@pushary/agent-hooks 1.9.24 → 1.9.25

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.9.25
+
+- "Always allow Bash in this workspace" and "Always allow Bash in this repository" now still ask about a command with a real consequence. That is running downloaded code (`curl ... | sh`, or a file downloaded and then run), a production deploy or migration (`vercel --prod`, `RAILS_ENV=production bin/rails db:migrate`), a schema push or reset (`prisma db push`, `prisma migrate reset`, `supabase db push`, `drizzle-kit push`), a SQL client that writes or runs a script file (`psql -c "UPDATE ..."`, `psql -f`, `psql < file`, `sqlite3 app.db < schema.sql`), `redis-cli FLUSHALL`, a cluster deploy (`kubectl apply`, `helm upgrade`), publishing (`docker push`, `npm publish`), `gh pr merge`, `gh repo delete`, `aws s3 sync --delete`, restarting, stopping or unloading a service (`systemctl restart`, `launchctl unload`), throwing away uncommitted changes (`git checkout <file>`, `git restore`, `git branch -D`), and writing or deleting a `.env` or secrets file. These used to run without a question. They are recognised behind wrappers such as `sudo`, `env`, `timeout` and `xargs`, behind global flags such as `git -C dir`, inside `if` and `for` blocks, and with output redirected to a log file.
+- Under those rules a plain `git push`, `git push -u origin HEAD`, `git push --dry-run`, `git clean -n`, and an `rm`, `git rm` or `unlink` of a file keep running. Asking about every push and every removal under a rule that says always allow is too much. A force push, `rm -r` and `git clean -f` still ask, as before, and a force push now also asks when it is written as `git -C dir push --force`, `git push origin +main`, or a push that deletes or mirrors branches on the remote (`--delete`, `:branch`, `--mirror`, `--prune`).
+- The same applies to a bare `Bash` approve rule written on the Policies page and to rules saved before this release. Presets and "Allow Bash for this session" keep their own rules. To let one of the held commands run anyway, add a specific rule such as `Bash(docker push:*)`.
+- Claude Code's commit form, `git commit -m "$(cat <<'EOF' ... EOF)"`, is now read as a commit when every shell reads its message as plain text, including macOS `/bin/bash` 3.2. "Allow Bash for this session" asks about fewer commits, a `Bash(git commit:*)` rule now covers them, and a `&& git push` after one is seen, also by a `Bash(git push:*)` deny rule. A message with an unmatched `)`, an apostrophe, a backslash, a backtick, or a line that starts with the closing word such as `EOF`, is not read this way and asks as before.
+- Production deploys and migrations, SQL that writes, runs a script file or comes from a variable or a pipe, `mongosh --eval`, cluster deploys and schema resets (`kubectl apply`, `helm upgrade`, `prisma db push`), `pg_restore --clean`, `mongorestore --drop`, `gh pr merge`, and publishing or deploying with `docker push`, `twine upload`, `cargo publish`, `npm unpublish`, `gh release create`, `pulumi up`, `cdk deploy`, `firebase deploy`, `fly deploy` or `wrangler deploy` now also ask under "Allow Bash for this session". These checks skip a command run with `--dry-run` or `--help`, but a command that says deploy, publish or release, such as `cargo publish --dry-run` or `firebase deploy --dry-run`, still asks, as it did before this release.
+
 ## 1.9.24
 
 - Under When I'm out, a call nobody answers is refused for every agent with no approval prompt of its own (Antigravity CLI, Cursor file edits, sessions started from your phone), even when your rule approves on timeout. The 1.9.17 notes said this; only Codex did it. Under Every time a rule that approves on timeout still runs the call after its full wait.

package/dist/bin/pushary-bell-hook.js

@@ -1,41 +1,41 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-2F6UQ3YD.js";
+} from "../chunk-UK7OY3EJ.js";
 import {
   readHookInput
-} from "../chunk-T5KM7J75.js";
-import "../chunk-W5NHIA4Y.js";
+} from "../chunk-2J2WFX7X.js";
+import "../chunk-7UZD2F4Y.js";
 import "../chunk-VTR4VRL2.js";
-import "../chunk-HBR6ZZHN.js";
-import "../chunk-RIBIEQHU.js";
-import "../chunk-3WRJU7KN.js";
-import "../chunk-JDWOK6PE.js";
+import "../chunk-PAMW5M53.js";
+import "../chunk-FCXYDR62.js";
+import "../chunk-FLC4TVXH.js";
+import "../chunk-YD3DIFIU.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-LOERK6N3.js";
-import "../chunk-OSOCONIE.js";
-import "../chunk-VFIZFKZY.js";
-import "../chunk-NJK4MGXL.js";
-import "../chunk-VICG46JC.js";
+import "../chunk-5WTEKIAS.js";
+import "../chunk-ZLY7BHN4.js";
+import "../chunk-KM7AEGKF.js";
+import "../chunk-4KZP4YMV.js";
+import "../chunk-ZNT4ZZXJ.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-U23XTMBF.js";
-import "../chunk-KT5BH6GC.js";
-import "../chunk-RFK2WN6S.js";
-import "../chunk-ZVON5PCF.js";
+import "../chunk-GC5HJE3T.js";
+import "../chunk-AXB4ABUD.js";
+import "../chunk-A3QQWXIE.js";
+import "../chunk-NFH2H7PD.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-RK7TDMQT.js";
-import "../chunk-H2RD5EMR.js";
-import "../chunk-2E6AWHV7.js";
-import "../chunk-IS737HST.js";
+import "../chunk-7V6PJFDF.js";
+import "../chunk-VEGS4NYF.js";
+import "../chunk-ZV3262AA.js";
+import "../chunk-ZLGCNHJG.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-GXQVOKHJ.js";
-import "../chunk-NQICO3ES.js";
+import "../chunk-EJMXZH5E.js";
+import "../chunk-2VQZC6DW.js";
 import "../chunk-AQFEP65J.js";
-import "../chunk-OY6NJWDD.js";
-import "../chunk-QDKNLNCA.js";
-import "../chunk-GM2IFDVF.js";
+import "../chunk-5Q2QJ2AL.js";
+import "../chunk-OOKIWOMK.js";
+import "../chunk-KGSN2SOL.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,39 +5,39 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-2F6UQ3YD.js";
+} from "../chunk-UK7OY3EJ.js";
 import {
   createIo
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-264EOGIK.js";
+} from "../chunk-KP4BIZLP.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-VICG46JC.js";
+} from "../chunk-ZNT4ZZXJ.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-U23XTMBF.js";
+import "../chunk-GC5HJE3T.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-GXQVOKHJ.js";
+import "../chunk-EJMXZH5E.js";
 import {
   claudeSettings
-} from "../chunk-NQICO3ES.js";
+} from "../chunk-2VQZC6DW.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-AQFEP65J.js";
-import "../chunk-OY6NJWDD.js";
-import "../chunk-QDKNLNCA.js";
+import "../chunk-5Q2QJ2AL.js";
+import "../chunk-OOKIWOMK.js";
 import {
   isRecord
-} from "../chunk-GM2IFDVF.js";
+} from "../chunk-KGSN2SOL.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,39 +8,39 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-35U2QHH2.js";
+} from "../chunk-HEJMZVJI.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-E4B7TXVS.js";
+} from "../chunk-SGGR5MN2.js";
 import {
   claudeTranscriptPath,
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-W5NHIA4Y.js";
+} from "../chunk-7UZD2F4Y.js";
 import "../chunk-VTR4VRL2.js";
 import {
   ensureDaemonRunning
-} from "../chunk-HBR6ZZHN.js";
+} from "../chunk-PAMW5M53.js";
 import {
   encryptRecord
-} from "../chunk-RIBIEQHU.js";
-import "../chunk-3WRJU7KN.js";
+} from "../chunk-FCXYDR62.js";
+import "../chunk-FLC4TVXH.js";
 import {
   transcriptsEnabled
-} from "../chunk-JDWOK6PE.js";
+} from "../chunk-YD3DIFIU.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
-import "../chunk-OSOCONIE.js";
-import "../chunk-VFIZFKZY.js";
-import "../chunk-NJK4MGXL.js";
-import "../chunk-VICG46JC.js";
+import "../chunk-ZLY7BHN4.js";
+import "../chunk-KM7AEGKF.js";
+import "../chunk-4KZP4YMV.js";
+import "../chunk-ZNT4ZZXJ.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-U23XTMBF.js";
+import "../chunk-GC5HJE3T.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -58,8 +58,8 @@ import {
   reportEvent,
   savePendingCommand,
   scopePathFor
-} from "../chunk-KT5BH6GC.js";
-import "../chunk-RFK2WN6S.js";
+} from "../chunk-AXB4ABUD.js";
+import "../chunk-A3QQWXIE.js";
 import {
   askUser,
   cancelQuestion,
@@ -69,28 +69,28 @@ import {
   waitForAnswer,
   waitsForThePhone,
   withdrawQuestion
-} from "../chunk-ZVON5PCF.js";
+} from "../chunk-NFH2H7PD.js";
 import "../chunk-POFBE6ZY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-RK7TDMQT.js";
-import "../chunk-H2RD5EMR.js";
-import "../chunk-2E6AWHV7.js";
+} from "../chunk-7V6PJFDF.js";
+import "../chunk-VEGS4NYF.js";
+import "../chunk-ZV3262AA.js";
 import {
   getMachineId
-} from "../chunk-IS737HST.js";
+} from "../chunk-ZLGCNHJG.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-GXQVOKHJ.js";
-import "../chunk-NQICO3ES.js";
+import "../chunk-EJMXZH5E.js";
+import "../chunk-2VQZC6DW.js";
 import "../chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-OY6NJWDD.js";
+} from "../chunk-5Q2QJ2AL.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-QDKNLNCA.js";
+} from "../chunk-OOKIWOMK.js";
 import {
   DECISION_STOP_REASON,
   KILL_REASON,
@@ -98,7 +98,7 @@ import {
   redactSecretsFromContent,
   resolveGate,
   timeoutActionWithoutLocalPrompt
-} from "../chunk-GM2IFDVF.js";
+} from "../chunk-KGSN2SOL.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {

package/dist/bin/pushary-clean.js

@@ -9,12 +9,12 @@ import {
   planCliKeyRevocations,
   readCliHeldKeys,
   revokeCliKeys
-} from "../chunk-L5MCJNSI.js";
+} from "../chunk-UJB6HHP4.js";
 import {
   isCursorPluginLeftover,
   releaseSoleGate,
   withoutPusharyCursorHooks
-} from "../chunk-HLXGEOX3.js";
+} from "../chunk-Q37XFSPO.js";
 import {
   HERMES_PIP_PACKAGE,
   readHermesStatus,
@@ -23,25 +23,25 @@ import {
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-SH2KK2ED.js";
+} from "../chunk-LDNKGG5G.js";
 import {
   planFxRemoval,
   removeInstructionBlock
-} from "../chunk-XA2RGGNR.js";
-import "../chunk-Q7IEFI7V.js";
+} from "../chunk-KZLOVLA6.js";
+import "../chunk-EJJNZYDS.js";
 import {
   disableDaemonService
-} from "../chunk-HBR6ZZHN.js";
+} from "../chunk-PAMW5M53.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-EE357RIP.js";
+import "../chunk-RSENVGBQ.js";
 import {
   macAppKeepsMcpEntry,
   mcpServerBearer,
   pusharyKey,
   readMacAppAgentKey,
   setupReceiptKey
-} from "../chunk-2JTJZ7VI.js";
-import "../chunk-CYGIJXAP.js";
+} from "../chunk-WEKXYS2F.js";
+import "../chunk-WKEP4JAW.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -53,14 +53,14 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-O3RRQTTV.js";
+} from "../chunk-FJKV64M7.js";
 import {
   ansiPainter,
   useColor
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-264EOGIK.js";
+} from "../chunk-KP4BIZLP.js";
 import {
   compatibleConfigFile,
   compatibleInstructionsFile,
@@ -73,7 +73,7 @@ import {
   removePusharySettings,
   removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-LOERK6N3.js";
+} from "../chunk-5WTEKIAS.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
@@ -81,12 +81,12 @@ import {
   resolveBridgeStub,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-OSOCONIE.js";
+} from "../chunk-ZLY7BHN4.js";
 import {
   removeGeminiSettings
-} from "../chunk-VFIZFKZY.js";
-import "../chunk-NJK4MGXL.js";
-import "../chunk-VICG46JC.js";
+} from "../chunk-KM7AEGKF.js";
+import "../chunk-4KZP4YMV.js";
+import "../chunk-ZNT4ZZXJ.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
@@ -96,20 +96,20 @@ import {
   isDisabledExport,
   removeClaudeAlias,
   shellProfileCandidates
-} from "../chunk-U23XTMBF.js";
-import "../chunk-KT5BH6GC.js";
-import "../chunk-RFK2WN6S.js";
-import "../chunk-ZVON5PCF.js";
+} from "../chunk-GC5HJE3T.js";
+import "../chunk-AXB4ABUD.js";
+import "../chunk-A3QQWXIE.js";
+import "../chunk-NFH2H7PD.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-RK7TDMQT.js";
-import "../chunk-H2RD5EMR.js";
-import "../chunk-2E6AWHV7.js";
-import "../chunk-IS737HST.js";
+import "../chunk-7V6PJFDF.js";
+import "../chunk-VEGS4NYF.js";
+import "../chunk-ZV3262AA.js";
+import "../chunk-ZLGCNHJG.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-GXQVOKHJ.js";
+import "../chunk-EJMXZH5E.js";
 import {
   claudeJson,
   claudeMcpReceipt,
@@ -146,14 +146,14 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-NQICO3ES.js";
+} from "../chunk-2VQZC6DW.js";
 import "../chunk-AQFEP65J.js";
 import {
   getBaseUrl
-} from "../chunk-OY6NJWDD.js";
+} from "../chunk-5Q2QJ2AL.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-QDKNLNCA.js";
+} from "../chunk-OOKIWOMK.js";
 import {
   CLI_PACKAGE_NAMES,
   HOOK_COMPATIBLE_PROFILES,
@@ -165,7 +165,7 @@ import {
   globalRootFor,
   isValidApiKey,
   redactSecrets
-} from "../chunk-GM2IFDVF.js";
+} from "../chunk-KGSN2SOL.js";
 
 // bin/pushary-clean.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync4 } from "fs";

package/dist/bin/pushary-codex-bridge.js

@@ -5,10 +5,10 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-T6TJA4RF.js";
+} from "../chunk-5ETE7F45.js";
 import {
   resolveProviderBinary
-} from "../chunk-KX776UXN.js";
+} from "../chunk-OWOSNGEQ.js";
 import "../chunk-RIVNNBEK.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
@@ -16,50 +16,50 @@ import {
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-35U2QHH2.js";
-import "../chunk-RIBIEQHU.js";
-import "../chunk-3WRJU7KN.js";
+} from "../chunk-HEJMZVJI.js";
+import "../chunk-FCXYDR62.js";
+import "../chunk-FLC4TVXH.js";
 import {
   transcriptsEnabled
-} from "../chunk-JDWOK6PE.js";
+} from "../chunk-YD3DIFIU.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-U23XTMBF.js";
+import "../chunk-GC5HJE3T.js";
 import {
   isAskUserResponse,
   isDecisionStopped,
   isWaitForAnswerResponse,
   withdrawQuestion,
   writeDegraded
-} from "../chunk-ZVON5PCF.js";
+} from "../chunk-NFH2H7PD.js";
 import "../chunk-POFBE6ZY.js";
 import {
   callMcpTool
-} from "../chunk-RK7TDMQT.js";
-import "../chunk-H2RD5EMR.js";
-import "../chunk-2E6AWHV7.js";
+} from "../chunk-7V6PJFDF.js";
+import "../chunk-VEGS4NYF.js";
+import "../chunk-ZV3262AA.js";
 import {
   getMachineId
-} from "../chunk-IS737HST.js";
+} from "../chunk-ZLGCNHJG.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-GXQVOKHJ.js";
-import "../chunk-NQICO3ES.js";
+import "../chunk-EJMXZH5E.js";
+import "../chunk-2VQZC6DW.js";
 import "../chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-OY6NJWDD.js";
-import "../chunk-QDKNLNCA.js";
+} from "../chunk-5Q2QJ2AL.js";
+import "../chunk-OOKIWOMK.js";
 import {
   elicitationContent,
   parseAgentQuestion,
   parseAgentQuestionAnswers,
   planElicitationAsk,
   readElicitationFields
-} from "../chunk-GM2IFDVF.js";
+} from "../chunk-KGSN2SOL.js";
 
 // bin/pushary-codex-bridge.ts
 import { existsSync } from "fs";

package/dist/bin/pushary-codex-hook.js

@@ -1,40 +1,40 @@
 #!/usr/bin/env node
 import {
   takeHookHoldBudget
-} from "../chunk-Z5L4NQHC.js";
+} from "../chunk-PM2WJSUH.js";
 import {
   defersToNativeMode,
   reportMachineDenial
-} from "../chunk-CLVU24OZ.js";
+} from "../chunk-BHRMHDOO.js";
 import {
   triggerAutoUpdate
-} from "../chunk-XQROISQB.js";
+} from "../chunk-VFF7ZBIS.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-GBD6G4TA.js";
+} from "../chunk-2CUE3XXS.js";
 import {
   readHookInput
-} from "../chunk-T5KM7J75.js";
+} from "../chunk-2J2WFX7X.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-E4B7TXVS.js";
-import "../chunk-W5NHIA4Y.js";
+} from "../chunk-SGGR5MN2.js";
+import "../chunk-7UZD2F4Y.js";
 import "../chunk-VTR4VRL2.js";
-import "../chunk-HBR6ZZHN.js";
-import "../chunk-RIBIEQHU.js";
-import "../chunk-3WRJU7KN.js";
-import "../chunk-JDWOK6PE.js";
+import "../chunk-PAMW5M53.js";
+import "../chunk-FCXYDR62.js";
+import "../chunk-FLC4TVXH.js";
+import "../chunk-YD3DIFIU.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-LOERK6N3.js";
-import "../chunk-OSOCONIE.js";
-import "../chunk-VFIZFKZY.js";
-import "../chunk-NJK4MGXL.js";
-import "../chunk-VICG46JC.js";
+import "../chunk-5WTEKIAS.js";
+import "../chunk-ZLY7BHN4.js";
+import "../chunk-KM7AEGKF.js";
+import "../chunk-4KZP4YMV.js";
+import "../chunk-ZNT4ZZXJ.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-U23XTMBF.js";
+import "../chunk-GC5HJE3T.js";
 import {
   CODEX_AGENT,
   DEFAULT_SESSION,
@@ -78,8 +78,8 @@ import {
   toPolicyLookup,
   toPolicyLookups,
   userScope
-} from "../chunk-KT5BH6GC.js";
-import "../chunk-RFK2WN6S.js";
+} from "../chunk-AXB4ABUD.js";
+import "../chunk-A3QQWXIE.js";
 import {
   askUser,
   cancelQuestion,
@@ -92,31 +92,31 @@ import {
   sendNotification,
   unavailableQuestionUnlessSubscriptionRequired,
   waitForQuestion
-} from "../chunk-ZVON5PCF.js";
+} from "../chunk-NFH2H7PD.js";
 import "../chunk-POFBE6ZY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-RK7TDMQT.js";
-import "../chunk-H2RD5EMR.js";
-import "../chunk-2E6AWHV7.js";
+} from "../chunk-7V6PJFDF.js";
+import "../chunk-VEGS4NYF.js";
+import "../chunk-ZV3262AA.js";
 import {
   getMachineId
-} from "../chunk-IS737HST.js";
+} from "../chunk-ZLGCNHJG.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-GXQVOKHJ.js";
+import "../chunk-EJMXZH5E.js";
 import {
   canonicalJson
-} from "../chunk-NQICO3ES.js";
+} from "../chunk-2VQZC6DW.js";
 import {
   writeFileAtomic
 } from "../chunk-AQFEP65J.js";
 import {
   getApiKey
-} from "../chunk-OY6NJWDD.js";
-import "../chunk-QDKNLNCA.js";
+} from "../chunk-5Q2QJ2AL.js";
+import "../chunk-OOKIWOMK.js";
 import {
   CODEX_RESCUE_TOOL_NAME,
   DECISION_STOP_REASON,
@@ -140,7 +140,7 @@ import {
   resolveGate,
   scopeBreachReasonOf,
   unapprovedScopeReason
-} from "../chunk-GM2IFDVF.js";
+} from "../chunk-KGSN2SOL.js";
 
 // bin/pushary-codex-hook.ts
 import { basename } from "path";
@@ -769,7 +769,7 @@ var decidePreToolUse = async (input) => {
 };
 var repairCodexHoldsQuietly = async () => {
   try {
-    const { repairCodexHolds } = await import("../reapply-7TDCFXNF.js");
+    const { repairCodexHolds } = await import("../reapply-LFEQ5GF6.js");
     repairCodexHolds();
   } catch {
     return;

package/dist/bin/pushary-codex.js

@@ -1,32 +1,32 @@
 #!/usr/bin/env node
 import {
   reportEvent
-} from "../chunk-KT5BH6GC.js";
-import "../chunk-RFK2WN6S.js";
+} from "../chunk-AXB4ABUD.js";
+import "../chunk-A3QQWXIE.js";
 import {
   askUser,
   isDecisionStopped,
   waitForAnswer
-} from "../chunk-ZVON5PCF.js";
+} from "../chunk-NFH2H7PD.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-RK7TDMQT.js";
-import "../chunk-H2RD5EMR.js";
-import "../chunk-2E6AWHV7.js";
+import "../chunk-7V6PJFDF.js";
+import "../chunk-VEGS4NYF.js";
+import "../chunk-ZV3262AA.js";
 import {
   getMachineId
-} from "../chunk-IS737HST.js";
+} from "../chunk-ZLGCNHJG.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-GXQVOKHJ.js";
-import "../chunk-NQICO3ES.js";
+import "../chunk-EJMXZH5E.js";
+import "../chunk-2VQZC6DW.js";
 import "../chunk-AQFEP65J.js";
 import {
   getApiKey
-} from "../chunk-OY6NJWDD.js";
+} from "../chunk-5Q2QJ2AL.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-QDKNLNCA.js";
-import "../chunk-GM2IFDVF.js";
+} from "../chunk-OOKIWOMK.js";
+import "../chunk-KGSN2SOL.js";
 
 // bin/pushary-codex.ts
 import { basename } from "path";