-IB3WIIFC.js";
+import "../chunk-E2RXTRM2.js";
+import "../chunk-SEZUF33H.js";
+import "../chunk-YAU4JCYI.js";
+import "../chunk-YONHM5BQ.js";
+import "../chunk-7TSL3JCX.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-OD6ZMBFA.js";
-import "../chunk-LM2IY7OH.js";
-import "../chunk-M3OVAMTR.js";
-import "../chunk-3E6SMCCH.js";
+import "../chunk-4ABHSCFJ.js";
+import "../chunk-NILVJ7HV.js";
+import "../chunk-CRW4P7JU.js";
+import "../chunk-DVLQ4TVD.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-6JTEGLQY.js";
-import "../chunk-ZS3JF5WZ.js";
-import "../chunk-6A6BXMNK.js";
-import "../chunk-BK2CBKUC.js";
+import "../chunk-SXVXANPI.js";
+import "../chunk-UAA4BEYM.js";
+import "../chunk-B4OS2OVD.js";
+import "../chunk-KRDQQL2X.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-PZ2CZIP4.js";
-import "../chunk-HCCYXFX3.js";
+import "../chunk-MID7BURF.js";
+import "../chunk-FEKP3NJR.js";
 import "../chunk-FT7UNIS3.js";
-import "../chunk-PKMZSKF5.js";
-import "../chunk-SFUVP6RK.js";
-import "../chunk-VERKRKUN.js";
+import "../chunk-XQ4HTTBB.js";
+import "../chunk-LHGB64O2.js";
+import "../chunk-6HMCOGKJ.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,37 +5,37 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-L6TIDQNU.js";
+} from "../chunk-MGW26CW7.js";
 import {
   createIo
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-JCQURRHV.js";
+} from "../chunk-LXYNKZFP.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-IB3WIIFC.js";
+} from "../chunk-7TSL3JCX.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-OD6ZMBFA.js";
+import "../chunk-4ABHSCFJ.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-PZ2CZIP4.js";
+import "../chunk-MID7BURF.js";
 import {
   claudeSettings
-} from "../chunk-HCCYXFX3.js";
+} from "../chunk-FEKP3NJR.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-FT7UNIS3.js";
-import "../chunk-PKMZSKF5.js";
-import "../chunk-SFUVP6RK.js";
-import "../chunk-VERKRKUN.js";
+import "../chunk-XQ4HTTBB.js";
+import "../chunk-LHGB64O2.js";
+import "../chunk-6HMCOGKJ.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,39 +8,39 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-AFFFTDUS.js";
+} from "../chunk-KT36OCRW.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-RN2HEOY2.js";
+} from "../chunk-5LQRUBFB.js";
 import {
   claudeTranscriptPath,
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-EXHTATWA.js";
+} from "../chunk-XUUE6MYM.js";
 import "../chunk-6WEC3KZP.js";
 import {
   ensureDaemonRunning
-} from "../chunk-JCVGBUCZ.js";
+} from "../chunk-6GQDOO5P.js";
 import {
   encryptRecord
-} from "../chunk-K4UPPZK4.js";
-import "../chunk-U4X3GQR2.js";
+} from "../chunk-XGHXQUDG.js";
+import "../chunk-ATDOYZXC.js";
 import {
   transcriptsEnabled
-} from "../chunk-W3IBC4FG.js";
+} from "../chunk-2V2CCTGQ.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
-import "../chunk-TGEOVHWA.js";
-import "../chunk-IHBVOC2Q.js";
-import "../chunk-JSD26D6B.js";
-import "../chunk-IB3WIIFC.js";
+import "../chunk-SEZUF33H.js";
+import "../chunk-YAU4JCYI.js";
+import "../chunk-YONHM5BQ.js";
+import "../chunk-7TSL3JCX.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-OD6ZMBFA.js";
+import "../chunk-4ABHSCFJ.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -58,8 +58,8 @@ import {
   reportEvent,
   savePendingCommand,
   scopePathFor
-} from "../chunk-LM2IY7OH.js";
-import "../chunk-M3OVAMTR.js";
+} from "../chunk-NILVJ7HV.js";
+import "../chunk-CRW4P7JU.js";
 import {
   askUser,
   cancelQuestion,
@@ -67,36 +67,37 @@ import {
   isLocalQuestionHandoff,
   nextLongPollMs,
   waitForAnswer,
+  waitsForThePhone,
   withdrawQuestion
-} from "../chunk-3E6SMCCH.js";
+} from "../chunk-DVLQ4TVD.js";
 import "../chunk-POFBE6ZY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-6JTEGLQY.js";
-import "../chunk-ZS3JF5WZ.js";
-import "../chunk-6A6BXMNK.js";
+} from "../chunk-SXVXANPI.js";
+import "../chunk-UAA4BEYM.js";
+import "../chunk-B4OS2OVD.js";
 import {
   getMachineId
-} from "../chunk-BK2CBKUC.js";
+} from "../chunk-KRDQQL2X.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-PZ2CZIP4.js";
-import "../chunk-HCCYXFX3.js";
+import "../chunk-MID7BURF.js";
+import "../chunk-FEKP3NJR.js";
 import "../chunk-FT7UNIS3.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-PKMZSKF5.js";
+} from "../chunk-XQ4HTTBB.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-SFUVP6RK.js";
+} from "../chunk-LHGB64O2.js";
 import {
   DECISION_STOP_REASON,
   KILL_REASON,
   UNVERIFIABLE_APPROVAL_REASON,
   redactSecretsFromContent,
   resolveGate
-} from "../chunk-VERKRKUN.js";
+} from "../chunk-6HMCOGKJ.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {
@@ -542,7 +543,7 @@ var createRemoteApprover = (deps) => {
       if (isDecisionStopped(question)) return deny(DECISION_STOP_REASON);
       entry.correlationId = question.correlationId;
       const localHandoff = isLocalQuestionHandoff(question);
-      let answer = question.answered ? { ...question, answered: true } : localHandoff ? { answered: false } : await waitForPhone(entry, question.correlationId, windowFor(policy));
+      let answer = question.answered ? { ...question, answered: true } : waitsForThePhone(question) ? await waitForPhone(entry, question.correlationId, windowFor(policy)) : { answered: false };
       if (isDecisionStopped(answer) || entry.controller.signal.aborted) return deny(DECISION_STOP_REASON);
       if (!answer.answered) {
         answer = await withdrawQuestion(deps.apiKey, question.correlationId, { cancelQuestion: cancelQuestion2, waitForAnswer: waitForAnswer2 });

package/dist/bin/pushary-clean.js

@@ -13,7 +13,7 @@ import {
   isCursorPluginLeftover,
   releaseSoleGate,
   withoutPusharyCursorHooks
-} from "../chunk-AELYA5BM.js";
+} from "../chunk-FRZS7XQF.js";
 import {
   HERMES_PIP_PACKAGE,
   readHermesStatus,
@@ -22,27 +22,27 @@ import {
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-VPGJBKWU.js";
+} from "../chunk-AXG5QMRM.js";
 import {
   planFxRemoval,
   removeInstructionBlock
-} from "../chunk-IDVBDHSX.js";
-import "../chunk-LCRYCE5F.js";
+} from "../chunk-5RMD75P2.js";
+import "../chunk-YXYSPMD3.js";
 import {
   disableDaemonService
-} from "../chunk-JCVGBUCZ.js";
+} from "../chunk-6GQDOO5P.js";
 import "../chunk-XHKBHWLX.js";
 import {
   APPROVAL_SETTINGS_PATH
-} from "../chunk-O43I5GBC.js";
+} from "../chunk-QDRDDVLH.js";
 import {
   macAppKeepsMcpEntry,
   mcpServerBearer,
   pusharyKey,
   readMacAppAgentKey,
   setupReceiptKey
-} from "../chunk-ERAUU54Q.js";
-import "../chunk-LDLMAGTK.js";
+} from "../chunk-HYPSYXP4.js";
+import "../chunk-2YAHQ763.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -54,14 +54,14 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-5MCHXYBH.js";
+} from "../chunk-DKFAJHLI.js";
 import {
   ansiPainter,
   useColor
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-JCQURRHV.js";
+} from "../chunk-LXYNKZFP.js";
 import {
   compatibleConfigFile,
   compatibleInstructionsFile,
@@ -74,7 +74,7 @@ import {
   removePusharySettings,
   removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-JN2PBSLX.js";
+} from "../chunk-E2RXTRM2.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
@@ -82,12 +82,12 @@ import {
   resolveBridgeStub,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-TGEOVHWA.js";
+} from "../chunk-SEZUF33H.js";
 import {
   removeGeminiSettings
-} from "../chunk-IHBVOC2Q.js";
-import "../chunk-JSD26D6B.js";
-import "../chunk-IB3WIIFC.js";
+} from "../chunk-YAU4JCYI.js";
+import "../chunk-YONHM5BQ.js";
+import "../chunk-7TSL3JCX.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
@@ -100,22 +100,22 @@ import {
   readConfigFileKey,
   readMacAppKeyPrefix,
   removeClaudeAlias
-} from "../chunk-OD6ZMBFA.js";
-import "../chunk-LM2IY7OH.js";
-import "../chunk-M3OVAMTR.js";
-import "../chunk-3E6SMCCH.js";
+} from "../chunk-4ABHSCFJ.js";
+import "../chunk-NILVJ7HV.js";
+import "../chunk-CRW4P7JU.js";
+import "../chunk-DVLQ4TVD.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-6JTEGLQY.js";
+import "../chunk-SXVXANPI.js";
 import {
   absoluteUrl
-} from "../chunk-ZS3JF5WZ.js";
-import "../chunk-6A6BXMNK.js";
-import "../chunk-BK2CBKUC.js";
+} from "../chunk-UAA4BEYM.js";
+import "../chunk-B4OS2OVD.js";
+import "../chunk-KRDQQL2X.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-PZ2CZIP4.js";
+import "../chunk-MID7BURF.js";
 import {
   claudeJson,
   claudeMcpReceipt,
@@ -152,14 +152,14 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-HCCYXFX3.js";
+} from "../chunk-FEKP3NJR.js";
 import "../chunk-FT7UNIS3.js";
 import {
   getBaseUrl
-} from "../chunk-PKMZSKF5.js";
+} from "../chunk-XQ4HTTBB.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-SFUVP6RK.js";
+} from "../chunk-LHGB64O2.js";
 import {
   CLI_PACKAGE_NAMES,
   HOOK_COMPATIBLE_PROFILES,
@@ -171,7 +171,7 @@ import {
   globalRootFor,
   isValidApiKey,
   redactSecrets
-} from "../chunk-VERKRKUN.js";
+} from "../chunk-6HMCOGKJ.js";
 
 // bin/pushary-clean.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync4 } from "fs";

package/dist/bin/pushary-codex-bridge.js

@@ -5,10 +5,10 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-TE4M3E2M.js";
+} from "../chunk-A6U4RRFM.js";
 import {
   resolveProviderBinary
-} from "../chunk-KLMAOQR4.js";
+} from "../chunk-OWUDBHXW.js";
 import "../chunk-RIVNNBEK.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
@@ -16,50 +16,50 @@ import {
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-AFFFTDUS.js";
-import "../chunk-K4UPPZK4.js";
-import "../chunk-U4X3GQR2.js";
+} from "../chunk-KT36OCRW.js";
+import "../chunk-XGHXQUDG.js";
+import "../chunk-ATDOYZXC.js";
 import {
   transcriptsEnabled
-} from "../chunk-W3IBC4FG.js";
+} from "../chunk-2V2CCTGQ.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-OD6ZMBFA.js";
+import "../chunk-4ABHSCFJ.js";
 import {
   isAskUserResponse,
   isDecisionStopped,
   isWaitForAnswerResponse,
   withdrawQuestion,
   writeDegraded
-} from "../chunk-3E6SMCCH.js";
+} from "../chunk-DVLQ4TVD.js";
 import "../chunk-POFBE6ZY.js";
 import {
   callMcpTool
-} from "../chunk-6JTEGLQY.js";
-import "../chunk-ZS3JF5WZ.js";
-import "../chunk-6A6BXMNK.js";
+} from "../chunk-SXVXANPI.js";
+import "../chunk-UAA4BEYM.js";
+import "../chunk-B4OS2OVD.js";
 import {
   getMachineId
-} from "../chunk-BK2CBKUC.js";
+} from "../chunk-KRDQQL2X.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-PZ2CZIP4.js";
-import "../chunk-HCCYXFX3.js";
+import "../chunk-MID7BURF.js";
+import "../chunk-FEKP3NJR.js";
 import "../chunk-FT7UNIS3.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-PKMZSKF5.js";
-import "../chunk-SFUVP6RK.js";
+} from "../chunk-XQ4HTTBB.js";
+import "../chunk-LHGB64O2.js";
 import {
   elicitationContent,
   parseAgentQuestion,
   parseAgentQuestionAnswers,
   planElicitationAsk,
   readElicitationFields
-} from "../chunk-VERKRKUN.js";
+} from "../chunk-6HMCOGKJ.js";
 
 // bin/pushary-codex-bridge.ts
 import { existsSync } from "fs";