pushary 1.9.96 → 1.9.97

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 1.9.97
+
+- Asking only about risky steps with permissions off is now for Claude Code's `--dangerously-skip-permissions` alone. Codex in every approval mode, and every other agent that reports `bypassPermissions`, gates exactly as it did in 1.9.93 again: `codex exec` reports that mode whatever its approval policy is, so in 1.9.94 to 1.9.96 a routine call that used to reach your phone ran without a question.
+- With Claude Code's permissions off, Pushary now also asks about:
+  - an upload with `scp` or `rsync` to another machine, `sshpass` included (an rsync dry run still runs);
+  - a secret written to a host (`doppler secrets set`, `vercel env add`, `fly secrets set`, `heroku config:set`, `netlify env:set`, `railway variables --set`, `supabase secrets set`, `wrangler secret put`, Firebase function secrets, `gcloud secrets`, `az keyvault secret set`), also through `npx`, `pnpm`, `yarn` or `bun` with a version;
+  - `gh workflow run`, `enable` and `disable`;
+  - pushing a tag named `v` and a number, such as `v1`, unless the push sets an upstream branch;
+  - a `git config` setting that runs a program, such as `core.fsmonitor`, `core.sshCommand`, a pager, a credential helper other than the usual ones, a diff or merge driver or tool, a filter, an include, `protocol.allow`, or an alias or submodule update that starts with `!` (switching a setting on or off still runs, except for an include);
+  - a PowerShell `Invoke-RestMethod` or `Invoke-WebRequest` that sends data off the machine;
+  - an edit to, or a shell write into, a shell profile such as `~/.zshrc` or `~/.bash_aliases`, `~/.zsh`, `~/.zshrc.d`, `~/.config/zsh`, Oh My Zsh, Powerlevel10k's `~/.p10k.zsh`, a systemd user unit, `~/.gitconfig` and its included files, `.git/config`, `.mcp.json`, `.cursor/mcp.json`, `.claude/hooks`, a launch agent or daemon, the PowerShell profile, a file in `/etc`, or the CLI's own cached policy and mode files.
+- With Claude Code's permissions off, `ssh host uptime`, `free`, `who`, `docker ps`, `docker logs`, `systemctl status` and `journalctl` now run without a question. Reads, downloads, local copies and `git push origin main` run as before.
+- Every other Claude Code mode, and Always allow for Bash, judge commands exactly as 1.9.96 did.
+
 ## 1.9.96
 
 - With permissions off (`claude --dangerously-skip-permissions`, or Codex set to never ask), a workspace can now choose to never be stopped. Settings has a new choice, "When your agent skips permissions": "Stop me for risky steps" (the default, as in 1.9.94) or "Never stop me", which lets every step run, a merge under an Always allow for Bash included. Your own ask and deny rules, presets, approval routes, the kill switch and a scope you approved still apply.

package/dist/{api-FPEL3PLH.js → api-WH3DLHJB.js}

@@ -17,23 +17,23 @@ import {
   waitForQuestion,
   waitsForThePhone,
   withdrawQuestion
-} from "./chunk-CRJDKGEF.js";
+} from "./chunk-Z6O6CDTP.js";
 import "./chunk-POFBE6ZY.js";
-import "./chunk-V7EWOHNV.js";
-import "./chunk-CTKJVVDL.js";
-import "./chunk-B75SIY5C.js";
-import "./chunk-N2KK2NSY.js";
-import "./chunk-YCYFREHD.js";
-import "./chunk-77HBRZJI.js";
-import "./chunk-TXDFQD2I.js";
+import "./chunk-E5WUBHVH.js";
+import "./chunk-OW4WEO56.js";
+import "./chunk-6RGQIKAC.js";
+import "./chunk-ZFUSWR2P.js";
+import "./chunk-KNVTKFDP.js";
+import "./chunk-6CDA4R5L.js";
+import "./chunk-RZD7ULBJ.js";
 import "./chunk-PPY5N2E6.js";
 import "./chunk-KZERVKTD.js";
-import "./chunk-6YG5PZZS.js";
+import "./chunk-CMDIKFVL.js";
 import "./chunk-ZVU6WMMU.js";
 import {
   DECISION_STOP_REASON,
   UNVERIFIABLE_APPROVAL_REASON
-} from "./chunk-OS32P4RZ.js";
+} from "./chunk-WOFHN2IZ.js";
 import "./chunk-MLKGABMK.js";
 export {
   ABANDONED_WAIT,

package/dist/bin/pushary-bell-hook.js

@@ -1,41 +1,41 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-B4G4Q2AF.js";
+} from "../chunk-R7TVELKF.js";
 import {
   readHookInput
-} from "../chunk-M7ZV5IPA.js";
-import "../chunk-QDS55ODM.js";
-import "../chunk-OP2WJEPY.js";
-import "../chunk-7CW3K3B5.js";
-import "../chunk-TZWK2BVY.js";
-import "../chunk-SISYAMDC.js";
-import "../chunk-3GPXHHBM.js";
-import "../chunk-OQY4G7FS.js";
+} from "../chunk-EAJT6RYP.js";
+import "../chunk-CG3C2WL7.js";
+import "../chunk-VPT3RDTO.js";
+import "../chunk-HXUE6IIP.js";
+import "../chunk-APFQBVQW.js";
+import "../chunk-HWEEBVS7.js";
+import "../chunk-5YRDZE5F.js";
+import "../chunk-5U63KUP3.js";
 import "../chunk-NMUI3ZWG.js";
-import "../chunk-PDRPVVZX.js";
+import "../chunk-UAUADSJX.js";
 import "../chunk-XMSDA5WA.js";
-import "../chunk-SARU6WNW.js";
+import "../chunk-CP72YEEA.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-TVGOSEWS.js";
-import "../chunk-TAMHTWQZ.js";
-import "../chunk-XLM2JZBE.js";
-import "../chunk-KG7GT7UW.js";
-import "../chunk-CRJDKGEF.js";
+import "../chunk-HD7AURL6.js";
+import "../chunk-VVP4CP4O.js";
+import "../chunk-ZDIQPYM2.js";
+import "../chunk-CB2RYMAO.js";
+import "../chunk-Z6O6CDTP.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-V7EWOHNV.js";
-import "../chunk-CTKJVVDL.js";
-import "../chunk-B75SIY5C.js";
-import "../chunk-N2KK2NSY.js";
-import "../chunk-C4IKRLT4.js";
-import "../chunk-YCYFREHD.js";
-import "../chunk-77HBRZJI.js";
-import "../chunk-TXDFQD2I.js";
+import "../chunk-E5WUBHVH.js";
+import "../chunk-OW4WEO56.js";
+import "../chunk-6RGQIKAC.js";
+import "../chunk-ZFUSWR2P.js";
+import "../chunk-GEA6ZV2P.js";
+import "../chunk-KNVTKFDP.js";
+import "../chunk-6CDA4R5L.js";
+import "../chunk-RZD7ULBJ.js";
 import "../chunk-PPY5N2E6.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-6YG5PZZS.js";
+import "../chunk-CMDIKFVL.js";
 import "../chunk-ZVU6WMMU.js";
-import "../chunk-OS32P4RZ.js";
+import "../chunk-WOFHN2IZ.js";
 import "../chunk-MLKGABMK.js";
 
 // bin/pushary-bell-hook.ts

package/dist/bin/pushary-bell.js

@@ -5,40 +5,40 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-B4G4Q2AF.js";
+} from "../chunk-R7TVELKF.js";
 import {
   createIo
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-MSPHJNUL.js";
+} from "../chunk-MGYGWHG5.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-OQY4G7FS.js";
+} from "../chunk-5U63KUP3.js";
 import {
   parseFlags
 } from "../chunk-NMUI3ZWG.js";
-import "../chunk-TVGOSEWS.js";
-import "../chunk-C4IKRLT4.js";
+import "../chunk-HD7AURL6.js";
+import "../chunk-GEA6ZV2P.js";
 import {
   claudeSettings
-} from "../chunk-YCYFREHD.js";
+} from "../chunk-KNVTKFDP.js";
 import {
   readJsonSafe,
   writeJsonAtomic
-} from "../chunk-77HBRZJI.js";
-import "../chunk-TXDFQD2I.js";
+} from "../chunk-6CDA4R5L.js";
+import "../chunk-RZD7ULBJ.js";
 import "../chunk-PPY5N2E6.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-6YG5PZZS.js";
+import "../chunk-CMDIKFVL.js";
 import "../chunk-ZVU6WMMU.js";
 import {
   isRecord
-} from "../chunk-OS32P4RZ.js";
+} from "../chunk-WOFHN2IZ.js";
 import "../chunk-MLKGABMK.js";
 
 // bin/pushary-bell.ts

package/dist/bin/pushary-claude.js

@@ -2,7 +2,7 @@
 import {
   WRAPPER_ACTIVE_ENV,
   findClaudeBinary
-} from "../chunk-PD2DWO4X.js";
+} from "../chunk-KYX7VBEE.js";
 import {
   CommandReceipts,
   controllerCommandSchema
@@ -12,39 +12,39 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-SI2CJ2BB.js";
-import "../chunk-J3W32P43.js";
+} from "../chunk-VHOGSWUF.js";
+import "../chunk-NI3NSURQ.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-ARDQBF25.js";
+} from "../chunk-GN2L5CYF.js";
 import {
   claudeTranscriptPath,
   redactDraft,
   registerTranscript,
   registeredTranscriptEnabled,
   startDraftPublisher
-} from "../chunk-QDS55ODM.js";
-import "../chunk-OP2WJEPY.js";
+} from "../chunk-CG3C2WL7.js";
+import "../chunk-VPT3RDTO.js";
 import {
   ensureDaemonRunning
-} from "../chunk-TZWK2BVY.js";
-import "../chunk-SISYAMDC.js";
-import "../chunk-3GPXHHBM.js";
-import "../chunk-OQY4G7FS.js";
+} from "../chunk-APFQBVQW.js";
+import "../chunk-HWEEBVS7.js";
+import "../chunk-5YRDZE5F.js";
+import "../chunk-5U63KUP3.js";
 import "../chunk-NMUI3ZWG.js";
-import "../chunk-PDRPVVZX.js";
+import "../chunk-UAUADSJX.js";
 import {
   external_exports
 } from "../chunk-XMSDA5WA.js";
 import {
   transcriptsEnabled
-} from "../chunk-SARU6WNW.js";
+} from "../chunk-CP72YEEA.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
-import "../chunk-TVGOSEWS.js";
+import "../chunk-HD7AURL6.js";
 import {
   DEFAULT_SESSION,
   fetchModeState,
@@ -57,17 +57,17 @@ import {
   removePendingCommand,
   reportEvent,
   savePendingCommand
-} from "../chunk-TAMHTWQZ.js";
+} from "../chunk-VVP4CP4O.js";
 import {
   UNNAMED_ACTION,
   deriveToolTarget,
   describeToolCall,
   scopePathFor
-} from "../chunk-XLM2JZBE.js";
+} from "../chunk-ZDIQPYM2.js";
 import {
   repoKeyFor,
   repositoryScopeFor
-} from "../chunk-KG7GT7UW.js";
+} from "../chunk-CB2RYMAO.js";
 import {
   askUser,
   cancelQuestion,
@@ -79,30 +79,30 @@ import {
   waitForAnswer,
   waitsForThePhone,
   withdrawQuestion
-} from "../chunk-CRJDKGEF.js";
+} from "../chunk-Z6O6CDTP.js";
 import "../chunk-POFBE6ZY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-V7EWOHNV.js";
-import "../chunk-CTKJVVDL.js";
-import "../chunk-B75SIY5C.js";
+} from "../chunk-E5WUBHVH.js";
+import "../chunk-OW4WEO56.js";
+import "../chunk-6RGQIKAC.js";
 import {
   getMachineId
-} from "../chunk-N2KK2NSY.js";
-import "../chunk-C4IKRLT4.js";
+} from "../chunk-ZFUSWR2P.js";
+import "../chunk-GEA6ZV2P.js";
 import {
   claudeConfigDir
-} from "../chunk-YCYFREHD.js";
-import "../chunk-77HBRZJI.js";
+} from "../chunk-KNVTKFDP.js";
+import "../chunk-6CDA4R5L.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-TXDFQD2I.js";
+} from "../chunk-RZD7ULBJ.js";
 import "../chunk-PPY5N2E6.js";
 import "../chunk-KZERVKTD.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-6YG5PZZS.js";
+} from "../chunk-CMDIKFVL.js";
 import "../chunk-ZVU6WMMU.js";
 import {
   DECISION_STOP_REASON,
@@ -115,7 +115,7 @@ import {
   refusesWhenUnanswered,
   resolveGate,
   timeoutActionWithoutLocalPrompt
-} from "../chunk-OS32P4RZ.js";
+} from "../chunk-WOFHN2IZ.js";
 import "../chunk-MLKGABMK.js";
 
 // src/wrapper/localPassthrough.ts

package/dist/bin/pushary-clean.js

@@ -15,30 +15,30 @@ import {
   storedMacAppState,
   storedPusharyKeychainServices,
   waitForMacAppExit
-} from "../chunk-AEOYYLXF.js";
+} from "../chunk-2ZAFA3XI.js";
 import {
   PUSHARY_SKILL_NAME,
   PUSHARY_SKILL_SOURCE,
   createGuards
 } from "../chunk-J42EAEX3.js";
-import "../chunk-VTFXPV4U.js";
+import "../chunk-TKOL7DJH.js";
 import "../chunk-XCEN33UP.js";
 import {
   describeCliKeyRevocation,
   planCliKeyRevocations,
   readCliHeldKeys,
   revokeCliKeys
-} from "../chunk-TQKVKV76.js";
+} from "../chunk-T35RHO3X.js";
 import {
   isCursorPluginLeftover,
   releaseSoleGate,
   withoutPusharyCursorHooks
-} from "../chunk-GAZPL742.js";
+} from "../chunk-VAY5AJ6N.js";
 import {
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-HOYWYQNC.js";
+} from "../chunk-5WOO44TA.js";
 import {
   configFileHoldsMacAppKey,
   macAppKeepsMcpEntry,
@@ -46,22 +46,22 @@ import {
   pusharyKey,
   readMacAppAgentKey,
   setupReceiptKey
-} from "../chunk-M52UDSMQ.js";
-import "../chunk-EMVK57K7.js";
+} from "../chunk-QP3OSLKU.js";
+import "../chunk-VVHNHETX.js";
 import {
   HERMES_CONFIG_FILE,
   defaultHermesHome,
   hermesReceiptPaths,
   removeHermesWiring
-} from "../chunk-2QFD5XGU.js";
+} from "../chunk-JR6FCHAQ.js";
 import "../chunk-QCGNGEGE.js";
 import {
   planClineRemoval,
   planFxRemoval,
   removeClineServer
-} from "../chunk-WVDPP7OQ.js";
-import "../chunk-IVYKPYMH.js";
-import "../chunk-XZHJVGR3.js";
+} from "../chunk-OBB6VTSG.js";
+import "../chunk-TZE2S3XP.js";
+import "../chunk-RSITUL2U.js";
 import {
   OPENCODE_ASKED_PERMISSIONS,
   OPENCODE_PLUGIN_SIBLING,
@@ -75,15 +75,15 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-BDCFB4NV.js";
+} from "../chunk-4D4USO5K.js";
 import {
   ansiPainter,
   useColor
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-MSPHJNUL.js";
-import "../chunk-J3W32P43.js";
+} from "../chunk-MGYGWHG5.js";
+import "../chunk-NI3NSURQ.js";
 import {
   compatibleConfigFile,
   compatibleDocuments,
@@ -95,10 +95,10 @@ import {
   removeCompatibleHooks,
   removeCompatibleMcpServer,
   serializeConfigDocument
-} from "../chunk-7CW3K3B5.js";
+} from "../chunk-HXUE6IIP.js";
 import {
   disableDaemonService
-} from "../chunk-TZWK2BVY.js";
+} from "../chunk-APFQBVQW.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
@@ -107,9 +107,9 @@ import {
   resolveBridgeStub,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-SISYAMDC.js";
-import "../chunk-3GPXHHBM.js";
-import "../chunk-OQY4G7FS.js";
+} from "../chunk-HWEEBVS7.js";
+import "../chunk-5YRDZE5F.js";
+import "../chunk-5U63KUP3.js";
 import {
   parseFlags
 } from "../chunk-NMUI3ZWG.js";
@@ -119,18 +119,18 @@ import {
   isDisabledExport,
   removeClaudeAlias,
   shellProfileCandidates
-} from "../chunk-TVGOSEWS.js";
+} from "../chunk-HD7AURL6.js";
 import "../chunk-E46NE7FB.js";
-import "../chunk-TAMHTWQZ.js";
-import "../chunk-XLM2JZBE.js";
-import "../chunk-KG7GT7UW.js";
-import "../chunk-CRJDKGEF.js";
+import "../chunk-VVP4CP4O.js";
+import "../chunk-ZDIQPYM2.js";
+import "../chunk-CB2RYMAO.js";
+import "../chunk-Z6O6CDTP.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-V7EWOHNV.js";
-import "../chunk-CTKJVVDL.js";
-import "../chunk-B75SIY5C.js";
-import "../chunk-N2KK2NSY.js";
-import "../chunk-C4IKRLT4.js";
+import "../chunk-E5WUBHVH.js";
+import "../chunk-OW4WEO56.js";
+import "../chunk-6RGQIKAC.js";
+import "../chunk-ZFUSWR2P.js";
+import "../chunk-GEA6ZV2P.js";
 import {
   claudeConfigDir,
   claudeJson,
@@ -173,24 +173,24 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-YCYFREHD.js";
+} from "../chunk-KNVTKFDP.js";
 import {
   cleanNpmEnv,
   globalPackageState,
   npmIsOnPath,
   readGlobalFolder,
   readGlobalPrefix
-} from "../chunk-77HBRZJI.js";
+} from "../chunk-6CDA4R5L.js";
 import {
   getBaseUrl
-} from "../chunk-TXDFQD2I.js";
+} from "../chunk-RZD7ULBJ.js";
 import "../chunk-PPY5N2E6.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-6YG5PZZS.js";
+} from "../chunk-CMDIKFVL.js";
 import {
   CLI_PACKAGE_NAMES,
   globalPackageFolder,
@@ -204,7 +204,7 @@ import {
   SUPPORT_EMAIL,
   isValidApiKey,
   redactSecrets
-} from "../chunk-OS32P4RZ.js";
+} from "../chunk-WOFHN2IZ.js";
 import "../chunk-MLKGABMK.js";
 
 // bin/pushary-clean.ts

package/dist/bin/pushary-codex-bridge.js

@@ -1,45 +1,45 @@
 #!/usr/bin/env node
 import {
   runCodexBridge
-} from "../chunk-YGMSDYOH.js";
-import "../chunk-NGSJHUQN.js";
+} from "../chunk-KZTN6OXM.js";
+import "../chunk-5OLBO5EB.js";
 import {
   resolveProviderBinary
-} from "../chunk-KHGW7THQ.js";
-import "../chunk-UFWRBHTV.js";
+} from "../chunk-LKDAMWTZ.js";
+import "../chunk-QCEY7TSX.js";
 import "../chunk-N5P2FLOJ.js";
 import {
   withSpawnProcessOwnership
-} from "../chunk-SI2CJ2BB.js";
-import "../chunk-J3W32P43.js";
-import "../chunk-PDRPVVZX.js";
+} from "../chunk-VHOGSWUF.js";
+import "../chunk-NI3NSURQ.js";
+import "../chunk-UAUADSJX.js";
 import "../chunk-XMSDA5WA.js";
 import {
   transcriptsEnabled
-} from "../chunk-SARU6WNW.js";
+} from "../chunk-CP72YEEA.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-TVGOSEWS.js";
-import "../chunk-KG7GT7UW.js";
-import "../chunk-CRJDKGEF.js";
+import "../chunk-HD7AURL6.js";
+import "../chunk-CB2RYMAO.js";
+import "../chunk-Z6O6CDTP.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-V7EWOHNV.js";
-import "../chunk-CTKJVVDL.js";
-import "../chunk-B75SIY5C.js";
+import "../chunk-E5WUBHVH.js";
+import "../chunk-OW4WEO56.js";
+import "../chunk-6RGQIKAC.js";
 import {
   getMachineId
-} from "../chunk-N2KK2NSY.js";
-import "../chunk-C4IKRLT4.js";
-import "../chunk-YCYFREHD.js";
-import "../chunk-77HBRZJI.js";
+} from "../chunk-ZFUSWR2P.js";
+import "../chunk-GEA6ZV2P.js";
+import "../chunk-KNVTKFDP.js";
+import "../chunk-6CDA4R5L.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-TXDFQD2I.js";
+} from "../chunk-RZD7ULBJ.js";
 import "../chunk-PPY5N2E6.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-6YG5PZZS.js";
+import "../chunk-CMDIKFVL.js";
 import "../chunk-ZVU6WMMU.js";
-import "../chunk-OS32P4RZ.js";
+import "../chunk-WOFHN2IZ.js";
 import "../chunk-MLKGABMK.js";
 
 // bin/pushary-codex-bridge.ts