@pushary/agent-hooks 1.9.11 → 1.9.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/bin/pushary-bell-hook.js +25 -25
- package/dist/bin/pushary-bell.js +9 -9
- package/dist/bin/pushary-claude.js +24 -24
- package/dist/bin/pushary-clean.js +28 -28
- package/dist/bin/pushary-codex-bridge.js +17 -17
- package/dist/bin/pushary-codex-hook.js +30 -30
- package/dist/bin/pushary-codex.js +12 -12
- package/dist/bin/pushary-connect.js +24 -24
- package/dist/bin/pushary-cowork.js +5 -5
- package/dist/bin/pushary-daemon.js +42 -37
- package/dist/bin/pushary-disconnect.js +28 -28
- package/dist/bin/pushary-doctor.js +33 -33
- package/dist/bin/pushary-elicitation-hook.js +25 -25
- package/dist/bin/pushary-gemini-bridge.js +13 -13
- package/dist/bin/pushary-gemini-hook.js +27 -27
- package/dist/bin/pushary-hook.js +29 -29
- package/dist/bin/pushary-login.js +12 -12
- package/dist/bin/pushary-logout.js +10 -10
- package/dist/bin/pushary-mcp.js +9 -9
- package/dist/bin/pushary-mode.js +12 -12
- package/dist/bin/pushary-notification-hook.js +24 -24
- package/dist/bin/pushary-opencode-hook.js +26 -26
- package/dist/bin/pushary-permission-denied-hook.js +29 -29
- package/dist/bin/pushary-permission-hook.js +28 -28
- package/dist/bin/pushary-post-hook.js +24 -24
- package/dist/bin/pushary-prompt-hook.js +24 -24
- package/dist/bin/pushary-session-end-hook.js +24 -24
- package/dist/bin/pushary-session-start-hook.js +28 -28
- package/dist/bin/pushary-setup.js +35 -35
- package/dist/bin/pushary-stats.js +5 -5
- package/dist/bin/pushary-status.js +26 -26
- package/dist/bin/pushary-stop-hook.js +24 -24
- package/dist/bin/pushary-stopfailure-hook.js +24 -24
- package/dist/bin/pushary-suggestions.js +12 -12
- package/dist/bin/pushary-transcript-register.js +17 -17
- package/dist/bin/pushary-transcripts.js +7 -7
- package/dist/bin/pushary-upgrade.js +30 -30
- package/dist/bin/pushary-wait.js +12 -12
- package/dist/bin/pushary.js +6 -6
- package/dist/{chunk-MX3LPP3K.js → chunk-2GBUL4NP.js} +6 -6
- package/dist/{chunk-2NAQRPZQ.js → chunk-2NKTEA42.js} +1 -1
- package/dist/{chunk-PTGUJZSD.js → chunk-2QJ6K2SR.js} +7 -6
- package/dist/{chunk-Z4AOR6RZ.js → chunk-3VPS7JPH.js} +2 -2
- package/dist/{chunk-LBAMPNDM.js → chunk-4DWQNP52.js} +4 -4
- package/dist/{chunk-XYCTS3WP.js → chunk-5HPC3RNE.js} +1 -1
- package/dist/{chunk-LX6EWNRK.js → chunk-5VUB6VVO.js} +4 -4
- package/dist/{chunk-A6J5Z2HO.js → chunk-7U26QSMF.js} +8 -8
- package/dist/{chunk-AIWZRRSK.js → chunk-A2DW2RNT.js} +4 -4
- package/dist/{chunk-4FWWHCYM.js → chunk-AWD2SLNA.js} +4 -4
- package/dist/{chunk-MHHXR7DT.js → chunk-BNQKHPEC.js} +4 -4
- package/dist/{chunk-KEV2MOJH.js → chunk-BOHDM4T7.js} +4 -4
- package/dist/{chunk-YETKAI5Q.js → chunk-BX2R7SIY.js} +6 -6
- package/dist/{chunk-KBN3UP2R.js → chunk-CATIBZQH.js} +3 -3
- package/dist/{chunk-WHRYW4P2.js → chunk-CKUACXAX.js} +5 -5
- package/dist/{chunk-I4I4UH62.js → chunk-CMZ4CW5J.js} +3 -3
- package/dist/{chunk-V6IW5WMK.js → chunk-CPUEZAE2.js} +1 -1
- package/dist/{chunk-CHDAH4HP.js → chunk-CXKY5FGY.js} +8 -8
- package/dist/{chunk-GUNZHSTL.js → chunk-DWHCF4RH.js} +5 -5
- package/dist/{chunk-5WAYSUWV.js → chunk-DYQ5QIDN.js} +2 -2
- package/dist/{chunk-ZTSMQYST.js → chunk-E2FGVADR.js} +2 -2
- package/dist/{chunk-N6GEI3PK.js → chunk-EYLQVCME.js} +2 -2
- package/dist/{chunk-P7N7FJ7W.js → chunk-FLPXTN3Q.js} +1 -1
- package/dist/{chunk-MJLTABWF.js → chunk-FSCWOYK6.js} +3 -3
- package/dist/{chunk-MITMDERZ.js → chunk-GP44LTXN.js} +1 -1
- package/dist/{chunk-C6QM5SJR.js → chunk-GTM7C36Y.js} +2 -2
- package/dist/{chunk-WCELLK4P.js → chunk-J5XCHLP4.js} +2 -2
- package/dist/{chunk-E6YQW43K.js → chunk-JKGTASA2.js} +1 -1
- package/dist/{chunk-TVVUJTUW.js → chunk-JNDELCH5.js} +1 -1
- package/dist/{chunk-CZYMYM7X.js → chunk-KXCWWHYO.js} +3 -3
- package/dist/{chunk-BDRXDO25.js → chunk-LBDMCNQY.js} +2 -2
- package/dist/{chunk-BZI7EBTB.js → chunk-M2P3HQA3.js} +1 -1
- package/dist/{chunk-PRJNUNCV.js → chunk-MEHDBT5H.js} +2 -2
- package/dist/{chunk-4HR2ICME.js → chunk-NDZKDJQU.js} +1 -1
- package/dist/{chunk-BMP2BLIR.js → chunk-OBGZUD73.js} +3 -3
- package/dist/{chunk-2GG77ADC.js → chunk-PKQ435Z2.js} +1 -1
- package/dist/{chunk-LUHNNZSH.js → chunk-PMUOEEUE.js} +2 -2
- package/dist/{chunk-P2EJN7UB.js → chunk-PNBJAYSL.js} +1 -1
- package/dist/{chunk-VOP5U2VX.js → chunk-QOBOIFGG.js} +87 -9
- package/dist/{chunk-2AQ4VZSA.js → chunk-RBBMGCSZ.js} +1 -1
- package/dist/{chunk-M54ATCOZ.js → chunk-RYBAJXV4.js} +1 -1
- package/dist/{chunk-7RWQZQV2.js → chunk-SJ7M37RL.js} +5 -5
- package/dist/{chunk-OKSU74QH.js → chunk-SQJUXVLW.js} +2 -2
- package/dist/{chunk-STUJXZC2.js → chunk-TSGQYARU.js} +4 -4
- package/dist/{chunk-4RENRBSB.js → chunk-TZCHW6KR.js} +4 -4
- package/dist/{chunk-HX5TI6DP.js → chunk-UEQWLVJB.js} +1 -1
- package/dist/{chunk-ERXY2SIW.js → chunk-VDPU4YQN.js} +11 -11
- package/dist/{chunk-EJVYEOKC.js → chunk-WBSL4FBX.js} +3 -3
- package/dist/{chunk-CBDJ2X5P.js → chunk-WKP2KRTU.js} +2 -2
- package/dist/{chunk-GA4J6YFN.js → chunk-YZWUTWDG.js} +2 -2
- package/dist/{chunk-KIVFWGG6.js → chunk-Z6VYZSVA.js} +5 -5
- package/dist/{chunk-FJCOOFT7.js → chunk-ZC6EVOX6.js} +1 -1
- package/dist/{chunk-N7HXP4PZ.js → chunk-ZHF4JDVE.js} +1 -1
- package/dist/{global-upgrade-VT2JS7DR.js → global-upgrade-OCZWEF3A.js} +6 -6
- package/dist/{paths-WRBEUNEY.js → paths-SOGZJICO.js} +2 -2
- package/dist/{reapply-BCR6U7HO.js → reapply-DFG5IE6N.js} +20 -20
- package/dist/src/index.js +19 -19
- package/dist/{upgrade-lock-VRYMTPZQ.js → upgrade-lock-XLE5GVWS.js} +3 -3
- package/package.json +1 -1
|
@@ -6,38 +6,38 @@ import {
|
|
|
6
6
|
} from "./chunk-SGZJ5LYH.js";
|
|
7
7
|
import {
|
|
8
8
|
ensureDaemonRunning
|
|
9
|
-
} from "./chunk-
|
|
9
|
+
} from "./chunk-2QJ6K2SR.js";
|
|
10
10
|
import {
|
|
11
11
|
buildTranscriptRecords,
|
|
12
12
|
decodePublicKey,
|
|
13
13
|
generateSessionKey,
|
|
14
14
|
wrapSessionKey
|
|
15
|
-
} from "./chunk-
|
|
15
|
+
} from "./chunk-PKQ435Z2.js";
|
|
16
16
|
import {
|
|
17
17
|
fetchTranscriptRecipients,
|
|
18
18
|
uploadTranscriptRecords
|
|
19
|
-
} from "./chunk-
|
|
19
|
+
} from "./chunk-ZHF4JDVE.js";
|
|
20
20
|
import {
|
|
21
21
|
transcriptEnvironmentPreference,
|
|
22
22
|
transcriptsEnabled
|
|
23
|
-
} from "./chunk-
|
|
23
|
+
} from "./chunk-M2P3HQA3.js";
|
|
24
24
|
import {
|
|
25
25
|
hookOwnerOf
|
|
26
|
-
} from "./chunk-
|
|
26
|
+
} from "./chunk-SJ7M37RL.js";
|
|
27
27
|
import {
|
|
28
28
|
readTranscriptPreference
|
|
29
|
-
} from "./chunk-
|
|
29
|
+
} from "./chunk-3VPS7JPH.js";
|
|
30
30
|
import {
|
|
31
31
|
codexHome,
|
|
32
32
|
pusharyDir
|
|
33
|
-
} from "./chunk-
|
|
33
|
+
} from "./chunk-AWD2SLNA.js";
|
|
34
34
|
import {
|
|
35
35
|
writeJsonAtomic
|
|
36
36
|
} from "./chunk-T7E75EKA.js";
|
|
37
37
|
import {
|
|
38
38
|
getApiKey,
|
|
39
39
|
getBaseUrl
|
|
40
|
-
} from "./chunk-
|
|
40
|
+
} from "./chunk-ZC6EVOX6.js";
|
|
41
41
|
|
|
42
42
|
// src/transcript-registration.ts
|
|
43
43
|
import { createHash } from "crypto";
|
|
@@ -5,18 +5,18 @@ import {
|
|
|
5
5
|
import {
|
|
6
6
|
SubscriptionRequiredError,
|
|
7
7
|
callMcpTool
|
|
8
|
-
} from "./chunk-
|
|
8
|
+
} from "./chunk-CATIBZQH.js";
|
|
9
9
|
import {
|
|
10
10
|
installNetworkDefaults,
|
|
11
11
|
isNetworkFailure
|
|
12
|
-
} from "./chunk-
|
|
12
|
+
} from "./chunk-WBSL4FBX.js";
|
|
13
13
|
import {
|
|
14
14
|
clientReportClaims
|
|
15
|
-
} from "./chunk-
|
|
15
|
+
} from "./chunk-AWD2SLNA.js";
|
|
16
16
|
import {
|
|
17
17
|
getApiKey,
|
|
18
18
|
getBaseUrl
|
|
19
|
-
} from "./chunk-
|
|
19
|
+
} from "./chunk-ZC6EVOX6.js";
|
|
20
20
|
import {
|
|
21
21
|
ASK_AGENT_NAME_MAX,
|
|
22
22
|
ASK_QUESTION_MAX,
|
|
@@ -24,7 +24,7 @@ import {
|
|
|
24
24
|
DECISION_LINE_MAX,
|
|
25
25
|
degradedLine,
|
|
26
26
|
truncateLine
|
|
27
|
-
} from "./chunk-
|
|
27
|
+
} from "./chunk-QOBOIFGG.js";
|
|
28
28
|
|
|
29
29
|
// src/client-report-claim.ts
|
|
30
30
|
import { createHash } from "crypto";
|
|
@@ -3,11 +3,11 @@ import {
|
|
|
3
3
|
decodePublicKey,
|
|
4
4
|
generateSessionKey,
|
|
5
5
|
wrapSessionKey
|
|
6
|
-
} from "./chunk-
|
|
6
|
+
} from "./chunk-PKQ435Z2.js";
|
|
7
7
|
import {
|
|
8
8
|
fetchTranscriptRecipients,
|
|
9
9
|
uploadTranscriptRecords
|
|
10
|
-
} from "./chunk-
|
|
10
|
+
} from "./chunk-ZHF4JDVE.js";
|
|
11
11
|
|
|
12
12
|
// src/live-session.ts
|
|
13
13
|
var MAX_TRANSCRIPT_QUEUE = 100;
|
|
@@ -6,12 +6,12 @@ import {
|
|
|
6
6
|
permissionDeniedAction,
|
|
7
7
|
releaseThrottle,
|
|
8
8
|
reportEvent
|
|
9
|
-
} from "./chunk-
|
|
9
|
+
} from "./chunk-7U26QSMF.js";
|
|
10
10
|
import {
|
|
11
11
|
machineDecisionFor,
|
|
12
12
|
shouldDeferToNativeMode,
|
|
13
13
|
wireVerdictFor
|
|
14
|
-
} from "./chunk-
|
|
14
|
+
} from "./chunk-QOBOIFGG.js";
|
|
15
15
|
|
|
16
16
|
// src/machine-decision-audit.ts
|
|
17
17
|
import { basename } from "path";
|
|
@@ -10,10 +10,10 @@ import {
|
|
|
10
10
|
resolvePackageVersionFromBinary,
|
|
11
11
|
resolvePathBinary,
|
|
12
12
|
resolvePathBinaryAsync
|
|
13
|
-
} from "./chunk-
|
|
13
|
+
} from "./chunk-AWD2SLNA.js";
|
|
14
14
|
import {
|
|
15
15
|
MANAGED_PROVIDERS
|
|
16
|
-
} from "./chunk-
|
|
16
|
+
} from "./chunk-QOBOIFGG.js";
|
|
17
17
|
|
|
18
18
|
// src/setup/codex-install.ts
|
|
19
19
|
var NATIVE_BINARY_MIN_BYTES = 20 * 1024 * 1024;
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import {
|
|
2
2
|
SETUP_FLAGS
|
|
3
|
-
} from "./chunk-
|
|
3
|
+
} from "./chunk-NDZKDJQU.js";
|
|
4
4
|
import {
|
|
5
5
|
parseFlags
|
|
6
6
|
} from "./chunk-GMXKITVA.js";
|
|
@@ -9,7 +9,7 @@ import {
|
|
|
9
9
|
} from "./chunk-7QLSKOSU.js";
|
|
10
10
|
import {
|
|
11
11
|
NPX_LATEST_COMMAND
|
|
12
|
-
} from "./chunk-
|
|
12
|
+
} from "./chunk-RYBAJXV4.js";
|
|
13
13
|
import {
|
|
14
14
|
CLAUDE_CONNECTOR_GUIDE,
|
|
15
15
|
CLAUDE_CONNECTOR_STEPS,
|
|
@@ -17,7 +17,7 @@ import {
|
|
|
17
17
|
CLAUDE_CONNECTOR_URL,
|
|
18
18
|
COWORK_CONNECTOR_LIMIT,
|
|
19
19
|
COWORK_STANDING_INSTRUCTIONS
|
|
20
|
-
} from "./chunk-
|
|
20
|
+
} from "./chunk-QOBOIFGG.js";
|
|
21
21
|
|
|
22
22
|
// src/cli/cowork.ts
|
|
23
23
|
import { readFileSync } from "fs";
|
|
@@ -3,10 +3,10 @@ import {
|
|
|
3
3
|
} from "./chunk-KZERVKTD.js";
|
|
4
4
|
import {
|
|
5
5
|
renderCommandHelp
|
|
6
|
-
} from "./chunk-
|
|
6
|
+
} from "./chunk-RYBAJXV4.js";
|
|
7
7
|
import {
|
|
8
8
|
getPackageVersion
|
|
9
|
-
} from "./chunk-
|
|
9
|
+
} from "./chunk-QOBOIFGG.js";
|
|
10
10
|
|
|
11
11
|
// src/cli/usage.ts
|
|
12
12
|
var exitOnHelpFlag = (command) => {
|
|
@@ -3,7 +3,7 @@ import {
|
|
|
3
3
|
} from "./chunk-POFBE6ZY.js";
|
|
4
4
|
import {
|
|
5
5
|
autoUpdateState
|
|
6
|
-
} from "./chunk-
|
|
6
|
+
} from "./chunk-AWD2SLNA.js";
|
|
7
7
|
import {
|
|
8
8
|
readJsonSafe,
|
|
9
9
|
writeJsonAtomic
|
|
@@ -14,7 +14,7 @@ import {
|
|
|
14
14
|
cliPackagePathSegments,
|
|
15
15
|
globalUpgradeEntry,
|
|
16
16
|
ownPackageRoot
|
|
17
|
-
} from "./chunk-
|
|
17
|
+
} from "./chunk-QOBOIFGG.js";
|
|
18
18
|
|
|
19
19
|
// src/auto-update.ts
|
|
20
20
|
import { spawn } from "child_process";
|
|
@@ -5,16 +5,16 @@ import {
|
|
|
5
5
|
import {
|
|
6
6
|
NOTIFICATION_MATCHED_TYPES,
|
|
7
7
|
POSTTOOLUSE_MIRRORED_TOOLS
|
|
8
|
-
} from "./chunk-
|
|
8
|
+
} from "./chunk-JKGTASA2.js";
|
|
9
9
|
import {
|
|
10
10
|
isProtectedByScope,
|
|
11
11
|
registerHookEntry
|
|
12
|
-
} from "./chunk-
|
|
12
|
+
} from "./chunk-AWD2SLNA.js";
|
|
13
13
|
import {
|
|
14
14
|
CLAUDE_PRETOOLUSE_MATCHER,
|
|
15
15
|
HOOK_BUDGETS,
|
|
16
16
|
HOOK_LOCATOR_BINARY
|
|
17
|
-
} from "./chunk-
|
|
17
|
+
} from "./chunk-QOBOIFGG.js";
|
|
18
18
|
|
|
19
19
|
// src/gemini-config.ts
|
|
20
20
|
var GEMINI_HOOK_BINARY = "pushary-gemini-hook";
|
|
@@ -1,13 +1,13 @@
|
|
|
1
1
|
import {
|
|
2
2
|
openCodeConfigDirFrom
|
|
3
|
-
} from "./chunk-
|
|
3
|
+
} from "./chunk-Z6VYZSVA.js";
|
|
4
4
|
import {
|
|
5
5
|
codexHomeFrom,
|
|
6
6
|
resolvePathBinary
|
|
7
|
-
} from "./chunk-
|
|
7
|
+
} from "./chunk-AWD2SLNA.js";
|
|
8
8
|
import {
|
|
9
9
|
HOOK_COMPATIBLE_PROFILES
|
|
10
|
-
} from "./chunk-
|
|
10
|
+
} from "./chunk-QOBOIFGG.js";
|
|
11
11
|
|
|
12
12
|
// src/hermes-config.ts
|
|
13
13
|
import { execFileSync } from "child_process";
|
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
import {
|
|
2
2
|
pusharyHookExecutable
|
|
3
|
-
} from "./chunk-
|
|
3
|
+
} from "./chunk-SJ7M37RL.js";
|
|
4
4
|
import {
|
|
5
5
|
isProtectedByScope,
|
|
6
6
|
registerHookEntry
|
|
7
|
-
} from "./chunk-
|
|
7
|
+
} from "./chunk-AWD2SLNA.js";
|
|
8
8
|
|
|
9
9
|
// src/cursor-config.ts
|
|
10
10
|
var hookCommandOf = (entry) => {
|
|
@@ -380,13 +380,15 @@ var fromAntigravity = (event, payload) => {
|
|
|
380
380
|
const cwd = firstWorkspace(payload) ?? nonEmptyString(call?.tool_input.Cwd);
|
|
381
381
|
const sessionId = nonEmptyString(payload.conversationId);
|
|
382
382
|
const transcriptPath = nonEmptyString(payload.transcriptPath);
|
|
383
|
+
const error = event === "PostToolUse" ? nonEmptyString(payload.error) : void 0;
|
|
383
384
|
return {
|
|
384
385
|
...rest,
|
|
385
386
|
...event ? { hook_event_name: event } : {},
|
|
386
387
|
...sessionId ? { session_id: sessionId } : {},
|
|
387
388
|
...transcriptPath ? { transcript_path: transcriptPath } : {},
|
|
388
389
|
...cwd ? { cwd } : {},
|
|
389
|
-
...call ?? {}
|
|
390
|
+
...call ?? {},
|
|
391
|
+
...error ? { tool_response: { error } } : {}
|
|
390
392
|
};
|
|
391
393
|
};
|
|
392
394
|
var claudeShapedHookInput = (dialect, event, payload) => dialect === "antigravity" ? fromAntigravity(event, payload) : payload;
|
|
@@ -862,7 +864,7 @@ var AUTH_REJECTION_REASONS = [
|
|
|
862
864
|
// ../contracts/src/declined-agents.ts
|
|
863
865
|
var DECLINED_AGENTS_FILE = "declined-agents.json";
|
|
864
866
|
var DECLINED_AGENTS_VERSION = 1;
|
|
865
|
-
var isDeclinableAgent = (value) => typeof value === "string" &&
|
|
867
|
+
var isDeclinableAgent = (value) => typeof value === "string" && DISCONNECT_AGENT_IDS.includes(value);
|
|
866
868
|
var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
|
|
867
869
|
var canonicalAgents = (agents) => [...new Set(agents)].sort();
|
|
868
870
|
var parseDeclinedAgents = (value) => {
|
|
@@ -1273,7 +1275,9 @@ var SAFE_SHELL_COMMANDS = /* @__PURE__ */ new Set([
|
|
|
1273
1275
|
"du",
|
|
1274
1276
|
"df",
|
|
1275
1277
|
"ps",
|
|
1276
|
-
"true"
|
|
1278
|
+
"true",
|
|
1279
|
+
"sleep",
|
|
1280
|
+
"pgrep"
|
|
1277
1281
|
]);
|
|
1278
1282
|
var SAFE_GIT_SUBCOMMANDS = /* @__PURE__ */ new Set([
|
|
1279
1283
|
"status",
|
|
@@ -1295,6 +1299,8 @@ var SAFE_GIT_SUBCOMMANDS = /* @__PURE__ */ new Set([
|
|
|
1295
1299
|
"count-objects"
|
|
1296
1300
|
]);
|
|
1297
1301
|
var GIT_WRITE_FLAGS = (token) => token === "--output" || token.startsWith("--output=");
|
|
1302
|
+
var GIT_READ_ONLY_BRANCH_ARGUMENTS = ["branch", "--show-current"];
|
|
1303
|
+
var isReadOnlyGitBranch = (args) => args.length === GIT_READ_ONLY_BRANCH_ARGUMENTS.length && args.every((arg, index) => arg === GIT_READ_ONLY_BRANCH_ARGUMENTS[index]);
|
|
1298
1304
|
var DANGEROUS_FIND_ACTIONS = /* @__PURE__ */ new Set([
|
|
1299
1305
|
"-exec",
|
|
1300
1306
|
"-execdir",
|
|
@@ -1401,6 +1407,7 @@ var isSafeSimpleCommand = (segment) => {
|
|
|
1401
1407
|
if (exe === "git") {
|
|
1402
1408
|
const sub = tokens[1];
|
|
1403
1409
|
if (!sub || sub.startsWith("-")) return false;
|
|
1410
|
+
if (isReadOnlyGitBranch(tokens.slice(1))) return true;
|
|
1404
1411
|
if (!SAFE_GIT_SUBCOMMANDS.has(sub)) return false;
|
|
1405
1412
|
return !tokens.some(GIT_WRITE_FLAGS);
|
|
1406
1413
|
}
|
|
@@ -1415,8 +1422,61 @@ var isSafeSimpleCommand = (segment) => {
|
|
|
1415
1422
|
if (exe === "sed") return isPrintOnlySed(tokens.slice(1));
|
|
1416
1423
|
if (exe === "date") return isReadOnlyDate(tokens.slice(1));
|
|
1417
1424
|
if (exe === "printf") return isOutputOnlyPrintf(tokens.slice(1));
|
|
1425
|
+
if (exe === RIPGREP_PROGRAM) return carriesNoRefusedOption(tokens.slice(1), RIPGREP_OPTIONS_THAT_RUN_A_PROGRAM);
|
|
1426
|
+
if (exe === SORT_PROGRAM) return carriesNoRefusedOption(tokens.slice(1), SORT_OPTIONS_THAT_WRITE_OR_RUN);
|
|
1427
|
+
if (exe === UNIQ_PROGRAM) return uniqFileOperandCount(tokens.slice(1)) <= UNIQ_MAX_FILE_OPERANDS;
|
|
1418
1428
|
return SAFE_SHELL_COMMANDS.has(exe);
|
|
1419
1429
|
};
|
|
1430
|
+
var RIPGREP_PROGRAM = "rg";
|
|
1431
|
+
var RIPGREP_OPTIONS_THAT_RUN_A_PROGRAM = {
|
|
1432
|
+
long: ["--pre", "--pre-glob", "--hostname-bin", "--search-zip"],
|
|
1433
|
+
short: ["-z"]
|
|
1434
|
+
};
|
|
1435
|
+
var SORT_PROGRAM = "sort";
|
|
1436
|
+
var SORT_OPTIONS_THAT_WRITE_OR_RUN = {
|
|
1437
|
+
long: ["--output", "--compress-program", "--temporary-directory"],
|
|
1438
|
+
short: ["-o", "-T"]
|
|
1439
|
+
};
|
|
1440
|
+
var UNIQ_PROGRAM = "uniq";
|
|
1441
|
+
var UNIQ_MAX_FILE_OPERANDS = 1;
|
|
1442
|
+
var UNIQ_OPTIONS_WITH_A_SEPARATE_VALUE = [
|
|
1443
|
+
"-f",
|
|
1444
|
+
"-s",
|
|
1445
|
+
"-w",
|
|
1446
|
+
"--skip-fields",
|
|
1447
|
+
"--skip-chars",
|
|
1448
|
+
"--check-chars"
|
|
1449
|
+
];
|
|
1450
|
+
var uniqFileOperandCount = (args) => {
|
|
1451
|
+
let operands = 0;
|
|
1452
|
+
let optionsEnded = false;
|
|
1453
|
+
for (let index = 0; index < args.length; index += 1) {
|
|
1454
|
+
const arg = args[index] ?? "";
|
|
1455
|
+
if (optionsEnded || !isFlagToken(arg) || arg === STDIN_OPERAND) {
|
|
1456
|
+
operands += 1;
|
|
1457
|
+
optionsEnded = true;
|
|
1458
|
+
} else if (arg === END_OF_OPTIONS) {
|
|
1459
|
+
optionsEnded = true;
|
|
1460
|
+
} else if (UNIQ_OPTIONS_WITH_A_SEPARATE_VALUE.includes(arg)) {
|
|
1461
|
+
index += 1;
|
|
1462
|
+
}
|
|
1463
|
+
}
|
|
1464
|
+
return operands;
|
|
1465
|
+
};
|
|
1466
|
+
var STDIN_OPERAND = "-";
|
|
1467
|
+
var LONG_OPTION_PREFIX = "--";
|
|
1468
|
+
var OPTION_VALUE_SEPARATOR = "=";
|
|
1469
|
+
var longOptionName = (token) => token.split(OPTION_VALUE_SEPARATOR, 1)[0] ?? token;
|
|
1470
|
+
var abbreviatesALongOption = (token, longOptions) => {
|
|
1471
|
+
const name = longOptionName(token);
|
|
1472
|
+
return longOptions.some((option) => option.startsWith(name));
|
|
1473
|
+
};
|
|
1474
|
+
var clustersAShortOption = (token, shortOptions) => shortOptions.some((option) => token.slice(1).includes(option.slice(1)));
|
|
1475
|
+
var isRefusedOption = (token, options) => {
|
|
1476
|
+
if (token === END_OF_OPTIONS || !isFlagToken(token)) return false;
|
|
1477
|
+
return token.startsWith(LONG_OPTION_PREFIX) ? abbreviatesALongOption(token, options.long) : clustersAShortOption(token, options.short);
|
|
1478
|
+
};
|
|
1479
|
+
var carriesNoRefusedOption = (args, options) => !args.some((arg) => isRefusedOption(arg, options));
|
|
1420
1480
|
var SED_PRINT_ONLY_SCRIPT = /^(?:\d+|\$)(?:,(?:\d+|\$))?p$/;
|
|
1421
1481
|
var SED_QUIET_FLAG = "-n";
|
|
1422
1482
|
var DATE_FORMAT_PREFIX = "+";
|
|
@@ -1429,7 +1489,16 @@ var READ_ONLY_SEGMENT_SEPARATOR = /&&|\|\||[;|]/g;
|
|
|
1429
1489
|
var PIPELINE_CHAIN_SEPARATOR = /&&|\|\||;/g;
|
|
1430
1490
|
var EXPANSION_THAT_CAN_BECOME_A_FLAG = /\$|(?:^|\s)[*?[]/;
|
|
1431
1491
|
var SHELL_QUOTE_CHARACTERS = /['"]/g;
|
|
1432
|
-
var INSPECTED_ARGUMENT_COMMANDS = /* @__PURE__ */ new Set([
|
|
1492
|
+
var INSPECTED_ARGUMENT_COMMANDS = /* @__PURE__ */ new Set([
|
|
1493
|
+
"git",
|
|
1494
|
+
"find",
|
|
1495
|
+
"sed",
|
|
1496
|
+
"date",
|
|
1497
|
+
"printf",
|
|
1498
|
+
RIPGREP_PROGRAM,
|
|
1499
|
+
SORT_PROGRAM,
|
|
1500
|
+
UNIQ_PROGRAM
|
|
1501
|
+
]);
|
|
1433
1502
|
var argumentsMayExpand = (segment) => {
|
|
1434
1503
|
const visible = shellVisibleText(segment);
|
|
1435
1504
|
return visible === null || EXPANSION_THAT_CAN_BECOME_A_FLAG.test(visible.replace(SHELL_QUOTE_CHARACTERS, ""));
|
|
@@ -2206,12 +2275,21 @@ var autoApprove = (tool) => ({
|
|
|
2206
2275
|
mode: "terminal_only",
|
|
2207
2276
|
pushFirstSeconds: 0
|
|
2208
2277
|
});
|
|
2278
|
+
var CODEX_COORDINATION_TOOLS = [
|
|
2279
|
+
"mcp__codex_app__wait_threads",
|
|
2280
|
+
"mcp__codex_app__send_message_to_thread"
|
|
2281
|
+
];
|
|
2282
|
+
var CODEX_COORDINATION_TOOL_NAMES = new Set(CODEX_COORDINATION_TOOLS);
|
|
2283
|
+
var isCodexCoordinationTool = (toolName) => CODEX_COORDINATION_TOOL_NAMES.has(toolName);
|
|
2284
|
+
var isNamedByARule = (rank) => rank !== void 0 && rank !== "wildcard";
|
|
2285
|
+
var isSpecificArgumentRank = (rank) => rank === "exact" || rank === "prefix";
|
|
2286
|
+
var shellReadOnlyFloorApplies = (toolName, arg, rank) => !isSpecificArgumentRank(rank) && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg);
|
|
2287
|
+
var coordinationFloorApplies = (toolName, rank) => isCodexCoordinationTool(toolName) && !isNamedByARule(rank);
|
|
2209
2288
|
var resolveAutoResolveOrigin = (config, toolName, toolInput, cwd, repoKey, sessionId) => {
|
|
2210
2289
|
const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
|
|
2211
2290
|
const arg = args[0];
|
|
2212
|
-
const
|
|
2213
|
-
|
|
2214
|
-
if (!governedBySpecificRule && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg)) {
|
|
2291
|
+
const rank = selectGoverningRule(config.policies, toolName, args, repoKey, sessionId)?.rank;
|
|
2292
|
+
if (shellReadOnlyFloorApplies(toolName, arg, rank) || coordinationFloorApplies(toolName, rank)) {
|
|
2215
2293
|
return DECISION_ORIGIN.safeReadonly;
|
|
2216
2294
|
}
|
|
2217
2295
|
return DECISION_ORIGIN.autopilot;
|
|
@@ -2238,10 +2316,10 @@ var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, se
|
|
|
2238
2316
|
mode: config.defaultMode ?? "push_first",
|
|
2239
2317
|
pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
|
|
2240
2318
|
};
|
|
2241
|
-
const governedBySpecificRule = match?.rank
|
|
2319
|
+
const governedBySpecificRule = isSpecificArgumentRank(match?.rank);
|
|
2242
2320
|
const governedBySessionToolGrant = match?.rank === "tool" && isSessionToolGrant(match.policy);
|
|
2243
2321
|
const governingMode = base.mode;
|
|
2244
|
-
const approvedByReadOnlyFloor = !
|
|
2322
|
+
const approvedByReadOnlyFloor = !isAutoDeny(base) && (shellReadOnlyFloorApplies(toolName, arg, match?.rank) || coordinationFloorApplies(toolName, match?.rank));
|
|
2245
2323
|
if (governedBySessionToolGrant && !approvedByReadOnlyFloor && typeof arg === "string" && commandNeedsAPerson(toolName, arg)) {
|
|
2246
2324
|
return resolvePolicy(withoutSessionToolGrants(config), toolName, modeOverride, toolInput, cwd, repoKey, sessionId);
|
|
2247
2325
|
}
|
|
@@ -2,23 +2,23 @@ import {
|
|
|
2
2
|
CLAUDE_HOOK_EVENTS,
|
|
3
3
|
GEMINI_HOOK_EVENTS,
|
|
4
4
|
hasGeminiHooks
|
|
5
|
-
} from "./chunk-
|
|
5
|
+
} from "./chunk-KXCWWHYO.js";
|
|
6
6
|
import {
|
|
7
7
|
AGENT_CHOICES
|
|
8
|
-
} from "./chunk-
|
|
8
|
+
} from "./chunk-NDZKDJQU.js";
|
|
9
9
|
import {
|
|
10
10
|
BELL_HOOK_BINARY
|
|
11
|
-
} from "./chunk-
|
|
11
|
+
} from "./chunk-JNDELCH5.js";
|
|
12
12
|
import {
|
|
13
13
|
CODEX_HOOK_EVENTS,
|
|
14
14
|
hasCodexHooks,
|
|
15
15
|
holdBudgetOf
|
|
16
|
-
} from "./chunk-
|
|
16
|
+
} from "./chunk-AWD2SLNA.js";
|
|
17
17
|
import {
|
|
18
18
|
CURSOR_GATE_EVENTS,
|
|
19
19
|
HOOK_LOCATOR_BINARY,
|
|
20
20
|
hookCommandHoldBudget
|
|
21
|
-
} from "./chunk-
|
|
21
|
+
} from "./chunk-QOBOIFGG.js";
|
|
22
22
|
|
|
23
23
|
// src/diagnostics/bridge.ts
|
|
24
24
|
import { execFileSync } from "child_process";
|
|
@@ -3,10 +3,10 @@ import {
|
|
|
3
3
|
keyPrefix,
|
|
4
4
|
readConfigFileKey,
|
|
5
5
|
readMacAppKeyPrefix
|
|
6
|
-
} from "./chunk-
|
|
6
|
+
} from "./chunk-3VPS7JPH.js";
|
|
7
7
|
import {
|
|
8
8
|
NPX_LATEST_COMMAND
|
|
9
|
-
} from "./chunk-
|
|
9
|
+
} from "./chunk-RYBAJXV4.js";
|
|
10
10
|
|
|
11
11
|
// src/key-signed-out.ts
|
|
12
12
|
var VERDICT_BY_CHECK = {
|
|
@@ -14,19 +14,19 @@ import {
|
|
|
14
14
|
} from "./chunk-U4TMAANR.js";
|
|
15
15
|
import {
|
|
16
16
|
callMcpTool
|
|
17
|
-
} from "./chunk-
|
|
17
|
+
} from "./chunk-CATIBZQH.js";
|
|
18
18
|
import {
|
|
19
19
|
reportedInstallSource
|
|
20
|
-
} from "./chunk-
|
|
20
|
+
} from "./chunk-WKP2KRTU.js";
|
|
21
21
|
import {
|
|
22
22
|
NPX_LATEST_COMMAND
|
|
23
|
-
} from "./chunk-
|
|
23
|
+
} from "./chunk-RYBAJXV4.js";
|
|
24
24
|
import {
|
|
25
25
|
NO_PAIRING_COMPUTER,
|
|
26
26
|
PAIR_TTL_SECONDS,
|
|
27
27
|
classifyConfirmResponse,
|
|
28
28
|
isAnswerSource
|
|
29
|
-
} from "./chunk-
|
|
29
|
+
} from "./chunk-QOBOIFGG.js";
|
|
30
30
|
|
|
31
31
|
// src/reach.ts
|
|
32
32
|
var reachVerdict = (channels) => {
|
|
@@ -1,18 +1,18 @@
|
|
|
1
1
|
import {
|
|
2
2
|
macAppBridgeAvailable
|
|
3
|
-
} from "./chunk-
|
|
3
|
+
} from "./chunk-Z6VYZSVA.js";
|
|
4
4
|
import {
|
|
5
5
|
keyPrefix
|
|
6
|
-
} from "./chunk-
|
|
6
|
+
} from "./chunk-3VPS7JPH.js";
|
|
7
7
|
import {
|
|
8
8
|
bridgeAgentKey
|
|
9
|
-
} from "./chunk-
|
|
9
|
+
} from "./chunk-AWD2SLNA.js";
|
|
10
10
|
import {
|
|
11
11
|
readJsonSafe
|
|
12
12
|
} from "./chunk-T7E75EKA.js";
|
|
13
13
|
import {
|
|
14
14
|
isValidApiKey
|
|
15
|
-
} from "./chunk-
|
|
15
|
+
} from "./chunk-QOBOIFGG.js";
|
|
16
16
|
|
|
17
17
|
// src/shared-mcp-key.ts
|
|
18
18
|
var asRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
|