@pushary/agent-hooks 1.7.2 → 1.8.0

package/dist/{chunk-WWTLAZQA.js → chunk-NQTHFF4W.js}

@@ -455,21 +455,42 @@ var compatibleTargetFiles = (profile) => {
 };
 
 // ../contracts/src/redaction.ts
-var CREDENTIAL_KEY = String.raw`(?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)["']?\s*[=:]\s*`;
-var CLOSED_DOUBLE_QUOTE = '"';
-var CLOSED_SINGLE_QUOTE = "'";
-var DOUBLE_QUOTE_OR_CUT_OFF = String.raw`(?:"|\\?$)`;
-var SINGLE_QUOTE_OR_CUT_OFF = "(?:'|$)";
-var credentialAssignmentRule = (doubleQuoteEnd, singleQuoteEnd) => ({
-  pattern: new RegExp(
-    String.raw`(${CREDENTIAL_KEY})(?:(")(?:\\[\s\S]|[^"\\])*${doubleQuoteEnd}|(')[^']*${singleQuoteEnd}|\S+)`,
-    "gi"
-  ),
-  replacement: "$1$2$3[redacted]$2$3"
+var CREDENTIAL_NAME = String.raw`(?:authorization|secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)["']?`;
+var CREDENTIAL_KEY = String.raw`${CREDENTIAL_NAME}\s*[=:]\s*`;
+var DISPLAYED_CREDENTIAL_KEY = String.raw`${CREDENTIAL_NAME}(?:[ \t]*:[ \t]*|[ \t]+=[ \t]*|=)`;
+var SHELL_INERT_UNIT = String.raw`(?:[A-Za-z0-9_\-./+=:@%^!#]|\\[^\s'"])`;
+var SHELL_INERT_SINGLE_QUOTED_UNIT = String.raw`[A-Za-z0-9_\-./+=:@%^!#\\]`;
+var SHELL_INERT_URL_PASSWORD_UNIT = String.raw`(?:[A-Za-z0-9_\-.+=:%^!#]|\\[^\s'"@/])`;
+var PEM_LINE_BREAK = String.raw`(?:\r?\n|(?:\\r)?\\n)`;
+var credentialAssignmentRule = (key, doubleQuoted, singleQuoted, bare) => ({
+  pattern: new RegExp(String.raw`(${key})(?:(")${doubleQuoted}|(')${singleQuoted}|(["']?)${bare})`, "gi"),
+  replacement: "$1$2$3$4[redacted]$2$3"
 });
-var PRECISE_SECRET_RULES = [
+var DISPLAYED_SECRET_SHAPES = {
+  privateKeyBody: String.raw`${PEM_LINE_BREAK}?(?:(?:Proc-Type|DEK-Info): [A-Za-z0-9,-]+${PEM_LINE_BREAK})*(?:[A-Za-z0-9+/=\r\n]|\\[rn])*?`,
+  urlPassword: `${SHELL_INERT_URL_PASSWORD_UNIT}+`,
+  authorizationValue: `${SHELL_INERT_UNIT}+`,
+  credentialAssignment: credentialAssignmentRule(
+    DISPLAYED_CREDENTIAL_KEY,
+    `${SHELL_INERT_UNIT}*"`,
+    `${SHELL_INERT_SINGLE_QUOTED_UNIT}*'`,
+    `${SHELL_INERT_UNIT}+`
+  )
+};
+var CUT_OFF_SECRET_SHAPES = {
+  privateKeyBody: String.raw`[\s\S]*?`,
+  urlPassword: String.raw`[^\s@/]+`,
+  authorizationValue: String.raw`\S+`,
+  credentialAssignment: credentialAssignmentRule(
+    CREDENTIAL_KEY,
+    String.raw`(?:\\[\s\S]|[^"\\])*(?:"|\\?$)`,
+    "[^']*(?:'|$)",
+    String.raw`\S+`
+  )
+};
+var secretRedactionRules = (shapes) => [
   { pattern: /\bpk_[A-Za-z0-9_]+\.[A-Za-z0-9_]+/g, replacement: "[redacted]" },
-  { pattern: /-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z0-9 ]*PRIVATE KEY-----/g, replacement: "[redacted key]" },
+  { pattern: new RegExp(String.raw`-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----${shapes.privateKeyBody}-----END[A-Z0-9 ]*PRIVATE KEY-----`, "g"), replacement: "[redacted key]" },
   { pattern: /\bsk-[A-Za-z0-9_-]{16,}\b/g, replacement: "[redacted]" },
   { pattern: /\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, replacement: "[redacted]" },
   { pattern: /\bwhsec_[A-Za-z0-9]{16,}\b/g, replacement: "[redacted]" },
@@ -482,21 +503,17 @@ var PRECISE_SECRET_RULES = [
   { pattern: /\bnpm_[A-Za-z0-9]{36}\b/g, replacement: "[redacted]" },
   { pattern: /\bxai-[A-Za-z0-9]{16,}\b/g, replacement: "[redacted]" },
   { pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, replacement: "[redacted]" },
-  { pattern: /\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)[^\s@/]+@/gi, replacement: "$1[redacted]@" },
+  { pattern: new RegExp(String.raw`\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)${shapes.urlPassword}@`, "gi"), replacement: "$1[redacted]@" },
   { pattern: /\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, replacement: "bearer [redacted]" },
-  { pattern: /\bauthorization:\s*\S+/gi, replacement: "authorization: [redacted]" }
-];
-var SECRET_REDACTION_RULES = [
-  ...PRECISE_SECRET_RULES,
-  credentialAssignmentRule(CLOSED_DOUBLE_QUOTE, CLOSED_SINGLE_QUOTE)
-];
-var CUT_OFF_TEXT_REDACTION_RULES = [
-  ...PRECISE_SECRET_RULES,
-  credentialAssignmentRule(DOUBLE_QUOTE_OR_CUT_OFF, SINGLE_QUOTE_OR_CUT_OFF)
+  { pattern: new RegExp(String.raw`\bauthorization:\s*${shapes.authorizationValue}`, "gi"), replacement: "authorization: [redacted]" },
+  shapes.credentialAssignment
 ];
+var SECRET_REDACTION_RULES = secretRedactionRules(DISPLAYED_SECRET_SHAPES);
+var CUT_OFF_TEXT_REDACTION_RULES = secretRedactionRules(CUT_OFF_SECRET_SHAPES);
 var HIGH_ENTROPY_RULE = { pattern: /[A-Za-z0-9+/]{40,}={0,2}/g, replacement: "[redacted]" };
 var applyRedactionRules = (rules, text) => rules.reduce((acc, rule) => acc.replace(rule.pattern, rule.replacement), text);
 var redactSecrets = (text) => applyRedactionRules(SECRET_REDACTION_RULES, text);
+var redactSecretsFromContent = (text) => applyRedactionRules(CUT_OFF_TEXT_REDACTION_RULES, text);
 var redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE.pattern, HIGH_ENTROPY_RULE.replacement);
 
 // ../contracts/src/degraded.ts
@@ -642,9 +659,13 @@ var INSTALL_SOURCES = [
   "framework_adapter",
   /** The browser onboarding wizard. */
   "dashboard",
-  /** Reported nothing, or reported something we do not recognise. */
   /** The macOS app pairing a phone from its own onboarding. */
   "mac_app",
+  /** The phone app's own sign-up, which provisions the agent site before any web step. */
+  "mobile_app",
+  /** The CLI's device-code sign-in page (`/cli/authorize`), which provisions a site before any web step. */
+  "cli_login",
+  /** Reported nothing, or reported something we do not recognise. */
   "unknown"
 ];
 var isInstallSource = (value) => typeof value === "string" && INSTALL_SOURCES.includes(value);
@@ -1518,6 +1539,16 @@ var API_KEY_PATTERN = /^pk_[a-f0-9]+\.[a-f0-9]+$/;
 var isValidApiKey = (value) => API_KEY_PATTERN.test(value);
 var ACTION_BODY_MAX = 4e3;
 var DECISION_LINE_MAX = 500;
+var ASK_QUESTION_MAX = 500;
+var ASK_AGENT_NAME_MAX = 100;
+var TRUNCATION_MARK = "\u2026";
+var isHighSurrogate = (code) => code >= 55296 && code <= 56319;
+var truncateLine = (text, max, mark = TRUNCATION_MARK) => {
+  if (text.length <= max) return text;
+  const end = max - mark.length;
+  const keep = isHighSurrogate(text.charCodeAt(end - 1)) ? end - 1 : end;
+  return `${text.slice(0, keep)}${mark}`;
+};
 var APPROVAL_FATIGUE_FLAG_PATTERNS = [
   /\brm\s+-[a-z]*r/i,
   /\brmdir\b/i,
@@ -2522,40 +2553,126 @@ var hookActivationResult = (report) => {
   return report && !report.truncated && report.evidence.length === 1 ? report.evidence[0].result : "unverified";
 };
 
+// src/cli-package-name.ts
+var CANONICAL_PACKAGE = "pushary";
+var LEGACY_PACKAGE = "@pushary/agent-hooks";
+var CLI_PACKAGE_NAMES = [CANONICAL_PACKAGE, LEGACY_PACKAGE];
+var isCliPackageName = (value) => typeof value === "string" && CLI_PACKAGE_NAMES.some((name) => name === value);
+var cliPackagePathSegments = (name) => name.split("/");
+
+// src/global-package.ts
+import { posix, win32 } from "path";
+var OWNERSHIP_PROBE_COMMAND = "pushary-hook";
+var pathApiFor = (platform) => platform === "win32" ? win32 : posix;
+var POSIX_GLOBAL_ROOT_SEGMENTS = ["lib", "node_modules"];
+var UPGRADE_ENTRY_SEGMENTS = ["dist", "bin", "pushary-upgrade.js"];
+var globalRootFor = (prefix, platform) => platform === "win32" ? win32.join(prefix, "node_modules") : posix.join(prefix, ...POSIX_GLOBAL_ROOT_SEGMENTS);
+var globalPackageFolder = (root, name, platform) => pathApiFor(platform).join(root, ...cliPackagePathSegments(name));
+var globalUpgradeEntry = (prefix, name, platform) => pathApiFor(platform).join(globalPackageFolder(globalRootFor(prefix, platform), name, platform), ...UPGRADE_ENTRY_SEGMENTS);
+var isInsideFolder = (target, folder, platform) => {
+  const pathApi = pathApiFor(platform);
+  const relativePath = pathApi.relative(folder, target);
+  return relativePath !== "" && !relativePath.startsWith("..") && !pathApi.isAbsolute(relativePath);
+};
+var linkPointsInto = (evidence, targets, name) => evidence.globalRoots.some((root) => {
+  const folder = globalPackageFolder(root, name, evidence.platform);
+  return targets.some((target) => isInsideFolder(target, folder, evidence.platform));
+});
+var ownerFromInstalled = (installed, whenNone) => {
+  const [only, ...others] = installed;
+  if (only === void 0) return whenNone;
+  if (others.length > 0) return { kind: "unknown", reason: "both_installed" };
+  return { kind: "owned", name: only };
+};
+var decideCommandOwner = (evidence) => {
+  const { link } = evidence;
+  if (link.kind === "resolved") {
+    const name = CLI_PACKAGE_NAMES.find((candidate) => linkPointsInto(evidence, link.targets, candidate));
+    return name === void 0 ? { kind: "unknown", reason: "foreign_command" } : { kind: "owned", name };
+  }
+  const whenNone = link.kind === "absent" ? { kind: "none" } : { kind: "unknown", reason: "unreadable_command" };
+  return ownerFromInstalled(evidence.installed, whenNone);
+};
+var CMD_SHIM_TARGET = /"%(?:~dp0|dp0%)\\([^"]+?)"\s+%[*]/;
+var cmdShimTarget = (shimDir, contents) => {
+  const relativeTarget = CMD_SHIM_TARGET.exec(contents)?.[1];
+  return relativeTarget === void 0 ? void 0 : win32.resolve(shimDir, relativeTarget);
+};
+var launchedPackage = (ownName) => ownName ?? LEGACY_PACKAGE;
+var globalInstallTarget = (owner, ownName) => {
+  switch (owner.kind) {
+    case "owned":
+      return owner.name;
+    case "none":
+      return launchedPackage(ownName);
+    case "unknown":
+      return LEGACY_PACKAGE;
+  }
+};
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var declaresOwnershipProbe = (bin) => isRecord2(bin) && typeof bin[OWNERSHIP_PROBE_COMMAND] === "string";
+var cliManifestName = (manifest) => {
+  if (!isRecord2(manifest) || !isCliPackageName(manifest.name) || !declaresOwnershipProbe(manifest.bin)) return void 0;
+  return manifest.name;
+};
+var classifyGlobalFolder = (name, read) => {
+  if (read.kind === "unreadable") return { kind: "unseen" };
+  const { manifest } = read;
+  if (!isRecord2(manifest) || cliManifestName(manifest) !== name) return { kind: "foreign" };
+  return { kind: "ours", installed: { name, version: typeof manifest.version === "string" ? manifest.version : void 0 } };
+};
+var classifyGlobalInstall = (installed, owner) => {
+  const [only, ...others] = installed;
+  if (only === void 0) return { kind: "absent" };
+  if (others.length === 0) return { kind: "single", installed: only };
+  return { kind: "both", installed, owner };
+};
+var isUninstallable = (evidence) => evidence.listing !== "absent" && evidence.folder !== "foreign";
+var globalPackagesToUninstall = (evidence) => evidence.filter(isUninstallable).map((entry) => entry.name);
+var commandsPackage = (install) => {
+  if (install.kind === "single") return install.installed;
+  if (install.kind !== "both" || install.owner.kind !== "owned") return void 0;
+  const ownerName = install.owner.name;
+  return install.installed.find((installed) => installed.name === ownerName);
+};
+
 // src/cli/version.ts
 import { readFileSync } from "fs";
 import { dirname, join, parse } from "path";
 import { fileURLToPath } from "url";
-var PACKAGE_NAME = "@pushary/agent-hooks";
 var UNKNOWN_VERSION = "0.0.0";
-var findOwnPackageJson = (start) => {
+var cliManifestNameAt = (manifestPath) => {
+  try {
+    return cliManifestName(JSON.parse(readFileSync(manifestPath, "utf-8")));
+  } catch {
+    return void 0;
+  }
+};
+var findOwnPackage = (start) => {
   const { root } = parse(start);
   let dir = start;
   while (true) {
-    const candidate = join(dir, "package.json");
-    try {
-      const pkg = JSON.parse(readFileSync(candidate, "utf-8"));
-      if (pkg.name === PACKAGE_NAME) return candidate;
-    } catch {
-    }
+    const name = cliManifestNameAt(join(dir, "package.json"));
+    if (name !== void 0) return { root: dir, name };
     if (dir === root) return void 0;
     const parent = dirname(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
 };
-var getPackageVersion = () => {
-  const root = ownPackageRoot();
-  return (root === void 0 ? void 0 : packageVersionAt(root)) ?? UNKNOWN_VERSION;
-};
-var ownPackageRoot = () => {
+var runningPackage = () => {
   try {
-    const found = findOwnPackageJson(dirname(fileURLToPath(import.meta.url)));
-    return found ? dirname(found) : void 0;
+    return findOwnPackage(dirname(fileURLToPath(import.meta.url)));
   } catch {
     return void 0;
   }
 };
+var getPackageVersion = () => {
+  const root = ownPackageRoot();
+  return (root === void 0 ? void 0 : packageVersionAt(root)) ?? UNKNOWN_VERSION;
+};
+var ownPackageRoot = () => runningPackage()?.root;
+var ownPackageName = () => runningPackage()?.name;
 var packageVersionAt = (packageRoot) => {
   try {
     const manifest = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf-8"));
@@ -2601,6 +2718,7 @@ export {
   hookCompatibleProfileBySource,
   compatibleTargetFiles,
   redactSecrets,
+  redactSecretsFromContent,
   redactSecretsDeep,
   degradedLine,
   hookWritePath,
@@ -2639,6 +2757,9 @@ export {
   isValidApiKey,
   ACTION_BODY_MAX,
   DECISION_LINE_MAX,
+  ASK_QUESTION_MAX,
+  ASK_AGENT_NAME_MAX,
+  truncateLine,
   isAnswerSource,
   buildDecisionEpisodeFeatures,
   resolveAutoResolveOrigin,
@@ -2682,8 +2803,26 @@ export {
   planElicitationAsk,
   elicitationContent,
   elicitationContentFromAnswers,
+  CANONICAL_PACKAGE,
+  LEGACY_PACKAGE,
+  CLI_PACKAGE_NAMES,
+  cliPackagePathSegments,
+  OWNERSHIP_PROBE_COMMAND,
+  POSIX_GLOBAL_ROOT_SEGMENTS,
+  globalRootFor,
+  globalPackageFolder,
+  globalUpgradeEntry,
+  decideCommandOwner,
+  cmdShimTarget,
+  launchedPackage,
+  globalInstallTarget,
+  classifyGlobalFolder,
+  classifyGlobalInstall,
+  globalPackagesToUninstall,
+  commandsPackage,
   getPackageVersion,
   ownPackageRoot,
+  ownPackageName,
   packageVersionAt,
   isNewerVersion,
   isReleaseVersion,

package/dist/{chunk-KLXYMPTM.js → chunk-OKXS7WDZ.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-NYBZJ44G.js";
+} from "./chunk-A2A2YTMG.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-Q7CDBJXU.js → chunk-OLQRRFBX.js}

@@ -1,6 +1,6 @@
 import {
   readTranscriptPreference
-} from "./chunk-VSGKQ3HI.js";
+} from "./chunk-P7WQEVWA.js";
 
 // src/transcript-setting.ts
 var transcriptEnvironmentPreference = () => {

package/dist/{chunk-VSGKQ3HI.js → chunk-P7WQEVWA.js}

@@ -1,6 +1,6 @@
 import {
   resolveInstallSourceFor
-} from "./chunk-LI3C2IQY.js";
+} from "./chunk-DB3ONZB4.js";
 import {
   backupFile,
   readJsonSafe,
@@ -9,7 +9,7 @@ import {
 } from "./chunk-T7E75EKA.js";
 import {
   configFilePath
-} from "./chunk-SJN64NJX.js";
+} from "./chunk-GPEGOGRJ.js";
 
 // src/shell-alias.ts
 import { homedir } from "os";

package/dist/{chunk-UUTWHVSV.js → chunk-Q7E4I6UA.js}

@@ -1,19 +1,15 @@
 import {
   activeHookSource,
   activeIdentity
-} from "./chunk-T3PRPFDY.js";
+} from "./chunk-J5TIV3J6.js";
 import {
-  blockedActionFingerprint,
   defersToNativeMode,
-  forgetBlockedActionHint,
-  hasBlockedActionHint,
-  recordBlockedActionHint,
   reportMachineDenial
-} from "./chunk-IZVAVXHQ.js";
+} from "./chunk-CJVVKOSR.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-F6BMJOSW.js";
+} from "./chunk-JU6W3XAU.js";
 import {
   announceSubscriptionRequired,
   denyReasonFrom,
@@ -22,6 +18,8 @@ import {
 } from "./chunk-5OP5MQI7.js";
 import {
   UNNAMED_ACTION,
+  approvalAwaitingRetry,
+  blockedActionFingerprint,
   claimThrottle,
   deriveAction,
   deriveActionBody,
@@ -29,15 +27,19 @@ import {
   deriveToolTarget,
   describeToolCall,
   fetchModeState,
+  forgetBlockedActionHint,
   getPolicy,
+  hasBlockedActionHint,
+  markApprovalReminded,
   permissionDeniedAction,
   readLastPrompt,
   readLastUserPrompt,
+  recordBlockedActionHint,
   repoKeyFor,
   reportEvent,
   scopePathFor,
   settleQuestionsForToolUse
-} from "./chunk-2B4XCMH6.js";
+} from "./chunk-CULUZTWQ.js";
 import {
   DEFAULT_SESSION
 } from "./chunk-N6IOSZOE.js";
@@ -53,17 +55,17 @@ import {
   requestGate,
   sendNotification,
   waitForQuestion
-} from "./chunk-2XOHXZRC.js";
+} from "./chunk-NGDD6TXY.js";
 import {
   SubscriptionRequiredError
-} from "./chunk-D4OGEWLH.js";
+} from "./chunk-M5ICYGHT.js";
 import {
   getMachineId
-} from "./chunk-HOIGXMI7.js";
+} from "./chunk-LXQ5FBBD.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-SJN64NJX.js";
+} from "./chunk-GPEGOGRJ.js";
 import {
   AGENT_QUESTION_STRATEGY,
   GATE_BLOCK_REASON_MAX_LENGTH,
@@ -91,7 +93,7 @@ import {
   parseAgentQuestions,
   resolveGate,
   stoppedOutput
-} from "./chunk-WWTLAZQA.js";
+} from "./chunk-NQTHFF4W.js";
 
 // src/claude-permission-rules.ts
 import { readFileSync, statSync } from "fs";
@@ -530,6 +532,7 @@ var batchScopeReason = "This patch exceeds the agreed scope. Split it into singl
 var BLOCKED_ACTION_GATE_TIMEOUT_MS = 15e3;
 var BLOCKED_ACTION_CLAIM_TIMEOUT_MS = 4e3;
 var BLOCKED_ACTION_ALLOW_REASON = "Approved from Pushary after auto mode blocked it";
+var BLOCKED_ACTION_CHANGED_RETRY_REASON = "This is not the call the person allowed from Pushary, so their approval does not cover it. Send the call auto mode blocked again, exactly as it was with nothing changed, to use their approval.";
 var blockReasonOf = (reason) => typeof reason === "string" ? reason.trim().slice(0, GATE_BLOCK_REASON_MAX_LENGTH).trim() || void 0 : void 0;
 var blockedActionFingerprintFor = (input) => blockedActionFingerprint({
   sessionId: input.session_id,
@@ -566,6 +569,13 @@ var claimedBlockedActionRetry = async (apiKey, input) => {
     return false;
   }
 };
+var remindedOfApprovedRetry = (input) => {
+  const approval = approvalAwaitingRetry(input.session_id);
+  if (!approval || approval.reminded || approval.toolName !== input.tool_name) return false;
+  if (approval.fingerprint === blockedActionFingerprintFor(input)) return false;
+  markApprovalReminded(approval);
+  return true;
+};
 var handlePreToolUse = async (input, canonical) => {
   if (isPusharyOwnTool(input.tool_name)) return void 0;
   let apiKey;
@@ -597,6 +607,7 @@ var handlePreToolUse = async (input, canonical) => {
       return handleExitPlanMode(apiKey, input);
     }
     if (await claimedBlockedActionRetry(apiKey, input)) return allow(BLOCKED_ACTION_ALLOW_REASON);
+    if (remindedOfApprovedRetry(input)) return deny(BLOCKED_ACTION_CHANGED_RETRY_REASON);
     if (!(verdict.kind === "gate" && verdict.scopeReason) && shouldDeferToNativeMode(input.permission_mode, input.tool_name)) {
       return void 0;
     }
@@ -709,11 +720,12 @@ var isRetryOutput = (output) => {
     return false;
   }
 };
-var retryOnce = (fingerprint) => recordBlockedActionHint(fingerprint) ? claudePermissionDeniedOutput("allow") : void 0;
+var approvedCallOf = (input) => input.session_id ? { sessionId: input.session_id, toolName: input.tool_name } : void 0;
+var retryOnce = (fingerprint, input) => recordBlockedActionHint(fingerprint, approvedCallOf(input)) ? claudePermissionDeniedOutput("allow") : void 0;
 var askAboutBlockedAction = async (apiKey, input, fingerprint, holdEndsAt) => {
   const reply = await requestGate(apiKey, blockedActionGateRequest(input, "PermissionDenied"), BLOCKED_ACTION_GATE_TIMEOUT_MS);
   if (!reply) return void 0;
-  if (reply.kind === "no_opinion") return isRetryOutput(reply.output) ? retryOnce(fingerprint) : void 0;
+  if (reply.kind === "no_opinion") return isRetryOutput(reply.output) ? retryOnce(fingerprint, input) : void 0;
   if (reply.kind !== "ask" || !reply.correlationId || reply.deadlineSeconds === void 0) return void 0;
   if (reply.noDevices) {
     await cancelQuestion(apiKey, reply.correlationId, AbortSignal.timeout(4e3)).catch(() => void 0);
@@ -721,7 +733,7 @@ var askAboutBlockedAction = async (apiKey, input, fingerprint, holdEndsAt) => {
   }
   const deadline = Math.min(hookWaitDeadline(START_MS, reply.deadlineSeconds, "claude", Date.now()), holdEndsAt);
   const answer = await pollForAnswer(apiKey, reply.correlationId, deadline);
-  return isAffirmativeAnswer(answer) ? retryOnce(fingerprint) : void 0;
+  return isAffirmativeAnswer(answer) ? retryOnce(fingerprint, input) : void 0;
 };
 var handlePermissionDenied = async (input, holdBudgetSeconds) => {
   await reportPermissionDenied(input);

package/dist/{chunk-WXIVUIXA.js → chunk-R7437YI3.js}

@@ -3,11 +3,11 @@ import {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-R7ZETVNR.js";
+} from "./chunk-MPWXGONV.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-QSZ37ROP.js";
+} from "./chunk-SAXBC4AZ.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;

package/dist/{chunk-5GIBNUBD.js → chunk-RHR6NARM.js}

@@ -6,10 +6,10 @@ import {
   codexHooksJsonIn,
   isPusharyCodexCommand,
   resolvePathBinary
-} from "./chunk-NYBZJ44G.js";
+} from "./chunk-A2A2YTMG.js";
 import {
   getPackageVersion
-} from "./chunk-WWTLAZQA.js";
+} from "./chunk-NQTHFF4W.js";
 
 // src/codex-app-server.ts
 import { existsSync, realpathSync } from "fs";

package/dist/{chunk-QSZ37ROP.js → chunk-SAXBC4AZ.js}

@@ -1,6 +1,6 @@
 import {
   getBaseUrl
-} from "./chunk-SJN64NJX.js";
+} from "./chunk-GPEGOGRJ.js";
 
 // src/transcript-api.ts
 var fetchTranscriptRecipients = async (apiKey, baseUrl = getBaseUrl()) => {

package/dist/{chunk-U3MS6D5X.js → chunk-SIFVFP6T.js}

@@ -1,6 +1,6 @@
 import {
   parseVersion
-} from "./chunk-A6WQF7FQ.js";
+} from "./chunk-3EVPNIBE.js";
 
 // src/setup/agent-probe.ts
 import { execSync } from "child_process";

package/dist/{chunk-TVJYGZXB.js → chunk-SLFABHW3.js}

@@ -1,9 +1,9 @@
 import {
   parseSseMessages
-} from "./chunk-D4OGEWLH.js";
+} from "./chunk-M5ICYGHT.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-65RN6ZCO.js";
+} from "./chunk-E4FJTUH4.js";
 
 // src/mcp-stdio-bridge.ts
 var MCP_BRIDGE_BINARY = "pushary-mcp";
@@ -11,6 +11,7 @@ var MCP_BRIDGE_PATH = "/api/mcp/mcp";
 var MCP_BRIDGE_REQUEST_TIMEOUT_MS = 9e4;
 var JSON_RPC_PARSE_ERROR = -32700;
 var MCP_BRIDGE_ERROR = -32e3;
+var MCP_MAX_RESPONSE_BYTES = 1024 * 1024;
 var MCP_SESSION_HEADER = "mcp-session-id";
 var MCP_PROTOCOL_HEADER = "mcp-protocol-version";
 var INITIALIZE_METHOD = "initialize";
@@ -63,6 +64,25 @@ var negotiatedProtocolOf = (messages, initializeIds) => {
   }
   return void 0;
 };
+var readBoundedResponse = async (response) => {
+  if (!response.body) return "";
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > MCP_MAX_RESPONSE_BYTES) throw new Error("MCP response exceeds the 1 MiB limit.");
+      chunks.push(value);
+    }
+    return Buffer.concat(chunks).toString("utf8");
+  } finally {
+    await reader.cancel().catch(() => void 0);
+    reader.releaseLock();
+  }
+};
 var createMcpStdioBridge = (deps) => {
   let sessionId = null;
   let protocolVersion = null;
@@ -73,9 +93,9 @@ var createMcpStdioBridge = (deps) => {
     ...sessionId ? { [MCP_SESSION_HEADER]: sessionId } : {},
     ...protocolVersion ? { [MCP_PROTOCOL_HEADER]: protocolVersion } : {}
   });
-  const failRequests = (requests, message, answered = /* @__PURE__ */ new Set()) => {
+  const failRequests = async (requests, message, answered = /* @__PURE__ */ new Set()) => {
     for (const request of requests) {
-      if (!answered.has(request.id)) deps.emit(bridgeError(request.id, message));
+      if (!answered.has(request.id)) await deps.emit(bridgeError(request.id, message));
     }
   };
   const post = async (line, apiKey) => deps.fetchImpl(deps.endpoint, {
@@ -87,7 +107,7 @@ var createMcpStdioBridge = (deps) => {
   const forward = async (line) => {
     const parsed = parseBridgeLine(line);
     if (!parsed.ok) {
-      deps.emit(bridgeError(null, PARSE_ERROR_MESSAGE, JSON_RPC_PARSE_ERROR));
+      await deps.emit(bridgeError(null, PARSE_ERROR_MESSAGE, JSON_RPC_PARSE_ERROR));
       return;
     }
     const requests = requestsIn(parsed.payload);
@@ -96,25 +116,35 @@ var createMcpStdioBridge = (deps) => {
     let body;
     try {
       response = await post(line, apiKey);
-      body = await response.text();
+      body = await readBoundedResponse(response);
     } catch (err) {
-      failRequests(requests, unreachableMessage(err));
+      await failRequests(requests, unreachableMessage(err));
       return;
     }
     sessionId = response.headers.get(MCP_SESSION_HEADER) ?? sessionId;
     const messages = parseMcpMessages(body, response.headers.get("content-type")).filter(isJsonRpcMessage);
     const initializeIds = new Set(requests.filter((request) => request.method === INITIALIZE_METHOD).map((request) => request.id));
     protocolVersion = negotiatedProtocolOf(messages, initializeIds) ?? protocolVersion;
-    for (const message of messages) deps.emit(message);
+    for (const message of messages) await deps.emit(message);
     const answered = new Set(messages.map(responseIdOf).filter(isJsonRpcId));
     const failure = response.ok ? NO_RESPONSE_MESSAGE : httpFailureMessage(response.status, apiKey !== null, body);
-    failRequests(requests, failure, answered);
+    await failRequests(requests, failure, answered);
+  };
+  const reject = async (line, message) => {
+    const parsed = parseBridgeLine(line);
+    if (!parsed.ok) {
+      await deps.emit(bridgeError(null, PARSE_ERROR_MESSAGE, JSON_RPC_PARSE_ERROR));
+      return;
+    }
+    await failRequests(requestsIn(parsed.payload), message);
   };
-  return { forward };
+  return { forward, reject };
 };
 
 export {
   MCP_BRIDGE_BINARY,
   MCP_BRIDGE_PATH,
+  bridgeError,
+  parseBridgeLine,
   createMcpStdioBridge
 };

package/dist/{chunk-M2JGLFFS.js → chunk-TY4JT7W3.js}

@@ -1,6 +1,6 @@
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-65RN6ZCO.js";
+} from "./chunk-E4FJTUH4.js";
 
 // src/setup/codex-trust.ts
 var CODEX_TRUST_TELEMETRY = {