@pushary/agent-hooks 0.98.0 → 1.0.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 1.0.0
+
+Run `pushary setup` and tick the agents you use. Five more are on the list: Qwen Code, CodeBuddy, Qoder, Droid and Devin CLI. Nothing changes for an agent you already had wired.
+
+- Gate five more agents on their own hooks, not on good intentions. Qwen Code, CodeBuddy, Qoder, Droid and Devin CLI each register the same events Claude Code does, in the file and the spelling that agent uses, and each returns a verdict that agent obeys. Shell commands, writes and edits go through your policy and your phone the same way they always have. Twelve agents are now enforced rather than cooperative.
+- Devin answers in its own dialect. It reads `{"decision":"approve"|"block"}` where the others read Claude's `permissionDecision`, so the verdict is written the way each agent reads it. A stop from your phone carries across both: it ends the turn rather than declining one tool call and letting the next one through.
+- Two tools are deliberately not claimed on Devin. A question answered on your phone comes back as rewritten input, and Devin's reply shape has nowhere to put it, so asking there would tell the agent "approved" and hand it the question you already answered. Pushary stands aside instead, and Devin asks you itself.
+- Read the file out of a patch before judging it. Droid edits by sending a patch rather than a path, and a rule written for a file cannot match a patch body. A single-file patch is now resolved to the file it touches, so `Edit(**/.env)` denies it. A patch over several files is not judged at all and goes back to the agent to ask, because one answer cannot cover several files honestly.
+- Never judge a call whose target cannot be read. If a tool names its file under a key Pushary does not recognise, the only rule that could match is the one written for the tool alone, and that is always the looser one. Pushary now says it has no opinion and lets the agent ask you, rather than approving on a rule that was never meant for that file.
+- Leave a config alone when it is not the shape Pushary knows. These are five other vendors' files. Where a hook list is something other than a list, setup now names the key, changes nothing and reports the agent as skipped, instead of replacing what it found. It already refused to rewrite a file that would not parse; this is the same care for a file that parses and is simply shaped differently.
+- Keep the directory a shell command names. An approval card that said `rm -rf *` without saying where it ran was describing a different command than the one about to happen.
+
+These five rest on each vendor's documentation and our own round trip; no vendor binary was installed to confirm them. If setup reports one as skipped, that is the check above doing its job, and the message names the key it did not recognise.
+
+## 0.99.0
+
+Nothing to run. This release is the part that runs itself: the repairs below happen on the next session start, on the machine that already has them wrong.
+
+- Switch on a hold that an older release registered without its proof. `PermissionDenied` and Codex's `Stop` hold only when their registration carries `--hold-budget`, and a registration written before 0.97.0 is present and looks correct, so nothing noticed it had stopped holding. Until now the repair was `pushary upgrade`, run by hand. Claude Code's registration is now checked on every session start whether or not Claude Code itself has changed, and Codex's is checked on its own session start, which had no repair of any kind before this. An auto-mode block or an auto-reviewer denial can be answered again without anyone being told to run a command.
+- Hooks the macOS app wrote are still left to the app, on both agents. It repairs its own, and rewriting them here would point them at a binary the app does not install.
+- Read a hold budget that is not this release's as no proof, which is what the Mac app has always done. `pushary doctor` says a hook "carries no current hold budget" rather than that it predates one, because now it can mean either.
+- Never replace an absolute path in a hook command with a bare name. When the bin directory cannot be found, which is what a GUI-launched agent or an nvm switch does to `npm prefix -g`, the rewrite is refused and the registration you already have is left alone. A hold that does not hold still works less well than it should; a hook command that no longer resolves does nothing at all, and the rewrite touches every event at once. `pushary upgrade` is a person at a prompt and is unchanged.
+- Write Codex's `config.toml` atomically, carrying its permissions over. It is now written from a session-start hook, and two sessions starting at once must not leave it half written. An atomic write replaces the file rather than its bytes, so the mode is copied across by hand: this file holds your API key, Codex creates it private to you, and it stays that way.
+
 ## 0.98.0
 
 Run `pushary setup` so the instruction block in Codex's AGENTS.md, GEMINI.md and OpenCode's AGENTS.md carries the new line. `pushary upgrade` rewrites hooks and trust, not instruction files.

package/dist/bin/pushary-bell-hook.js

@@ -1,34 +1,35 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-NIXVMMJM.js";
+} from "../chunk-S2W4ZSHE.js";
 import {
   readHookInput
-} from "../chunk-M4TVEMLH.js";
-import "../chunk-5B5QV3KC.js";
-import "../chunk-OBYC6SN4.js";
-import "../chunk-W2MG2P46.js";
-import "../chunk-LBNAGGLV.js";
-import "../chunk-IRLTW6KF.js";
-import "../chunk-6LRGZJFB.js";
-import "../chunk-DOD3A6EU.js";
-import "../chunk-HFQ7WSHZ.js";
-import "../chunk-2GLOHBYB.js";
-import "../chunk-XPPXOKIG.js";
+} from "../chunk-IWZG2Y4Z.js";
+import "../chunk-HGEI7SVM.js";
+import "../chunk-YKLCWWEI.js";
+import "../chunk-2SL5X7UB.js";
+import "../chunk-3UUAK2AK.js";
+import "../chunk-CDTGL7TT.js";
+import "../chunk-XK34HTMW.js";
+import "../chunk-MSOFZYI3.js";
+import "../chunk-2PS3DTHQ.js";
+import "../chunk-UWQVODHT.js";
+import "../chunk-7ZDFVWRR.js";
 import "../chunk-EQRS3SGM.js";
-import "../chunk-NQGYPTJQ.js";
+import "../chunk-IBU7UU3R.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-OPR2BPD4.js";
-import "../chunk-WU6LSXJ6.js";
-import "../chunk-XL3RKJYQ.js";
+import "../chunk-EMCNSBF3.js";
+import "../chunk-7WMFPYR5.js";
+import "../chunk-LTPQKBJH.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-SJLGOVC6.js";
+import "../chunk-DOYARIYB.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-VZD2GEKB.js";
+import "../chunk-A3D43VXO.js";
+import "../chunk-4LL6LG5X.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-OUAE3GKO.js";
+import "../chunk-TTBRBWAK.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,15 +5,15 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-NIXVMMJM.js";
+} from "../chunk-S2W4ZSHE.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-2GLOHBYB.js";
+} from "../chunk-UWQVODHT.js";
 import {
   claudeSettings
-} from "../chunk-XL3RKJYQ.js";
+} from "../chunk-LTPQKBJH.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
@@ -25,17 +25,18 @@ import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-SJLGOVC6.js";
+import "../chunk-DOYARIYB.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
+import "../chunk-A3D43VXO.js";
 import {
   readJsonSafe,
   writeJsonAtomic
-} from "../chunk-VZD2GEKB.js";
+} from "../chunk-4LL6LG5X.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-OUAE3GKO.js";
+import "../chunk-TTBRBWAK.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,7 +8,7 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-J44RPHUZ.js";
+} from "../chunk-DMJTWULU.js";
 import {
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
@@ -17,30 +17,33 @@ import {
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-5B5QV3KC.js";
-import "../chunk-OBYC6SN4.js";
-import "../chunk-W2MG2P46.js";
-import "../chunk-LBNAGGLV.js";
-import "../chunk-IRLTW6KF.js";
-import "../chunk-6LRGZJFB.js";
+} from "../chunk-HGEI7SVM.js";
+import "../chunk-YKLCWWEI.js";
+import "../chunk-2SL5X7UB.js";
+import "../chunk-3UUAK2AK.js";
+import "../chunk-CDTGL7TT.js";
+import "../chunk-XK34HTMW.js";
 import {
   ensureDaemonRunning
-} from "../chunk-DOD3A6EU.js";
-import "../chunk-HFQ7WSHZ.js";
-import "../chunk-2GLOHBYB.js";
+} from "../chunk-MSOFZYI3.js";
+import "../chunk-2PS3DTHQ.js";
+import "../chunk-UWQVODHT.js";
 import {
   encryptRecord
-} from "../chunk-XPPXOKIG.js";
+} from "../chunk-7ZDFVWRR.js";
 import "../chunk-EQRS3SGM.js";
 import {
   transcriptsEnabled
-} from "../chunk-NQGYPTJQ.js";
+} from "../chunk-IBU7UU3R.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import {
   DEFAULT_SESSION,
+  UNNAMED_ACTION,
+  deriveToolTarget,
+  describeToolCall,
   fetchModeState,
   getPolicy,
   markPendingCommandDelivered,
@@ -51,15 +54,10 @@ import {
   removePendingCommand,
   repoKeyFor,
   reportEvent,
-  savePendingCommand
-} from "../chunk-YJDRHQLG.js";
-import {
-  UNNAMED_ACTION,
-  deriveToolTarget,
-  describeToolCall,
+  savePendingCommand,
   scopePathFor
-} from "../chunk-A76GNRIK.js";
-import "../chunk-OPR2BPD4.js";
+} from "../chunk-MDV7ZRAT.js";
+import "../chunk-EMCNSBF3.js";
 import {
   DECISION_STOP_REASON,
   askUser,
@@ -72,16 +70,17 @@ import {
 } from "../chunk-LGXUGYUH.js";
 import {
   getMachineId
-} from "../chunk-WU6LSXJ6.js";
-import "../chunk-XL3RKJYQ.js";
+} from "../chunk-7WMFPYR5.js";
+import "../chunk-LTPQKBJH.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-SJLGOVC6.js";
+import "../chunk-DOYARIYB.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-VZD2GEKB.js";
+import "../chunk-A3D43VXO.js";
+import "../chunk-4LL6LG5X.js";
 import {
   getApiKey,
   getBaseUrl
@@ -90,7 +89,7 @@ import {
   KILL_REASON,
   redactSecrets,
   resolveGate
-} from "../chunk-OUAE3GKO.js";
+} from "../chunk-TTBRBWAK.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {

package/dist/bin/pushary-clean.js

@@ -5,14 +5,14 @@ import {
   createGuards,
   resolveHermesPython,
   runHermesPythonScript
-} from "../chunk-FAJ4R7IB.js";
+} from "../chunk-RFNMSC6N.js";
 import "../chunk-KBITFQST.js";
 import {
   removeInstructionBlock,
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-V47GITZV.js";
+} from "../chunk-447SBIC7.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -22,35 +22,45 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-HB2KB7QL.js";
+} from "../chunk-XNXIMIFY.js";
+import {
+  compatibleConfigFile,
+  compatibleInstructionsFile,
+  compatibleMcpFile,
+  compatiblePermissionRuleFile,
+  removeCompatibleHooks,
+  removeCompatibleMcpServer
+} from "../chunk-HS2KEAFD.js";
 import {
   isClaudeMcpSnapshot,
   removeClaudeMcpServers,
   removePusharySettings,
+  removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-QXIF6R4P.js";
+} from "../chunk-MGI6MLFU.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-W2MG2P46.js";
-import "../chunk-LBNAGGLV.js";
-import "../chunk-IRLTW6KF.js";
+} from "../chunk-2SL5X7UB.js";
+import "../chunk-3UUAK2AK.js";
+import "../chunk-CDTGL7TT.js";
 import {
   pusharyHookExecutable
-} from "../chunk-6LRGZJFB.js";
+} from "../chunk-XK34HTMW.js";
 import {
   disableDaemonService
-} from "../chunk-DOD3A6EU.js";
+} from "../chunk-MSOFZYI3.js";
 import {
   removeGeminiSettings
-} from "../chunk-HFQ7WSHZ.js";
-import "../chunk-2GLOHBYB.js";
+} from "../chunk-2PS3DTHQ.js";
+import "../chunk-UWQVODHT.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-A76GNRIK.js";
-import "../chunk-OPR2BPD4.js";
-import "../chunk-WU6LSXJ6.js";
+import "../chunk-MDV7ZRAT.js";
+import "../chunk-EMCNSBF3.js";
+import "../chunk-LGXUGYUH.js";
+import "../chunk-7WMFPYR5.js";
 import {
   bridgeAgentKey,
   claudeJson,
@@ -79,7 +89,7 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-XL3RKJYQ.js";
+} from "../chunk-LTPQKBJH.js";
 import {
   exitOnHelpFlag
 } from "../chunk-GOQHN2UH.js";
@@ -90,18 +100,22 @@ import {
 import "../chunk-DINDL2CF.js";
 import {
   removeClaudeAlias
-} from "../chunk-SJLGOVC6.js";
+} from "../chunk-DOYARIYB.js";
+import "../chunk-EYRGBYZG.js";
+import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-VZD2GEKB.js";
+import "../chunk-A3D43VXO.js";
+import "../chunk-4LL6LG5X.js";
 import "../chunk-2UMNXADU.js";
 import {
   CURSOR_GATE_EVENTS,
+  HOOK_COMPATIBLE_PROFILES,
   HOOK_LOCATOR_BINARY,
   isValidApiKey
-} from "../chunk-OUAE3GKO.js";
+} from "../chunk-TTBRBWAK.js";
 
 // bin/pushary-clean.ts
 import { existsSync, readFileSync, copyFileSync, readdirSync } from "fs";
@@ -550,6 +564,35 @@ var main = async () => {
   } else {
     console.log(`  ${skip} Codex skill directory ${dim("(not found)")}`);
   }
+  for (const profile of HOOK_COMPATIBLE_PROFILES) {
+    const edits = [
+      [compatibleConfigFile(profile), (config) => removeCompatibleHooks(config, profile)],
+      ...compatibleMcpFile(profile) ? [[compatibleMcpFile(profile), (config) => removeCompatibleMcpServer(config, profile)]] : [],
+      ...compatiblePermissionRuleFile(profile) ? [[compatiblePermissionRuleFile(profile), removePusharyToolPermissions]] : []
+    ];
+    const byPath = /* @__PURE__ */ new Map();
+    for (const [path, edit] of edits) byPath.set(path, [...byPath.get(path) ?? [], edit]);
+    for (const [path, removals] of byPath) {
+      const config = readJson(path);
+      if (!config) {
+        console.log(`  ${skip} ${profile.label} ${shortenHome(path)} ${dim("(not found)")}`);
+        continue;
+      }
+      if (removals.reduce((changed, remove) => remove(config) || changed, false)) {
+        writeJson(path, config);
+        console.log(`  ${check} ${profile.label} ${shortenHome(path)} ${dim(did("cleaned"))}`);
+      } else {
+        console.log(`  ${skip} ${profile.label} ${shortenHome(path)} ${dim("(no pushary entries)")}`);
+      }
+    }
+    const instructions = compatibleInstructionsFile(profile);
+    if (!instructions) continue;
+    if (guardedInstructionBlockRemoval(instructions)) {
+      console.log(`  ${check} ${profile.label} ${shortenHome(instructions)} ${dim("(removed Pushary block)")}`);
+    } else {
+      console.log(`  ${skip} ${profile.label} ${shortenHome(instructions)} ${dim("(no pushary block)")}`);
+    }
+  }
   const geminiSettingsPath = geminiSettings();
   const geminiSettings2 = readJson(geminiSettingsPath);
   if (geminiSettings2) {

package/dist/bin/pushary-codex-bridge.js

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
-import "../chunk-TZHDKRMG.js";
+import "../chunk-IYA3NCZG.js";
 import {
   LiveTranscriptRelay,
   liveSessionSleep,
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-5KLAETSU.js";
+} from "../chunk-GTR72MIU.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
   describeIdleWindow,
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-J44RPHUZ.js";
-import "../chunk-XPPXOKIG.js";
+} from "../chunk-DMJTWULU.js";
+import "../chunk-7ZDFVWRR.js";
 import "../chunk-EQRS3SGM.js";
 import {
   transcriptsEnabled
-} from "../chunk-NQGYPTJQ.js";
+} from "../chunk-IBU7UU3R.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
@@ -28,18 +28,19 @@ import {
 } from "../chunk-LGXUGYUH.js";
 import {
   getMachineId
-} from "../chunk-WU6LSXJ6.js";
+} from "../chunk-7WMFPYR5.js";
 import {
   resolveBinary
-} from "../chunk-XL3RKJYQ.js";
-import "../chunk-SJLGOVC6.js";
+} from "../chunk-LTPQKBJH.js";
+import "../chunk-DOYARIYB.js";
 import {
   callMcpTool
 } from "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-VZD2GEKB.js";
+import "../chunk-A3D43VXO.js";
+import "../chunk-4LL6LG5X.js";
 import {
   getApiKey,
   getBaseUrl
@@ -47,7 +48,7 @@ import {
 import {
   parseAgentQuestion,
   parseAgentQuestionAnswers
-} from "../chunk-OUAE3GKO.js";
+} from "../chunk-TTBRBWAK.js";
 
 // bin/pushary-codex-bridge.ts
 import { existsSync } from "fs";

package/dist/bin/pushary-codex-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   takeHookHoldBudget
-} from "../chunk-SI7GYBQP.js";
+} from "../chunk-XKDKUFMP.js";
 import {
   blockedActionFingerprint,
   codexCallKey,
@@ -12,38 +12,44 @@ import {
   recordBlockedActionHint,
   recordCodexCallDecision,
   userScope
-} from "../chunk-53QCTSWY.js";
+} from "../chunk-3C4ERARU.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-XOOWC62T.js";
+} from "../chunk-DUOG74E7.js";
 import {
   readHookInput
-} from "../chunk-M4TVEMLH.js";
+} from "../chunk-IWZG2Y4Z.js";
 import {
   denyReasonFrom,
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
-import "../chunk-5B5QV3KC.js";
-import "../chunk-OBYC6SN4.js";
-import "../chunk-W2MG2P46.js";
-import "../chunk-LBNAGGLV.js";
-import "../chunk-IRLTW6KF.js";
-import "../chunk-6LRGZJFB.js";
-import "../chunk-DOD3A6EU.js";
-import "../chunk-HFQ7WSHZ.js";
-import "../chunk-2GLOHBYB.js";
-import "../chunk-XPPXOKIG.js";
+import "../chunk-HGEI7SVM.js";
+import "../chunk-YKLCWWEI.js";
+import "../chunk-2SL5X7UB.js";
+import "../chunk-3UUAK2AK.js";
+import "../chunk-CDTGL7TT.js";
+import "../chunk-XK34HTMW.js";
+import "../chunk-MSOFZYI3.js";
+import "../chunk-2PS3DTHQ.js";
+import "../chunk-UWQVODHT.js";
+import "../chunk-7ZDFVWRR.js";
 import "../chunk-EQRS3SGM.js";
-import "../chunk-NQGYPTJQ.js";
+import "../chunk-IBU7UU3R.js";
 import "../chunk-XHKBHWLX.js";
 import {
   CODEX_AGENT,
   DEFAULT_SESSION,
+  UNNAMED_ACTION,
   codexAllow,
   codexDeny,
   codexPass,
+  codexReviewerDenialsSince,
+  deriveActionBody,
+  deriveBlocker,
+  deriveToolTarget,
   describeApplyPatch,
+  describeToolCall,
   fetchModeState,
   getPolicy,
   handleCompaction,
@@ -52,30 +58,22 @@ import {
   handleStop,
   handleSubagentStop,
   handleUserPrompt,
+  isCodexGuardianRolloutHead,
   permissionTimeoutDecision,
   policyRequestFor,
   preToolUseTimeoutDecision,
+  readCodexTurnContext,
   readLastPrompt,
   repoKeyFor,
   reportEvent,
+  scanCodexGuardianReviews,
+  scopePathFor,
+  sessionIdentityOf,
   toCodexWire,
   toPolicyLookup,
   toPolicyLookups
-} from "../chunk-YJDRHQLG.js";
-import {
-  UNNAMED_ACTION,
-  codexReviewerDenialsSince,
-  deriveActionBody,
-  deriveBlocker,
-  deriveToolTarget,
-  describeToolCall,
-  isCodexGuardianRolloutHead,
-  readCodexTurnContext,
-  scanCodexGuardianReviews,
-  scopePathFor,
-  sessionIdentityOf
-} from "../chunk-A76GNRIK.js";
-import "../chunk-OPR2BPD4.js";
+} from "../chunk-MDV7ZRAT.js";
+import "../chunk-EMCNSBF3.js";
 import {
   DECISION_STOP_REASON,
   askUser,
@@ -90,20 +88,21 @@ import {
 } from "../chunk-LGXUGYUH.js";
 import {
   getMachineId
-} from "../chunk-WU6LSXJ6.js";
+} from "../chunk-7WMFPYR5.js";
 import {
   canonicalJson
-} from "../chunk-XL3RKJYQ.js";
+} from "../chunk-LTPQKBJH.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-SJLGOVC6.js";
+import "../chunk-DOYARIYB.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
+import "../chunk-A3D43VXO.js";
 import {
   writeFileAtomic
-} from "../chunk-VZD2GEKB.js";
+} from "../chunk-4LL6LG5X.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
@@ -119,7 +118,7 @@ import {
   hookWaitClamped,
   hookWaitDeadline,
   resolveGate
-} from "../chunk-OUAE3GKO.js";
+} from "../chunk-TTBRBWAK.js";
 
 // bin/pushary-codex-hook.ts
 import { basename } from "path";
@@ -733,6 +732,14 @@ var decidePreToolUse = async (input) => {
     return codexPass();
   }
 };
+var repairCodexHoldsQuietly = async () => {
+  try {
+    const { repairCodexHolds } = await import("../reapply-I4NB5SSM.js");
+    repairCodexHolds();
+  } catch {
+    return;
+  }
+};
 var reportSessionStart = async (input, action = "Session started") => {
   try {
     await reportEvent({
@@ -803,6 +810,7 @@ var main = async () => {
         break;
       }
       case "SessionStart":
+        await repairCodexHoldsQuietly();
         await reportSessionStart(input);
         break;
       case "SessionEnd":

package/dist/bin/pushary-codex.js

@@ -1,9 +1,8 @@
 #!/usr/bin/env node
 import {
   reportEvent
-} from "../chunk-YJDRHQLG.js";
-import "../chunk-A76GNRIK.js";
-import "../chunk-OPR2BPD4.js";
+} from "../chunk-MDV7ZRAT.js";
+import "../chunk-EMCNSBF3.js";
 import {
   askUser,
   isDecisionStopped,
@@ -11,17 +10,18 @@ import {
 } from "../chunk-LGXUGYUH.js";
 import {
   getMachineId
-} from "../chunk-WU6LSXJ6.js";
-import "../chunk-XL3RKJYQ.js";
+} from "../chunk-7WMFPYR5.js";
+import "../chunk-LTPQKBJH.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-VZD2GEKB.js";
+import "../chunk-A3D43VXO.js";
+import "../chunk-4LL6LG5X.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
-import "../chunk-OUAE3GKO.js";
+import "../chunk-TTBRBWAK.js";
 
 // bin/pushary-codex.ts
 import { basename } from "path";

package/dist/bin/pushary-connect.js

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import {
   printKeyCheck
-} from "../chunk-6C6MS57P.js";
+} from "../chunk-TVY7AT6O.js";
 import {
   connectDevice,
   connectExistingApp,
   printConnectInstructions
-} from "../chunk-LX4NNYII.js";
+} from "../chunk-BPD4P3NN.js";
 import "../chunk-3EGEA4KH.js";
 import {
   checkApiKey
-} from "../chunk-3RVCQDC4.js";
+} from "../chunk-BOZETFXB.js";
 import "../chunk-QCGNGEGE.js";
 import {
   createIo
@@ -25,7 +25,7 @@ import {
 import "../chunk-DINDL2CF.js";
 import {
   readKeySource
-} from "../chunk-SJLGOVC6.js";
+} from "../chunk-DOYARIYB.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import {
@@ -34,9 +34,10 @@ import {
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-VZD2GEKB.js";
+import "../chunk-A3D43VXO.js";
+import "../chunk-4LL6LG5X.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-OUAE3GKO.js";
+import "../chunk-TTBRBWAK.js";
 
 // bin/pushary-connect.ts
 exitOnHelpFlag("connect");