@pushary/agent-hooks 1.6.2 → 1.6.4

package/dist/{chunk-A5ODW52C.js → chunk-CAS7GFWI.js}

@@ -447,6 +447,34 @@ var compatibleTargetFiles = (profile) => {
   return [...seen.values()];
 };
 
+// ../contracts/src/redaction.ts
+var SECRET_REDACTION_RULES = [
+  { pattern: /\bpk_[A-Za-z0-9_]+\.[A-Za-z0-9_]+/g, replacement: "[redacted]" },
+  { pattern: /-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z0-9 ]*PRIVATE KEY-----/g, replacement: "[redacted key]" },
+  { pattern: /\bsk-[A-Za-z0-9_-]{16,}\b/g, replacement: "[redacted]" },
+  { pattern: /\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, replacement: "[redacted]" },
+  { pattern: /\bwhsec_[A-Za-z0-9]{16,}\b/g, replacement: "[redacted]" },
+  { pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, replacement: "[redacted]" },
+  { pattern: /\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, replacement: "[redacted]" },
+  { pattern: /\bglpat-[A-Za-z0-9_-]{20,}\b/g, replacement: "[redacted]" },
+  { pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, replacement: "[redacted]" },
+  { pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g, replacement: "[redacted]" },
+  { pattern: /\bAKIA[0-9A-Z]{16}\b/g, replacement: "[redacted]" },
+  { pattern: /\bnpm_[A-Za-z0-9]{36}\b/g, replacement: "[redacted]" },
+  { pattern: /\bxai-[A-Za-z0-9]{16,}\b/g, replacement: "[redacted]" },
+  { pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, replacement: "[redacted]" },
+  { pattern: /\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)[^\s@/]+@/gi, replacement: "$1[redacted]@" },
+  { pattern: /\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, replacement: "bearer [redacted]" },
+  { pattern: /\bauthorization:\s*\S+/gi, replacement: "authorization: [redacted]" },
+  {
+    pattern: /((?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[=:]\s*)("[^"]*"|'[^']*'|\S+)/gi,
+    replacement: "$1[redacted]"
+  }
+];
+var HIGH_ENTROPY_RULE = { pattern: /[A-Za-z0-9+/]{40,}={0,2}/g, replacement: "[redacted]" };
+var redactSecrets = (text) => SECRET_REDACTION_RULES.reduce((acc, rule) => acc.replace(rule.pattern, rule.replacement), text);
+var redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE.pattern, HIGH_ENTROPY_RULE.replacement);
+
 // ../contracts/src/degraded.ts
 var DEGRADED_PREFIX = "[degraded]";
 var degradedPayload = (subsystem, report) => ({
@@ -461,6 +489,46 @@ var degradedLine = (subsystem, report) => `${DEGRADED_PREFIX} ${JSON.stringify(d
 
 // ../contracts/src/setup-wire.ts
 var PAIR_TTL_SECONDS = 900;
+var SETUP_AGENT_CHOICES = [
+  "claude_code",
+  "codex",
+  "gemini_cli",
+  "hermes",
+  "cursor",
+  "vscode",
+  "opencode",
+  ...COMPATIBLE_AGENT_TYPES,
+  "custom"
+];
+var SETUP_CONNECT_MODES = ["app", "browser", "web", "none"];
+var isSetupConnectMode = (value) => typeof value === "string" && SETUP_CONNECT_MODES.includes(value);
+
+// ../contracts/src/observability.ts
+var CLIENT_CONTEXT_HEADERS = {
+  surface: "x-pushary-surface",
+  clientVersion: "x-pushary-client-version",
+  machineId: "x-pushary-machine-id",
+  runId: "x-pushary-run-id",
+  platform: "x-pushary-platform"
+};
+var CLIENT_REPORT_PATH = "/api/agent/client-report";
+var CLIENT_VERSION_PATTERN = /^\d+(?:\.\d+){1,3}(?:[-+][0-9A-Za-z.-]+)?$/;
+var CONTEXT_ID_PATTERN = /^[A-Za-z0-9-]{8,64}$/;
+var PLATFORM_PATTERN = /^[a-z0-9_.-]{1,32}$/;
+var CONTEXT_VALUE_MAX_LENGTH = 64;
+var isClientVersion = (value) => typeof value === "string" && value.length <= CONTEXT_VALUE_MAX_LENGTH && CLIENT_VERSION_PATTERN.test(value);
+var isContextId = (value) => typeof value === "string" && CONTEXT_ID_PATTERN.test(value);
+var isClientPlatform = (value) => typeof value === "string" && PLATFORM_PATTERN.test(value);
+var clientContextHeaders = (source) => {
+  const headers = {
+    [CLIENT_CONTEXT_HEADERS.surface]: source.surface,
+    [CLIENT_CONTEXT_HEADERS.runId]: source.runId
+  };
+  if (isClientVersion(source.clientVersion)) headers[CLIENT_CONTEXT_HEADERS.clientVersion] = source.clientVersion;
+  if (isContextId(source.machineId)) headers[CLIENT_CONTEXT_HEADERS.machineId] = source.machineId;
+  if (isClientPlatform(source.platform)) headers[CLIENT_CONTEXT_HEADERS.platform] = source.platform;
+  return headers;
+};
 
 // ../contracts/src/index.ts
 var KEY_SCOPES = ["full_access", "agent", "connector", "bound"];
@@ -1532,31 +1600,6 @@ var computeDeltaSignal = (input) => {
   }
   return { deltaSignal: "match", deltaScore: 0, remoteApprove: !destructive };
 };
-var SECRET_REDACTION_RULES = [
-  { pattern: /\bpk_[A-Za-z0-9_]+\.[A-Za-z0-9_]+/g, replacement: "[redacted]" },
-  { pattern: /-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z0-9 ]*PRIVATE KEY-----/g, replacement: "[redacted key]" },
-  { pattern: /\bsk-[A-Za-z0-9_-]{16,}\b/g, replacement: "[redacted]" },
-  { pattern: /\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, replacement: "[redacted]" },
-  { pattern: /\bwhsec_[A-Za-z0-9]{16,}\b/g, replacement: "[redacted]" },
-  { pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, replacement: "[redacted]" },
-  { pattern: /\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, replacement: "[redacted]" },
-  { pattern: /\bglpat-[A-Za-z0-9_-]{20,}\b/g, replacement: "[redacted]" },
-  { pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, replacement: "[redacted]" },
-  { pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g, replacement: "[redacted]" },
-  { pattern: /\bAKIA[0-9A-Z]{16}\b/g, replacement: "[redacted]" },
-  { pattern: /\bnpm_[A-Za-z0-9]{36}\b/g, replacement: "[redacted]" },
-  { pattern: /\bxai-[A-Za-z0-9]{16,}\b/g, replacement: "[redacted]" },
-  { pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, replacement: "[redacted]" },
-  { pattern: /\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, replacement: "bearer [redacted]" },
-  { pattern: /\bauthorization:\s*\S+/gi, replacement: "authorization: [redacted]" },
-  {
-    pattern: /((?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[=:]\s*)("[^"]*"|'[^']*'|\S+)/gi,
-    replacement: "$1[redacted]"
-  }
-];
-var HIGH_ENTROPY_RULE = { pattern: /[A-Za-z0-9+/]{40,}={0,2}/g, replacement: "[redacted]" };
-var redactSecrets = (text) => SECRET_REDACTION_RULES.reduce((acc, rule) => acc.replace(rule.pattern, rule.replacement), text);
-var redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE.pattern, HIGH_ENTROPY_RULE.replacement);
 var AUTHORIZATION_CANONICAL_VERSION = "pushary.authz.v1";
 var AUTHORIZATION_CANONICAL_FIXTURE = [
   {
@@ -2468,7 +2511,6 @@ export {
   DISCONNECTABLE_AGENTS,
   REPO_AWARE_AGENTS,
   MANAGED_PROVIDERS,
-  COMPATIBLE_AGENT_TYPES,
   PHONE_ANSWERED_TOOLS,
   canonicalToolName,
   toToolLookup,
@@ -2477,11 +2519,18 @@ export {
   hookCompatibleProfile,
   hookCompatibleProfileBySource,
   compatibleTargetFiles,
+  redactSecrets,
+  redactSecretsDeep,
   degradedLine,
   hookWritePath,
   isHookActivationReport,
   hookActivationResult,
   PAIR_TTL_SECONDS,
+  SETUP_AGENT_CHOICES,
+  SETUP_CONNECT_MODES,
+  isSetupConnectMode,
+  CLIENT_REPORT_PATH,
+  clientContextHeaders,
   normalizeKeyScope,
   parseAgentQuestion,
   parseAgentQuestions,
@@ -2509,8 +2558,6 @@ export {
   isValidApiKey,
   ACTION_BODY_MAX,
   DECISION_LINE_MAX,
-  redactSecrets,
-  redactSecretsDeep,
   isAnswerSource,
   buildDecisionEpisodeFeatures,
   resolveAutoResolveOrigin,

package/dist/{chunk-M543MAUN.js → chunk-D3K2FPPJ.js}

@@ -6,16 +6,16 @@ import {
 } from "./chunk-SGZJ5LYH.js";
 import {
   hookOwnerOf
-} from "./chunk-KKZ5TDTB.js";
+} from "./chunk-5SWQZ6HY.js";
 import {
   ensureDaemonRunning
-} from "./chunk-KUQF2VO6.js";
+} from "./chunk-OZE2TQX5.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-7REOI7BC.js";
+} from "./chunk-XOMH53NB.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
@@ -23,14 +23,14 @@ import {
 import {
   transcriptEnvironmentPreference,
   transcriptsEnabled
-} from "./chunk-5KREBDUT.js";
+} from "./chunk-VA2R64I7.js";
+import {
+  readTranscriptPreference
+} from "./chunk-R4HVHTNA.js";
 import {
   codexHome,
   pusharyDir
-} from "./chunk-ON7VIYOQ.js";
-import {
-  readTranscriptPreference
-} from "./chunk-RKNA2L2J.js";
+} from "./chunk-K32C2RGK.js";
 import {
   writeJsonAtomic
 } from "./chunk-T7E75EKA.js";

package/dist/chunk-DESAUCH2.js

@@ -0,0 +1,126 @@
+import {
+  readExistingMachineId
+} from "./chunk-DZTKLE7Q.js";
+import {
+  NetworkError
+} from "./chunk-7QLSKOSU.js";
+import {
+  getBaseUrl
+} from "./chunk-OSJEMXSR.js";
+import {
+  clientContextHeaders
+} from "./chunk-CAS7GFWI.js";
+import {
+  getPackageVersion
+} from "./chunk-HWJW3CPO.js";
+
+// src/cli/net.ts
+import { createRequire } from "module";
+
+// src/cli/client-context.ts
+import { randomUUID } from "crypto";
+var CLI_RUN_ID = randomUUID();
+var cliPlatform = () => `${process.platform}-${process.arch}`;
+var memoizedContext = null;
+var safeMachineId = () => {
+  try {
+    return readExistingMachineId();
+  } catch {
+    return null;
+  }
+};
+var readCliClientContext = () => ({
+  surface: "cli",
+  clientVersion: getPackageVersion(),
+  machineId: safeMachineId(),
+  runId: CLI_RUN_ID,
+  platform: cliPlatform()
+});
+var cliClientContext = () => {
+  if (memoizedContext) return memoizedContext;
+  const context = readCliClientContext();
+  if (context.machineId !== null) memoizedContext = context;
+  return context;
+};
+var originOf = (url) => {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return null;
+  }
+};
+var requestUrlOf = (input) => typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+var isPusharyRequest = (input, baseUrl) => {
+  const target = originOf(requestUrlOf(input));
+  return target !== null && target === originOf(baseUrl);
+};
+var mergeClientContextHeaders = (input, init, context) => {
+  const headers = new Headers(input instanceof Request ? input.headers : void 0);
+  new Headers(init?.headers).forEach((value, name) => headers.set(name, value));
+  for (const [name, value] of Object.entries(clientContextHeaders(context))) {
+    if (!headers.has(name)) headers.set(name, value);
+  }
+  return headers;
+};
+var withClientContext = (fetchImpl, options) => (input, init) => isPusharyRequest(input, options.baseUrl()) ? fetchImpl(input, { ...init, headers: mergeClientContextHeaders(input, init, options.context()) }) : fetchImpl(input, init);
+var installed = false;
+var installClientContextHeaders = () => {
+  if (installed) return;
+  installed = true;
+  globalThis.fetch = withClientContext(globalThis.fetch.bind(globalThis), { baseUrl: getBaseUrl, context: cliClientContext });
+};
+
+// src/cli/net.ts
+var requireCjs = createRequire(import.meta.url);
+var PROXY_VARS = ["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy"];
+var proxyFromEnv = () => {
+  for (const name of PROXY_VARS) {
+    const value = process.env[name]?.trim();
+    if (value) return value;
+  }
+  return void 0;
+};
+var installed2 = false;
+var installNetworkDefaults = () => {
+  if (installed2) return;
+  installed2 = true;
+  installClientContextHeaders();
+  if (!proxyFromEnv()) return;
+  try {
+    const { EnvHttpProxyAgent, setGlobalDispatcher } = requireCjs("undici");
+    setGlobalDispatcher(new EnvHttpProxyAgent());
+  } catch {
+  }
+};
+var isNetworkFailure = (err) => {
+  if (!(err instanceof Error)) return false;
+  const code = err.code;
+  if (code && ["ENOTFOUND", "ECONNREFUSED", "ECONNRESET", "ETIMEDOUT", "EAI_AGAIN", "EPROTO", "CERT_HAS_EXPIRED", "UNABLE_TO_VERIFY_LEAF_SIGNATURE"].includes(code)) {
+    return true;
+  }
+  return err.name === "AbortError" || err.name === "TimeoutError" || /fetch failed/i.test(err.message);
+};
+var DEFAULT_TIMEOUT_MS = 15e3;
+var pusharyFetch = async (url, init = {}) => {
+  installNetworkDefaults();
+  const { timeoutMs = DEFAULT_TIMEOUT_MS, signal, ...rest } = init;
+  try {
+    return await fetch(url, {
+      ...rest,
+      signal: signal ?? AbortSignal.timeout(timeoutMs)
+    });
+  } catch (err) {
+    if (isNetworkFailure(err)) {
+      const proxy = proxyFromEnv();
+      const via = proxy ? ` (via proxy ${proxy})` : "";
+      throw new NetworkError(`Could not reach ${new URL(url).host}${via}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    throw err;
+  }
+};
+
+export {
+  installNetworkDefaults,
+  isNetworkFailure,
+  pusharyFetch
+};

package/dist/{chunk-LH2N6VAN.js → chunk-DZTKLE7Q.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-ON7VIYOQ.js";
+} from "./chunk-K32C2RGK.js";
 import {
   writeFileAtomic
 } from "./chunk-T7E75EKA.js";
@@ -18,6 +18,7 @@ var readMachineId = (filePath) => {
     return null;
   }
 };
+var readExistingMachineId = (options = {}) => readMachineId(options.filePath ?? join(pusharyDir(), "machine-id"));
 var getOrCreateMachineId = (options = {}) => {
   const filePath = options.filePath ?? join(pusharyDir(), "machine-id");
   const existing = readMachineId(filePath);
@@ -41,5 +42,6 @@ var getOrCreateMachineId = (options = {}) => {
 var getMachineId = (options = {}) => getOrCreateMachineId(options);
 
 export {
+  readExistingMachineId,
   getMachineId
 };

package/dist/{chunk-LVHGSD5E.js → chunk-EREBZHN2.js}

@@ -1,9 +1,13 @@
+import {
+  clientErrorKindOf,
+  reportClientError
+} from "./chunk-VOCZHOXV.js";
 import {
   callMcpTool
-} from "./chunk-HETOKNIL.js";
+} from "./chunk-BJENQBMH.js";
 import {
-  installProxyDispatcher
-} from "./chunk-SAF6HGAA.js";
+  installNetworkDefaults
+} from "./chunk-DESAUCH2.js";
 import {
   getBaseUrl
 } from "./chunk-OSJEMXSR.js";
@@ -44,7 +48,7 @@ var isBlockedActionClaim = (data) => {
 };
 
 // src/api.ts
-installProxyDispatcher();
+installNetworkDefaults();
 var DECISION_STOP_REASON = "Approval was cancelled or became unavailable. Retry only after resolving it.";
 var isDecisionStopped = (result) => result.handoffAction === "stop" || ["cancelled", "unavailable", "stopped", "missing"].includes(result.status ?? "");
 var isLocalQuestionHandoff = (result) => result.suppressed === true || result.noDevices === true || result.status === "terminal" || result.status === "notified";
@@ -130,7 +134,8 @@ var requestGate = async (apiKey, request, timeoutMs = 15e3) => {
   try {
     const reply = await postAgentRequest(apiKey, GATE_PATH, request, timeoutMs);
     return isGateReply(reply) ? reply : null;
-  } catch {
+  } catch (error) {
+    void reportClientError({ kind: clientErrorKindOf(error), code: "gate_request_failed" });
     return null;
   }
 };
@@ -138,7 +143,8 @@ var claimBlockedAction = async (apiKey, request, timeoutMs) => {
   try {
     const reply = await postAgentRequest(apiKey, BLOCKED_ACTION_CLAIM_PATH, request, timeoutMs);
     return isBlockedActionClaim(reply) ? reply.granted : null;
-  } catch {
+  } catch (error) {
+    void reportClientError({ kind: clientErrorKindOf(error), code: "blocked_action_claim_failed" });
     return null;
   }
 };

package/dist/{chunk-E72R2MHO.js → chunk-GBL4BTG3.js}

@@ -2,10 +2,10 @@ import {
   resolveBinary,
   resolveGlobalPackageVersion,
   resolvePackageVersionFromBinary
-} from "./chunk-ON7VIYOQ.js";
+} from "./chunk-K32C2RGK.js";
 import {
   MANAGED_PROVIDERS
-} from "./chunk-A5ODW52C.js";
+} from "./chunk-CAS7GFWI.js";
 
 // src/live-capabilities.ts
 var CLAUDE_BRIDGE_CAPABILITY = "claude-bridge";

package/dist/{chunk-GKO7T4JM.js → chunk-H6XU22TN.js}

@@ -1,22 +1,26 @@
 import {
   NOTIFICATION_PUSH_TYPES,
   POSTTOOLUSE_MIRROR_ONLY_TOOLS
-} from "./chunk-XINNQCPW.js";
+} from "./chunk-YUGGNZSF.js";
 import {
   cancelQuestion,
   isPolicyConfig,
   sendNotification,
   waitForAnswer
-} from "./chunk-LVHGSD5E.js";
+} from "./chunk-EREBZHN2.js";
 import {
-  getMachineId
-} from "./chunk-LH2N6VAN.js";
+  clientErrorKindOf,
+  reportClientError
+} from "./chunk-VOCZHOXV.js";
 import {
   withRetry
-} from "./chunk-HETOKNIL.js";
+} from "./chunk-BJENQBMH.js";
+import {
+  getMachineId
+} from "./chunk-DZTKLE7Q.js";
 import {
   reportedInstallSource
-} from "./chunk-NSG2Q4PI.js";
+} from "./chunk-VHNDE3ZD.js";
 import {
   getApiKey,
   getBaseUrl
@@ -44,7 +48,7 @@ import {
   resolveAutoResolveOrigin,
   resolvePolicy,
   toToolLookup
-} from "./chunk-A5ODW52C.js";
+} from "./chunk-CAS7GFWI.js";
 
 // src/policy.ts
 import { createHash } from "crypto";
@@ -176,12 +180,14 @@ var fetchModeState = async (apiKey, sessionId, reuseWithinMs = 0, signal) => {
       signal: AbortSignal.any([AbortSignal.timeout(3e3), ...signal ? [signal] : []])
     });
     if (!response.ok) {
+      void reportClientError({ kind: "http_status", code: `mode_http_${response.status}` });
       return degradedFallback(apiKey, response.status === 401 || response.status === 403);
     }
     const state = modeStateFromResponse(await response.json());
     writeLastGoodMode(apiKey, state, sessionId);
     return state;
-  } catch {
+  } catch (error) {
+    void reportClientError({ kind: clientErrorKindOf(error), code: "mode_fetch_failed" });
     return degradedFallback(apiKey);
   }
 };

package/dist/{chunk-OXFWJIW4.js → chunk-HUB4Q35G.js}

@@ -1,6 +1,6 @@
 import {
   readConfigFileKey
-} from "./chunk-RKNA2L2J.js";
+} from "./chunk-R4HVHTNA.js";
 
 // src/bell/fleet.ts
 import { closeSync, constants, futimesSync, lstatSync, mkdirSync, openSync, readdirSync, unlinkSync } from "fs";

package/dist/{chunk-NEUYPY3I.js → chunk-I2YUMZLE.js}

@@ -5,19 +5,20 @@ import {
   UsageError
 } from "./chunk-7QLSKOSU.js";
 import {
-  COMPATIBLE_AGENT_TYPES,
+  SETUP_AGENT_CHOICES,
+  SETUP_CONNECT_MODES,
+  isSetupConnectMode,
   isValidApiKey
-} from "./chunk-A5ODW52C.js";
+} from "./chunk-CAS7GFWI.js";
 
 // src/setup/options.ts
-var AGENT_CHOICES = ["claude_code", "codex", "gemini_cli", "hermes", "cursor", "vscode", "opencode", ...COMPATIBLE_AGENT_TYPES, "custom"];
-var CONNECT_MODES = ["app", "browser", "web", "none"];
+var AGENT_CHOICES = SETUP_AGENT_CHOICES;
 var CONNECT_ALIASES = { auto: "app", pwa: "web" };
 var parseConnectMode = (raw) => {
   const value = raw.trim().toLowerCase();
   if (Object.hasOwn(CONNECT_ALIASES, value)) return CONNECT_ALIASES[value];
-  if (CONNECT_MODES.includes(value)) return value;
-  throw new UsageError(`--connect must be one of: ${CONNECT_MODES.join(", ")} (got ${raw})`);
+  if (isSetupConnectMode(value)) return value;
+  throw new UsageError(`--connect must be one of: ${SETUP_CONNECT_MODES.join(", ")} (got ${raw})`);
 };
 var VERIFY_MODES = ["roundtrip", "push", "none"];
 var parseVerifyMode = (raw) => {

package/dist/{chunk-3PDQE66Q.js → chunk-I3XJATMR.js}

@@ -1,6 +1,6 @@
 import {
   HOOK_LOCATOR_BINARY
-} from "./chunk-A5ODW52C.js";
+} from "./chunk-CAS7GFWI.js";
 
 // src/diagnostics/bridge.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-TCT4WUDP.js → chunk-JOGA3TL2.js}

@@ -2,21 +2,21 @@ import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "./chunk-E72R2MHO.js";
+} from "./chunk-GBL4BTG3.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   hasDaemonServiceDefinition,
   readDaemonNeedsLogin,
   readDaemonStatus
-} from "./chunk-KUQF2VO6.js";
-import {
-  getMachineId
-} from "./chunk-LH2N6VAN.js";
+} from "./chunk-OZE2TQX5.js";
 import {
   readControlMode,
   readKeySource
-} from "./chunk-RKNA2L2J.js";
+} from "./chunk-R4HVHTNA.js";
+import {
+  getMachineId
+} from "./chunk-DZTKLE7Q.js";
 import {
   getBaseUrl
 } from "./chunk-OSJEMXSR.js";

package/dist/{chunk-ON7VIYOQ.js → chunk-K32C2RGK.js}

@@ -2,7 +2,7 @@ import {
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY,
   withHookHoldBudget
-} from "./chunk-A5ODW52C.js";
+} from "./chunk-CAS7GFWI.js";
 import {
   isReleaseVersion
 } from "./chunk-HWJW3CPO.js";
@@ -625,6 +625,7 @@ var bridgeAgentKey = () => join3(pusharyDir(), "bridge-auth", "agent-key.json");
 var autoUpdateState = () => join3(pusharyDir(), "auto-update.json");
 var autoUpdateLock = () => join3(pusharyDir(), "auto-update.lock");
 var autoUpdateLog = () => join3(pusharyDir(), "logs", "auto-update.log");
+var clientReportClaims = () => join3(pusharyDir(), "client-reports");
 var claudeRegistrationReceipt = () => join3(pusharyDir(), "setup", "claude-registration.json");
 var hermesConfigReceipt = () => join3(pusharyDir(), "setup", "hermes-config.json");
 var hookTakeoverReceipt = (agent) => join3(pusharyDir(), "setup", `hook-takeover-${agent}.json`);
@@ -698,6 +699,7 @@ export {
   autoUpdateState,
   autoUpdateLock,
   autoUpdateLog,
+  clientReportClaims,
   claudeRegistrationReceipt,
   hermesConfigReceipt,
   hookTakeoverReceipt,

package/dist/{chunk-F5ENKWKY.js → chunk-LDRGVXLR.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-ON7VIYOQ.js";
+} from "./chunk-K32C2RGK.js";
 import {
   readJsonSafe
 } from "./chunk-T7E75EKA.js";

package/dist/{chunk-TDXQQB55.js → chunk-LFMOYHPY.js}

@@ -1,7 +1,7 @@
 import {
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-HXKY6DFD.js";
+} from "./chunk-UGKDBJJX.js";
 import {
   createIo
 } from "./chunk-5RUIFDTP.js";

package/dist/{chunk-572FZF7T.js → chunk-LJEL7IB5.js}

@@ -3,28 +3,28 @@ import {
   addPusharyToolPermissions,
   isPusharyHook,
   removeClaudeMcpServers
-} from "./chunk-RK2MUM6Q.js";
+} from "./chunk-ZA5UXRNE.js";
 import {
   CLAUDE_HOOK_EVENTS,
   addGeminiMcpServer,
   removeGeminiMcpServer
-} from "./chunk-HW2M7XAU.js";
+} from "./chunk-7CLTSZOL.js";
 import {
   CLAUDE_CODE_AGENT,
   parseApplyPatchFiles
-} from "./chunk-GKO7T4JM.js";
+} from "./chunk-H6XU22TN.js";
 import {
   guardBinary,
   holdBudgetOf,
   registerHookEntry
-} from "./chunk-ON7VIYOQ.js";
+} from "./chunk-K32C2RGK.js";
 import {
   PHONE_ANSWERED_TOOLS,
   hookCompatibleProfile,
   hookCompatibleProfileBySource,
   toToolLookup,
   withHookHoldBudget
-} from "./chunk-A5ODW52C.js";
+} from "./chunk-CAS7GFWI.js";
 
 // src/compatible-config.ts
 import { homedir } from "os";

package/dist/{chunk-3HUDBDO7.js → chunk-LQI7W4RG.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-ON7VIYOQ.js";
+} from "./chunk-K32C2RGK.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-RKSBBEGT.js → chunk-N62KAMMY.js}

@@ -1,6 +1,6 @@
 import {
   resolvePathBinary
-} from "./chunk-ON7VIYOQ.js";
+} from "./chunk-K32C2RGK.js";
 
 // src/hermes-config.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-LN3FETAC.js → chunk-NFH73H5B.js}

@@ -1,12 +1,12 @@
 import {
   openCodeConfigDirFrom
-} from "./chunk-SB2CRLFK.js";
+} from "./chunk-3VZX4NSP.js";
 import {
   codexHomeFrom
-} from "./chunk-ON7VIYOQ.js";
+} from "./chunk-K32C2RGK.js";
 import {
   HOOK_COMPATIBLE_PROFILES
-} from "./chunk-A5ODW52C.js";
+} from "./chunk-CAS7GFWI.js";
 
 // src/vscode-config.ts
 import { homedir } from "os";

package/dist/{chunk-SD6SAIEV.js → chunk-NYMPLNV3.js}

@@ -7,10 +7,10 @@ import {
   permissionDeniedAction,
   releaseThrottle,
   reportEvent
-} from "./chunk-GKO7T4JM.js";
+} from "./chunk-H6XU22TN.js";
 import {
   canonicalJson
-} from "./chunk-ON7VIYOQ.js";
+} from "./chunk-K32C2RGK.js";
 import {
   writeFileAtomic
 } from "./chunk-T7E75EKA.js";
@@ -20,7 +20,7 @@ import {
   machineDecisionFor,
   shouldDeferToNativeMode,
   wireVerdictFor
-} from "./chunk-A5ODW52C.js";
+} from "./chunk-CAS7GFWI.js";
 
 // src/machine-decision-audit.ts
 import { basename } from "path";