@pushary/agent-hooks 1.9.24 → 1.9.26

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 1.9.26
+
+- `arch` is no longer approved as a read. On a Mac, `arch -arm64 <command>` runs the command after it, so `arch -arm64 git push --force` was approved without asking, even under a `Bash(git push:*)` deny rule. A command behind `arch` is now judged like the same command without it. Use `uname -m` to read the architecture; it is still approved as a read.
+- Codex in any mode except full access now asks your phone before a command that changes something through GitHub, Stripe, AWS or Twilio, such as `gh pr comment`, `gh api -X DELETE`, `gh api ... -f field=value`, a GraphQL mutation, `stripe refunds create`, `aws lambda invoke`, `aws ses send-email`, an upload with `aws s3 cp` or `aws s3 sync`, or `twilio api:core:messages:create`. Since 1.9.15 these ran without a question whenever Codex did not raise one of its own, which is the case when its sandbox allows network access. Reads such as `gh pr view`, `gh api repos/...`, `stripe charges list`, `aws s3 ls` and `aws ec2 describe-instances` still run without asking.
+- In the same modes Codex now also asks before a patch to a `.env` file, a credentials file or a GitHub Actions workflow. Codex applies an edit inside the project without asking, so these used to change with nothing shown. `.env.example` and other files under `.github` are not affected.
+
+## 1.9.25
+
+- "Always allow Bash in this workspace" and "Always allow Bash in this repository" now still ask about a command with a real consequence. That is running downloaded code (`curl ... | sh`, or a file downloaded and then run), a production deploy or migration (`vercel --prod`, `RAILS_ENV=production bin/rails db:migrate`), a schema push or reset (`prisma db push`, `prisma migrate reset`, `supabase db push`, `drizzle-kit push`), a SQL client that writes or runs a script file (`psql -c "UPDATE ..."`, `psql -f`, `psql < file`, `sqlite3 app.db < schema.sql`), `redis-cli FLUSHALL`, a cluster deploy (`kubectl apply`, `helm upgrade`), publishing (`docker push`, `npm publish`), `gh pr merge`, `gh repo delete`, `aws s3 sync --delete`, restarting, stopping or unloading a service (`systemctl restart`, `launchctl unload`), throwing away uncommitted changes (`git checkout <file>`, `git restore`, `git branch -D`), and writing or deleting a `.env` or secrets file. These used to run without a question. They are recognised behind wrappers such as `sudo`, `env`, `timeout` and `xargs`, behind global flags such as `git -C dir`, inside `if` and `for` blocks, and with output redirected to a log file.
+- Under those rules a plain `git push`, `git push -u origin HEAD`, `git push --dry-run`, `git clean -n`, and an `rm`, `git rm` or `unlink` of a file keep running. Asking about every push and every removal under a rule that says always allow is too much. A force push, `rm -r` and `git clean -f` still ask, as before, and a force push now also asks when it is written as `git -C dir push --force`, `git push origin +main`, or a push that deletes or mirrors branches on the remote (`--delete`, `:branch`, `--mirror`, `--prune`).
+- The same applies to a bare `Bash` approve rule written on the Policies page and to rules saved before this release. Presets and "Allow Bash for this session" keep their own rules. To let one of the held commands run anyway, add a specific rule such as `Bash(docker push:*)`.
+- Claude Code's commit form, `git commit -m "$(cat <<'EOF' ... EOF)"`, is now read as a commit when every shell reads its message as plain text, including macOS `/bin/bash` 3.2. "Allow Bash for this session" asks about fewer commits, a `Bash(git commit:*)` rule now covers them, and a `&& git push` after one is seen, also by a `Bash(git push:*)` deny rule. A message with an unmatched `)`, an apostrophe, a backslash, a backtick, or a line that starts with the closing word such as `EOF`, is not read this way and asks as before.
+- Production deploys and migrations, SQL that writes, runs a script file or comes from a variable or a pipe, `mongosh --eval`, cluster deploys and schema resets (`kubectl apply`, `helm upgrade`, `prisma db push`), `pg_restore --clean`, `mongorestore --drop`, `gh pr merge`, and publishing or deploying with `docker push`, `twine upload`, `cargo publish`, `npm unpublish`, `gh release create`, `pulumi up`, `cdk deploy`, `firebase deploy`, `fly deploy` or `wrangler deploy` now also ask under "Allow Bash for this session". These checks skip a command run with `--dry-run` or `--help`, but a command that says deploy, publish or release, such as `cargo publish --dry-run` or `firebase deploy --dry-run`, still asks, as it did before this release.
+
 ## 1.9.24
 
 - Under When I'm out, a call nobody answers is refused for every agent with no approval prompt of its own (Antigravity CLI, Cursor file edits, sessions started from your phone), even when your rule approves on timeout. The 1.9.17 notes said this; only Codex did it. Under Every time a rule that approves on timeout still runs the call after its full wait.

package/dist/bin/pushary-bell-hook.js

@@ -1,41 +1,41 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-2F6UQ3YD.js";
+} from "../chunk-KTRRDTZN.js";
 import {
   readHookInput
-} from "../chunk-T5KM7J75.js";
-import "../chunk-W5NHIA4Y.js";
+} from "../chunk-SCFKXAHX.js";
+import "../chunk-5FL4M4YF.js";
 import "../chunk-VTR4VRL2.js";
-import "../chunk-HBR6ZZHN.js";
-import "../chunk-RIBIEQHU.js";
-import "../chunk-3WRJU7KN.js";
-import "../chunk-JDWOK6PE.js";
+import "../chunk-P7WJ2KKO.js";
+import "../chunk-NCAVDVXP.js";
+import "../chunk-4GKLAQY4.js";
+import "../chunk-OGTWSEWN.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-LOERK6N3.js";
-import "../chunk-OSOCONIE.js";
-import "../chunk-VFIZFKZY.js";
-import "../chunk-NJK4MGXL.js";
-import "../chunk-VICG46JC.js";
+import "../chunk-AXOMDPA7.js";
+import "../chunk-L62RNE5F.js";
+import "../chunk-2YF72RC5.js";
+import "../chunk-Y5O4TO7U.js";
+import "../chunk-ZPLDPPZO.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-U23XTMBF.js";
-import "../chunk-KT5BH6GC.js";
-import "../chunk-RFK2WN6S.js";
-import "../chunk-ZVON5PCF.js";
+import "../chunk-3HBLQXCJ.js";
+import "../chunk-BIV2LKDK.js";
+import "../chunk-XUVKAWV3.js";
+import "../chunk-DDRSG6JL.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-RK7TDMQT.js";
-import "../chunk-H2RD5EMR.js";
-import "../chunk-2E6AWHV7.js";
-import "../chunk-IS737HST.js";
+import "../chunk-AG5ATWVT.js";
+import "../chunk-GRL4VVUP.js";
+import "../chunk-CXG7XA4E.js";
+import "../chunk-4YWINUPJ.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-GXQVOKHJ.js";
-import "../chunk-NQICO3ES.js";
+import "../chunk-KJ2W7ECE.js";
+import "../chunk-3TRGUDQ3.js";
 import "../chunk-AQFEP65J.js";
-import "../chunk-OY6NJWDD.js";
-import "../chunk-QDKNLNCA.js";
-import "../chunk-GM2IFDVF.js";
+import "../chunk-5UKZXDHV.js";
+import "../chunk-47RVFUEG.js";
+import "../chunk-TVP5UU33.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,39 +5,39 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-2F6UQ3YD.js";
+} from "../chunk-KTRRDTZN.js";
 import {
   createIo
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-264EOGIK.js";
+} from "../chunk-RQPJEYLM.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-VICG46JC.js";
+} from "../chunk-ZPLDPPZO.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-U23XTMBF.js";
+import "../chunk-3HBLQXCJ.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-GXQVOKHJ.js";
+import "../chunk-KJ2W7ECE.js";
 import {
   claudeSettings
-} from "../chunk-NQICO3ES.js";
+} from "../chunk-3TRGUDQ3.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-AQFEP65J.js";
-import "../chunk-OY6NJWDD.js";
-import "../chunk-QDKNLNCA.js";
+import "../chunk-5UKZXDHV.js";
+import "../chunk-47RVFUEG.js";
 import {
   isRecord
-} from "../chunk-GM2IFDVF.js";
+} from "../chunk-TVP5UU33.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,39 +8,39 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-35U2QHH2.js";
+} from "../chunk-K4OV2VLB.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-E4B7TXVS.js";
+} from "../chunk-ZXYHVZZZ.js";
 import {
   claudeTranscriptPath,
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-W5NHIA4Y.js";
+} from "../chunk-5FL4M4YF.js";
 import "../chunk-VTR4VRL2.js";
 import {
   ensureDaemonRunning
-} from "../chunk-HBR6ZZHN.js";
+} from "../chunk-P7WJ2KKO.js";
 import {
   encryptRecord
-} from "../chunk-RIBIEQHU.js";
-import "../chunk-3WRJU7KN.js";
+} from "../chunk-NCAVDVXP.js";
+import "../chunk-4GKLAQY4.js";
 import {
   transcriptsEnabled
-} from "../chunk-JDWOK6PE.js";
+} from "../chunk-OGTWSEWN.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
-import "../chunk-OSOCONIE.js";
-import "../chunk-VFIZFKZY.js";
-import "../chunk-NJK4MGXL.js";
-import "../chunk-VICG46JC.js";
+import "../chunk-L62RNE5F.js";
+import "../chunk-2YF72RC5.js";
+import "../chunk-Y5O4TO7U.js";
+import "../chunk-ZPLDPPZO.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-U23XTMBF.js";
+import "../chunk-3HBLQXCJ.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -58,8 +58,8 @@ import {
   reportEvent,
   savePendingCommand,
   scopePathFor
-} from "../chunk-KT5BH6GC.js";
-import "../chunk-RFK2WN6S.js";
+} from "../chunk-BIV2LKDK.js";
+import "../chunk-XUVKAWV3.js";
 import {
   askUser,
   cancelQuestion,
@@ -69,28 +69,28 @@ import {
   waitForAnswer,
   waitsForThePhone,
   withdrawQuestion
-} from "../chunk-ZVON5PCF.js";
+} from "../chunk-DDRSG6JL.js";
 import "../chunk-POFBE6ZY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-RK7TDMQT.js";
-import "../chunk-H2RD5EMR.js";
-import "../chunk-2E6AWHV7.js";
+} from "../chunk-AG5ATWVT.js";
+import "../chunk-GRL4VVUP.js";
+import "../chunk-CXG7XA4E.js";
 import {
   getMachineId
-} from "../chunk-IS737HST.js";
+} from "../chunk-4YWINUPJ.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-GXQVOKHJ.js";
-import "../chunk-NQICO3ES.js";
+import "../chunk-KJ2W7ECE.js";
+import "../chunk-3TRGUDQ3.js";
 import "../chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-OY6NJWDD.js";
+} from "../chunk-5UKZXDHV.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-QDKNLNCA.js";
+} from "../chunk-47RVFUEG.js";
 import {
   DECISION_STOP_REASON,
   KILL_REASON,
@@ -98,7 +98,7 @@ import {
   redactSecretsFromContent,
   resolveGate,
   timeoutActionWithoutLocalPrompt
-} from "../chunk-GM2IFDVF.js";
+} from "../chunk-TVP5UU33.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {

package/dist/bin/pushary-clean.js

@@ -9,12 +9,12 @@ import {
   planCliKeyRevocations,
   readCliHeldKeys,
   revokeCliKeys
-} from "../chunk-L5MCJNSI.js";
+} from "../chunk-GPDABKLD.js";
 import {
   isCursorPluginLeftover,
   releaseSoleGate,
   withoutPusharyCursorHooks
-} from "../chunk-HLXGEOX3.js";
+} from "../chunk-PPOQG2U6.js";
 import {
   HERMES_PIP_PACKAGE,
   readHermesStatus,
@@ -23,25 +23,25 @@ import {
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-SH2KK2ED.js";
+} from "../chunk-CA2EOOZG.js";
 import {
   planFxRemoval,
   removeInstructionBlock
-} from "../chunk-XA2RGGNR.js";
-import "../chunk-Q7IEFI7V.js";
+} from "../chunk-XDTGYZIT.js";
+import "../chunk-BIKHLGEL.js";
 import {
   disableDaemonService
-} from "../chunk-HBR6ZZHN.js";
+} from "../chunk-P7WJ2KKO.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-EE357RIP.js";
+import "../chunk-IU5PAJDG.js";
 import {
   macAppKeepsMcpEntry,
   mcpServerBearer,
   pusharyKey,
   readMacAppAgentKey,
   setupReceiptKey
-} from "../chunk-2JTJZ7VI.js";
-import "../chunk-CYGIJXAP.js";
+} from "../chunk-JXHJYLFF.js";
+import "../chunk-3G4R2FLX.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -53,14 +53,14 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-O3RRQTTV.js";
+} from "../chunk-TEQJNXJH.js";
 import {
   ansiPainter,
   useColor
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-264EOGIK.js";
+} from "../chunk-RQPJEYLM.js";
 import {
   compatibleConfigFile,
   compatibleInstructionsFile,
@@ -73,7 +73,7 @@ import {
   removePusharySettings,
   removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-LOERK6N3.js";
+} from "../chunk-AXOMDPA7.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
@@ -81,12 +81,12 @@ import {
   resolveBridgeStub,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-OSOCONIE.js";
+} from "../chunk-L62RNE5F.js";
 import {
   removeGeminiSettings
-} from "../chunk-VFIZFKZY.js";
-import "../chunk-NJK4MGXL.js";
-import "../chunk-VICG46JC.js";
+} from "../chunk-2YF72RC5.js";
+import "../chunk-Y5O4TO7U.js";
+import "../chunk-ZPLDPPZO.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
@@ -96,20 +96,20 @@ import {
   isDisabledExport,
   removeClaudeAlias,
   shellProfileCandidates
-} from "../chunk-U23XTMBF.js";
-import "../chunk-KT5BH6GC.js";
-import "../chunk-RFK2WN6S.js";
-import "../chunk-ZVON5PCF.js";
+} from "../chunk-3HBLQXCJ.js";
+import "../chunk-BIV2LKDK.js";
+import "../chunk-XUVKAWV3.js";
+import "../chunk-DDRSG6JL.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-RK7TDMQT.js";
-import "../chunk-H2RD5EMR.js";
-import "../chunk-2E6AWHV7.js";
-import "../chunk-IS737HST.js";
+import "../chunk-AG5ATWVT.js";
+import "../chunk-GRL4VVUP.js";
+import "../chunk-CXG7XA4E.js";
+import "../chunk-4YWINUPJ.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-GXQVOKHJ.js";
+import "../chunk-KJ2W7ECE.js";
 import {
   claudeJson,
   claudeMcpReceipt,
@@ -146,14 +146,14 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-NQICO3ES.js";
+} from "../chunk-3TRGUDQ3.js";
 import "../chunk-AQFEP65J.js";
 import {
   getBaseUrl
-} from "../chunk-OY6NJWDD.js";
+} from "../chunk-5UKZXDHV.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-QDKNLNCA.js";
+} from "../chunk-47RVFUEG.js";
 import {
   CLI_PACKAGE_NAMES,
   HOOK_COMPATIBLE_PROFILES,
@@ -165,7 +165,7 @@ import {
   globalRootFor,
   isValidApiKey,
   redactSecrets
-} from "../chunk-GM2IFDVF.js";
+} from "../chunk-TVP5UU33.js";
 
 // bin/pushary-clean.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync4 } from "fs";

package/dist/bin/pushary-codex-bridge.js

@@ -5,10 +5,10 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-T6TJA4RF.js";
+} from "../chunk-FDT7KSQY.js";
 import {
   resolveProviderBinary
-} from "../chunk-KX776UXN.js";
+} from "../chunk-F2HVTVQG.js";
 import "../chunk-RIVNNBEK.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
@@ -16,50 +16,50 @@ import {
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-35U2QHH2.js";
-import "../chunk-RIBIEQHU.js";
-import "../chunk-3WRJU7KN.js";
+} from "../chunk-K4OV2VLB.js";
+import "../chunk-NCAVDVXP.js";
+import "../chunk-4GKLAQY4.js";
 import {
   transcriptsEnabled
-} from "../chunk-JDWOK6PE.js";
+} from "../chunk-OGTWSEWN.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-U23XTMBF.js";
+import "../chunk-3HBLQXCJ.js";
 import {
   isAskUserResponse,
   isDecisionStopped,
   isWaitForAnswerResponse,
   withdrawQuestion,
   writeDegraded
-} from "../chunk-ZVON5PCF.js";
+} from "../chunk-DDRSG6JL.js";
 import "../chunk-POFBE6ZY.js";
 import {
   callMcpTool
-} from "../chunk-RK7TDMQT.js";
-import "../chunk-H2RD5EMR.js";
-import "../chunk-2E6AWHV7.js";
+} from "../chunk-AG5ATWVT.js";
+import "../chunk-GRL4VVUP.js";
+import "../chunk-CXG7XA4E.js";
 import {
   getMachineId
-} from "../chunk-IS737HST.js";
+} from "../chunk-4YWINUPJ.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-GXQVOKHJ.js";
-import "../chunk-NQICO3ES.js";
+import "../chunk-KJ2W7ECE.js";
+import "../chunk-3TRGUDQ3.js";
 import "../chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-OY6NJWDD.js";
-import "../chunk-QDKNLNCA.js";
+} from "../chunk-5UKZXDHV.js";
+import "../chunk-47RVFUEG.js";
 import {
   elicitationContent,
   parseAgentQuestion,
   parseAgentQuestionAnswers,
   planElicitationAsk,
   readElicitationFields
-} from "../chunk-GM2IFDVF.js";
+} from "../chunk-TVP5UU33.js";
 
 // bin/pushary-codex-bridge.ts
 import { existsSync } from "fs";

package/dist/bin/pushary-codex-hook.js

@@ -1,40 +1,40 @@
 #!/usr/bin/env node
 import {
   takeHookHoldBudget
-} from "../chunk-Z5L4NQHC.js";
+} from "../chunk-PUJQFTKF.js";
 import {
   defersToNativeMode,
   reportMachineDenial
-} from "../chunk-CLVU24OZ.js";
+} from "../chunk-FA3YPD4P.js";
 import {
   triggerAutoUpdate
-} from "../chunk-XQROISQB.js";
+} from "../chunk-TS3CRCI7.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-GBD6G4TA.js";
+} from "../chunk-3DLVLVEM.js";
 import {
   readHookInput
-} from "../chunk-T5KM7J75.js";
+} from "../chunk-SCFKXAHX.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-E4B7TXVS.js";
-import "../chunk-W5NHIA4Y.js";
+} from "../chunk-ZXYHVZZZ.js";
+import "../chunk-5FL4M4YF.js";
 import "../chunk-VTR4VRL2.js";
-import "../chunk-HBR6ZZHN.js";
-import "../chunk-RIBIEQHU.js";
-import "../chunk-3WRJU7KN.js";
-import "../chunk-JDWOK6PE.js";
+import "../chunk-P7WJ2KKO.js";
+import "../chunk-NCAVDVXP.js";
+import "../chunk-4GKLAQY4.js";
+import "../chunk-OGTWSEWN.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-LOERK6N3.js";
-import "../chunk-OSOCONIE.js";
-import "../chunk-VFIZFKZY.js";
-import "../chunk-NJK4MGXL.js";
-import "../chunk-VICG46JC.js";
+import "../chunk-AXOMDPA7.js";
+import "../chunk-L62RNE5F.js";
+import "../chunk-2YF72RC5.js";
+import "../chunk-Y5O4TO7U.js";
+import "../chunk-ZPLDPPZO.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-U23XTMBF.js";
+import "../chunk-3HBLQXCJ.js";
 import {
   CODEX_AGENT,
   DEFAULT_SESSION,
@@ -78,8 +78,8 @@ import {
   toPolicyLookup,
   toPolicyLookups,
   userScope
-} from "../chunk-KT5BH6GC.js";
-import "../chunk-RFK2WN6S.js";
+} from "../chunk-BIV2LKDK.js";
+import "../chunk-XUVKAWV3.js";
 import {
   askUser,
   cancelQuestion,
@@ -92,31 +92,31 @@ import {
   sendNotification,
   unavailableQuestionUnlessSubscriptionRequired,
   waitForQuestion
-} from "../chunk-ZVON5PCF.js";
+} from "../chunk-DDRSG6JL.js";
 import "../chunk-POFBE6ZY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-RK7TDMQT.js";
-import "../chunk-H2RD5EMR.js";
-import "../chunk-2E6AWHV7.js";
+} from "../chunk-AG5ATWVT.js";
+import "../chunk-GRL4VVUP.js";
+import "../chunk-CXG7XA4E.js";
 import {
   getMachineId
-} from "../chunk-IS737HST.js";
+} from "../chunk-4YWINUPJ.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-GXQVOKHJ.js";
+import "../chunk-KJ2W7ECE.js";
 import {
   canonicalJson
-} from "../chunk-NQICO3ES.js";
+} from "../chunk-3TRGUDQ3.js";
 import {
   writeFileAtomic
 } from "../chunk-AQFEP65J.js";
 import {
   getApiKey
-} from "../chunk-OY6NJWDD.js";
-import "../chunk-QDKNLNCA.js";
+} from "../chunk-5UKZXDHV.js";
+import "../chunk-47RVFUEG.js";
 import {
   CODEX_RESCUE_TOOL_NAME,
   DECISION_STOP_REASON,
@@ -140,7 +140,7 @@ import {
   resolveGate,
   scopeBreachReasonOf,
   unapprovedScopeReason
-} from "../chunk-GM2IFDVF.js";
+} from "../chunk-TVP5UU33.js";
 
 // bin/pushary-codex-hook.ts
 import { basename } from "path";
@@ -769,7 +769,7 @@ var decidePreToolUse = async (input) => {
 };
 var repairCodexHoldsQuietly = async () => {
   try {
-    const { repairCodexHolds } = await import("../reapply-7TDCFXNF.js");
+    const { repairCodexHolds } = await import("../reapply-B7KMGQH7.js");
     repairCodexHolds();
   } catch {
     return;

package/dist/bin/pushary-codex.js

@@ -1,32 +1,32 @@
 #!/usr/bin/env node
 import {
   reportEvent
-} from "../chunk-KT5BH6GC.js";
-import "../chunk-RFK2WN6S.js";
+} from "../chunk-BIV2LKDK.js";
+import "../chunk-XUVKAWV3.js";
 import {
   askUser,
   isDecisionStopped,
   waitForAnswer
-} from "../chunk-ZVON5PCF.js";
+} from "../chunk-DDRSG6JL.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-RK7TDMQT.js";
-import "../chunk-H2RD5EMR.js";
-import "../chunk-2E6AWHV7.js";
+import "../chunk-AG5ATWVT.js";
+import "../chunk-GRL4VVUP.js";
+import "../chunk-CXG7XA4E.js";
 import {
   getMachineId
-} from "../chunk-IS737HST.js";
+} from "../chunk-4YWINUPJ.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-GXQVOKHJ.js";
-import "../chunk-NQICO3ES.js";
+import "../chunk-KJ2W7ECE.js";
+import "../chunk-3TRGUDQ3.js";
 import "../chunk-AQFEP65J.js";
 import {
   getApiKey
-} from "../chunk-OY6NJWDD.js";
+} from "../chunk-5UKZXDHV.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-QDKNLNCA.js";
-import "../chunk-GM2IFDVF.js";
+} from "../chunk-47RVFUEG.js";
+import "../chunk-TVP5UU33.js";
 
 // bin/pushary-codex.ts
 import { basename } from "path";