Pushary

Stop babysitting AI agents. Approve Claude Code, Codex, Cursor & Gemini from your lock screen. One policy + audit trail across every agent.

[Pushary @usepushary]

Your AI agent didn’t fail. It’s waiting for you.

Pushary puts Claude Code, Codex, Cursor & Gemini approvals on your lock screen. Tap yes/no. The run continues.

One inbox. One policy. An audit trail across every agent.

What still makes you babysit your agents?

[Pushary @usepushary]

unblocking agents one tap at a time

[Aadil Ghani @aadilbuilds]

cracked event yesterday in Berlin

Thanks to M&M siblings for organizing and Almedia for hosting <3

[Product Hunt 😸 @ProductHunt]

Tired of digging through your AI notifications?

@usepushary puts Claude Code, Codex, Cursor, Gemini CLI, VS Code and OpenCode in your Mac’s notch. For quick responses and status updates.

[Pushary @usepushary]

@ProductHunt Keep pushing, click, tap, go 🫶

PH1MON for 1 month free

[Pushary @usepushary]

@aadilbuilds Making moves, one tap at a time >>

[Pushary @usepushary]

@aadilbuilds @ProductHunt PH1MON at checkout for a month off

[Pushary @usepushary]

@askOkara How do you handle a queued reply when the conversation changes before review? I'd want the card to show what's new and let me skip it if someone already answered. A high-impact item can become unnecessary while it waits in the feed.

[Pushary @usepushary]

An approval should apply to the exact action shown.

Approve a draft, then change its recipient, attachment or text: the old approval should no longer allow sending.

That's a useful test for any agent workflow with a human review step.

[Pushary @usepushary]

@aadilbuilds u know what else is sick/

https://t.co/ExE5RUZf5c

[Pushary @usepushary]

@nykdotdev Yes. Expiry limits duration; revocation handles intent changing before expiry. The control plane has to propagate revocation to active runs, not just prevent the next run. Otherwise a valid grant can outlive the decision that created it.

[Pushary @usepushary]

The approval step is the right boundary, but the email trigger needs its own controls too: verified sender, replay protection, merchant or category allowlists, per-transaction and daily caps, and short-lived cards. Otherwise one spoofed message can inherit both identity and spend.

[Pushary @usepushary]

An autonomous agent can stop for four different reasons:

• quota
• missing context
• failed validation
• missing authority

They should not look the same to the operator.

Every stopped run needs a reason, the last safe action, the smallest next input, and whether it can resume automatically.

[Pushary @usepushary]

@nykdotdev Yes. The grant should carry its own budget: allowed action, resource boundary, expiry, and revocation. The agent receives a capability it can exercise, not permanent access it can reinterpret.

[Pushary @usepushary]

Running agents on your infrastructure is the right direction. The next boundary is authority: service-scoped credentials, approval for public or destructive mutations, and receipts written outside the agent process. Infrastructure ownership without action-level controls still leaves the operator guessing what was delegated.

[Pushary @usepushary]

@itselyone PASS/BLOCKED is a useful contract between the agent and operator. BLOCKED becomes much better when it includes the attempted action, resource, boundary crossed, and smallest decision needed. Then the human can answer without reopening the task or widening scope accidentally.

[Pushary @usepushary]

@zent7x The per-task permission choice is the most interesting part. Even “full” needs boundaries around external side effects like deploys, messages, billing, and secret access. A critic catches bad code. An authority layer catches actions nobody actually delegated.

[Pushary @usepushary]

@ConorBronsdon @SlackHQ Slack can make agent work legible to the team, but channel membership should not automatically grant authority to act. Context can come from the channel. Permission should resolve separately by action, resource, and owner, especially when several people steer one agent.

[Pushary @usepushary]

@SeanMathena This is the distinction that matters. Logs answer what happened, not whether it was authorized. Before the side effect, the runtime still needs to verify the owner, granted scope, and whether that grant remains valid.

[Pushary @usepushary]

That first prompt for reads outside the working directory carries a lot of authority. The choice should be scoped to specific paths, expire with the session, and remain visible in the audit trail. “Allow once” is very different from silently turning one consent into permanent filesystem access.

[Pushary @usepushary]

Read access needs a boundary too. Scanning outside the selected workspace can expose session history, credentials, and unrelated client code even if nothing is modified. The safe default is workspace-only discovery, an explicit prompt before expanding scope, and a receipt showing which paths were read.