@pushary/agent-hooks 1.9.14 → 1.9.16

package/dist/{chunk-RMWV3MYN.js → chunk-4MOOSU5Y.js}

@@ -11,22 +11,22 @@ import {
   clipToRow,
   terminalColumns,
   useColor
-} from "./chunk-U4TMAANR.js";
+} from "./chunk-FO3MDD26.js";
 import {
   callMcpTool
-} from "./chunk-CIZQARGJ.js";
+} from "./chunk-S2LU6HIZ.js";
 import {
   reportedInstallSource
-} from "./chunk-ZSL7B7NF.js";
+} from "./chunk-VKYDON4A.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-FKQMH2DW.js";
+} from "./chunk-OIAZ2QAC.js";
 import {
   NO_PAIRING_COMPUTER,
   PAIR_TTL_SECONDS,
   classifyConfirmResponse,
   isAnswerSource
-} from "./chunk-NAROM5IR.js";
+} from "./chunk-AYV2NRYJ.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {
@@ -282,9 +282,9 @@ var describeAnswerSource = (source) => {
   switch (source) {
     case "mobile_app":
     case "mobile_background":
-      return "A phone answered this synthetic test.";
+      return "Answered on your phone.";
     case "mac_app":
-      return "A Mac answered this synthetic test.";
+      return "Answered on your Mac.";
     case "sandbox":
       return "This was a simulated sandbox answer.";
     default:
@@ -357,6 +357,7 @@ var yellow = paint("\x1B[33m");
 var check = green("\u2713");
 var apiBase = () => process.env.PUSHARY_API_URL?.trim() || process.env.PUSHARY_BASE_URL?.trim() || "https://pushary.com";
 var EXIT_ABORTED = 130;
+var EXIT_TERMINATED = 143;
 var CONNECT_POLL_INTERVAL_MS = 2500;
 var CONNECT_TIMEOUT_MS = 18e4;
 var EMPTY_CHANNELS = {
@@ -491,10 +492,11 @@ var startSpinner = (getLabel) => {
     writeStatusLine(`${finalGlyph} ${finalLabel}`);
   };
 };
+var qrRows = (qr) => qr.replace(/\n+$/, "").split("\n");
 var printQr = (url) => new Promise((resolve, reject) => {
   try {
     qrcodeTerminal.generate(url, { small: true }, (qr) => {
-      writeHuman("\n" + qr.split("\n").map((line) => "    " + line).join("\n") + "\n");
+      writeHuman("\n" + qrRows(qr).map((line) => "    " + line).join("\n") + "\n");
       resolve();
     });
   } catch (err) {
@@ -737,7 +739,17 @@ var PAIR_TIMEOUT_MS = PAIR_TTL_SECONDS * 1e3 - PAIR_STOP_BEFORE_EXPIRY_MS;
 var PAIR_HINT_AFTER_MS = 45e3;
 var PAIR_BROWSER_FALLBACK_AFTER_MS = 6e4;
 var BROWSER_CONNECT_COMMAND = `${NPX_LATEST_COMMAND} setup --connect browser`;
-var PAIR_BROWSER_FALLBACK_LINE = `Still waiting? Sign in with a browser instead: Ctrl-C, then ${BROWSER_CONNECT_COMMAND}`;
+var PAIR_BROWSER_FALLBACK_LINE = `Still waiting? Ctrl-C, then: ${BROWSER_CONNECT_COMMAND}`;
+var PAIR_INSTALL_HINT = "No app yet? Install it, sign in, then scan the code above. Ctrl-C to stop.";
+var PAIR_GET_APP_LINE = "No app yet? Get it at pushary.com/download. Setup keeps waiting.";
+var describePairingScreen = (screen) => [
+  bold("Connect your phone"),
+  "Scan this with your phone's camera or the Pushary app.",
+  `${dim("Or open on your phone:")} ${cyan(screen.universalLink)}`,
+  `Your phone will show ${cyan(screen.fingerprint)}. Check it matches.`,
+  `${dim("Already have the app and it opened a browser? Use")} ${cyan(screen.deepLink)}`,
+  dim(PAIR_GET_APP_LINE)
+];
 var SYSTEM_PAIR_CLOCK = { now: () => Date.now(), sleep };
 var startPairing = async (cliPublicKey, computer) => {
   try {
@@ -841,15 +853,10 @@ var connectViaAppPairing = async (options = {}) => {
   }
   const { pairId, code } = started;
   const { qrLink, universalLink, deepLink } = buildPairLinks(pairId, keypair.publicKeyB64, apiBase(), code);
-  console.log();
-  console.log(`  ${bold("Connect your Pushary app")}`);
-  console.log(`  ${dim("Scan this with your phone camera:")}`);
+  for (const line of describePairingScreen({ universalLink, fingerprint: publicKeyFingerprint(keypair.publicKeyB64), deepLink })) {
+    console.log(`  ${line}`);
+  }
   await printQr(qrLink);
-  console.log(`  ${dim("No camera handy? Open this on the phone instead:")}`);
-  console.log(`  ${cyan(universalLink)}`);
-  console.log(`  ${dim("Confirm the app shows fingerprint")} ${cyan(publicKeyFingerprint(keypair.publicKeyB64))}`);
-  console.log(`  ${dim("Already have the app and it opened a browser? Use")} ${cyan(deepLink)}`);
-  console.log();
   const startedAt = clock.now();
   const deadline = requestedAt + PAIR_TIMEOUT_MS;
   let hintShown = false;
@@ -861,20 +868,22 @@ var connectViaAppPairing = async (options = {}) => {
     }
     if (!hintShown) {
       hintShown = true;
-      writeStatusLine(
-        `${dim("No app yet? Install it, sign in with this account, then scan. Ctrl-C to stop.")}`
-      );
+      writeStatusLine(dim(PAIR_INSTALL_HINT));
     }
     return `Waiting for the app ${dim(`(${left}m left)`)}`;
   });
   let cancelled = false;
-  const onInterrupt = () => {
+  const cancelOnSignal = (exitCode) => () => {
+    if (cancelled) return;
     cancelled = true;
     stop(yellow("!"), "Cancelled");
-    const flushed = options.onCancelled?.();
-    void Promise.allSettled([Promise.resolve(flushed), cancelPairing(pairId)]).finally(() => process.exit(EXIT_ABORTED));
+    const flushed = options.onCancelled?.(exitCode);
+    void Promise.allSettled([Promise.resolve(flushed), cancelPairing(pairId)]).finally(() => process.exit(exitCode));
   };
+  const onInterrupt = cancelOnSignal(EXIT_ABORTED);
+  const onTerminate = cancelOnSignal(EXIT_TERMINATED);
   process.once("SIGINT", onInterrupt);
+  process.once("SIGTERM", onTerminate);
   let consecutiveFailures = 0;
   try {
     while (clock.now() < deadline) {
@@ -900,7 +909,7 @@ var connectViaAppPairing = async (options = {}) => {
         try {
           apiKey = openSealedKey(claim.sealed, keypair);
         } catch {
-          stop(yellow("!"), "Pairing failed to decrypt \u2014 re-run setup to try again");
+          stop(yellow("!"), "Pairing failed to decrypt. Re-run setup to try again.");
           await cancelPairing(pairId);
           return pairFailed("decrypt");
         }
@@ -909,7 +918,7 @@ var connectViaAppPairing = async (options = {}) => {
         return { kind: "paired", apiKey, handle: claim.siteSlug };
       }
       if (claim?.status === "expired") {
-        stop(yellow("!"), "Pairing expired \u2014 re-run setup to try again");
+        stop(yellow("!"), "Pairing expired. Re-run setup to try again.");
         return pairFailed("expired");
       }
       if (claim?.status === "failed") {
@@ -927,6 +936,7 @@ var connectViaAppPairing = async (options = {}) => {
     return pairFailed("unreachable");
   } finally {
     process.off("SIGINT", onInterrupt);
+    process.off("SIGTERM", onTerminate);
   }
 };
 
@@ -934,6 +944,7 @@ export {
   reachVerdict,
   describeReach,
   verifyRoundTrip,
+  describeRoundTripOutcome,
   describeRoundTrip,
   roundTripEvidence,
   fetchChannels,

package/dist/{chunk-NNCK2PUR.js → chunk-4PQGFWPO.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   renderCommandHelp
-} from "./chunk-FKQMH2DW.js";
+} from "./chunk-OIAZ2QAC.js";
 import {
   getPackageVersion
-} from "./chunk-NAROM5IR.js";
+} from "./chunk-AYV2NRYJ.js";
 
 // src/cli/usage.ts
 var exitOnHelpFlag = (command) => {

package/dist/{chunk-VYXXAFIA.js → chunk-52JA2WTH.js}

@@ -1,6 +1,6 @@
 import {
   PRETOOLUSE_GATED_TOOLS
-} from "./chunk-NAROM5IR.js";
+} from "./chunk-AYV2NRYJ.js";
 
 // src/claude-tools.ts
 var POSTTOOLUSE_MIRROR_ONLY_TOOLS = ["TodoWrite", "Task", "WebFetch", "WebSearch"];

package/dist/{chunk-2WWHZTI5.js → chunk-5ETPCIG4.js}

@@ -13,7 +13,7 @@ import {
   isReleaseVersion,
   ownPackageName,
   withHookHoldBudget
-} from "./chunk-NAROM5IR.js";
+} from "./chunk-AYV2NRYJ.js";
 
 // src/setup/paths.ts
 import { homedir as homedir2 } from "os";
@@ -168,6 +168,23 @@ var NpmMissingError = class extends Error {
     this.name = "NpmMissingError";
   }
 };
+var NpmPermissionError = class extends Error {
+  constructor(detail) {
+    super(detail);
+    this.name = "NpmPermissionError";
+  }
+};
+var NPM_PERMISSION_CODE = /\bE(?:ACCES|PERM)\b/;
+var ERROR_TEXT_FIELDS = ["code", "stderr", "stdout", "message"];
+var errorTextOf = (err) => {
+  if (typeof err !== "object" || err === null) return [String(err)];
+  return ERROR_TEXT_FIELDS.flatMap((field) => {
+    const value = Reflect.get(err, field);
+    return typeof value === "string" || Buffer.isBuffer(value) ? [value.toString()] : [];
+  });
+};
+var isNpmPermissionFailure = (err) => errorTextOf(err).some((text) => NPM_PERMISSION_CODE.test(text));
+var npmInstallFailure = (err) => isNpmPermissionFailure(err) ? new NpmPermissionError(npmErrorMessage(err)) : new Error(npmErrorMessage(err));
 var resolveBinary = (name) => resolveGlobalBinary(name) ?? resolvePathBinary(name);
 var resolvePackageVersionFromBinary = (binary, packageName) => {
   try {
@@ -365,9 +382,9 @@ var installGlobally = (options) => {
   }
   const started = (async () => {
     if (!npmIsOnPath()) throw new NpmMissingError();
-    const { withUpgradeLock } = await import("./global-upgrade-P5CJ22AW.js");
-    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-DQF62B6X.js");
-    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-XZE2MPTP.js");
+    const { withUpgradeLock } = await import("./global-upgrade-4XWM5RXK.js");
+    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-HVWZN4BZ.js");
+    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-2RE6MBKF.js");
     let result = "skipped";
     const install = async () => {
       const platform = process.platform;
@@ -848,6 +865,8 @@ export {
   npmIsOnPath,
   globalPackageState,
   NpmMissingError,
+  NpmPermissionError,
+  npmInstallFailure,
   resolveBinary,
   resolvePackageVersionFromBinary,
   resolveGlobalPackageVersion,

package/dist/{chunk-XJKM6NQS.js → chunk-65OI53N7.js}

@@ -3,27 +3,27 @@ import {
   expectedLaunchCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "./chunk-ECU2Y7D2.js";
+} from "./chunk-W2AUU35K.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   hasDaemonServiceDefinition,
   readDaemonNeedsLogin,
   readDaemonStatus
-} from "./chunk-7SIZISYH.js";
+} from "./chunk-PZ33VQ54.js";
 import {
   readControlMode,
   readKeySource
-} from "./chunk-NMDGIMDV.js";
+} from "./chunk-DUDI3Z7F.js";
 import {
   getMachineId
-} from "./chunk-ZVFKNSRX.js";
+} from "./chunk-XIJMMY6M.js";
 import {
   getBaseUrl
-} from "./chunk-AJRT3JGE.js";
+} from "./chunk-PJNZJPPX.js";
 import {
   getPackageVersion
-} from "./chunk-NAROM5IR.js";
+} from "./chunk-AYV2NRYJ.js";
 
 // src/machines.ts
 import { hostname } from "os";

package/dist/{chunk-42WYKVHL.js → chunk-7BNU5AVD.js}

@@ -6,12 +6,12 @@ import {
   permissionDeniedAction,
   releaseThrottle,
   reportEvent
-} from "./chunk-WYPQKDKX.js";
+} from "./chunk-IHPSFUL2.js";
 import {
   machineDecisionFor,
   shouldDeferToNativeMode,
   wireVerdictFor
-} from "./chunk-NAROM5IR.js";
+} from "./chunk-AYV2NRYJ.js";
 
 // src/machine-decision-audit.ts
 import { basename } from "path";

package/dist/{chunk-3KHQWC4F.js → chunk-7DE5BZMB.js}

@@ -1,6 +1,6 @@
 import {
   ensureCodexTrustsPusharyHooks
-} from "./chunk-YSVCBUT3.js";
+} from "./chunk-ISJ5ROXM.js";
 import {
   detectClaudeVersion
 } from "./chunk-RIVNNBEK.js";
@@ -12,12 +12,12 @@ import {
   openCodeHookArgv,
   openCodePluginDir,
   openCodeWired
-} from "./chunk-5RONPCMH.js";
+} from "./chunk-HBDZYQZX.js";
 import {
   addClaudeMcpServer,
   addPusharyHooks,
   addPusharyToolPermissions
-} from "./chunk-POJUUEGO.js";
+} from "./chunk-PVOOKOKX.js";
 import {
   claudeUnprovenHolds,
   claudeWired,
@@ -25,7 +25,7 @@ import {
   codexWired,
   geminiWired,
   planHooks
-} from "./chunk-SEQSZYLW.js";
+} from "./chunk-ZOMVMLMU.js";
 import {
   CLAUDE_HOOK_BINARY,
   CLAUDE_HOOK_EVENTS,
@@ -36,7 +36,7 @@ import {
   needsReregistration,
   registrationSignatures,
   supportedClaudeEvents
-} from "./chunk-RV4U3LYL.js";
+} from "./chunk-EDEIIKCV.js";
 import {
   formatVersion
 } from "./chunk-6ICPEJY5.js";
@@ -59,7 +59,7 @@ import {
   registrationHolderOf,
   resolveGlobalBinary,
   vscodePluginMcp
-} from "./chunk-2WWHZTI5.js";
+} from "./chunk-5ETPCIG4.js";
 import {
   readJsonSafe,
   writeFileAtomic,

package/dist/{chunk-PWO6T7JG.js → chunk-7EBZRHIH.js}

@@ -5,18 +5,18 @@ import {
 import {
   SubscriptionRequiredError,
   callMcpTool
-} from "./chunk-CIZQARGJ.js";
+} from "./chunk-S2LU6HIZ.js";
 import {
   installNetworkDefaults,
   isNetworkFailure
-} from "./chunk-EB6LH3U6.js";
+} from "./chunk-3DZG5EXY.js";
 import {
   clientReportClaims
-} from "./chunk-2WWHZTI5.js";
+} from "./chunk-5ETPCIG4.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-AJRT3JGE.js";
+} from "./chunk-PJNZJPPX.js";
 import {
   ASK_AGENT_NAME_MAX,
   ASK_QUESTION_MAX,
@@ -24,7 +24,7 @@ import {
   DECISION_LINE_MAX,
   degradedLine,
   truncateLine
-} from "./chunk-NAROM5IR.js";
+} from "./chunk-AYV2NRYJ.js";
 
 // src/client-report-claim.ts
 import { createHash } from "crypto";

package/dist/{chunk-NAROM5IR.js → chunk-AYV2NRYJ.js}

@@ -1716,6 +1716,8 @@ var DESTRUCTIVE_SUBCOMMANDS = /* @__PURE__ */ new Set([
   "wipe",
   "reset"
 ]);
+var SUBCOMMAND_WORD_SEPARATOR = /[-:]/;
+var subcommandWordDestroys = (word) => word.split(SUBCOMMAND_WORD_SEPARATOR).some((part) => DESTRUCTIVE_SUBCOMMANDS.has(part));
 var DATA_LOSS_COMMAND_PATTERNS = [
   "Bash(git branch -D:*)",
   "Bash(git branch --delete:*)",
@@ -1810,7 +1812,7 @@ var normalizedCommand = (command) => {
   const segments = readableCommandSegments(command);
   return segments === null ? null : segments.map((segment) => normalizedInvocation(invocationOf(segment))).join("; ");
 };
-var subcommandDestroys = ({ program, args }) => program !== void 0 && SUBCOMMAND_CLIS.has(basenameOf(program.text)) && subcommandWordsOf(argsAfterHarmlessGlobalFlags(args)).some((word) => DESTRUCTIVE_SUBCOMMANDS.has(word.text));
+var subcommandDestroys = ({ program, args }) => program !== void 0 && SUBCOMMAND_CLIS.has(basenameOf(program.text)) && subcommandWordsOf(argsAfterHarmlessGlobalFlags(args)).some((word) => subcommandWordDestroys(word.text));
 var segmentNeedsAPerson = (toolName, segment) => {
   const invocation = invocationOf(segment);
   const normalized = normalizedInvocation(invocation);
@@ -1826,7 +1828,79 @@ var withoutSessionToolGrants = (config) => ({
   policies: config.policies.filter((policy) => !isSessionToolGrant(policy))
 });
 var SESSION_TOOL_GRANT_TOOLS = /* @__PURE__ */ new Set(["Bash"]);
-var isSessionToolGrant = (policy) => Boolean(policy.sessionId) && SESSION_TOOL_GRANT_TOOLS.has(policy.tool) && isAutoApprove(policy);
+var MCP_TOOL_PREFIX = "mcp__";
+var parseMcpToolName = (toolName) => {
+  if (!toolName.startsWith(MCP_TOOL_PREFIX)) return void 0;
+  const rest = toolName.slice(MCP_TOOL_PREFIX.length);
+  const split = rest.indexOf("__");
+  if (split <= 0 || split + 2 >= rest.length) return void 0;
+  return { server: rest.slice(0, split), tool: rest.slice(split + 2) };
+};
+var CAMEL_CASE_BOUNDARY = /([a-z0-9])([A-Z])/g;
+var MCP_TOOL_NAME_WORD_SEPARATOR = /[\s_.:-]+/;
+var wordsOfMcpToolName = (toolName) => toolName.replace(CAMEL_CASE_BOUNDARY, "$1 $2").toLowerCase().split(MCP_TOOL_NAME_WORD_SEPARATOR).filter((word) => word.length > 0);
+var MCP_TOOL_WORDS_THAT_MOVE_MONEY = /* @__PURE__ */ new Set([
+  "pay",
+  "payment",
+  "payout",
+  "refund",
+  "charge",
+  "transfer",
+  "withdraw",
+  "money",
+  "purchase",
+  "buy",
+  "wire",
+  "transaction",
+  "invoice",
+  "subscription"
+]);
+var MCP_TOOL_WORDS_THAT_RUN_CODE = /* @__PURE__ */ new Set([
+  "exec",
+  "execute",
+  "eval",
+  "run",
+  "shell",
+  "command",
+  "cmd",
+  "script",
+  "sql",
+  "repl",
+  "js",
+  "python",
+  "terminal"
+]);
+var MCP_TOOL_WORDS_THAT_REACH_OTHERS = /* @__PURE__ */ new Set([
+  "send",
+  "email",
+  "post",
+  "publish",
+  "merge",
+  "deploy",
+  "promote",
+  "release",
+  "push",
+  "force",
+  "cancel",
+  "revoke",
+  "kill",
+  "truncate",
+  "write",
+  "overwrite",
+  "move",
+  "rename",
+  "upload",
+  "invite",
+  "share"
+]);
+var mcpToolWordNeedsAPerson = (word) => DESTRUCTIVE_SUBCOMMANDS.has(word) || MCP_TOOL_WORDS_THAT_MOVE_MONEY.has(word) || MCP_TOOL_WORDS_THAT_RUN_CODE.has(word) || MCP_TOOL_WORDS_THAT_REACH_OTHERS.has(word);
+var mcpToolNameNeedsAPerson = (toolName) => {
+  const words = wordsOfMcpToolName(toolName);
+  const phrase = words.join(" ");
+  return words.some(mcpToolWordNeedsAPerson) || classifyDecisionRisk(phrase, phrase) !== "standard";
+};
+var allowsSessionToolGrant = (toolName) => SESSION_TOOL_GRANT_TOOLS.has(toolName) || parseMcpToolName(toolName) !== void 0 && !isPusharyOwnTool(toolName.toLowerCase()) && !mcpToolNameNeedsAPerson(toolName);
+var isSessionToolGrant = (policy) => Boolean(policy.sessionId) && allowsSessionToolGrant(policy.tool) && isAutoApprove(policy);
 var API_KEY_PATTERN = /^pk_[a-f0-9]+\.[a-f0-9]+$/;
 var isValidApiKey = (value) => API_KEY_PATTERN.test(value);
 var ACTION_BODY_MAX = 4e3;
@@ -2509,6 +2583,17 @@ var agentPromptsBeforeAnEdit = ({ source, event, permissionMode }) => {
   return event === "PreToolUse" && runsTheClaudeHook(source) && claudePromptsBeforeAnEdit(permissionMode);
 };
 var editGoesToTheAgentsPrompt = (call, input, verdict) => agentPromptsBeforeAnEdit(call) && editAsksAtTheAgentsPrompt(input, verdict);
+var SCOPE_BATCH_REASON = "This patch exceeds the agreed scope. Split it into single-file edits so each additional path can be approved.";
+var unapprovedScopeReason = (scopeReason) => `${scopeReason}. Nobody approved this path, so the change was refused.`;
+var codexRaisesItsOwnPrompts = (permissionMode) => permissionMode !== "bypassPermissions";
+var isScopeReason = (scopeReason) => typeof scopeReason === "string" && scopeReason.length > 0;
+var scopeBreachReasonOf = (verdict) => verdict.kind === "gate" && isScopeReason(verdict.scopeReason) ? verdict.scopeReason : void 0;
+var onlyCodexPreToolUseCanAsk = (verdict, permissionMode) => verdict.kind === "gate" && (scopeBreachReasonOf(verdict) !== void 0 || !codexRaisesItsOwnPrompts(permissionMode));
+var runsACommandThatNeedsAPerson = ({ toolName, toolInputs }) => toolName === "Bash" && toolInputs.some((toolInput) => {
+  const command = extractPolicyArg(toolName, toolInput);
+  return command !== void 0 && commandNeedsAPerson(toolName, command);
+});
+var codexCallNeedsAPerson = (input, verdict, call) => onlyCodexPreToolUseCanAsk(verdict, call.permissionMode) || verdict.kind === "gate" && (aChosenRuleGoverns(input) || call.deletesFiles || runsACommandThatNeedsAPerson(input));
 var MAX_AGENT_PERMISSION_RULES_PER_KIND = 256;
 var MAX_AGENT_PERMISSION_RULE_LENGTH = 512;
 var isAgentPermissionRule = (value) => typeof value === "string" && value.length > 0 && value.length <= MAX_AGENT_PERMISSION_RULE_LENGTH;
@@ -3105,6 +3190,7 @@ export {
   isSafeReadOnlyCommand,
   isAutoApprove,
   FILE_TARGET_TOOLS,
+  parseMcpToolName,
   isValidApiKey,
   ACTION_BODY_MAX,
   DECISION_LINE_MAX,
@@ -3131,6 +3217,11 @@ export {
   CLAUDE_PRETOOLUSE_MATCHER,
   resolveGate,
   editGoesToTheAgentsPrompt,
+  SCOPE_BATCH_REASON,
+  unapprovedScopeReason,
+  scopeBreachReasonOf,
+  onlyCodexPreToolUseCanAsk,
+  codexCallNeedsAPerson,
   claudePermissionRulesFromSettings,
   claudeConsultsItsAllowlist,
   agentRulesAllowEveryInput,

package/dist/{chunk-3U4R475X.js → chunk-BARUIIUR.js}

@@ -1,6 +1,6 @@
 import {
   pusharyFetch
-} from "./chunk-EB6LH3U6.js";
+} from "./chunk-3DZG5EXY.js";
 import {
   NetworkError
 } from "./chunk-7QLSKOSU.js";
@@ -9,11 +9,11 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   getBaseUrl
-} from "./chunk-AJRT3JGE.js";
+} from "./chunk-PJNZJPPX.js";
 import {
   isValidApiKey,
   normalizeKeyScope
-} from "./chunk-NAROM5IR.js";
+} from "./chunk-AYV2NRYJ.js";
 
 // src/session.ts
 var samePusharyAccount = (left, right) => left.kind === "ok" && right.kind === "ok" && left.identity.workspaceId !== "" && left.identity.workspaceId === right.identity.workspaceId && left.identity.siteId === right.identity.siteId;

package/dist/{chunk-QD6GQDYW.js → chunk-COGQIULO.js}

@@ -1,6 +1,6 @@
 import {
   readConfigFileKey
-} from "./chunk-NMDGIMDV.js";
+} from "./chunk-DUDI3Z7F.js";
 
 // src/bell/fleet.ts
 import { closeSync, constants, futimesSync, lstatSync, mkdirSync, openSync, readdirSync, unlinkSync } from "fs";

package/dist/{chunk-Y6IKUCVF.js → chunk-CXXYHPN7.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-2WWHZTI5.js";
+} from "./chunk-5ETPCIG4.js";
 import {
   readJsonSafe,
   writeFileAtomic
@@ -13,7 +13,7 @@ import {
   serializeDeclinedAgents,
   withDeclinedAgent,
   withoutDeclinedAgent
-} from "./chunk-NAROM5IR.js";
+} from "./chunk-AYV2NRYJ.js";
 
 // src/declined-agents-file.ts
 import { join } from "path";

package/dist/{chunk-2Q6IT5PR.js → chunk-DMJPRZVJ.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-3EGEA4KH.js";
 import {
   getBaseUrl
-} from "./chunk-AJRT3JGE.js";
+} from "./chunk-PJNZJPPX.js";
 
 // src/cli/login-ui.ts
 import { hostname } from "os";

package/dist/{chunk-NMDGIMDV.js → chunk-DUDI3Z7F.js}

@@ -1,6 +1,6 @@
 import {
   resolveInstallSourceFor
-} from "./chunk-ZSL7B7NF.js";
+} from "./chunk-VKYDON4A.js";
 import {
   backupFile,
   readJsonSafe,
@@ -9,7 +9,7 @@ import {
 } from "./chunk-T7E75EKA.js";
 import {
   configFilePath
-} from "./chunk-AJRT3JGE.js";
+} from "./chunk-PJNZJPPX.js";
 
 // src/shell-alias.ts
 import { homedir } from "os";

package/dist/{chunk-RV4U3LYL.js → chunk-EDEIIKCV.js}

@@ -5,16 +5,16 @@ import {
 import {
   NOTIFICATION_MATCHED_TYPES,
   POSTTOOLUSE_MIRRORED_TOOLS
-} from "./chunk-VYXXAFIA.js";
+} from "./chunk-52JA2WTH.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-2WWHZTI5.js";
+} from "./chunk-5ETPCIG4.js";
 import {
   CLAUDE_PRETOOLUSE_MATCHER,
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY
-} from "./chunk-NAROM5IR.js";
+} from "./chunk-AYV2NRYJ.js";
 
 // src/gemini-config.ts
 var GEMINI_HOOK_BINARY = "pushary-gemini-hook";

package/dist/{chunk-H7MTFFNI.js → chunk-EDXJEQCK.js}

@@ -1,18 +1,18 @@
 import {
   macAppBridgeAvailable
-} from "./chunk-5RONPCMH.js";
+} from "./chunk-HBDZYQZX.js";
 import {
   keyPrefix
-} from "./chunk-NMDGIMDV.js";
+} from "./chunk-DUDI3Z7F.js";
 import {
   bridgeAgentKey
-} from "./chunk-2WWHZTI5.js";
+} from "./chunk-5ETPCIG4.js";
 import {
   readJsonSafe
 } from "./chunk-T7E75EKA.js";
 import {
   isValidApiKey
-} from "./chunk-NAROM5IR.js";
+} from "./chunk-AYV2NRYJ.js";
 
 // src/shared-mcp-key.ts
 var asRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;

package/dist/{chunk-U4TMAANR.js → chunk-FO3MDD26.js}

@@ -72,11 +72,11 @@ var createIo = (stream = process.stdout, context = {}) => {
     process.stderr.write(`${yellow("!")} ${s}
 `);
   };
+  const finishedLine = (label, end) => end ? `  ${end.ok ? check() : yellow("!")} ${end.label}` : `  ${check()} ${label}`;
   const spinner = async (label, fn, options = {}) => {
     if (stream.isTTY !== true) {
       try {
-        await fn();
-        line(`  ${check()} ${label}`);
+        line(finishedLine(label, await fn()));
       } catch (err) {
         line(`  ${yellow("!")} ${label} ${dim(`(${describeError(err)})`)}`);
         if (!options.optional) throw err;
@@ -88,9 +88,9 @@ var createIo = (stream = process.stdout, context = {}) => {
       stream.write(`\r  ${dim(SPINNER_FRAMES[frame++ % SPINNER_FRAMES.length])} ${clipToRow(label, terminalColumns(stream) - SPINNER_FRAME_WIDTH)}\x1B[K`);
     }, SPINNER_INTERVAL_MS);
     try {
-      await fn();
+      const end = await fn();
       clearInterval(timer);
-      stream.write(`\r  ${check()} ${label}\x1B[K
+      stream.write(`\r${finishedLine(label, end)}\x1B[K
 `);
     } catch (err) {
       clearInterval(timer);