@pushary/agent-hooks 1.9.1 → 1.9.2

package/dist/{chunk-NVLXK2I6.js → chunk-ESME4HN2.js}

@@ -3,28 +3,28 @@ import {
   addPusharyToolPermissions,
   isPusharyHook,
   removeClaudeMcpServers
-} from "./chunk-6Q4NM2LW.js";
+} from "./chunk-FHLRRCUZ.js";
 import {
   CLAUDE_HOOK_EVENTS,
   addGeminiMcpServer,
   removeGeminiMcpServer
-} from "./chunk-D3RS57MN.js";
+} from "./chunk-B6BLCHJW.js";
 import {
   CLAUDE_CODE_AGENT,
   parseApplyPatchFiles
-} from "./chunk-JCER3Q6P.js";
+} from "./chunk-35N53QLA.js";
 import {
   guardBinary,
   holdBudgetOf,
   registerHookEntry
-} from "./chunk-ZMKEKWNR.js";
+} from "./chunk-HZ57E6LS.js";
 import {
   PHONE_ANSWERED_TOOLS,
   hookCompatibleProfile,
   hookCompatibleProfileBySource,
   toToolLookup,
   withHookHoldBudget
-} from "./chunk-XEIV5QOT.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/compatible-config.ts
 import { homedir } from "os";

package/dist/{chunk-5K43TBK4.js → chunk-EUNYNLDU.js}

@@ -2,17 +2,17 @@ import {
   CLAUDE_HOOK_EVENTS,
   GEMINI_HOOK_EVENTS,
   hasGeminiHooks
-} from "./chunk-D3RS57MN.js";
+} from "./chunk-B6BLCHJW.js";
 import {
   CODEX_HOOK_EVENTS,
   hasCodexHooks,
   holdBudgetOf
-} from "./chunk-ZMKEKWNR.js";
+} from "./chunk-HZ57E6LS.js";
 import {
   CURSOR_GATE_EVENTS,
   HOOK_LOCATOR_BINARY,
   hookCommandHoldBudget
-} from "./chunk-XEIV5QOT.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/diagnostics/wiring.ts
 var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;

package/dist/{chunk-6Q4NM2LW.js → chunk-FHLRRCUZ.js}

@@ -1,17 +1,17 @@
 import {
   CLAUDE_HOOK_EVENTS,
   supportedClaudeEvents
-} from "./chunk-D3RS57MN.js";
+} from "./chunk-B6BLCHJW.js";
 import {
   guardBinary,
   holdBudgetOf,
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-ZMKEKWNR.js";
+} from "./chunk-HZ57E6LS.js";
 import {
   HOOK_LOCATOR_BINARY,
   withHookHoldBudget
-} from "./chunk-XEIV5QOT.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/claude-config.ts
 import { join } from "path";

package/dist/{chunk-VQLWYKX7.js → chunk-FWQM6V7Z.js}

@@ -1,6 +1,6 @@
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-FVOCQSBG.js";
+} from "./chunk-ABIW72ST.js";
 
 // src/setup/codex-trust.ts
 var CODEX_TRUST_TELEMETRY = {

package/dist/{chunk-IITCMJ4G.js → chunk-HLNSTJND.js}

@@ -10,10 +10,10 @@ import {
   resolvePackageVersionFromBinary,
   resolvePathBinary,
   resolvePathBinaryAsync
-} from "./chunk-ZMKEKWNR.js";
+} from "./chunk-HZ57E6LS.js";
 import {
   MANAGED_PROVIDERS
-} from "./chunk-XEIV5QOT.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/setup/codex-install.ts
 var NATIVE_BINARY_MIN_BYTES = 20 * 1024 * 1024;

package/dist/{chunk-ZMKEKWNR.js → chunk-HZ57E6LS.js}

@@ -13,7 +13,7 @@ import {
   isReleaseVersion,
   ownPackageName,
   withHookHoldBudget
-} from "./chunk-XEIV5QOT.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/setup/paths.ts
 import { homedir as homedir2 } from "os";
@@ -365,9 +365,9 @@ var installGlobally = (options) => {
   }
   const started = (async () => {
     if (!npmIsOnPath()) throw new NpmMissingError();
-    const { withUpgradeLock } = await import("./global-upgrade-ML2RHV4W.js");
-    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-2A2YUUEU.js");
-    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-LG3IEDDM.js");
+    const { withUpgradeLock } = await import("./global-upgrade-N24WINE7.js");
+    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-F6SM6IEZ.js");
+    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-53PCHAOJ.js");
     let result = "skipped";
     const install = async () => {
       const platform = process.platform;
@@ -510,6 +510,7 @@ var CODEX_HOOK_EVENTS = [
   { event: "PreCompact", matcher: "manual|auto", delivery: "telemetry", timeout: 5 },
   { event: "PostCompact", matcher: "manual|auto", delivery: "telemetry", timeout: 5 }
 ];
+var CODEX_REQUIRED_APPROVAL_EVENTS = CODEX_HOOK_EVENTS.filter((event) => event.delivery === "approval").map((event) => event.event);
 var CODEX_EVENT_KEY = {
   PermissionRequest: "permission_request",
   PreToolUse: "pre_tool_use",
@@ -701,11 +702,22 @@ var codexTrustGaps = (config, hooksConfig, hooksJsonPath, command, positions) =>
   for (const definition of CODEX_HOOK_EVENTS) {
     const position = positions[definition.event];
     if (!position) continue;
-    const stored = asRecord2(state?.[codexHookStateKey(hooksJsonPath, definition.event, position)])?.trusted_hash;
+    const hookState = asRecord2(state?.[codexHookStateKey(hooksJsonPath, definition.event, position)]);
+    if (definition.delivery === "approval" && hookState?.enabled === false) {
+      gaps.push({ event: definition.event, kind: "disabled" });
+      continue;
+    }
+    const stored = hookState?.trusted_hash;
     const eventKey = CODEX_EVENT_KEY[definition.event] ?? definition.event;
     const onDisk = asRecord2(
       asRecord2(hooks?.[definition.event]) ?? (Array.isArray(hooks?.[definition.event]) ? hooks[definition.event][position[0]] : void 0)
     );
+    const handlers = onDisk?.hooks;
+    const handler = Array.isArray(handlers) ? asRecord2(handlers[position[1]]) : void 0;
+    if (definition.delivery === "approval" && handler?.async === true) {
+      gaps.push({ event: definition.event, kind: "asynchronous" });
+      continue;
+    }
     const diskHash = onDisk ? codexEntryTrustHash(eventKey, onDisk) : void 0;
     if (stored !== void 0 && diskHash !== void 0 && stored === diskHash) {
       if (diskHash !== codexHookTrustHash(definition, command)) {
@@ -855,6 +867,7 @@ export {
   codexAgentsMd,
   codexSkillDir,
   CODEX_HOOK_EVENTS,
+  CODEX_REQUIRED_APPROVAL_EVENTS,
   addCodexMcpServer,
   readCodexMcpAuth,
   isPusharyCodexCommand,

package/dist/{chunk-JHZAZAI3.js → chunk-HZYUDXIH.js}

@@ -1,23 +1,23 @@
 import {
   clientErrorKindOf,
   reportClientError
-} from "./chunk-SPB3QRE7.js";
+} from "./chunk-XXSAGQAV.js";
 import {
   SubscriptionRequiredError,
   callMcpTool
-} from "./chunk-VH6763OR.js";
+} from "./chunk-XOXW4D6P.js";
 import {
   installNetworkDefaults
-} from "./chunk-6JTTJIKJ.js";
+} from "./chunk-V3P2VSX7.js";
 import {
   getBaseUrl
-} from "./chunk-4SB46XLF.js";
+} from "./chunk-L52OIZXV.js";
 import {
   ASK_AGENT_NAME_MAX,
   ASK_QUESTION_MAX,
   DECISION_LINE_MAX,
   truncateLine
-} from "./chunk-XEIV5QOT.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/api.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-UPTEPARD.js → chunk-IH5NZMN4.js}

@@ -1,9 +1,9 @@
 import {
   registerTranscript
-} from "./chunk-WWDPULS3.js";
+} from "./chunk-PN3F7LOB.js";
 import {
   writeDegraded
-} from "./chunk-SPB3QRE7.js";
+} from "./chunk-XXSAGQAV.js";
 
 // src/tool-hook-input.ts
 var OPTIONAL_TEXT_FIELDS = ["hook_event_name", "session_id", "cwd", "transcript_path", "tool_use_id", "permission_mode"];

package/dist/{chunk-LZMH4EGE.js → chunk-IVPVCCFT.js}

@@ -4,7 +4,7 @@ import {
 import {
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-DMA3QUOB.js";
+} from "./chunk-Y6DSV2OS.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";

package/dist/{chunk-QXL27RY6.js → chunk-JXLANQLV.js}

@@ -2,7 +2,7 @@ import {
   autoUpdateLock,
   installPackageGlobally,
   npmErrorMessage
-} from "./chunk-ZMKEKWNR.js";
+} from "./chunk-HZ57E6LS.js";
 import {
   writeJsonAtomic
 } from "./chunk-T7E75EKA.js";

package/dist/{chunk-65TOHCXT.js → chunk-KP45FGHD.js}

@@ -1,15 +1,15 @@
 import {
   AGENT_CHOICES
-} from "./chunk-HU2LWGEE.js";
+} from "./chunk-CEHDCHXK.js";
 import {
   isBridgeLocator
-} from "./chunk-LXWUYG7D.js";
+} from "./chunk-2XK6D4WL.js";
 import {
   pusharyHookExecutable
-} from "./chunk-5K43TBK4.js";
+} from "./chunk-EUNYNLDU.js";
 import {
   BELL_HOOK_BINARY
-} from "./chunk-COSADFEH.js";
+} from "./chunk-DKDZXJHZ.js";
 
 // src/setup/hook-ownership.ts
 var commandsIn = (value) => {

package/dist/{chunk-4SB46XLF.js → chunk-L52OIZXV.js}

@@ -1,6 +1,6 @@
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-FVOCQSBG.js";
+} from "./chunk-ABIW72ST.js";
 
 // src/config.ts
 import { readFileSync } from "fs";

package/dist/{chunk-P7YDVWLL.js → chunk-MZXXLIF6.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-XEIV5QOT.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-GHKNUQYU.js → chunk-N2ATGXI4.js}

@@ -5,7 +5,7 @@ import {
   permissionDeniedAction,
   releaseThrottle,
   reportEvent
-} from "./chunk-JCER3Q6P.js";
+} from "./chunk-35N53QLA.js";
 import {
   DEFAULT_SESSION
 } from "./chunk-N6IOSZOE.js";
@@ -13,7 +13,7 @@ import {
   machineDecisionFor,
   shouldDeferToNativeMode,
   wireVerdictFor
-} from "./chunk-XEIV5QOT.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/machine-decision-audit.ts
 import { basename } from "path";

package/dist/{chunk-WWDPULS3.js → chunk-PN3F7LOB.js}

@@ -6,38 +6,38 @@ import {
 } from "./chunk-SGZJ5LYH.js";
 import {
   hookOwnerOf
-} from "./chunk-65TOHCXT.js";
+} from "./chunk-KP45FGHD.js";
 import {
   ensureDaemonRunning
-} from "./chunk-PEGKBNGN.js";
+} from "./chunk-WCHFDVCC.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-FJPC35OW.js";
+} from "./chunk-U4DLXAGD.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-PMS3EBD2.js";
+} from "./chunk-UX2YSFKS.js";
 import {
   transcriptEnvironmentPreference,
   transcriptsEnabled
-} from "./chunk-7ER66HZH.js";
+} from "./chunk-CTYCABBH.js";
 import {
   readTranscriptPreference
-} from "./chunk-RJ7ECJSZ.js";
+} from "./chunk-ZNUNWWCN.js";
 import {
   codexHome,
   pusharyDir
-} from "./chunk-ZMKEKWNR.js";
+} from "./chunk-HZ57E6LS.js";
 import {
   writeJsonAtomic
 } from "./chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-4SB46XLF.js";
+} from "./chunk-L52OIZXV.js";
 
 // src/transcript-registration.ts
 import { createHash } from "crypto";

package/dist/{chunk-LKKYRNJT.js → chunk-Q36G3P7I.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-3EGEA4KH.js";
 import {
   getBaseUrl
-} from "./chunk-4SB46XLF.js";
+} from "./chunk-L52OIZXV.js";
 
 // src/cli/login-ui.ts
 import { hostname } from "os";

package/dist/{chunk-SWGY5WNX.js → chunk-QDCEEQUS.js}

@@ -1,11 +1,11 @@
 import {
   ensureCodexTrustsPusharyHooks
-} from "./chunk-KR5JASA4.js";
+} from "./chunk-SI327OZF.js";
 import {
   addClaudeMcpServer,
   addPusharyHooks,
   addPusharyToolPermissions
-} from "./chunk-6Q4NM2LW.js";
+} from "./chunk-FHLRRCUZ.js";
 import {
   detectClaudeVersion
 } from "./chunk-RIVNNBEK.js";
@@ -15,7 +15,7 @@ import {
   codexUnprovenHolds,
   codexWired,
   geminiWired
-} from "./chunk-5K43TBK4.js";
+} from "./chunk-EUNYNLDU.js";
 import {
   CLAUDE_HOOK_BINARY,
   CLAUDE_HOOK_EVENTS,
@@ -26,7 +26,7 @@ import {
   needsReregistration,
   registrationSignatures,
   supportedClaudeEvents
-} from "./chunk-D3RS57MN.js";
+} from "./chunk-B6BLCHJW.js";
 import {
   formatVersion
 } from "./chunk-6ICPEJY5.js";
@@ -49,7 +49,7 @@ import {
   registrationHolderOf,
   resolveGlobalBinary,
   vscodePluginMcp
-} from "./chunk-ZMKEKWNR.js";
+} from "./chunk-HZ57E6LS.js";
 import {
   readJsonSafe,
   writeFileAtomic,

package/dist/{chunk-RNDFGHSQ.js → chunk-RTKPR4UA.js}

@@ -1,6 +1,6 @@
 import {
   PRETOOLUSE_GATED_TOOLS
-} from "./chunk-XEIV5QOT.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/claude-tools.ts
 var POSTTOOLUSE_MIRROR_ONLY_TOOLS = ["TodoWrite", "Task", "WebFetch", "WebSearch"];

package/dist/{chunk-LJI7U6PM.js → chunk-SFKU5DXZ.js}

@@ -1,9 +1,9 @@
 import {
   parseSseMessages
-} from "./chunk-VH6763OR.js";
+} from "./chunk-XOXW4D6P.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-FVOCQSBG.js";
+} from "./chunk-ABIW72ST.js";
 
 // src/mcp-stdio-bridge.ts
 var MCP_BRIDGE_BINARY = "pushary-mcp";

package/dist/{chunk-KR5JASA4.js → chunk-SI327OZF.js}

@@ -2,14 +2,16 @@ import {
   spawnClaude
 } from "./chunk-XHKBHWLX.js";
 import {
+  CODEX_HOOK_EVENTS,
+  CODEX_REQUIRED_APPROVAL_EVENTS,
   codexHome,
   codexHooksJsonIn,
   isPusharyCodexCommand,
   resolvePathBinary
-} from "./chunk-ZMKEKWNR.js";
+} from "./chunk-HZ57E6LS.js";
 import {
   getPackageVersion
-} from "./chunk-XEIV5QOT.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/codex-app-server.ts
 import { existsSync, realpathSync } from "fs";
@@ -20,6 +22,7 @@ var CODEX_HOOK_STATUS = {
   modified: "modified",
   managed: "managed",
   disabled: "disabled",
+  asynchronous: "asynchronous",
   notListed: "not listed"
 };
 var CODEX_APP_SERVER_ARGS = ["app-server"];
@@ -42,11 +45,19 @@ var CODEX_NOT_ASKED = {
 };
 var UNRECOGNISED_LISTING = "Codex answered hooks/list in a shape Pushary does not recognise";
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var isCodexListedHook = (value) => isRecord(value) && typeof value.key === "string" && typeof value.eventName === "string" && typeof value.command === "string" && typeof value.sourcePath === "string" && typeof value.enabled === "boolean" && typeof value.isManaged === "boolean" && typeof value.currentHash === "string" && typeof value.trustStatus === "string";
+var hasCodexHookIdentity = (value) => isRecord(value) && typeof value.key === "string" && value.key.length > 0 && typeof value.eventName === "string" && value.eventName.length > 0 && typeof value.sourcePath === "string" && value.sourcePath.length > 0 && typeof value.enabled === "boolean" && typeof value.isManaged === "boolean" && typeof value.currentHash === "string" && value.currentHash.length > 0 && typeof value.trustStatus === "string" && value.trustStatus.length > 0;
+var isCodexListedHook = (value) => hasCodexHookIdentity(value) && (value.handlerType === void 0 || value.handlerType === "command") && typeof value.command === "string" && value.command.length > 0 && (value.async === void 0 || typeof value.async === "boolean");
+var isCodexHookMetadata = (value) => {
+  if (isCodexListedHook(value)) return true;
+  if (!hasCodexHookIdentity(value)) return false;
+  if (value.handlerType === "prompt" || value.handlerType === "agent") return true;
+  return value.handlerType === "mcpTool" && typeof value.server === "string" && value.server.length > 0 && typeof value.tool === "string" && value.tool.length > 0;
+};
 var listedHookFields = (hook) => ({
   key: hook.key,
   eventName: hook.eventName,
   command: hook.command,
+  async: hook.async ?? false,
   sourcePath: hook.sourcePath,
   enabled: hook.enabled,
   isManaged: hook.isManaged,
@@ -67,20 +78,17 @@ var hooksListingOf = (result) => {
   const warnings = [];
   for (const layer of result.data) {
     if (!isRecord(layer) || !Array.isArray(layer.hooks)) return null;
+    if (!layer.hooks.every(isCodexHookMetadata)) return null;
     hooks.push(...layer.hooks.filter(isCodexListedHook).map(listedHookFields));
     warnings.push(...diagnosticMessages(layer.warnings), ...diagnosticMessages(layer.errors));
   }
   return { hooks, warnings };
 };
 var isPusharyHookIn = (hooksJsonPath, hook) => hook.sourcePath === hooksJsonPath && isPusharyCodexCommand(hook.command);
-var isTrustableByPushary = (hook) => hook.enabled && !hook.isManaged && hook.trustStatus !== CODEX_HOOK_STATUS.managed;
+var isTrustableByPushary = (hook) => hook.enabled && !hook.isManaged && hook.trustStatus !== CODEX_HOOK_STATUS.managed && !(CODEX_REQUIRED_APPROVAL_EVENTS.includes(hookEventOf(hook.eventName)) && hook.async === true);
 var pusharyHooksIn = (hooks, hooksJsonPath) => hooks.filter((hook) => isPusharyHookIn(hooksJsonPath, hook));
 var selectPusharyCodexHooks = (hooks, hooksJsonPath) => pusharyHooksIn(hooks, hooksJsonPath).filter(isTrustableByPushary);
-var codexTrustVerdict = (hooks, hooksJsonPath) => {
-  if (pusharyHooksIn(hooks, hooksJsonPath).length === 0) return { kind: "unlisted" };
-  const untrusted = selectPusharyCodexHooks(hooks, hooksJsonPath).filter((hook) => hook.trustStatus !== CODEX_HOOK_STATUS.trusted);
-  return untrusted.length === 0 ? { kind: "trusted" } : { kind: "untrusted", hooks: untrusted };
-};
+var codexTrustVerdict = (hooks, hooksJsonPath) => assessCodexHookTrust(CODEX_HOOK_EVENTS.map((event) => event.event), pusharyHooksIn(hooks, hooksJsonPath));
 var codexTrustEdit = (hooks) => ({
   edits: [{
     keyPath: HOOKS_STATE_KEY_PATH,
@@ -94,16 +102,34 @@ var initializeParams = (clientVersion) => ({
 });
 var hooksListParams = (cwd) => ({ cwds: [cwd] });
 var hookEventOf = (eventName) => eventName.charAt(0).toUpperCase() + eventName.slice(1);
+var trustStatusOf = (hook) => {
+  if (!hook.enabled) return CODEX_HOOK_STATUS.disabled;
+  if (CODEX_REQUIRED_APPROVAL_EVENTS.includes(hookEventOf(hook.eventName)) && hook.async === true) return CODEX_HOOK_STATUS.asynchronous;
+  return hook.trustStatus;
+};
 var readingOf = (hook) => ({
   event: hookEventOf(hook.eventName),
-  status: hook.enabled ? hook.trustStatus : CODEX_HOOK_STATUS.disabled
+  status: trustStatusOf(hook)
 });
-var codexHookTrustByEvent = (events, hooks) => events.map((event) => hooks.map(readingOf).find((reading) => reading.event === event) ?? { event, status: CODEX_HOOK_STATUS.notListed });
-var CODEX_TRUST_FAILURES = /* @__PURE__ */ new Set([CODEX_HOOK_STATUS.untrusted, CODEX_HOOK_STATUS.modified]);
-var isCodexTrustFailure = (reading) => CODEX_TRUST_FAILURES.has(reading.status);
+var codexHookTrustByEvent = (events, hooks) => {
+  const readings = hooks.map(readingOf);
+  const result = [];
+  for (const event of events) {
+    const matching = readings.filter((reading) => reading.event === event);
+    result.push(...matching.length > 0 ? matching : [{ event, status: CODEX_HOOK_STATUS.notListed }]);
+  }
+  return result;
+};
+var isCodexTrustFailure = (reading) => {
+  if (reading.status === CODEX_HOOK_STATUS.trusted || reading.status === CODEX_HOOK_STATUS.managed) return false;
+  if (reading.status === CODEX_HOOK_STATUS.disabled || reading.status === CODEX_HOOK_STATUS.notListed) {
+    return CODEX_REQUIRED_APPROVAL_EVENTS.includes(reading.event);
+  }
+  return true;
+};
 var eventsWithStatus = (readings, status) => readings.filter((reading) => reading.status === status).map((reading) => reading.event);
 var assessCodexHookTrust = (events, hooks) => {
-  const readings = codexHookTrustByEvent(events, hooks);
+  const readings = codexHookTrustByEvent([.../* @__PURE__ */ new Set([...events, ...CODEX_REQUIRED_APPROVAL_EVENTS])], hooks);
   const notListed = eventsWithStatus(readings, CODEX_HOOK_STATUS.notListed);
   if (readings.length > 0 && notListed.length === readings.length) return { kind: "unlisted" };
   const disabled = eventsWithStatus(readings, CODEX_HOOK_STATUS.disabled);
@@ -265,7 +291,7 @@ var confirmationAfterWrite = (listing, hooksJsonPath, writeError) => {
   const verdict = codexTrustVerdict(listing.hooks, hooksJsonPath);
   if (verdict.kind === "trusted") return { kind: "verified", wrote: true };
   if (verdict.kind === "unlisted") return { kind: "unlisted", warnings: listing.warnings };
-  return { kind: "refused", hooks: verdict.hooks.map(readingOf), writeError };
+  return { kind: "refused", hooks: verdict.failures, writeError };
 };
 var trustConversation = (launch, hooksJsonPath) => async (session) => {
   const unavailable = await openSession(session);
@@ -275,7 +301,9 @@ var trustConversation = (launch, hooksJsonPath) => async (session) => {
   const verdict = codexTrustVerdict(before.hooks, hooksJsonPath);
   if (verdict.kind === "trusted") return { kind: "verified", wrote: false };
   if (verdict.kind === "unlisted") return { kind: "unlisted", warnings: before.warnings };
-  const written = await session.request(METHOD_CONFIG_BATCH_WRITE, codexTrustEdit(verdict.hooks));
+  const trustable = selectPusharyCodexHooks(before.hooks, hooksJsonPath).filter((hook) => hook.trustStatus === CODEX_HOOK_STATUS.untrusted || hook.trustStatus === CODEX_HOOK_STATUS.modified);
+  if (trustable.length === 0) return { kind: "refused", hooks: verdict.failures, writeError: null };
+  const written = await session.request(METHOD_CONFIG_BATCH_WRITE, codexTrustEdit(trustable));
   const after = await listHooks(session, launch);
   if (!isListing(after)) return after;
   return confirmationAfterWrite(after, hooksJsonPath, written.kind === "error" ? written.message : null);

package/dist/{chunk-FJPC35OW.js → chunk-U4DLXAGD.js}

@@ -1,6 +1,6 @@
 import {
   redactSecretsFromContent
-} from "./chunk-XEIV5QOT.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";

package/dist/{chunk-6QSDNXGM.js → chunk-UBCTOE5X.js}

@@ -1,9 +1,9 @@
 import {
   configFilePath
-} from "./chunk-4SB46XLF.js";
+} from "./chunk-L52OIZXV.js";
 import {
   normalizeInstallSource
-} from "./chunk-XEIV5QOT.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/install-source.ts
 import { readFileSync } from "fs";

package/dist/{chunk-RS4ZOFSF.js → chunk-UBNJYMTG.js}

@@ -14,18 +14,19 @@ import {
 } from "./chunk-U4TMAANR.js";
 import {
   callMcpTool
-} from "./chunk-VH6763OR.js";
+} from "./chunk-XOXW4D6P.js";
 import {
   reportedInstallSource
-} from "./chunk-6QSDNXGM.js";
+} from "./chunk-UBCTOE5X.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-FVOCQSBG.js";
+} from "./chunk-ABIW72ST.js";
 import {
   NO_PAIRING_COMPUTER,
   PAIR_TTL_SECONDS,
+  classifyConfirmResponse,
   isAnswerSource
-} from "./chunk-XEIV5QOT.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {
@@ -206,8 +207,8 @@ var defaultCancel = async (apiKey, correlationId) => {
   });
 };
 var answeredRoundTrip = (answer, correlationId, latencyMs) => {
-  if (answer.value !== "yes" && answer.value !== "no") {
-    return { kind: "error", detail: "the server reported an answer without a valid Yes or No value" };
+  if (answer.value === void 0 || classifyConfirmResponse(answer.value) === null) {
+    return { kind: "error", detail: "the server reported an answer without a valid Yes, No or defer value" };
   }
   return {
     kind: "answered",

package/dist/{chunk-PMS3EBD2.js → chunk-UX2YSFKS.js}

@@ -1,6 +1,6 @@
 import {
   getBaseUrl
-} from "./chunk-4SB46XLF.js";
+} from "./chunk-L52OIZXV.js";
 
 // src/transcript-api.ts
 var fetchTranscriptRecipients = async (apiKey, baseUrl = getBaseUrl()) => {

package/dist/{chunk-6JTTJIKJ.js → chunk-V3P2VSX7.js}

@@ -1,16 +1,16 @@
 import {
   readExistingMachineId
-} from "./chunk-J7JXA2LX.js";
+} from "./chunk-3O4EBTR3.js";
 import {
   NetworkError
 } from "./chunk-7QLSKOSU.js";
 import {
   getBaseUrl
-} from "./chunk-4SB46XLF.js";
+} from "./chunk-L52OIZXV.js";
 import {
   clientContextHeaders,
   getPackageVersion
-} from "./chunk-XEIV5QOT.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/cli/net.ts
 import { createRequire } from "module";