Pushary
Blog
Changelog

What shipped: more agents, and agents that ask before risky steps

Gemini CLI and Codex now have native Pushary hooks, and setup writes a proactive-ask instruction so they volunteer questions over push.

AG
Aadil Ghani
Founder, Pushary
Jun 26, 20262 min read
Share

Two things landed in agent-hooks. Gemini CLI and Codex are now first-class, and setup teaches both of them to ask you before a risky step instead of waiting to be stopped at a gate.

More agents, wired natively

Gemini CLI connects through MCP plus native hooks. Codex gets a native hooks adapter with auto-trust and a file-based key, so it works without you pasting credentials into a config by hand. Both join Claude Code, Cursor, and Hermes on the same CLI hook path, which means the same permission policy and the same audit trail apply no matter which agent is running. See Codex notifications for the Codex setup, or the quickstart to connect any of them.

Why "ask before" needed a fix

A hook is a gate. It fires when an agent reaches for a tool, and Pushary decides allow, ask, or deny. That covers shell commands and file writes well. It does not cover the cases where the agent should pause and ask a judgment question on its own, like "which of these two refactors do you want" or "this migration will drop a column, proceed?" Those only happen if the agent decides to ask.

Codex and Gemini were not volunteering those questions, because nothing told them they could. The hook gates them, but it never drives the asking.

What changed

Setup now writes a short use-Pushary instruction into the file each CLI already loads on startup: AGENTS.md for Codex, GEMINI.md for Gemini CLI. The instruction tells the agent to send a push and wait for your answer before anything risky or irreversible, and to notify you when a long task finishes. So now you get both layers: the hook still enforces your permission policy, and the agent also raises its own questions to your phone.

The read-only safe floor still applies underneath. Proven read-only commands like ls, cat, and git status auto-approve so you only hear about decisions that matter. That floor was set from 1,721 real production questions, not a guess.

Turning it on

Run setup or doctor and it writes the instruction file for you. Existing installs pick it up on the next setup run. If you manage AGENTS.md or GEMINI.md yourself, the block is additive and you can edit the wording.

Every question and answer lands in the audit log with its answer source, so a teammate or an auditor can see what was asked and how it was decided. More on the agent surface at Pushary for AI agents.

AG
Aadil Ghani
Founder, Pushary

Building Pushary so an AI agent can reach you on your phone and wait for a yes before it does something you would not want.

Read next

Changelog

Connect Claude Desktop with one URL: notify and ask, nothing else

Paste one URL to let Claude Desktop reach your phone. Connector-scoped revocable key, notify and ask only, no enforced gating.

Jun 25, 20262 min readAadil Ghani
Changelog

Pushary for Cursor: a fail-closed gate, now on the marketplace

A Cursor plugin that gates shell commands behind a phone approval, fails closed, and survives the Windows stdin double-fire bug.

Jun 20, 20262 min readAadil Ghani
Changelog

What shipped: reliable delivery across browser, mobile, and the iOS home screen

We fixed silent push failures on agent sites, put Web Push, Mobile, and Slack in one Connections tab, and gave iOS home-screen users a pending-questions inbox.

Jun 19, 20261 min readAadil Ghani

Get a push the moment your agent needs you

Approvals, done alerts, and a kill switch for Claude Code, Codex, Cursor, and the rest. It takes a couple of minutes to set up.