@pushary/agent-hooks 1.7.2 → 1.8.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 1.8.0
+
+- **An approval you give after auto mode blocks a call is no longer lost when the agent rewords the call.** Your approval covers only the exact call that was blocked. Claude Code tells the agent only that it may retry, and an agent that sent a changed command was blocked again, so the approval you gave from your phone or the Mac notch did nothing. Pushary now refuses the first changed call and tells the agent to send the blocked call again unchanged. If the agent ends its turn without sending it, Pushary tells it to send it.
+- Claude Code no longer tells your phone and the Mac notch that it is waiting for you while its background tasks are still running. Claude Code reports itself idle after a minute at the prompt even when it will continue by itself once those tasks finish. A question from the agent still reaches you as before.
+- A prompt longer than 500 characters, or a shell command longer than about 490, no longer stops your agent at its next phone approval. The hook sent the whole text and the server refused it, so Claude Code halted with "Pushary could not create a verifiable approval" and Codex and OpenCode denied the call. The question, intent, action, blocker and agent name are now cut to what the card can show, and a cut line ends in "…". The server now does the same for every older CLI, so this fix does not wait for you to update. (#1604)
+- A line cut to fit, including a long diff, never ends on half an emoji. The server stores these lines as JSON, and Postgres refuses a half character, so the approval failed to save.
+- `pushary doctor`, `pushary upgrade`, `pushary clean` and automatic updates recognise a global install under either package name, `@pushary/agent-hooks` or `pushary`. A machine keeps the name it already has, and setup on a new machine installs the name it was run from. Nothing changes for an existing install.
+- `pushary doctor` flags a machine with both names installed globally, because uninstalling either one removes every Pushary command.
+- `pushary upgrade` no longer installs over an automatic update that is still running. It says another upgrade is running, with its process id, and stops.
+
+## 1.7.3
+
+- **Approval text never hides part of a command.** The value after a credential name is now hidden only up to the first space, quote or piece of shell syntax. 1.7.2 could still hide a command: `eval TOKEN="x; rm -rf ~"` read `eval TOKEN="[redacted]"`, `password= reboot` read `password= [redacted]`, and `rm -rf {password=x,/}` hid the `,/` that also deletes `/`. A private key block is hidden only when it holds nothing but the key. Tokens, keys and quoted values without spaces are hidden as before. A quoted value with spaces now shows what follows its first word, as in `--password='[redacted] pass'`. Logs and error reports still hide the whole value.
+
 ## 1.7.2
 
 - **Approval text shows the whole command again.** A credential name that closes a quoted string, as in `grep -rl "password=" . | xargs rm -f`, made 1.7.1 redact everything after it, so the approval read `grep -rl "password="[redacted]"` and hid the `rm`. The value after a credential name is still redacted, and the rest of the command is shown.

package/README.md

@@ -1,4 +1,4 @@
-# @pushary/agent-hooks
+# Pushary
 
 [![npm version](https://img.shields.io/npm/v/@pushary/agent-hooks.svg)](https://www.npmjs.com/package/@pushary/agent-hooks)
 [![npm downloads](https://img.shields.io/npm/dm/@pushary/agent-hooks.svg)](https://www.npmjs.com/package/@pushary/agent-hooks)
@@ -100,6 +100,18 @@ Verify it worked:
 npx @pushary/agent-hooks@latest doctor
 ```
 
+Setup installs this package globally with npm, at the version you ran, because the
+hooks run from that install. You never install it by hand.
+
+## Remove it
+
+```bash
+npx @pushary/agent-hooks@latest clean
+```
+
+It removes the hooks, the MCP entries, the stored key and the background service.
+Add `--dry-run` to see what it would remove first.
+
 ## Supported agents
 
 | Agent | Notify | Ask | Gate |

package/data/cursor-plugin/CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## 0.2.3
 
+- Approval text never hides part of a command. The value after a credential name is hidden only up to the first space, quote or piece of shell syntax, so `echo "password=" && rm -rf ~` and `eval TOKEN="x; rm -rf ~"` both show the `rm`. A private key block is hidden only when it holds nothing but the key.
 - Updates and Terminal hand an approval back to Cursor promptly. The gate no longer waits for a phone answer that Updates never asks for, and it withdraws the phone question before Cursor decides. An answer that arrives in that moment still counts.
 - A file change that goes back to the agent's own permissions is refused with the reason, because Cursor file hooks cannot show a local approval. Choose Every time for file changes you want to approve from your phone.
 - With no phone or other notification channel connected, a file change is refused with a message that says so. Shell commands and MCP calls still open Cursor's own prompt with "No device connected, approve here."

package/data/cursor-plugin/scripts/pushary-gate.mjs

@@ -2,6 +2,8 @@
 // Pushary Cursor hooks: server policy, fenced phone approvals, and lifecycle telemetry.
 // Dependency-free for marketplace installs. Regenerate agent-hooks/data after edits.
 
+import { redactSecrets, redactSecretsDeep } from './redaction.mjs'
+export { redactSecrets } from './redaction.mjs'
 import { createHash, randomUUID } from 'node:crypto'
 import { hostname } from 'node:os'
 import { existsSync, readFileSync } from 'node:fs'
@@ -294,27 +296,6 @@ export const describeNetworkFailure = (error, env = process.env) => {
 // line reached the lock screen verbatim.
 const ACTION_BODY_MAX = 4000
 const ACTION_BODY_TRUNCATION_MARKER = '\n… [truncated]'
-const REDACTION_RULES = [
-  [/-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z0-9 ]*PRIVATE KEY-----/g, '[redacted key]'],
-  [/\bsk-[A-Za-z0-9_-]{16,}\b/g, '[redacted]'],
-  [/\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, '[redacted]'],
-  [/\bwhsec_[A-Za-z0-9]{16,}\b/g, '[redacted]'],
-  [/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, '[redacted]'],
-  [/\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, '[redacted]'],
-  [/\bglpat-[A-Za-z0-9_-]{20,}\b/g, '[redacted]'],
-  [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, '[redacted]'],
-  [/\bAIza[A-Za-z0-9_-]{35}\b/g, '[redacted]'],
-  [/\bAKIA[0-9A-Z]{16}\b/g, '[redacted]'],
-  [/\bnpm_[A-Za-z0-9]{36}\b/g, '[redacted]'],
-  [/\bxai-[A-Za-z0-9]{16,}\b/g, '[redacted]'],
-  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, '[redacted]'],
-  [/\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, 'bearer [redacted]'],
-  [/\bauthorization:\s*\S+/gi, 'authorization: [redacted]'],
-  [/((?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[=:]\s*)(\"[^\"]*\"|'[^']*'|\S+)/gi, '$1[redacted]'],
-]
-const HIGH_ENTROPY_RULE = [/[A-Za-z0-9+/]{40,}={0,2}/g, '[redacted]']
-export const redactSecrets = (text) => REDACTION_RULES.reduce((acc, [pattern, replacement]) => acc.replace(pattern, replacement), text)
-const redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE[0], HIGH_ENTROPY_RULE[1])
 const capActionBody = (text) =>
   text.length <= ACTION_BODY_MAX ? text : `${text.slice(0, ACTION_BODY_MAX - ACTION_BODY_TRUNCATION_MARKER.length)}${ACTION_BODY_TRUNCATION_MARKER}`
 const deriveActionBody = (command) => capActionBody(redactSecretsDeep(command))

package/data/cursor-plugin/scripts/pushary-gate.test.mjs

@@ -14,7 +14,7 @@
 
 import assert from 'node:assert/strict'
 import { describe, it } from 'node:test'
-import { describeRequest, normalizeRepoRemote } from './pushary-gate.mjs'
+import { describeRequest, normalizeRepoRemote, redactSecrets } from './pushary-gate.mjs'
 
 describe('repo identity', () => {
   it('collapses the forms of one remote', () => {
@@ -113,3 +113,25 @@ describe('what the gate was asked about', () => {
     assert.equal(describeRequest({}), null)
   })
 })
+
+describe('approval text redaction', () => {
+  it('shows a command whole when a credential name only sits next to shell syntax', () => {
+    for (const command of [
+      'echo "password=" && rm -rf ~ && echo "x"',
+      'find / -name "token:" -o -delete -o -name "x"',
+      "grep -rl foo'password=' . | xargs rm -f 'important file'",
+      'grep "authorization:";rm important-file',
+      'echo "-----BEGIN PRIVATE KEY-----" && rm -rf ~ && echo "-----END PRIVATE KEY-----"',
+      'password= reboot',
+    ]) {
+      assert.equal(redactSecrets(command), command)
+    }
+  })
+
+  it('stops a hidden value at the first space, quote or piece of shell syntax', () => {
+    assert.equal(redactSecrets('eval TOKEN="x; rm -rf ~"'), 'eval TOKEN="[redacted]; rm -rf ~"')
+    assert.equal(redactSecrets('TOKEN=abc;rm file'), 'TOKEN=[redacted];rm file')
+    assert.equal(redactSecrets('rm -rf {password=x,/}'), 'rm -rf {password=[redacted],/}')
+    assert.equal(redactSecrets('export API_KEY="abc123" && rm -rf build'), 'export API_KEY="[redacted]" && rm -rf build')
+  })
+})

package/data/cursor-plugin/scripts/redaction.mjs

@@ -0,0 +1,51 @@
+// Generated by scripts/generate-editor-redaction.mjs.
+const CREDENTIAL_NAME = String.raw `(?:authorization|secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)["']?`;
+const CREDENTIAL_KEY = String.raw `${CREDENTIAL_NAME}\s*[=:]\s*`;
+const DISPLAYED_CREDENTIAL_KEY = String.raw `${CREDENTIAL_NAME}(?:[ \t]*:[ \t]*|[ \t]+=[ \t]*|=)`;
+const SHELL_INERT_UNIT = String.raw `(?:[A-Za-z0-9_\-./+=:@%^!#]|\\[^\s'"])`;
+const SHELL_INERT_SINGLE_QUOTED_UNIT = String.raw `[A-Za-z0-9_\-./+=:@%^!#\\]`;
+const SHELL_INERT_URL_PASSWORD_UNIT = String.raw `(?:[A-Za-z0-9_\-.+=:%^!#]|\\[^\s'"@/])`;
+const PEM_LINE_BREAK = String.raw `(?:\r?\n|(?:\\r)?\\n)`;
+const credentialAssignmentRule = (key, doubleQuoted, singleQuoted, bare) => ({
+    pattern: new RegExp(String.raw `(${key})(?:(")${doubleQuoted}|(')${singleQuoted}|(["']?)${bare})`, 'gi'),
+    replacement: '$1$2$3$4[redacted]$2$3',
+});
+const DISPLAYED_SECRET_SHAPES = {
+    privateKeyBody: String.raw `${PEM_LINE_BREAK}?(?:(?:Proc-Type|DEK-Info): [A-Za-z0-9,-]+${PEM_LINE_BREAK})*(?:[A-Za-z0-9+/=\r\n]|\\[rn])*?`,
+    urlPassword: `${SHELL_INERT_URL_PASSWORD_UNIT}+`,
+    authorizationValue: `${SHELL_INERT_UNIT}+`,
+    credentialAssignment: credentialAssignmentRule(DISPLAYED_CREDENTIAL_KEY, `${SHELL_INERT_UNIT}*"`, `${SHELL_INERT_SINGLE_QUOTED_UNIT}*'`, `${SHELL_INERT_UNIT}+`),
+};
+const CUT_OFF_SECRET_SHAPES = {
+    privateKeyBody: String.raw `[\s\S]*?`,
+    urlPassword: String.raw `[^\s@/]+`,
+    authorizationValue: String.raw `\S+`,
+    credentialAssignment: credentialAssignmentRule(CREDENTIAL_KEY, String.raw `(?:\\[\s\S]|[^"\\])*(?:"|\\?$)`, "[^']*(?:'|$)", String.raw `\S+`),
+};
+const secretRedactionRules = (shapes) => [
+    { pattern: /\bpk_[A-Za-z0-9_]+\.[A-Za-z0-9_]+/g, replacement: '[redacted]' },
+    { pattern: new RegExp(String.raw `-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----${shapes.privateKeyBody}-----END[A-Z0-9 ]*PRIVATE KEY-----`, 'g'), replacement: '[redacted key]' },
+    { pattern: /\bsk-[A-Za-z0-9_-]{16,}\b/g, replacement: '[redacted]' },
+    { pattern: /\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bwhsec_[A-Za-z0-9]{16,}\b/g, replacement: '[redacted]' },
+    { pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bglpat-[A-Za-z0-9_-]{20,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g, replacement: '[redacted]' },
+    { pattern: /\bAKIA[0-9A-Z]{16}\b/g, replacement: '[redacted]' },
+    { pattern: /\bnpm_[A-Za-z0-9]{36}\b/g, replacement: '[redacted]' },
+    { pattern: /\bxai-[A-Za-z0-9]{16,}\b/g, replacement: '[redacted]' },
+    { pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, replacement: '[redacted]' },
+    { pattern: new RegExp(String.raw `\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)${shapes.urlPassword}@`, 'gi'), replacement: '$1[redacted]@' },
+    { pattern: /\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, replacement: 'bearer [redacted]' },
+    { pattern: new RegExp(String.raw `\bauthorization:\s*${shapes.authorizationValue}`, 'gi'), replacement: 'authorization: [redacted]' },
+    shapes.credentialAssignment,
+];
+export const SECRET_REDACTION_RULES = secretRedactionRules(DISPLAYED_SECRET_SHAPES);
+const CUT_OFF_TEXT_REDACTION_RULES = secretRedactionRules(CUT_OFF_SECRET_SHAPES);
+const HIGH_ENTROPY_RULE = { pattern: /[A-Za-z0-9+/]{40,}={0,2}/g, replacement: '[redacted]' };
+const applyRedactionRules = (rules, text) => rules.reduce((acc, rule) => acc.replace(rule.pattern, rule.replacement), text);
+export const redactSecrets = (text) => applyRedactionRules(SECRET_REDACTION_RULES, text);
+export const redactSecretsFromContent = (text) => applyRedactionRules(CUT_OFF_TEXT_REDACTION_RULES, text);
+export const redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE.pattern, HIGH_ENTROPY_RULE.replacement);

package/data/vscode-plugin/CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## 0.2.3
 
+- Approval text never hides part of a command. The value after a credential name is hidden only up to the first space, quote or piece of shell syntax, so `echo "password=" && rm -rf ~` and `eval TOKEN="x; rm -rf ~"` both show the `rm`. A private key block is hidden only when it holds nothing but the key.
 - Updates hands an approval back to VS Code promptly. The gate no longer waits for a phone answer that Updates never asks for, and it withdraws the phone question before VS Code asks. An answer that arrives in that moment still counts.
 - With no phone or other notification channel connected, VS Code's prompt says "No device connected, approve here." instead of naming a delivery mode.
 - Approval questions carry the repository and the tool name the gate judged, so routing and repository rules apply to the question as they did to the gate. A file edit is asked about with its full path, so path rules and routing match it. A path longer than 80 characters falls back to the file type instead of making the question fail.

package/data/vscode-plugin/scripts/pushary-gate.mjs

@@ -2,6 +2,7 @@
 // Pushary VS Code hooks: server policy, fenced phone approvals, and lifecycle telemetry.
 // Dependency-free for marketplace installs. Regenerate agent-hooks/data after edits.
 
+import { redactSecrets, redactSecretsDeep } from './redaction.mjs'
 import { createHash, randomUUID } from 'node:crypto'
 import { homedir, hostname } from 'node:os'
 import { existsSync, readFileSync } from 'node:fs'
@@ -337,27 +338,6 @@ const ACTION_BODY_TRUNCATION_MARKER = '\n… [truncated]'
 // One combined list used to serve both, which meant the only text this gate
 // scrubbed was the action body. The question and the notification body carried
 // the raw command.
-const REDACTION_RULES = [
-  [/-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z0-9 ]*PRIVATE KEY-----/g, '[redacted key]'],
-  [/\bsk-[A-Za-z0-9_-]{16,}\b/g, '[redacted]'],
-  [/\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, '[redacted]'],
-  [/\bwhsec_[A-Za-z0-9]{16,}\b/g, '[redacted]'],
-  [/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, '[redacted]'],
-  [/\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, '[redacted]'],
-  [/\bglpat-[A-Za-z0-9_-]{20,}\b/g, '[redacted]'],
-  [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, '[redacted]'],
-  [/\bAIza[A-Za-z0-9_-]{35}\b/g, '[redacted]'],
-  [/\bAKIA[0-9A-Z]{16}\b/g, '[redacted]'],
-  [/\bnpm_[A-Za-z0-9]{36}\b/g, '[redacted]'],
-  [/\bxai-[A-Za-z0-9]{16,}\b/g, '[redacted]'],
-  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, '[redacted]'],
-  [/\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, 'bearer [redacted]'],
-  [/\bauthorization:\s*\S+/gi, 'authorization: [redacted]'],
-  [/((?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[=:]\s*)("[^"]*"|'[^']*'|\S+)/gi, '$1[redacted]'],
-]
-const HIGH_ENTROPY_RULE = [/[A-Za-z0-9+/]{40,}={0,2}/g, '[redacted]']
-const redactSecrets = (text) => REDACTION_RULES.reduce((acc, [pattern, replacement]) => acc.replace(pattern, replacement), text)
-const redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE[0], HIGH_ENTROPY_RULE[1])
 const capActionBody = (text) =>
   text.length <= ACTION_BODY_MAX ? text : `${text.slice(0, ACTION_BODY_MAX - ACTION_BODY_TRUNCATION_MARKER.length)}${ACTION_BODY_TRUNCATION_MARKER}`
 const deriveActionBody = (command) => capActionBody(redactSecretsDeep(command))

package/data/vscode-plugin/scripts/redaction.mjs

@@ -0,0 +1,51 @@
+// Generated by scripts/generate-editor-redaction.mjs.
+const CREDENTIAL_NAME = String.raw `(?:authorization|secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)["']?`;
+const CREDENTIAL_KEY = String.raw `${CREDENTIAL_NAME}\s*[=:]\s*`;
+const DISPLAYED_CREDENTIAL_KEY = String.raw `${CREDENTIAL_NAME}(?:[ \t]*:[ \t]*|[ \t]+=[ \t]*|=)`;
+const SHELL_INERT_UNIT = String.raw `(?:[A-Za-z0-9_\-./+=:@%^!#]|\\[^\s'"])`;
+const SHELL_INERT_SINGLE_QUOTED_UNIT = String.raw `[A-Za-z0-9_\-./+=:@%^!#\\]`;
+const SHELL_INERT_URL_PASSWORD_UNIT = String.raw `(?:[A-Za-z0-9_\-.+=:%^!#]|\\[^\s'"@/])`;
+const PEM_LINE_BREAK = String.raw `(?:\r?\n|(?:\\r)?\\n)`;
+const credentialAssignmentRule = (key, doubleQuoted, singleQuoted, bare) => ({
+    pattern: new RegExp(String.raw `(${key})(?:(")${doubleQuoted}|(')${singleQuoted}|(["']?)${bare})`, 'gi'),
+    replacement: '$1$2$3$4[redacted]$2$3',
+});
+const DISPLAYED_SECRET_SHAPES = {
+    privateKeyBody: String.raw `${PEM_LINE_BREAK}?(?:(?:Proc-Type|DEK-Info): [A-Za-z0-9,-]+${PEM_LINE_BREAK})*(?:[A-Za-z0-9+/=\r\n]|\\[rn])*?`,
+    urlPassword: `${SHELL_INERT_URL_PASSWORD_UNIT}+`,
+    authorizationValue: `${SHELL_INERT_UNIT}+`,
+    credentialAssignment: credentialAssignmentRule(DISPLAYED_CREDENTIAL_KEY, `${SHELL_INERT_UNIT}*"`, `${SHELL_INERT_SINGLE_QUOTED_UNIT}*'`, `${SHELL_INERT_UNIT}+`),
+};
+const CUT_OFF_SECRET_SHAPES = {
+    privateKeyBody: String.raw `[\s\S]*?`,
+    urlPassword: String.raw `[^\s@/]+`,
+    authorizationValue: String.raw `\S+`,
+    credentialAssignment: credentialAssignmentRule(CREDENTIAL_KEY, String.raw `(?:\\[\s\S]|[^"\\])*(?:"|\\?$)`, "[^']*(?:'|$)", String.raw `\S+`),
+};
+const secretRedactionRules = (shapes) => [
+    { pattern: /\bpk_[A-Za-z0-9_]+\.[A-Za-z0-9_]+/g, replacement: '[redacted]' },
+    { pattern: new RegExp(String.raw `-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----${shapes.privateKeyBody}-----END[A-Z0-9 ]*PRIVATE KEY-----`, 'g'), replacement: '[redacted key]' },
+    { pattern: /\bsk-[A-Za-z0-9_-]{16,}\b/g, replacement: '[redacted]' },
+    { pattern: /\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bwhsec_[A-Za-z0-9]{16,}\b/g, replacement: '[redacted]' },
+    { pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bglpat-[A-Za-z0-9_-]{20,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g, replacement: '[redacted]' },
+    { pattern: /\bAKIA[0-9A-Z]{16}\b/g, replacement: '[redacted]' },
+    { pattern: /\bnpm_[A-Za-z0-9]{36}\b/g, replacement: '[redacted]' },
+    { pattern: /\bxai-[A-Za-z0-9]{16,}\b/g, replacement: '[redacted]' },
+    { pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, replacement: '[redacted]' },
+    { pattern: new RegExp(String.raw `\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)${shapes.urlPassword}@`, 'gi'), replacement: '$1[redacted]@' },
+    { pattern: /\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, replacement: 'bearer [redacted]' },
+    { pattern: new RegExp(String.raw `\bauthorization:\s*${shapes.authorizationValue}`, 'gi'), replacement: 'authorization: [redacted]' },
+    shapes.credentialAssignment,
+];
+export const SECRET_REDACTION_RULES = secretRedactionRules(DISPLAYED_SECRET_SHAPES);
+const CUT_OFF_TEXT_REDACTION_RULES = secretRedactionRules(CUT_OFF_SECRET_SHAPES);
+const HIGH_ENTROPY_RULE = { pattern: /[A-Za-z0-9+/]{40,}={0,2}/g, replacement: '[redacted]' };
+const applyRedactionRules = (rules, text) => rules.reduce((acc, rule) => acc.replace(rule.pattern, rule.replacement), text);
+export const redactSecrets = (text) => applyRedactionRules(SECRET_REDACTION_RULES, text);
+export const redactSecretsFromContent = (text) => applyRedactionRules(CUT_OFF_TEXT_REDACTION_RULES, text);
+export const redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE.pattern, HIGH_ENTROPY_RULE.replacement);

package/dist/bin/pushary-bell-hook.js

@@ -1,38 +1,38 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-ZUKZJQGR.js";
+} from "../chunk-IPVKH2ST.js";
 import {
   readHookInput
-} from "../chunk-3RO2UWJQ.js";
-import "../chunk-ZMWX5SDA.js";
+} from "../chunk-KGDWDSNL.js";
+import "../chunk-JZTHGAPA.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-E3PLF7YB.js";
-import "../chunk-I7B2DNVU.js";
-import "../chunk-JMSB6CJT.js";
-import "../chunk-L6IF4JOF.js";
-import "../chunk-4S7CCOXB.js";
-import "../chunk-A6WQF7FQ.js";
-import "../chunk-KLXYMPTM.js";
-import "../chunk-R7ZETVNR.js";
-import "../chunk-QSZ37ROP.js";
-import "../chunk-Q7CDBJXU.js";
+import "../chunk-EYK3GSRH.js";
+import "../chunk-ZVSKMPBZ.js";
+import "../chunk-C2WCPBF7.js";
+import "../chunk-6J2JC2RT.js";
+import "../chunk-WE2J62NC.js";
+import "../chunk-3EVPNIBE.js";
+import "../chunk-OKXS7WDZ.js";
+import "../chunk-MPWXGONV.js";
+import "../chunk-SAXBC4AZ.js";
+import "../chunk-OLQRRFBX.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-RLRDPZG4.js";
-import "../chunk-6QZK4O36.js";
+import "../chunk-EPCXUP3P.js";
+import "../chunk-CVQYGMSR.js";
 import "../chunk-POFBE6ZY.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-VSGKQ3HI.js";
-import "../chunk-UFNBKYWT.js";
-import "../chunk-HOIGXMI7.js";
+import "../chunk-P7WQEVWA.js";
+import "../chunk-2OY3ZZ5N.js";
+import "../chunk-LXQ5FBBD.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-LI3C2IQY.js";
-import "../chunk-NYBZJ44G.js";
+import "../chunk-DB3ONZB4.js";
+import "../chunk-A2A2YTMG.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-SJN64NJX.js";
-import "../chunk-65RN6ZCO.js";
-import "../chunk-WWTLAZQA.js";
+import "../chunk-GPEGOGRJ.js";
+import "../chunk-E4FJTUH4.js";
+import "../chunk-NQTHFF4W.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,37 +5,37 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-ZUKZJQGR.js";
+} from "../chunk-IPVKH2ST.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-KLXYMPTM.js";
+} from "../chunk-OKXS7WDZ.js";
 import {
   createIo
 } from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-6NHXKTQU.js";
+} from "../chunk-HZVVNGEW.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-VSGKQ3HI.js";
+import "../chunk-P7WQEVWA.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-LI3C2IQY.js";
+import "../chunk-DB3ONZB4.js";
 import {
   claudeSettings
-} from "../chunk-NYBZJ44G.js";
+} from "../chunk-A2A2YTMG.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-T7E75EKA.js";
-import "../chunk-SJN64NJX.js";
-import "../chunk-65RN6ZCO.js";
-import "../chunk-WWTLAZQA.js";
+import "../chunk-GPEGOGRJ.js";
+import "../chunk-E4FJTUH4.js";
+import "../chunk-NQTHFF4W.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,7 +8,7 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-PWNQGITG.js";
+} from "../chunk-ZSZSSJCV.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
@@ -18,24 +18,24 @@ import {
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-ZMWX5SDA.js";
+} from "../chunk-JZTHGAPA.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-E3PLF7YB.js";
-import "../chunk-I7B2DNVU.js";
-import "../chunk-JMSB6CJT.js";
-import "../chunk-L6IF4JOF.js";
+import "../chunk-EYK3GSRH.js";
+import "../chunk-ZVSKMPBZ.js";
+import "../chunk-C2WCPBF7.js";
+import "../chunk-6J2JC2RT.js";
 import {
   ensureDaemonRunning
-} from "../chunk-4S7CCOXB.js";
-import "../chunk-A6WQF7FQ.js";
-import "../chunk-KLXYMPTM.js";
+} from "../chunk-WE2J62NC.js";
+import "../chunk-3EVPNIBE.js";
+import "../chunk-OKXS7WDZ.js";
 import {
   encryptRecord
-} from "../chunk-R7ZETVNR.js";
-import "../chunk-QSZ37ROP.js";
+} from "../chunk-MPWXGONV.js";
+import "../chunk-SAXBC4AZ.js";
 import {
   transcriptsEnabled
-} from "../chunk-Q7CDBJXU.js";
+} from "../chunk-OLQRRFBX.js";
 import {
   needsShell,
   spawnClaude
@@ -50,7 +50,7 @@ import {
   repoKeyFor,
   reportEvent,
   scopePathFor
-} from "../chunk-2B4XCMH6.js";
+} from "../chunk-CULUZTWQ.js";
 import {
   DEFAULT_SESSION,
   markPendingCommandDelivered,
@@ -60,7 +60,7 @@ import {
   removePendingCommand,
   savePendingCommand
 } from "../chunk-N6IOSZOE.js";
-import "../chunk-RLRDPZG4.js";
+import "../chunk-EPCXUP3P.js";
 import {
   DECISION_STOP_REASON,
   UNVERIFIABLE_APPROVAL_REASON,
@@ -71,36 +71,36 @@ import {
   nextLongPollMs,
   waitForAnswer,
   withdrawQuestion
-} from "../chunk-2XOHXZRC.js";
-import "../chunk-6QZK4O36.js";
+} from "../chunk-NGDD6TXY.js";
+import "../chunk-CVQYGMSR.js";
 import "../chunk-POFBE6ZY.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-VSGKQ3HI.js";
+import "../chunk-P7WQEVWA.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-D4OGEWLH.js";
-import "../chunk-VQDJ6KB3.js";
-import "../chunk-UFNBKYWT.js";
+} from "../chunk-M5ICYGHT.js";
+import "../chunk-2ABTSGFT.js";
+import "../chunk-2OY3ZZ5N.js";
 import {
   getMachineId
-} from "../chunk-HOIGXMI7.js";
+} from "../chunk-LXQ5FBBD.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-LI3C2IQY.js";
-import "../chunk-NYBZJ44G.js";
+import "../chunk-DB3ONZB4.js";
+import "../chunk-A2A2YTMG.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-SJN64NJX.js";
+} from "../chunk-GPEGOGRJ.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-65RN6ZCO.js";
+} from "../chunk-E4FJTUH4.js";
 import {
   KILL_REASON,
-  redactSecrets,
+  redactSecretsFromContent,
   resolveGate
-} from "../chunk-WWTLAZQA.js";
+} from "../chunk-NQTHFF4W.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {
@@ -161,7 +161,7 @@ var redactDraft = (text, complete = false) => {
     const close = text.indexOf(match[1], match.index + match[0].length);
     if (close < 0 || close >= end) end = Math.min(end, match.index);
   }
-  return redactSecrets(text.slice(0, end));
+  return redactSecretsFromContent(text.slice(0, end));
 };
 var DraftText = class {
   messageId = "";