pushary 1.9.35 → 1.9.37

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 1.9.37
+
+- Codex questions reach Pushary. When Codex asks you something with its question card (`request_user_input`), the question and its choices go to your phone or the Mac notch, and your answer goes back to Codex in place of the card. A question with no choices, one choice, more than four, or a secret stays in Codex, and so does one nobody answers or Pushary cannot reach. Setup and upgrade widen the Codex `PreToolUse` matcher to include both question tools.
+- When away now asks about a destructive Codex command (such as `rm -rf`, a force push, `git reset --hard` or `git clean`) or a patch that deletes a file, because Codex can run those without a prompt of its own. The question goes to your phone when you are away from the keyboard; at the keyboard Codex carries on as before. A call nobody answers is refused.
+
+## 1.9.36
+
+- Connect Grok Build to Pushary with native hooks for tool approvals, session activity and subagent activity. Setup, doctor, upgrades and disconnect use Grok's configuration directory, including a custom `GROK_HOME`.
+- Grok patch approvals inspect every affected path, including move destinations, and show the patch in the approval receipt. Existing kill, deny and scope rules apply to those calls.
+- Cleanup reports malformed or unreadable agent configuration and preserves the file so it can be repaired.
+- Grok's question and plan dialogs stay in Grok. Use Pushary's MCP tools for phone questions. Grok itself continues after a hook crash or timeout, so Pushary hooks do not replace Grok's native permission checks.
+
 ## 1.9.35
 
 - When you run setup yourself in a terminal and your phone cannot get notifications yet, it no longer stops with exit code 6. It asks you to open the Pushary app and allow notifications, waits up to 10 minutes for your phone, then sends a test notification. Press Enter to skip the wait. Runs with `--yes`, `--agents` or `--json`, and computers with the Pushary Mac app, keep the single check.

package/README.md

@@ -214,7 +214,7 @@ sign-out     Sign out: remove the key this machine stores, and say what it does
 pair         Pair a phone without re-running setup (--app for the Pushary app; also: connect)
 bell         Free local bell when an agent finishes or needs you. No account, no key, no network
 doctor       Verify your Pushary installation is working
-disconnect   Turn off one agent (claude|codex|gemini|cursor|opencode|qwen|codebuddy|qoder|droid|devin|antigravity|fx)
+disconnect   Turn off one agent (claude|codex|gemini|cursor|opencode|qwen|codebuddy|qoder|droid|devin|antigravity|grok|fx)
 clean        Remove Pushary from this machine (--everything: the Mac app's setup too, --dry-run: preview)
 mode         Choose where approval requests appear
 wait         Show or set the "wait for your phone" ladder (pushary wait 45)

package/dist/bin/pushary-bell-hook.js

@@ -1,41 +1,41 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-WPSI4246.js";
+} from "../chunk-UEIL72RN.js";
 import {
   readHookInput
-} from "../chunk-B5RLJ6QD.js";
-import "../chunk-CPYOJRDN.js";
+} from "../chunk-ZMR3DSMH.js";
+import "../chunk-V7Q7DQXL.js";
 import "../chunk-DWQYCOPI.js";
-import "../chunk-FPYBX36E.js";
-import "../chunk-CK3W7Q5S.js";
-import "../chunk-4PIAOJAW.js";
-import "../chunk-SMSX4TCC.js";
+import "../chunk-F3J6JFR2.js";
+import "../chunk-MAGB6VW6.js";
+import "../chunk-PYWLW7PC.js";
+import "../chunk-HQR6DYVG.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-7S7H7V5V.js";
-import "../chunk-6OGDGQTT.js";
-import "../chunk-QJ3ENGBT.js";
-import "../chunk-57FFQR46.js";
-import "../chunk-36ZCFJUI.js";
+import "../chunk-KHLYOIPY.js";
+import "../chunk-Q3TCLMYC.js";
+import "../chunk-6SYU5LVK.js";
+import "../chunk-Q52PBCN7.js";
+import "../chunk-SNI4FGOV.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-DCBSD22V.js";
-import "../chunk-SMRMWDFE.js";
-import "../chunk-DQKEGNTI.js";
-import "../chunk-OZMGO4WF.js";
+import "../chunk-N5WEEYV6.js";
+import "../chunk-W73URGML.js";
+import "../chunk-QUKATQ66.js";
+import "../chunk-HA22GGDG.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-H52HBSOD.js";
-import "../chunk-7IVV4LLF.js";
-import "../chunk-22YSHBTI.js";
-import "../chunk-ULJFIF5N.js";
+import "../chunk-Z5ORWTY3.js";
+import "../chunk-DYALNCS6.js";
+import "../chunk-NWSWP3KY.js";
+import "../chunk-VA36Q6BD.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-NMQLY4PE.js";
-import "../chunk-UPRNSD2T.js";
+import "../chunk-GUHM2UQO.js";
+import "../chunk-RFIHLLRH.js";
 import "../chunk-AQFEP65J.js";
-import "../chunk-3LS3GFJW.js";
-import "../chunk-45OXG3VR.js";
-import "../chunk-7FQL5NWJ.js";
+import "../chunk-AZXPJLKC.js";
+import "../chunk-WXA3CFZR.js";
+import "../chunk-235LKHLW.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,39 +5,39 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-WPSI4246.js";
+} from "../chunk-UEIL72RN.js";
 import {
   createIo
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-A5FFSXZE.js";
+} from "../chunk-JMLJHKJN.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-36ZCFJUI.js";
+} from "../chunk-SNI4FGOV.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-DCBSD22V.js";
+import "../chunk-N5WEEYV6.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-NMQLY4PE.js";
+import "../chunk-GUHM2UQO.js";
 import {
   claudeSettings
-} from "../chunk-UPRNSD2T.js";
+} from "../chunk-RFIHLLRH.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-AQFEP65J.js";
-import "../chunk-3LS3GFJW.js";
-import "../chunk-45OXG3VR.js";
+import "../chunk-AZXPJLKC.js";
+import "../chunk-WXA3CFZR.js";
 import {
   isRecord
-} from "../chunk-7FQL5NWJ.js";
+} from "../chunk-235LKHLW.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,39 +8,39 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-E2OZZZKP.js";
+} from "../chunk-UKCGR5T2.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-NKAMF2YJ.js";
+} from "../chunk-6VUVVVVN.js";
 import {
   claudeTranscriptPath,
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-CPYOJRDN.js";
+} from "../chunk-V7Q7DQXL.js";
 import "../chunk-DWQYCOPI.js";
 import {
   ensureDaemonRunning
-} from "../chunk-FPYBX36E.js";
+} from "../chunk-F3J6JFR2.js";
 import {
   encryptRecord
-} from "../chunk-CK3W7Q5S.js";
-import "../chunk-4PIAOJAW.js";
+} from "../chunk-MAGB6VW6.js";
+import "../chunk-PYWLW7PC.js";
 import {
   transcriptsEnabled
-} from "../chunk-SMSX4TCC.js";
+} from "../chunk-HQR6DYVG.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
-import "../chunk-6OGDGQTT.js";
-import "../chunk-QJ3ENGBT.js";
-import "../chunk-57FFQR46.js";
-import "../chunk-36ZCFJUI.js";
+import "../chunk-Q3TCLMYC.js";
+import "../chunk-6SYU5LVK.js";
+import "../chunk-Q52PBCN7.js";
+import "../chunk-SNI4FGOV.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-DCBSD22V.js";
+import "../chunk-N5WEEYV6.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -58,8 +58,8 @@ import {
   reportEvent,
   savePendingCommand,
   scopePathFor
-} from "../chunk-SMRMWDFE.js";
-import "../chunk-DQKEGNTI.js";
+} from "../chunk-W73URGML.js";
+import "../chunk-QUKATQ66.js";
 import {
   askUser,
   cancelQuestion,
@@ -70,28 +70,28 @@ import {
   waitForAnswer,
   waitsForThePhone,
   withdrawQuestion
-} from "../chunk-OZMGO4WF.js";
+} from "../chunk-HA22GGDG.js";
 import "../chunk-POFBE6ZY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-H52HBSOD.js";
-import "../chunk-7IVV4LLF.js";
-import "../chunk-22YSHBTI.js";
+} from "../chunk-Z5ORWTY3.js";
+import "../chunk-DYALNCS6.js";
+import "../chunk-NWSWP3KY.js";
 import {
   getMachineId
-} from "../chunk-ULJFIF5N.js";
+} from "../chunk-VA36Q6BD.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-NMQLY4PE.js";
-import "../chunk-UPRNSD2T.js";
+import "../chunk-GUHM2UQO.js";
+import "../chunk-RFIHLLRH.js";
 import "../chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-3LS3GFJW.js";
+} from "../chunk-AZXPJLKC.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-45OXG3VR.js";
+} from "../chunk-WXA3CFZR.js";
 import {
   DECISION_STOP_REASON,
   HAND_BACK_WITHOUT_A_PROMPT,
@@ -101,7 +101,7 @@ import {
   redactSecretsFromContent,
   resolveGate,
   timeoutActionWithoutLocalPrompt
-} from "../chunk-7FQL5NWJ.js";
+} from "../chunk-235LKHLW.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {

package/dist/bin/pushary-clean.js

@@ -9,12 +9,12 @@ import {
   planCliKeyRevocations,
   readCliHeldKeys,
   revokeCliKeys
-} from "../chunk-U7CN5HG2.js";
+} from "../chunk-NDQXKLGE.js";
 import {
   isCursorPluginLeftover,
   releaseSoleGate,
   withoutPusharyCursorHooks
-} from "../chunk-GC3SUMYD.js";
+} from "../chunk-4OQHT5IJ.js";
 import {
   HERMES_PIP_PACKAGE,
   readHermesStatus,
@@ -23,25 +23,25 @@ import {
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-IRU7DKJW.js";
+} from "../chunk-NPE44CX4.js";
 import {
   planFxRemoval,
   removeInstructionBlock
-} from "../chunk-EJWSE7S7.js";
-import "../chunk-UDECNZYI.js";
+} from "../chunk-JLQV3XLV.js";
+import "../chunk-UK3WY3LE.js";
 import {
   disableDaemonService
-} from "../chunk-FPYBX36E.js";
+} from "../chunk-F3J6JFR2.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-PEEJP4HN.js";
+import "../chunk-EK6PRPCY.js";
 import {
   macAppKeepsMcpEntry,
   mcpServerBearer,
   pusharyKey,
   readMacAppAgentKey,
   setupReceiptKey
-} from "../chunk-EGTRIM74.js";
-import "../chunk-FDNMQEU6.js";
+} from "../chunk-GSP7CC52.js";
+import "../chunk-VMIDUNOT.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -53,27 +53,30 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-WFPXKCN4.js";
+} from "../chunk-HJF57K2U.js";
 import {
   ansiPainter,
   useColor
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-A5FFSXZE.js";
+} from "../chunk-JMLJHKJN.js";
 import {
   compatibleConfigFile,
+  compatibleDocuments,
   compatibleInstructionsFile,
   compatibleMcpFile,
   compatiblePermissionRuleFile,
   isClaudeMcpSnapshot,
+  readConfigDocument,
   removeClaudeMcpServers,
   removeCompatibleHooks,
   removeCompatibleMcpServer,
   removePusharySettings,
   removePusharyToolPermissions,
-  restoreClaudeMcpServer
-} from "../chunk-7S7H7V5V.js";
+  restoreClaudeMcpServer,
+  serializeConfigDocument
+} from "../chunk-KHLYOIPY.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
@@ -81,12 +84,12 @@ import {
   resolveBridgeStub,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-6OGDGQTT.js";
+} from "../chunk-Q3TCLMYC.js";
 import {
   removeGeminiSettings
-} from "../chunk-QJ3ENGBT.js";
-import "../chunk-57FFQR46.js";
-import "../chunk-36ZCFJUI.js";
+} from "../chunk-6SYU5LVK.js";
+import "../chunk-Q52PBCN7.js";
+import "../chunk-SNI4FGOV.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
@@ -96,20 +99,20 @@ import {
   isDisabledExport,
   removeClaudeAlias,
   shellProfileCandidates
-} from "../chunk-DCBSD22V.js";
-import "../chunk-SMRMWDFE.js";
-import "../chunk-DQKEGNTI.js";
-import "../chunk-OZMGO4WF.js";
+} from "../chunk-N5WEEYV6.js";
+import "../chunk-W73URGML.js";
+import "../chunk-QUKATQ66.js";
+import "../chunk-HA22GGDG.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-H52HBSOD.js";
-import "../chunk-7IVV4LLF.js";
-import "../chunk-22YSHBTI.js";
-import "../chunk-ULJFIF5N.js";
+import "../chunk-Z5ORWTY3.js";
+import "../chunk-DYALNCS6.js";
+import "../chunk-NWSWP3KY.js";
+import "../chunk-VA36Q6BD.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-NMQLY4PE.js";
+import "../chunk-GUHM2UQO.js";
 import {
   claudeJson,
   claudeMcpReceipt,
@@ -146,14 +149,14 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-UPRNSD2T.js";
+} from "../chunk-RFIHLLRH.js";
 import "../chunk-AQFEP65J.js";
 import {
   getBaseUrl
-} from "../chunk-3LS3GFJW.js";
+} from "../chunk-AZXPJLKC.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-45OXG3VR.js";
+} from "../chunk-WXA3CFZR.js";
 import {
   CLI_PACKAGE_NAMES,
   HOOK_COMPATIBLE_PROFILES,
@@ -165,7 +168,7 @@ import {
   globalRootFor,
   isValidApiKey,
   redactSecrets
-} from "../chunk-7FQL5NWJ.js";
+} from "../chunk-235LKHLW.js";
 
 // bin/pushary-clean.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync4 } from "fs";
@@ -550,9 +553,9 @@ var isAppOwned = (name) => APP_OWNED_ENTRIES.includes(name);
 // src/compatible-clean.ts
 var keepsMcpServer = (profile, scope, io, home) => {
   const mcpPath = compatibleMcpFile(profile, home);
-  if (!mcpPath) return false;
-  const mcp = io.readJson(mcpPath);
-  return mcp !== null && scope.keepsMcpEntry(profile.agentType, mcpServerBearer(mcp.mcpServers));
+  if (!mcpPath || !profile.mcp) return false;
+  const document = readConfigDocument(mcpPath, profile.mcp.file.format, io.files);
+  return document.kind === "parsed" && scope.keepsMcpEntry(profile.agentType, mcpServerBearer(document.value[profile.mcp.container]));
 };
 var removalsByPath = (profile, removalScope2, home) => {
   const removals = /* @__PURE__ */ new Map();
@@ -575,19 +578,23 @@ var cleanInstructions = (profile, scope, io, home) => {
 var cleanCompatibleAgent = (profile, scope, io, home) => {
   const mcpKeptForApp = keepsMcpServer(profile, scope, io, home);
   const removalScope2 = { keepAppWiring: scope.keepAppWiring, keepMcpServer: mcpKeptForApp };
-  const files = [...removalsByPath(profile, removalScope2, home)].map(([path, removals]) => {
-    const config = io.readJson(path);
-    if (!config) return { path, outcome: "not_found" };
-    if (!removals.reduce((changed, remove) => remove(config) || changed, false)) return { path, outcome: "unchanged" };
-    io.writeJson(path, config);
-    return { path, outcome: "cleaned" };
+  const removals = removalsByPath(profile, removalScope2, home);
+  const files = [...compatibleDocuments(profile, home)].flatMap(([path, file]) => {
+    const edits = removals.get(path);
+    if (!edits) return [];
+    const document = readConfigDocument(path, file.format, io.files);
+    if (document.kind === "missing") return [{ path, outcome: "not_found" }];
+    if (document.kind === "unreadable") return [{ path, outcome: "unreadable" }];
+    if (!edits.reduce((changed, remove) => remove(document.value) || changed, false)) return [{ path, outcome: "unchanged" }];
+    io.files.write(path, serializeConfigDocument(document.value, file.format));
+    return [{ path, outcome: "cleaned" }];
   });
   return {
     profile,
     files,
     mcpKeptForApp,
     instructions: cleanInstructions(profile, scope, io, home),
-    soleGate: releaseSoleGate(profile, io.soleGateFiles, home)
+    soleGate: releaseSoleGate(profile, io.files, home)
   };
 };
 
@@ -634,8 +641,9 @@ var codexMcpKey = (config) => {
 var readText = (path) => {
   try {
     return readFileSync4(path, "utf-8");
-  } catch {
-    return null;
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
+    throw error;
   }
 };
 var readJson = (path) => {
@@ -1094,16 +1102,15 @@ var main = async () => {
   }
   const compatibleScope = { keepAppWiring: keepShared, keepsMcpEntry: macAppKeeps };
   const compatibleIo = {
-    readJson,
-    writeJson,
     removeInstructionBlock: guardedInstructionBlockRemoval,
-    soleGateFiles: { read: readText, write: guardedWrite, remove: (path) => guardedRemove(path, { force: true }) }
+    files: { read: readText, write: guardedWrite, remove: (path) => guardedRemove(path, { force: true }) }
   };
   for (const profile of HOOK_COMPATIBLE_PROFILES) {
     const report = cleanCompatibleAgent(profile, compatibleScope, compatibleIo);
     for (const file of report.files) {
       const label2 = `${profile.label} ${shortenHome(file.path)}`;
       if (file.outcome === "not_found") console.log(`  ${skip} ${label2} ${dim("(not found)")}`);
+      else if (file.outcome === "unreadable") console.log(`  ${skip} ${label2} ${yellow("(could not read configuration; left unchanged)")}`);
       else if (file.outcome === "cleaned") console.log(`  ${check} ${label2} ${dim(did("cleaned"))}`);
       else console.log(`  ${skip} ${label2} ${dim(keepShared ? "(nothing the CLI wrote)" : "(no pushary entries)")}`);
     }

package/dist/bin/pushary-codex-bridge.js

@@ -5,10 +5,10 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-HQKYWUBF.js";
+} from "../chunk-OSLC7G3D.js";
 import {
   resolveProviderBinary
-} from "../chunk-4TFD3WAA.js";
+} from "../chunk-YNJ372JU.js";
 import "../chunk-RIVNNBEK.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
@@ -16,50 +16,50 @@ import {
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-E2OZZZKP.js";
-import "../chunk-CK3W7Q5S.js";
-import "../chunk-4PIAOJAW.js";
+} from "../chunk-UKCGR5T2.js";
+import "../chunk-MAGB6VW6.js";
+import "../chunk-PYWLW7PC.js";
 import {
   transcriptsEnabled
-} from "../chunk-SMSX4TCC.js";
+} from "../chunk-HQR6DYVG.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-DCBSD22V.js";
+import "../chunk-N5WEEYV6.js";
 import {
   isAskUserResponse,
   isDecisionStopped,
   isWaitForAnswerResponse,
   withdrawQuestion,
   writeDegraded
-} from "../chunk-OZMGO4WF.js";
+} from "../chunk-HA22GGDG.js";
 import "../chunk-POFBE6ZY.js";
 import {
   callMcpTool
-} from "../chunk-H52HBSOD.js";
-import "../chunk-7IVV4LLF.js";
-import "../chunk-22YSHBTI.js";
+} from "../chunk-Z5ORWTY3.js";
+import "../chunk-DYALNCS6.js";
+import "../chunk-NWSWP3KY.js";
 import {
   getMachineId
-} from "../chunk-ULJFIF5N.js";
+} from "../chunk-VA36Q6BD.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-NMQLY4PE.js";
-import "../chunk-UPRNSD2T.js";
+import "../chunk-GUHM2UQO.js";
+import "../chunk-RFIHLLRH.js";
 import "../chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-3LS3GFJW.js";
-import "../chunk-45OXG3VR.js";
+} from "../chunk-AZXPJLKC.js";
+import "../chunk-WXA3CFZR.js";
 import {
   elicitationContent,
   parseAgentQuestion,
   parseAgentQuestionAnswers,
   planElicitationAsk,
   readElicitationFields
-} from "../chunk-7FQL5NWJ.js";
+} from "../chunk-235LKHLW.js";
 
 // bin/pushary-codex-bridge.ts
 import { existsSync } from "fs";