@pushary/agent-hooks 1.9.0 → 1.9.2

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 1.9.2
+
+- Setup, doctor and login finish writing their output before exiting, including when output is piped. Windows setup saves the key without printing it when no shell profile is available.
+- Editor approvals stop waiting when a question is missing or withdrawn. Pending configuration refreshes retry after five minutes, readiness tolerates client clock skew, and activation checks follow symlinks.
+- Codex coverage requires enabled, trusted synchronous permission hooks. Native permission requests show their redacted input without treating it as a shell command or file edit.
+
+## 1.9.1
+
+- **Fewer approvals for commands that only read.** A chain of reads joined by `;` or `||`, a `|`, `\` or `{` inside quotes (as in `grep "a\|b" src/` or `grep '^{' file`), `sed -n 50,66p file` and `date '+%H:%M:%S'` no longer wait for you. Before, any of these sent a prompt to your phone or the Mac notch.
+- **A read is no longer treated as destructive because of a word it reads.** `tail -5 release.log`, `grep "DELETE FROM" src/db.ts` and `cat deploy.log` were rated destructive because of `release`, `delete` or `deploy`, and a destructive rating overrides your own "auto-approve Bash" rule. They are now rated by what they do. A command that can act is rated as before, including a read piped into a shell or a database client, such as `echo "rm -rf ~" | sh`.
+- `git`, `find`, `sed` and `date` now ask when an argument is something the shell expands, such as `$VAR` or a glob at the start of a word. An expansion like that can turn into a flag the check never saw, for example a file named `-delete` matched by `find . -name *`.
+- Setup's global install now takes the same lock as `pushary upgrade` and automatic updates, so it never installs over an upgrade that is already running. (#1837)
+
 ## 1.9.0
 
 - When you scan setup's QR code with the Pushary app, the app now shows which computer is asking to connect: its name, whether it is a Mac, Windows or Linux computer, and the agents setup found on it. Before, it showed only the fingerprint. This needs Pushary app 1.0.31 or later; older apps work as before.

package/data/cursor-plugin/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "pushary",
   "displayName": "Pushary — Control Panel for AI Agents",
   "description": "Push notifications, human-in-the-loop questions, and permission gating for your AI coding agent. Get a push when a task finishes, answer the agent from your phone, and approve risky commands before they run.",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "author": { "name": "Pushary", "email": "business@pushary.com" },
   "homepage": "https://pushary.com",
   "repository": "https://github.com/Pushary/cursor-plugin",

package/data/cursor-plugin/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.2.4
+
+- Stop the gated action when a question is missing after withdrawal, instead of treating it as a timeout that can approve the action.
+
 ## 0.2.3
 
 - Approval text never hides part of a command. The value after a credential name is hidden only up to the first space, quote or piece of shell syntax, so `echo "password=" && rm -rf ~` and `eval TOKEN="x; rm -rf ~"` both show the `rm`. A private key block is hidden only when it holds nothing but the key.

package/data/cursor-plugin/scripts/pushary-gate.mjs

@@ -417,7 +417,7 @@ const withdraw = async (apiKey, correlationId) => {
     if (cancelled?.cancelled === true) return { answered: false }
     const answer = await callTool(apiKey, 'wait_for_answer', { correlationId, timeoutMs: 1_000 }, WITHDRAW_TIMEOUT_MS)
     if (answer?.answered) return answer
-    return ['expired', 'missing'].includes(answer?.status) ? { answered: false } : STOPPED
+    return answer?.status === 'expired' ? { answered: false } : STOPPED
   } catch {
     return STOPPED
   } finally {

package/data/vscode-plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pushary",
   "description": "Push notifications, human-in-the-loop questions, and permission gating for your AI agent. Get a push when a task finishes, answer the agent from your phone, and approve risky commands before they run.",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "author": {
     "name": "Pushary",
     "email": "business@pushary.com",

package/data/vscode-plugin/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.2.4
+
+- Stop the gated action when a question is missing after withdrawal, instead of treating it as a timeout that can approve the action.
+
 ## 0.2.3
 
 - Approval text never hides part of a command. The value after a credential name is hidden only up to the first space, quote or piece of shell syntax, so `echo "password=" && rm -rf ~` and `eval TOKEN="x; rm -rf ~"` both show the `rm`. A private key block is hidden only when it holds nothing but the key.

package/data/vscode-plugin/scripts/pushary-gate.mjs

@@ -518,7 +518,7 @@ const withdrawQuestion = async (apiKey, correlationId) => {
     if (cancelled?.cancelled === true) return { answered: false }
     const answer = await callTool(apiKey, 'wait_for_answer', { correlationId, timeoutMs: 1_000 }, WITHDRAW_TIMEOUT_MS)
     if (answer?.answered) return answer
-    return ['expired', 'missing'].includes(answer?.status) ? { answered: false } : STOPPED
+    return answer?.status === 'expired' ? { answered: false } : STOPPED
   } catch {
     return STOPPED
   } finally {

package/dist/bin/pushary-bell-hook.js

@@ -1,39 +1,39 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-KETBIX7I.js";
+} from "../chunk-Y73RBCQD.js";
 import {
   readHookInput
-} from "../chunk-OXQKXZJ3.js";
-import "../chunk-WFVNXGZ6.js";
+} from "../chunk-IH5NZMN4.js";
+import "../chunk-PN3F7LOB.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-OLG6FJV2.js";
-import "../chunk-ET6QSY3H.js";
-import "../chunk-TUZ7WKOF.js";
-import "../chunk-NAJ3UV4E.js";
-import "../chunk-LQESQPIT.js";
-import "../chunk-YFS4HYCI.js";
-import "../chunk-RZXQFAWR.js";
-import "../chunk-MGXXQHCM.js";
-import "../chunk-HSM5FIA3.js";
-import "../chunk-MBVV3RX3.js";
+import "../chunk-KP45FGHD.js";
+import "../chunk-CEHDCHXK.js";
+import "../chunk-2XK6D4WL.js";
+import "../chunk-EUNYNLDU.js";
+import "../chunk-WCHFDVCC.js";
+import "../chunk-B6BLCHJW.js";
+import "../chunk-DKDZXJHZ.js";
+import "../chunk-U4DLXAGD.js";
+import "../chunk-UX2YSFKS.js";
+import "../chunk-CTYCABBH.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-VYNTRHB6.js";
-import "../chunk-BG4QCOHQ.js";
+import "../chunk-RTKPR4UA.js";
+import "../chunk-XXSAGQAV.js";
 import "../chunk-POFBE6ZY.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-ZRHA4PGN.js";
-import "../chunk-P6VDRQF3.js";
-import "../chunk-VV4SBPCQ.js";
+import "../chunk-ZNUNWWCN.js";
+import "../chunk-V3P2VSX7.js";
+import "../chunk-3O4EBTR3.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-US3RDXK7.js";
-import "../chunk-R76C43H7.js";
+import "../chunk-UBCTOE5X.js";
+import "../chunk-HZ57E6LS.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-EG46RJRF.js";
-import "../chunk-SDSKTRIV.js";
-import "../chunk-4PCF34AB.js";
+import "../chunk-L52OIZXV.js";
+import "../chunk-ABIW72ST.js";
+import "../chunk-ZFDGCEKO.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,37 +5,37 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-KETBIX7I.js";
+} from "../chunk-Y73RBCQD.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-RZXQFAWR.js";
+} from "../chunk-DKDZXJHZ.js";
 import {
   createIo
 } from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-K75TP4JY.js";
+} from "../chunk-73BH4SZY.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-ZRHA4PGN.js";
+import "../chunk-ZNUNWWCN.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-US3RDXK7.js";
+import "../chunk-UBCTOE5X.js";
 import {
   claudeSettings
-} from "../chunk-R76C43H7.js";
+} from "../chunk-HZ57E6LS.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-T7E75EKA.js";
-import "../chunk-EG46RJRF.js";
-import "../chunk-SDSKTRIV.js";
-import "../chunk-4PCF34AB.js";
+import "../chunk-L52OIZXV.js";
+import "../chunk-ABIW72ST.js";
+import "../chunk-ZFDGCEKO.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,7 +8,7 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-3OFHFVPX.js";
+} from "../chunk-WM2MEFCA.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
@@ -18,24 +18,24 @@ import {
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-WFVNXGZ6.js";
+} from "../chunk-PN3F7LOB.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-OLG6FJV2.js";
-import "../chunk-ET6QSY3H.js";
-import "../chunk-TUZ7WKOF.js";
-import "../chunk-NAJ3UV4E.js";
+import "../chunk-KP45FGHD.js";
+import "../chunk-CEHDCHXK.js";
+import "../chunk-2XK6D4WL.js";
+import "../chunk-EUNYNLDU.js";
 import {
   ensureDaemonRunning
-} from "../chunk-LQESQPIT.js";
-import "../chunk-YFS4HYCI.js";
-import "../chunk-RZXQFAWR.js";
+} from "../chunk-WCHFDVCC.js";
+import "../chunk-B6BLCHJW.js";
+import "../chunk-DKDZXJHZ.js";
 import {
   encryptRecord
-} from "../chunk-MGXXQHCM.js";
-import "../chunk-HSM5FIA3.js";
+} from "../chunk-U4DLXAGD.js";
+import "../chunk-UX2YSFKS.js";
 import {
   transcriptsEnabled
-} from "../chunk-MBVV3RX3.js";
+} from "../chunk-CTYCABBH.js";
 import {
   needsShell,
   spawnClaude
@@ -51,7 +51,7 @@ import {
   repoKeyFor,
   reportEvent,
   scopePathFor
-} from "../chunk-42E4DE6C.js";
+} from "../chunk-35N53QLA.js";
 import {
   DEFAULT_SESSION,
   markPendingCommandDelivered,
@@ -61,7 +61,7 @@ import {
   removePendingCommand,
   savePendingCommand
 } from "../chunk-N6IOSZOE.js";
-import "../chunk-VYNTRHB6.js";
+import "../chunk-RTKPR4UA.js";
 import {
   DECISION_STOP_REASON,
   UNVERIFIABLE_APPROVAL_REASON,
@@ -72,36 +72,36 @@ import {
   nextLongPollMs,
   waitForAnswer,
   withdrawQuestion
-} from "../chunk-ZMVLKPT7.js";
-import "../chunk-BG4QCOHQ.js";
+} from "../chunk-HZYUDXIH.js";
+import "../chunk-XXSAGQAV.js";
 import "../chunk-POFBE6ZY.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-ZRHA4PGN.js";
+import "../chunk-ZNUNWWCN.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-CPBRXBLG.js";
-import "../chunk-75CEJ4WP.js";
-import "../chunk-P6VDRQF3.js";
+} from "../chunk-XOXW4D6P.js";
+import "../chunk-Y6DSV2OS.js";
+import "../chunk-V3P2VSX7.js";
 import {
   getMachineId
-} from "../chunk-VV4SBPCQ.js";
+} from "../chunk-3O4EBTR3.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-US3RDXK7.js";
-import "../chunk-R76C43H7.js";
+import "../chunk-UBCTOE5X.js";
+import "../chunk-HZ57E6LS.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-EG46RJRF.js";
+} from "../chunk-L52OIZXV.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-SDSKTRIV.js";
+} from "../chunk-ABIW72ST.js";
 import {
   KILL_REASON,
   redactSecretsFromContent,
   resolveGate
-} from "../chunk-4PCF34AB.js";
+} from "../chunk-ZFDGCEKO.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {

package/dist/bin/pushary-clean.js

@@ -4,7 +4,7 @@ import {
   PUSHARY_SKILL_SOURCE,
   createGuards,
   withoutPusharyCursorHooks
-} from "../chunk-XGS2DHGF.js";
+} from "../chunk-4KMTRXNL.js";
 import {
   HERMES_PIP_PACKAGE,
   planFxRemoval,
@@ -15,8 +15,8 @@ import {
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-K7DY2DQN.js";
-import "../chunk-MBNMO5IR.js";
+} from "../chunk-ZSOFZDLY.js";
+import "../chunk-SFKU5DXZ.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -28,7 +28,7 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-HHNFGWR5.js";
+} from "../chunk-AL4NHBZ6.js";
 import {
   compatibleConfigFile,
   compatibleInstructionsFile,
@@ -36,40 +36,40 @@ import {
   compatiblePermissionRuleFile,
   removeCompatibleHooks,
   removeCompatibleMcpServer
-} from "../chunk-CKPDSFY3.js";
+} from "../chunk-ESME4HN2.js";
 import {
   isClaudeMcpSnapshot,
   removeClaudeMcpServers,
   removePusharySettings,
   removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-MQJWO3AA.js";
+} from "../chunk-FHLRRCUZ.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-OLG6FJV2.js";
-import "../chunk-ET6QSY3H.js";
+} from "../chunk-KP45FGHD.js";
+import "../chunk-CEHDCHXK.js";
 import {
   liveBridgeProbe,
   resolveBridgeStub
-} from "../chunk-TUZ7WKOF.js";
-import "../chunk-NAJ3UV4E.js";
+} from "../chunk-2XK6D4WL.js";
+import "../chunk-EUNYNLDU.js";
 import {
   disableDaemonService
-} from "../chunk-LQESQPIT.js";
+} from "../chunk-WCHFDVCC.js";
 import {
   removeGeminiSettings
-} from "../chunk-YFS4HYCI.js";
-import "../chunk-RZXQFAWR.js";
+} from "../chunk-B6BLCHJW.js";
+import "../chunk-DKDZXJHZ.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-42E4DE6C.js";
+import "../chunk-35N53QLA.js";
 import "../chunk-N6IOSZOE.js";
-import "../chunk-VYNTRHB6.js";
-import "../chunk-ZMVLKPT7.js";
-import "../chunk-BG4QCOHQ.js";
+import "../chunk-RTKPR4UA.js";
+import "../chunk-HZYUDXIH.js";
+import "../chunk-XXSAGQAV.js";
 import "../chunk-POFBE6ZY.js";
 import {
   ansiPainter,
@@ -77,7 +77,7 @@ import {
 } from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-K75TP4JY.js";
+} from "../chunk-73BH4SZY.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
@@ -85,16 +85,16 @@ import {
   CANDIDATE_RCS,
   isDisabledExport,
   removeClaudeAlias
-} from "../chunk-ZRHA4PGN.js";
-import "../chunk-CPBRXBLG.js";
-import "../chunk-75CEJ4WP.js";
-import "../chunk-P6VDRQF3.js";
-import "../chunk-VV4SBPCQ.js";
+} from "../chunk-ZNUNWWCN.js";
+import "../chunk-XOXW4D6P.js";
+import "../chunk-Y6DSV2OS.js";
+import "../chunk-V3P2VSX7.js";
+import "../chunk-3O4EBTR3.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-US3RDXK7.js";
+import "../chunk-UBCTOE5X.js";
 import {
   bridgeAgentKey,
   claudeJson,
@@ -132,12 +132,12 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-R76C43H7.js";
+} from "../chunk-HZ57E6LS.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-EG46RJRF.js";
+import "../chunk-L52OIZXV.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-SDSKTRIV.js";
+} from "../chunk-ABIW72ST.js";
 import {
   CLI_PACKAGE_NAMES,
   HOOK_COMPATIBLE_PROFILES,
@@ -149,7 +149,7 @@ import {
   globalRootFor,
   isValidApiKey,
   redactSecrets
-} from "../chunk-4PCF34AB.js";
+} from "../chunk-ZFDGCEKO.js";
 
 // bin/pushary-clean.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync4 } from "fs";

package/dist/bin/pushary-codex-bridge.js

@@ -5,10 +5,10 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-JOQEPWDH.js";
+} from "../chunk-BFVE3WPB.js";
 import {
   resolveProviderBinary
-} from "../chunk-CFAD2LTH.js";
+} from "../chunk-HLNSTJND.js";
 import "../chunk-RIVNNBEK.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
@@ -16,12 +16,12 @@ import {
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-3OFHFVPX.js";
-import "../chunk-MGXXQHCM.js";
-import "../chunk-HSM5FIA3.js";
+} from "../chunk-WM2MEFCA.js";
+import "../chunk-U4DLXAGD.js";
+import "../chunk-UX2YSFKS.js";
 import {
   transcriptsEnabled
-} from "../chunk-MBVV3RX3.js";
+} from "../chunk-CTYCABBH.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
@@ -31,37 +31,37 @@ import {
   isDecisionStopped,
   isWaitForAnswerResponse,
   withdrawQuestion
-} from "../chunk-ZMVLKPT7.js";
+} from "../chunk-HZYUDXIH.js";
 import {
   writeDegraded
-} from "../chunk-BG4QCOHQ.js";
+} from "../chunk-XXSAGQAV.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-ZRHA4PGN.js";
+import "../chunk-ZNUNWWCN.js";
 import {
   callMcpTool
-} from "../chunk-CPBRXBLG.js";
-import "../chunk-75CEJ4WP.js";
-import "../chunk-P6VDRQF3.js";
+} from "../chunk-XOXW4D6P.js";
+import "../chunk-Y6DSV2OS.js";
+import "../chunk-V3P2VSX7.js";
 import {
   getMachineId
-} from "../chunk-VV4SBPCQ.js";
+} from "../chunk-3O4EBTR3.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-US3RDXK7.js";
-import "../chunk-R76C43H7.js";
+import "../chunk-UBCTOE5X.js";
+import "../chunk-HZ57E6LS.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-EG46RJRF.js";
-import "../chunk-SDSKTRIV.js";
+} from "../chunk-L52OIZXV.js";
+import "../chunk-ABIW72ST.js";
 import {
   elicitationContent,
   parseAgentQuestion,
   parseAgentQuestionAnswers,
   planElicitationAsk,
   readElicitationFields
-} from "../chunk-4PCF34AB.js";
+} from "../chunk-ZFDGCEKO.js";
 
 // bin/pushary-codex-bridge.ts
 import { existsSync } from "fs";

package/dist/bin/pushary-codex-hook.js

@@ -1,38 +1,38 @@
 #!/usr/bin/env node
 import {
   takeHookHoldBudget
-} from "../chunk-IQUBCAEK.js";
+} from "../chunk-BK3R5NRE.js";
 import {
   defersToNativeMode,
   reportMachineDenial
-} from "../chunk-YJZDIFON.js";
+} from "../chunk-N2ATGXI4.js";
 import {
   triggerAutoUpdate
-} from "../chunk-P25O4K3J.js";
+} from "../chunk-COVPHB56.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-IJJ3HHFT.js";
+} from "../chunk-MZXXLIF6.js";
 import {
   readHookInput
-} from "../chunk-OXQKXZJ3.js";
+} from "../chunk-IH5NZMN4.js";
 import {
   announceSubscriptionRequired,
   denyReasonFrom,
   isDeferAnswer
 } from "../chunk-5OP5MQI7.js";
-import "../chunk-WFVNXGZ6.js";
+import "../chunk-PN3F7LOB.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-OLG6FJV2.js";
-import "../chunk-ET6QSY3H.js";
-import "../chunk-TUZ7WKOF.js";
-import "../chunk-NAJ3UV4E.js";
-import "../chunk-LQESQPIT.js";
-import "../chunk-YFS4HYCI.js";
-import "../chunk-RZXQFAWR.js";
-import "../chunk-MGXXQHCM.js";
-import "../chunk-HSM5FIA3.js";
-import "../chunk-MBVV3RX3.js";
+import "../chunk-KP45FGHD.js";
+import "../chunk-CEHDCHXK.js";
+import "../chunk-2XK6D4WL.js";
+import "../chunk-EUNYNLDU.js";
+import "../chunk-WCHFDVCC.js";
+import "../chunk-B6BLCHJW.js";
+import "../chunk-DKDZXJHZ.js";
+import "../chunk-U4DLXAGD.js";
+import "../chunk-UX2YSFKS.js";
+import "../chunk-CTYCABBH.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
 import {
@@ -77,11 +77,11 @@ import {
   toPolicyLookup,
   toPolicyLookups,
   userScope
-} from "../chunk-42E4DE6C.js";
+} from "../chunk-35N53QLA.js";
 import {
   DEFAULT_SESSION
 } from "../chunk-N6IOSZOE.js";
-import "../chunk-VYNTRHB6.js";
+import "../chunk-RTKPR4UA.js";
 import {
   DECISION_STOP_REASON,
   UNVERIFIABLE_APPROVAL_REASON,
@@ -95,36 +95,36 @@ import {
   sendNotification,
   unavailableQuestionUnlessSubscriptionRequired,
   waitForQuestion
-} from "../chunk-ZMVLKPT7.js";
+} from "../chunk-HZYUDXIH.js";
 import {
   exitAfterClientReports
-} from "../chunk-BG4QCOHQ.js";
+} from "../chunk-XXSAGQAV.js";
 import "../chunk-POFBE6ZY.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-ZRHA4PGN.js";
+import "../chunk-ZNUNWWCN.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-CPBRXBLG.js";
-import "../chunk-75CEJ4WP.js";
-import "../chunk-P6VDRQF3.js";
+} from "../chunk-XOXW4D6P.js";
+import "../chunk-Y6DSV2OS.js";
+import "../chunk-V3P2VSX7.js";
 import {
   getMachineId
-} from "../chunk-VV4SBPCQ.js";
+} from "../chunk-3O4EBTR3.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-US3RDXK7.js";
+import "../chunk-UBCTOE5X.js";
 import {
   canonicalJson
-} from "../chunk-R76C43H7.js";
+} from "../chunk-HZ57E6LS.js";
 import {
   writeFileAtomic
 } from "../chunk-T7E75EKA.js";
 import {
   getApiKey
-} from "../chunk-EG46RJRF.js";
-import "../chunk-SDSKTRIV.js";
+} from "../chunk-L52OIZXV.js";
+import "../chunk-ABIW72ST.js";
 import {
   CODEX_RESCUE_TOOL_NAME,
   GATE_BLOCK_REASON_MAX_LENGTH,
@@ -137,7 +137,7 @@ import {
   hookWaitClamped,
   hookWaitDeadline,
   resolveGate
-} from "../chunk-4PCF34AB.js";
+} from "../chunk-ZFDGCEKO.js";
 
 // bin/pushary-codex-hook.ts
 import { basename } from "path";
@@ -764,7 +764,7 @@ var decidePreToolUse = async (input) => {
 };
 var repairCodexHoldsQuietly = async () => {
   try {
-    const { repairCodexHolds } = await import("../reapply-FYCVOWCW.js");
+    const { repairCodexHolds } = await import("../reapply-2SU2ZHEK.js");
     repairCodexHolds();
   } catch {
     return;