@pushary/agent-hooks 1.9.11 → 1.9.13

package/dist/{chunk-ERXY2SIW.js → chunk-TCVFNLMM.js}

@@ -1,21 +1,21 @@
 import {
   defersToNativeMode,
   reportMachineDenial
-} from "./chunk-ZTSMQYST.js";
+} from "./chunk-WIRM7ZLI.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-2AQ4VZSA.js";
+} from "./chunk-LBNIISXH.js";
 import {
   announceSubscriptionRequired,
   denyReasonFrom,
   isDeferAnswer,
   oncePerSession
-} from "./chunk-V6IW5WMK.js";
+} from "./chunk-GYR4G4WO.js";
 import {
   activeHookSource,
   activeIdentity
-} from "./chunk-KEV2MOJH.js";
+} from "./chunk-3VSMTCXV.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -40,7 +40,7 @@ import {
   reportEvent,
   scopePathFor,
   settleQuestionsForToolUse
-} from "./chunk-A6J5Z2HO.js";
+} from "./chunk-6NL3LYUM.js";
 import {
   askUser,
   cancelQuestion,
@@ -51,26 +51,28 @@ import {
   requestGate,
   sendNotification,
   waitForQuestion
-} from "./chunk-GUNZHSTL.js";
+} from "./chunk-JVUK5YFM.js";
 import {
   SubscriptionRequiredError
-} from "./chunk-KBN3UP2R.js";
+} from "./chunk-LYDO2SS6.js";
 import {
   getMachineId
-} from "./chunk-2NAQRPZQ.js";
+} from "./chunk-43ORAXAL.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-FJCOOFT7.js";
+} from "./chunk-7JM6TCMA.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-M54ATCOZ.js";
+} from "./chunk-4ATFPZ6X.js";
 import {
   AGENT_QUESTION_STRATEGY,
   DECISION_STOP_REASON,
   GATE_BLOCK_REASON_MAX_LENGTH,
   GATE_WIRE,
   PLAN_DECLINED_REASON,
+  SOLE_GATE_SIGNED_OUT_REASON,
+  SOLE_GATE_UNDECIDED_REASON,
   UNVERIFIABLE_APPROVAL_REASON,
   WITHDRAWN_APPROVAL_REASON,
   agentQuestionStrategy,
@@ -87,6 +89,7 @@ import {
   editGoesToTheAgentsPrompt,
   effectiveWaitSeconds,
   hasNativeApprovalPrompt,
+  hookCompatibleProfileBySource,
   hookHoldWindowMs,
   hookWaitClamped,
   hookWaitDeadline,
@@ -98,7 +101,7 @@ import {
   parseAgentQuestions,
   questionHandedToTheTerminal,
   resolveGate
-} from "./chunk-VOP5U2VX.js";
+} from "./chunk-TVDI7SX2.js";
 
 // src/claude-permission-rules.ts
 import { readFileSync, statSync } from "fs";
@@ -171,12 +174,14 @@ import { basename } from "path";
 var START_MS = Date.now();
 var ACTIVE_AGENT = activeIdentity(process.argv);
 var ACTIVE_SOURCE = activeHookSource(process.argv);
+var PUSHARY_IS_SOLE_GATE = ACTIVE_SOURCE !== null && hookCompatibleProfileBySource(ACTIVE_SOURCE)?.soleGate != null;
 var agentNameIn = (projectName) => `${ACTIVE_AGENT.label} - ${projectName}`;
 var allow = (reason) => claudePreToolUseOutput("allow", reason);
 var deny = (reason) => claudePreToolUseOutput("deny", reason);
 var allowWithInput = (updatedInput) => claudePreToolUseOutput("allow", void 0, updatedInput);
 var ask = (reason) => claudePreToolUseOutput("ask", reason);
 var halted = (reason) => claudeStoppedPreToolUseOutput(reason);
+var undecidedCall = (reason) => PUSHARY_IS_SOLE_GATE ? deny(reason) : void 0;
 var outcomeOfFailedAsk = (error, sessionId, failure) => {
   if (!(error instanceof SubscriptionRequiredError)) return failure;
   announceSubscriptionRequired(error.upgradeUrl, sessionId);
@@ -591,7 +596,8 @@ var handlePreToolUse = async (input, canonical) => {
   try {
     apiKey = getApiKey();
   } catch {
-    return handleKeyless(input);
+    handleKeyless(input);
+    return undecidedCall(SOLE_GATE_SIGNED_OUT_REASON);
   }
   try {
     const modeState = await fetchModeState(apiKey, input.session_id);
@@ -631,12 +637,12 @@ var handlePreToolUse = async (input, canonical) => {
       // State we could not establish, with an auto-approve on the table. No
       // opinion, so Claude Code's own flow runs as if the hook were absent.
       case "defer":
-        return void 0;
+        return undecidedCall(SOLE_GATE_UNDECIDED_REASON);
       default:
         return dispatchModeHandler(apiKey, input, verdict.policy, getMachineId(), modeState.trainingConsent, verdict.scopeReason, verdict.scopePath);
     }
   } catch {
-    return void 0;
+    return undecidedCall(SOLE_GATE_UNDECIDED_REASON);
   }
 };
 var permReqAllow = (updatedInput) => claudePermissionRequestOutput("allow", void 0, updatedInput);

package/dist/{chunk-MITMDERZ.js → chunk-TDSLVFG6.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-4FWWHCYM.js";
+} from "./chunk-WP57USIT.js";
 import {
   readJsonSafe
 } from "./chunk-T7E75EKA.js";

package/dist/{chunk-VOP5U2VX.js → chunk-TVDI7SX2.js}

@@ -239,7 +239,7 @@ var AGENTS = {
     connectVia: "Native hooks + MCP",
     setupCommand: PUSHARY_SETUP_COMMAND,
     enforcementDetail: "Shell commands, file writes, edits and MCP calls through native PreToolUse hooks in ~/.gemini/config/hooks.json, answered allow or deny.",
-    capabilityNote: 'Antigravity CLI ignores a hook\'s allow unless it runs in always-proceed mode (`toolPermission: "always-proceed"` or `--dangerously-skip-permissions`), so approving from the phone needs that mode, with Pushary as the only gate. Pushary answers allow or deny and never ask, because ask and force_ask run the call unprompted in that mode. An unanswered approval is blocked with a reason.'
+    capabilityNote: 'Antigravity CLI ignores a hook\'s allow unless it runs in always-proceed mode, so connecting it sets `toolPermission: "always-proceed"` when you never chose a mode, and disconnecting puts it back. Pushary is then the only gate: it answers allow or deny and never ask, and a call it cannot decide, one nobody answers, or one made after Pushary was removed is blocked with a reason.'
   },
   windsurf: {
     ...defaults,
@@ -332,6 +332,8 @@ var toToolLookup = (profile, toolName, toolInput, resolvePath = (path) => path)
 };
 var NO_AGENT_PROMPT_REASON = "Pushary needs an answer from the phone before this can run, and this agent has no approval prompt of its own here, so nothing ran. Ask the user, then try again.";
 var DENIED_BY_PUSHARY_REASON = "Denied from Pushary.";
+var SOLE_GATE_UNDECIDED_REASON = "Pushary could not decide on this call, so it did not run. Pushary is the only approval for this agent. Check that Pushary is signed in and online, then try again.";
+var SOLE_GATE_SIGNED_OUT_REASON = "Pushary is not signed in on this computer, so nothing can approve this call and it did not run. Sign in to Pushary, or disconnect this agent from Pushary.";
 var UNCARRIED_ANSWER_REASON = "The answer from the phone cannot be passed to this agent, so the call did not run. Ask the question in chat instead.";
 var renderAllowDenyDecision = (verdict) => {
   const { permissionDecision, permissionDecisionReason } = verdict.hookSpecificOutput;
@@ -357,6 +359,14 @@ var renderPreToolUseVerdict = (profile, verdict) => {
     ...stop
   };
 };
+var homePath = (segments) => `~/${segments.join("/")}`;
+var pusharyMissingReason = (profile) => {
+  const settingBack = profile.soleGate ? ` and remove ${profile.soleGate.key} from ${homePath(profile.soleGate.file)}` : "";
+  return `Pushary is not installed on this computer any more, so nothing can approve this call and it did not run. Reinstall Pushary, or remove the pushary hook from ${homePath(profile.configFile)}${settingBack}.`;
+};
+var refusalOutput = (profile, reason) => JSON.stringify(renderPreToolUseVerdict(profile, {
+  hookSpecificOutput: { permissionDecision: "deny", permissionDecisionReason: reason }
+}));
 var ANTIGRAVITY_MCP_TOOL = "call_mcp_tool";
 var isPayloadRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var nonEmptyString = (value) => typeof value === "string" && value.length > 0 ? value : void 0;
@@ -380,13 +390,15 @@ var fromAntigravity = (event, payload) => {
   const cwd = firstWorkspace(payload) ?? nonEmptyString(call?.tool_input.Cwd);
   const sessionId = nonEmptyString(payload.conversationId);
   const transcriptPath = nonEmptyString(payload.transcriptPath);
+  const error = event === "PostToolUse" ? nonEmptyString(payload.error) : void 0;
   return {
     ...rest,
     ...event ? { hook_event_name: event } : {},
     ...sessionId ? { session_id: sessionId } : {},
     ...transcriptPath ? { transcript_path: transcriptPath } : {},
     ...cwd ? { cwd } : {},
-    ...call ?? {}
+    ...call ?? {},
+    ...error ? { tool_response: { error } } : {}
   };
 };
 var claudeShapedHookInput = (dialect, event, payload) => dialect === "antigravity" ? fromAntigravity(event, payload) : payload;
@@ -440,7 +452,7 @@ var QWEN_CODE = {
   instructions: { file: [".qwen", "QWEN.md"], label: "Qwen Code" },
   permissionRuleFile: null,
   configDirIsShared: false,
-  setupNote: null
+  soleGate: null
 };
 var CODEBUDDY = {
   agentType: "codebuddy",
@@ -463,7 +475,7 @@ var CODEBUDDY = {
   instructions: { file: [".codebuddy", "CODEBUDDY.md"], label: "CodeBuddy" },
   permissionRuleFile: [".codebuddy", "settings.json"],
   configDirIsShared: false,
-  setupNote: null
+  soleGate: null
 };
 var QODER = {
   agentType: "qoder",
@@ -486,7 +498,7 @@ var QODER = {
   instructions: null,
   permissionRuleFile: null,
   configDirIsShared: false,
-  setupNote: null
+  soleGate: null
 };
 var DROID = {
   agentType: "droid",
@@ -514,7 +526,7 @@ var DROID = {
   instructions: null,
   permissionRuleFile: null,
   configDirIsShared: false,
-  setupNote: null
+  soleGate: null
 };
 var DEVIN = {
   agentType: "devin",
@@ -547,7 +559,7 @@ var DEVIN = {
   instructions: null,
   permissionRuleFile: null,
   configDirIsShared: false,
-  setupNote: null
+  soleGate: null
 };
 var ANTIGRAVITY_CLI = {
   agentType: "antigravity_cli",
@@ -582,7 +594,12 @@ var ANTIGRAVITY_CLI = {
   instructions: null,
   permissionRuleFile: null,
   configDirIsShared: true,
-  setupNote: 'Approvals from your phone take effect only when Antigravity CLI runs in always-proceed mode: start it with --dangerously-skip-permissions, or set "toolPermission": "always-proceed" in ~/.gemini/antigravity-cli/settings.json. Pushary is then the only gate, and an unanswered approval is blocked.'
+  soleGate: {
+    file: [".gemini", "antigravity-cli", "settings.json"],
+    key: "toolPermission",
+    value: "always-proceed",
+    receipt: [".pushary", "setup", "antigravity-tool-permission.json"]
+  }
 };
 var HOOK_COMPATIBLE_PROFILES = Object.freeze([QWEN_CODE, CODEBUDDY, QODER, DROID, DEVIN, ANTIGRAVITY_CLI]);
 var hookCompatibleProfile = (agentType) => HOOK_COMPATIBLE_PROFILES.find((profile) => profile.agentType === agentType);
@@ -862,7 +879,7 @@ var AUTH_REJECTION_REASONS = [
 // ../contracts/src/declined-agents.ts
 var DECLINED_AGENTS_FILE = "declined-agents.json";
 var DECLINED_AGENTS_VERSION = 1;
-var isDeclinableAgent = (value) => typeof value === "string" && HOOK_SOURCES.includes(value);
+var isDeclinableAgent = (value) => typeof value === "string" && DISCONNECT_AGENT_IDS.includes(value);
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var canonicalAgents = (agents) => [...new Set(agents)].sort();
 var parseDeclinedAgents = (value) => {
@@ -1273,7 +1290,9 @@ var SAFE_SHELL_COMMANDS = /* @__PURE__ */ new Set([
   "du",
   "df",
   "ps",
-  "true"
+  "true",
+  "sleep",
+  "pgrep"
 ]);
 var SAFE_GIT_SUBCOMMANDS = /* @__PURE__ */ new Set([
   "status",
@@ -1295,6 +1314,8 @@ var SAFE_GIT_SUBCOMMANDS = /* @__PURE__ */ new Set([
   "count-objects"
 ]);
 var GIT_WRITE_FLAGS = (token) => token === "--output" || token.startsWith("--output=");
+var GIT_READ_ONLY_BRANCH_ARGUMENTS = ["branch", "--show-current"];
+var isReadOnlyGitBranch = (args) => args.length === GIT_READ_ONLY_BRANCH_ARGUMENTS.length && args.every((arg, index) => arg === GIT_READ_ONLY_BRANCH_ARGUMENTS[index]);
 var DANGEROUS_FIND_ACTIONS = /* @__PURE__ */ new Set([
   "-exec",
   "-execdir",
@@ -1401,6 +1422,7 @@ var isSafeSimpleCommand = (segment) => {
   if (exe === "git") {
     const sub = tokens[1];
     if (!sub || sub.startsWith("-")) return false;
+    if (isReadOnlyGitBranch(tokens.slice(1))) return true;
     if (!SAFE_GIT_SUBCOMMANDS.has(sub)) return false;
     return !tokens.some(GIT_WRITE_FLAGS);
   }
@@ -1415,8 +1437,61 @@ var isSafeSimpleCommand = (segment) => {
   if (exe === "sed") return isPrintOnlySed(tokens.slice(1));
   if (exe === "date") return isReadOnlyDate(tokens.slice(1));
   if (exe === "printf") return isOutputOnlyPrintf(tokens.slice(1));
+  if (exe === RIPGREP_PROGRAM) return carriesNoRefusedOption(tokens.slice(1), RIPGREP_OPTIONS_THAT_RUN_A_PROGRAM);
+  if (exe === SORT_PROGRAM) return carriesNoRefusedOption(tokens.slice(1), SORT_OPTIONS_THAT_WRITE_OR_RUN);
+  if (exe === UNIQ_PROGRAM) return uniqFileOperandCount(tokens.slice(1)) <= UNIQ_MAX_FILE_OPERANDS;
   return SAFE_SHELL_COMMANDS.has(exe);
 };
+var RIPGREP_PROGRAM = "rg";
+var RIPGREP_OPTIONS_THAT_RUN_A_PROGRAM = {
+  long: ["--pre", "--pre-glob", "--hostname-bin", "--search-zip"],
+  short: ["-z"]
+};
+var SORT_PROGRAM = "sort";
+var SORT_OPTIONS_THAT_WRITE_OR_RUN = {
+  long: ["--output", "--compress-program", "--temporary-directory"],
+  short: ["-o", "-T"]
+};
+var UNIQ_PROGRAM = "uniq";
+var UNIQ_MAX_FILE_OPERANDS = 1;
+var UNIQ_OPTIONS_WITH_A_SEPARATE_VALUE = [
+  "-f",
+  "-s",
+  "-w",
+  "--skip-fields",
+  "--skip-chars",
+  "--check-chars"
+];
+var uniqFileOperandCount = (args) => {
+  let operands = 0;
+  let optionsEnded = false;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index] ?? "";
+    if (optionsEnded || !isFlagToken(arg) || arg === STDIN_OPERAND) {
+      operands += 1;
+      optionsEnded = true;
+    } else if (arg === END_OF_OPTIONS) {
+      optionsEnded = true;
+    } else if (UNIQ_OPTIONS_WITH_A_SEPARATE_VALUE.includes(arg)) {
+      index += 1;
+    }
+  }
+  return operands;
+};
+var STDIN_OPERAND = "-";
+var LONG_OPTION_PREFIX = "--";
+var OPTION_VALUE_SEPARATOR = "=";
+var longOptionName = (token) => token.split(OPTION_VALUE_SEPARATOR, 1)[0] ?? token;
+var abbreviatesALongOption = (token, longOptions) => {
+  const name = longOptionName(token);
+  return longOptions.some((option) => option.startsWith(name));
+};
+var clustersAShortOption = (token, shortOptions) => shortOptions.some((option) => token.slice(1).includes(option.slice(1)));
+var isRefusedOption = (token, options) => {
+  if (token === END_OF_OPTIONS || !isFlagToken(token)) return false;
+  return token.startsWith(LONG_OPTION_PREFIX) ? abbreviatesALongOption(token, options.long) : clustersAShortOption(token, options.short);
+};
+var carriesNoRefusedOption = (args, options) => !args.some((arg) => isRefusedOption(arg, options));
 var SED_PRINT_ONLY_SCRIPT = /^(?:\d+|\$)(?:,(?:\d+|\$))?p$/;
 var SED_QUIET_FLAG = "-n";
 var DATE_FORMAT_PREFIX = "+";
@@ -1429,7 +1504,16 @@ var READ_ONLY_SEGMENT_SEPARATOR = /&&|\|\||[;|]/g;
 var PIPELINE_CHAIN_SEPARATOR = /&&|\|\||;/g;
 var EXPANSION_THAT_CAN_BECOME_A_FLAG = /\$|(?:^|\s)[*?[]/;
 var SHELL_QUOTE_CHARACTERS = /['"]/g;
-var INSPECTED_ARGUMENT_COMMANDS = /* @__PURE__ */ new Set(["git", "find", "sed", "date", "printf"]);
+var INSPECTED_ARGUMENT_COMMANDS = /* @__PURE__ */ new Set([
+  "git",
+  "find",
+  "sed",
+  "date",
+  "printf",
+  RIPGREP_PROGRAM,
+  SORT_PROGRAM,
+  UNIQ_PROGRAM
+]);
 var argumentsMayExpand = (segment) => {
   const visible = shellVisibleText(segment);
   return visible === null || EXPANSION_THAT_CAN_BECOME_A_FLAG.test(visible.replace(SHELL_QUOTE_CHARACTERS, ""));
@@ -2206,12 +2290,21 @@ var autoApprove = (tool) => ({
   mode: "terminal_only",
   pushFirstSeconds: 0
 });
+var CODEX_COORDINATION_TOOLS = [
+  "mcp__codex_app__wait_threads",
+  "mcp__codex_app__send_message_to_thread"
+];
+var CODEX_COORDINATION_TOOL_NAMES = new Set(CODEX_COORDINATION_TOOLS);
+var isCodexCoordinationTool = (toolName) => CODEX_COORDINATION_TOOL_NAMES.has(toolName);
+var isNamedByARule = (rank) => rank !== void 0 && rank !== "wildcard";
+var isSpecificArgumentRank = (rank) => rank === "exact" || rank === "prefix";
+var shellReadOnlyFloorApplies = (toolName, arg, rank) => !isSpecificArgumentRank(rank) && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg);
+var coordinationFloorApplies = (toolName, rank) => isCodexCoordinationTool(toolName) && !isNamedByARule(rank);
 var resolveAutoResolveOrigin = (config, toolName, toolInput, cwd, repoKey, sessionId) => {
   const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
   const arg = args[0];
-  const match = selectGoverningRule(config.policies, toolName, args, repoKey, sessionId);
-  const governedBySpecificRule = match?.rank === "exact" || match?.rank === "prefix";
-  if (!governedBySpecificRule && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg)) {
+  const rank = selectGoverningRule(config.policies, toolName, args, repoKey, sessionId)?.rank;
+  if (shellReadOnlyFloorApplies(toolName, arg, rank) || coordinationFloorApplies(toolName, rank)) {
     return DECISION_ORIGIN.safeReadonly;
   }
   return DECISION_ORIGIN.autopilot;
@@ -2238,10 +2331,10 @@ var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, se
     mode: config.defaultMode ?? "push_first",
     pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
   };
-  const governedBySpecificRule = match?.rank === "exact" || match?.rank === "prefix";
+  const governedBySpecificRule = isSpecificArgumentRank(match?.rank);
   const governedBySessionToolGrant = match?.rank === "tool" && isSessionToolGrant(match.policy);
   const governingMode = base.mode;
-  const approvedByReadOnlyFloor = !governedBySpecificRule && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg);
+  const approvedByReadOnlyFloor = !isAutoDeny(base) && (shellReadOnlyFloorApplies(toolName, arg, match?.rank) || coordinationFloorApplies(toolName, match?.rank));
   if (governedBySessionToolGrant && !approvedByReadOnlyFloor && typeof arg === "string" && commandNeedsAPerson(toolName, arg)) {
     return resolvePolicy(withoutSessionToolGrants(config), toolName, modeOverride, toolInput, cwd, repoKey, sessionId);
   }
@@ -2941,7 +3034,11 @@ export {
   PHONE_ANSWERED_TOOLS,
   canonicalToolName,
   toToolLookup,
+  SOLE_GATE_UNDECIDED_REASON,
+  SOLE_GATE_SIGNED_OUT_REASON,
   renderPreToolUseVerdict,
+  pusharyMissingReason,
+  refusalOutput,
   claudeShapedHookInput,
   HOOK_COMPATIBLE_PROFILES,
   hookCompatibleProfile,

package/dist/{chunk-5WAYSUWV.js → chunk-U5SXTKZV.js}

@@ -3,11 +3,11 @@ import {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-2GG77ADC.js";
+} from "./chunk-RI5E5JQS.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-N7HXP4PZ.js";
+} from "./chunk-3EOXZYUE.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;

package/dist/{chunk-I4I4UH62.js → chunk-U6QEHPEF.js}

@@ -1,6 +1,6 @@
 import {
   pusharyFetch
-} from "./chunk-EJVYEOKC.js";
+} from "./chunk-LUYAXSUS.js";
 import {
   NetworkError
 } from "./chunk-7QLSKOSU.js";
@@ -9,11 +9,11 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   getBaseUrl
-} from "./chunk-FJCOOFT7.js";
+} from "./chunk-7JM6TCMA.js";
 import {
   isValidApiKey,
   normalizeKeyScope
-} from "./chunk-VOP5U2VX.js";
+} from "./chunk-TVDI7SX2.js";
 
 // src/session.ts
 var samePusharyAccount = (left, right) => left.kind === "ok" && right.kind === "ok" && left.identity.workspaceId !== "" && left.identity.workspaceId === right.identity.workspaceId && left.identity.siteId === right.identity.siteId;

package/dist/{chunk-OKSU74QH.js → chunk-UUBEEKT6.js}

@@ -3,10 +3,10 @@ import {
   keyPrefix,
   readConfigFileKey,
   readMacAppKeyPrefix
-} from "./chunk-Z4AOR6RZ.js";
+} from "./chunk-S2LDTUHS.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-M54ATCOZ.js";
+} from "./chunk-4ATFPZ6X.js";
 
 // src/key-signed-out.ts
 var VERDICT_BY_CHECK = {

package/dist/{chunk-STUJXZC2.js → chunk-VUHT6NYV.js}

@@ -14,19 +14,19 @@ import {
 } from "./chunk-U4TMAANR.js";
 import {
   callMcpTool
-} from "./chunk-KBN3UP2R.js";
+} from "./chunk-LYDO2SS6.js";
 import {
   reportedInstallSource
-} from "./chunk-CBDJ2X5P.js";
+} from "./chunk-NPRFA7YM.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-M54ATCOZ.js";
+} from "./chunk-4ATFPZ6X.js";
 import {
   NO_PAIRING_COMPUTER,
   PAIR_TTL_SECONDS,
   classifyConfirmResponse,
   isAnswerSource
-} from "./chunk-VOP5U2VX.js";
+} from "./chunk-TVDI7SX2.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {

package/dist/{chunk-ZTSMQYST.js → chunk-WIRM7ZLI.js}

@@ -6,12 +6,12 @@ import {
   permissionDeniedAction,
   releaseThrottle,
   reportEvent
-} from "./chunk-A6J5Z2HO.js";
+} from "./chunk-6NL3LYUM.js";
 import {
   machineDecisionFor,
   shouldDeferToNativeMode,
   wireVerdictFor
-} from "./chunk-VOP5U2VX.js";
+} from "./chunk-TVDI7SX2.js";
 
 // src/machine-decision-audit.ts
 import { basename } from "path";

package/dist/{chunk-BDRXDO25.js → chunk-WL4PVINO.js}

@@ -1,9 +1,9 @@
 import {
   parseSseMessages
-} from "./chunk-KBN3UP2R.js";
+} from "./chunk-LYDO2SS6.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-M54ATCOZ.js";
+} from "./chunk-4ATFPZ6X.js";
 
 // src/mcp-stdio-bridge.ts
 var MCP_BRIDGE_BINARY = "pushary-mcp";

package/dist/{chunk-4FWWHCYM.js → chunk-WP57USIT.js}

@@ -13,7 +13,7 @@ import {
   isReleaseVersion,
   ownPackageName,
   withHookHoldBudget
-} from "./chunk-VOP5U2VX.js";
+} from "./chunk-TVDI7SX2.js";
 
 // src/setup/paths.ts
 import { homedir as homedir2 } from "os";
@@ -365,9 +365,9 @@ var installGlobally = (options) => {
   }
   const started = (async () => {
     if (!npmIsOnPath()) throw new NpmMissingError();
-    const { withUpgradeLock } = await import("./global-upgrade-VT2JS7DR.js");
-    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-VRYMTPZQ.js");
-    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-WRBEUNEY.js");
+    const { withUpgradeLock } = await import("./global-upgrade-NIFOQFV4.js");
+    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-Z3LYROGK.js");
+    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-QPBLO5Q2.js");
     let result = "skipped";
     const install = async () => {
       const platform = process.platform;
@@ -438,6 +438,14 @@ var guardHookCommand = (target, platform = process.platform) => {
   return `${HOOK_SHELL} '${HOOK_GUARD_SCRIPTS[guardKindOf(target)]}' ${path}`;
 };
 var guardBinary = (path, platform) => guardHookCommand({ kind: "binary", path, runtime: "node" }, platform);
+var SILENT_MISS = "exit 0";
+var REFUSE = "R";
+var definesRefusal = (refusal) => `${REFUSE}() { printf %s ${shellDoubleQuoted(refusal)}; exit 0; }`;
+var guardBinaryRefusing = (path, refusal, platform = process.platform) => {
+  if (platform === "win32") return guardBinary(path, platform);
+  const script = `${definesRefusal(refusal)}; ${HOOK_GUARD_SCRIPTS.node_binary.replaceAll(SILENT_MISS, REFUSE)}`;
+  return `${HOOK_SHELL} '${script}' ${quoteIfNeeded(path)}`;
+};
 var guardNodeScript = (script, platform) => guardHookCommand({ kind: "node", script }, platform);
 var guardCursorGate = (script, platform) => guardHookCommand({ kind: "cursor_gate", script }, platform);
 var guardedArgv = (target, args = [], platform = process.platform) => {
@@ -854,6 +862,7 @@ export {
   installGlobally,
   holdBudgetOf,
   guardBinary,
+  guardBinaryRefusing,
   guardNodeScript,
   guardCursorGate,
   guardedArgv,

package/dist/{chunk-P2EJN7UB.js → chunk-Y25RH4VF.js}

@@ -2,7 +2,7 @@ import {
   autoUpdateLock,
   installPackageGlobally,
   npmErrorMessage
-} from "./chunk-4FWWHCYM.js";
+} from "./chunk-WP57USIT.js";
 import {
   writeJsonAtomic
 } from "./chunk-T7E75EKA.js";

package/dist/{chunk-4RENRBSB.js → chunk-YI37QERZ.js}

@@ -1,18 +1,18 @@
 import {
   macAppBridgeAvailable
-} from "./chunk-KIVFWGG6.js";
+} from "./chunk-6QPQG3Q5.js";
 import {
   keyPrefix
-} from "./chunk-Z4AOR6RZ.js";
+} from "./chunk-S2LDTUHS.js";
 import {
   bridgeAgentKey
-} from "./chunk-4FWWHCYM.js";
+} from "./chunk-WP57USIT.js";
 import {
   readJsonSafe
 } from "./chunk-T7E75EKA.js";
 import {
   isValidApiKey
-} from "./chunk-VOP5U2VX.js";
+} from "./chunk-TVDI7SX2.js";
 
 // src/shared-mcp-key.ts
 var asRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;

package/dist/{chunk-LBAMPNDM.js → chunk-ZAH3CCEV.js}

@@ -2,25 +2,25 @@ import {
   SIGNED_OUT_ON_MAC_MESSAGE,
   describeSignedOutKey,
   readSignedOutDiagnosis
-} from "./chunk-OKSU74QH.js";
+} from "./chunk-UUBEEKT6.js";
 import {
   createIo
 } from "./chunk-U4TMAANR.js";
 import {
   readKeySource
-} from "./chunk-Z4AOR6RZ.js";
+} from "./chunk-S2LDTUHS.js";
 import {
   absoluteUrl,
   checkApiKey,
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-I4I4UH62.js";
+} from "./chunk-U6QEHPEF.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
 import {
   getBaseUrl
-} from "./chunk-FJCOOFT7.js";
+} from "./chunk-7JM6TCMA.js";
 
 // src/cli/report-key.ts
 var { dim, yellow } = createIo();

package/dist/{global-upgrade-VT2JS7DR.js → global-upgrade-NIFOQFV4.js}

@@ -5,15 +5,15 @@ import {
   readGlobalUpgradeSubject,
   upgradeInstalledPackage,
   withUpgradeLock
-} from "./chunk-WHRYW4P2.js";
-import "./chunk-P2EJN7UB.js";
-import "./chunk-WCELLK4P.js";
+} from "./chunk-GFAVGG3X.js";
+import "./chunk-Y25RH4VF.js";
+import "./chunk-MPDJJNGA.js";
 import "./chunk-POFBE6ZY.js";
 import "./chunk-KZERVKTD.js";
-import "./chunk-4FWWHCYM.js";
+import "./chunk-WP57USIT.js";
 import "./chunk-T7E75EKA.js";
-import "./chunk-M54ATCOZ.js";
-import "./chunk-VOP5U2VX.js";
+import "./chunk-4ATFPZ6X.js";
+import "./chunk-TVDI7SX2.js";
 export {
   finishGlobalUpgrade,
   finishUpgradeWithLock,

package/dist/{paths-WRBEUNEY.js → paths-QPBLO5Q2.js}

@@ -32,8 +32,8 @@ import {
   pusharyDir,
   vscodePluginDir,
   vscodePluginMcp
-} from "./chunk-4FWWHCYM.js";
-import "./chunk-VOP5U2VX.js";
+} from "./chunk-WP57USIT.js";
+import "./chunk-TVDI7SX2.js";
 export {
   autoUpdateLock,
   autoUpdateLog,