@pushary/agent-hooks 1.9.25 → 1.9.27

package/dist/{chunk-KGSN2SOL.js → chunk-ZQZRBPTP.js}

@@ -989,6 +989,17 @@ var serializeDeclinedAgents = (agents) => `${JSON.stringify(declinedAgentsDocume
 var withDeclinedAgent = (agents, agent) => canonicalAgents([...agents, agent]);
 var withoutDeclinedAgent = (agents, agent) => agents.filter((candidate) => candidate !== agent);
 
+// ../contracts/src/cli-version-standing.ts
+var FIRST_AUTO_UPDATING_RELEASE = [1, 5, 0];
+var MIN_SAFE_RELEASE = [1, 9, 26];
+var formatReleaseVersion = (version) => version.join(".");
+var FIRST_AUTO_UPDATING_CLI_VERSION = formatReleaseVersion(FIRST_AUTO_UPDATING_RELEASE);
+var MIN_SAFE_CLI_VERSION = formatReleaseVersion(MIN_SAFE_RELEASE);
+
+// ../contracts/src/auto-update-report.ts
+var AUTO_UPDATE_RESULTS = ["updated", "current", "needs_manual", "failed", "finish_pending", "finish_blocked"];
+var isAutoUpdateResult = (value) => typeof value === "string" && AUTO_UPDATE_RESULTS.includes(value);
+
 // ../contracts/src/index.ts
 var KEY_SCOPES = ["full_access", "agent", "connector", "bound"];
 var normalizeKeyScope = (value) => typeof value === "string" && KEY_SCOPES.includes(value) ? value : null;
@@ -1370,7 +1381,6 @@ var SAFE_SHELL_COMMANDS = /* @__PURE__ */ new Set([
   "whoami",
   "id",
   "uname",
-  "arch",
   "printenv",
   "locale",
   "tty",
@@ -1664,15 +1674,16 @@ var verdictForPolicy = (policy) => {
   return "requires_human";
 };
 var policyIntent = (policy) => isAutoApprove(policy) ? PATTERN_INTENT.grant : PATTERN_INTENT.restrict;
-var selectGoverningRule = (policies, toolName, args, repoKey, sessionId) => {
+var restricts = (policy) => policyIntent(policy) === PATTERN_INTENT.restrict;
+var appliesToThisCall = (policy, repoKey, sessionId) => isRepoKeyMatch(policy.repoKey, repoKey) && (!policy.sessionId || policy.sessionId === sessionId);
+var selectGoverningRule = (policies, toolName, args, repoKey, sessionId, restrictedArgs = args) => {
   let best;
   let bestWeight = 0;
   let bestScoped = -1;
   let bestLength = -1;
   for (const candidate of policies) {
-    if (!isRepoKeyMatch(candidate.repoKey, repoKey)) continue;
-    if (candidate.sessionId && candidate.sessionId !== sessionId) continue;
-    const rank = matchToolPatternAny(candidate.tool, toolName, args, policyIntent(candidate));
+    if (!appliesToThisCall(candidate, repoKey, sessionId)) continue;
+    const rank = matchToolPatternAny(candidate.tool, toolName, restricts(candidate) ? restrictedArgs : args, policyIntent(candidate));
     if (rank === "none") continue;
     const weight = matchRankWeight(rank);
     const scoped = candidate.sessionId ? 2 : candidate.repoKey ? 1 : 0;
@@ -1721,6 +1732,7 @@ var COMMAND_RUNNERS = /* @__PURE__ */ new Set([
   "script",
   "su",
   "doas",
+  "arch",
   "npx",
   "bunx",
   "pnpx",
@@ -2178,6 +2190,157 @@ var writesASecretFile = ({ program, args }) => {
   if (WRITES_EVERY_OPERAND.has(name)) return operands.some(namesASecretFile);
   return EDITS_IN_PLACE.has(name) && args.some((arg) => IN_PLACE_FLAG.test(arg.text)) && operands.some(namesASecretFile);
 };
+var GITHUB_RESOURCE_NOUNS = /* @__PURE__ */ new Set([
+  "pr",
+  "issue",
+  "release",
+  "repo",
+  "gist",
+  "label",
+  "secret",
+  "variable",
+  "workflow",
+  "run",
+  "cache",
+  "project",
+  "ruleset",
+  "codespace",
+  "org",
+  "discussion"
+]);
+var GITHUB_READ_VERBS = /* @__PURE__ */ new Set([
+  "view",
+  "list",
+  "ls",
+  "status",
+  "diff",
+  "checks",
+  "check",
+  "watch",
+  "browse",
+  "download",
+  "clone",
+  "checkout",
+  "get",
+  "field-list",
+  "item-list"
+]);
+var GITHUB_OPTIONS_WITH_VALUES = /* @__PURE__ */ new Set(["-R", "--repo", "--hostname"]);
+var GITHUB_API_SUBCOMMAND = "api";
+var GITHUB_GRAPHQL_ENDPOINT = "graphql";
+var HTTP_METHOD_FLAGS = /* @__PURE__ */ new Set(["-X", "--method"]);
+var HTTP_METHOD_ATTACHED = /^(?:-X|--method=)(.+)$/;
+var HTTP_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+var GITHUB_API_BODY_FLAG = /^(?:-[fF]|--(?:field|raw-field|input)(?:=|$))/;
+var GITHUB_API_FILE_FIELD = /=@|^--input(?:=|$)/;
+var GRAPHQL_MUTATION = /\bmutation\b/i;
+var STRIPE_READ_COMMANDS = /* @__PURE__ */ new Set([
+  "get",
+  "listen",
+  "logs",
+  "status",
+  "version",
+  "help",
+  "login",
+  "logout",
+  "config",
+  "completion",
+  "open",
+  "resources"
+]);
+var STRIPE_REQUEST_COMMANDS_THAT_WRITE = /* @__PURE__ */ new Set(["post", "delete", "trigger", "fixtures"]);
+var STRIPE_READ_OPERATIONS = /* @__PURE__ */ new Set(["list", "retrieve", "search"]);
+var STRIPE_OPTIONS_WITH_VALUES = /* @__PURE__ */ new Set([
+  "--api-key",
+  "--project-name",
+  "-p",
+  "--color",
+  "--log-level",
+  "--device-name",
+  "--config",
+  "--stripe-account"
+]);
+var AWS_OPTIONS_WITH_VALUES = /* @__PURE__ */ new Set([
+  "--region",
+  "--profile",
+  "--output",
+  "--endpoint-url",
+  "--query",
+  "--color",
+  "--ca-bundle",
+  "--cli-read-timeout",
+  "--cli-connect-timeout",
+  "--cli-binary-format"
+]);
+var AWS_LOCAL_COMMANDS = /* @__PURE__ */ new Set(["configure", "help", "history", "sso", "login", "logout"]);
+var AWS_READ_OPERATION = /^(?:describe|list|get|head|batch-get|lookup|search|filter|scan|query|select|wait|validate|estimate|simulate|tail|ls|presign|help)(?:-|$)/;
+var AWS_S3_SERVICE = "s3";
+var AWS_S3_COPIES = /* @__PURE__ */ new Set(["cp", "sync"]);
+var S3_URL_PREFIX = "s3://";
+var TWILIO_TOPIC_SEPARATOR = ":";
+var TWILIO_READ_ACTIONS = /* @__PURE__ */ new Set(["list", "fetch"]);
+var positionalWordsOf = (args, optionsWithValues) => {
+  const endOfOptions = args.findIndex((arg) => arg.text === END_OF_OPTIONS);
+  const options = endOfOptions === -1 ? args : args.slice(0, endOfOptions);
+  const operands = endOfOptions === -1 ? [] : args.slice(endOfOptions + 1);
+  const positional = options.filter((arg, index) => !arg.text.startsWith("-") && !optionsWithValues.has(options[index - 1]?.text ?? ""));
+  return [...positional, ...operands];
+};
+var httpMethodOf = (args) => {
+  for (const [index, arg] of args.entries()) {
+    const attached = HTTP_METHOD_ATTACHED.exec(arg.text);
+    if (attached) return arg.expands ? null : attached[1];
+    if (HTTP_METHOD_FLAGS.has(arg.text)) {
+      const value = args[index + 1];
+      return value === void 0 || value.expands ? null : value.text;
+    }
+  }
+  return void 0;
+};
+var graphqlRequestCanWrite = (args) => args.some((arg) => arg.expands || GRAPHQL_MUTATION.test(arg.text) || GITHUB_API_FILE_FIELD.test(arg.text));
+var githubApiRequestWrites = (args) => {
+  const method = httpMethodOf(args);
+  if (method !== void 0) return method === null || !HTTP_READ_METHODS.has(method.toUpperCase());
+  if (args.some((arg) => arg.text === GITHUB_GRAPHQL_ENDPOINT)) return graphqlRequestCanWrite(args);
+  return args.some((arg) => GITHUB_API_BODY_FLAG.test(arg.text));
+};
+var githubCliWrites = (args) => {
+  const meaningful = argsAfterHarmlessGlobalFlags(args);
+  const [noun, verb] = positionalWordsOf(meaningful, GITHUB_OPTIONS_WITH_VALUES);
+  if (noun?.text === GITHUB_API_SUBCOMMAND) return githubApiRequestWrites(meaningful.slice(meaningful.indexOf(noun) + 1));
+  return noun !== void 0 && GITHUB_RESOURCE_NOUNS.has(noun.text) && verb !== void 0 && !GITHUB_READ_VERBS.has(verb.text);
+};
+var stripeCliWrites = (args) => {
+  const [command, operation] = positionalWordsOf(args, STRIPE_OPTIONS_WITH_VALUES);
+  if (command === void 0 || STRIPE_READ_COMMANDS.has(command.text)) return false;
+  if (STRIPE_REQUEST_COMMANDS_THAT_WRITE.has(command.text)) return true;
+  return operation !== void 0 && !STRIPE_READ_OPERATIONS.has(operation.text);
+};
+var s3CommandWrites = (operation, operands) => !AWS_S3_COPIES.has(operation) ? !AWS_READ_OPERATION.test(operation) : operands.slice(1).some((operand) => operand.expands || operand.text.startsWith(S3_URL_PREFIX));
+var awsCliWrites = (args) => {
+  const [service, operation, ...operands] = positionalWordsOf(args, AWS_OPTIONS_WITH_VALUES);
+  if (service === void 0 || operation === void 0 || AWS_LOCAL_COMMANDS.has(service.text)) return false;
+  return service.text === AWS_S3_SERVICE ? s3CommandWrites(operation.text, operands) : !AWS_READ_OPERATION.test(operation.text);
+};
+var twilioCliWrites = (args) => {
+  const [topic] = positionalWordsOf(args, /* @__PURE__ */ new Set());
+  if (topic === void 0 || !topic.text.includes(TWILIO_TOPIC_SEPARATOR)) return false;
+  return !TWILIO_READ_ACTIONS.has(topic.text.split(TWILIO_TOPIC_SEPARATOR).at(-1) ?? "");
+};
+var REMOTE_API_CLI_WRITES = /* @__PURE__ */ new Map([
+  ["gh", githubCliWrites],
+  ["stripe", stripeCliWrites],
+  ["aws", awsCliWrites],
+  ["twilio", twilioCliWrites]
+]);
+var invocationWritesThroughARemoteApi = ({ program, args }) => {
+  const writes = program === void 0 ? void 0 : REMOTE_API_CLI_WRITES.get(basenameOf(program.text));
+  return writes !== void 0 && writes(args);
+};
+var commandWritesThroughARemoteApi = (command) => {
+  const segments = readableCommandSegments(command);
+  return segments !== null && segments.some((segment) => invocationWritesThroughARemoteApi(invocationOf(segment)));
+};
 var segmentNeedsAPerson = (toolName, segment) => {
   const invocation = invocationOf(segment);
   const normalized = normalizedInvocation(invocation);
@@ -2297,15 +2460,14 @@ var replacesTheCrontab = ({ program, args }) => program !== void 0 && basenameOf
 var FIND_DELETE = "-delete";
 var FIND_RUNNERS = /* @__PURE__ */ new Set(["-exec", "-execdir", "-ok", "-okdir"]);
 var FIND_RUNNER_END = /* @__PURE__ */ new Set([";", "+"]);
+var FIND = "find";
+var commandsRunByFind = ({ program, args }) => program === void 0 || basenameOf(program.text) !== FIND ? [] : args.flatMap((arg, index) => FIND_RUNNERS.has(arg.text) ? [{ program: args[index + 1], args: args.slice(index + 2, findRunnerEnd(args, index + 2)) }] : []);
 var losesDataVisibly = (toolName, invocation, normalized, depth) => {
   const { program, args } = invocation;
   if (program === void 0) return false;
   const name = basenameOf(program.text);
-  if (name === "find") {
-    return args.some((arg) => arg.text === FIND_DELETE) || args.some((arg, index) => FIND_RUNNERS.has(arg.text) && invocationHasAVisibleConsequence(toolName, {
-      program: args[index + 1],
-      args: args.slice(index + 2, findRunnerEnd(args, index + 2))
-    }, depth + 1));
+  if (name === FIND) {
+    return args.some((arg) => arg.text === FIND_DELETE) || commandsRunByFind(invocation).some((run) => invocationHasAVisibleConsequence(toolName, run, depth + 1));
   }
   const destructiveArguments = destructiveArgumentsOf(name, args);
   return destructiveArguments !== void 0 && args.some((arg) => namesDestructiveArgument(arg.text, destructiveArguments)) || namesDestructiveWordInAnyCase(name, args.map((arg) => arg.text)) || gitDiscardsWork(invocation) || changesAService(invocation) || replacesTheCrontab(invocation) || isCoveredByPolicy(VISIBLE_DATA_LOSS_PATTERNS, toolName, normalized);
@@ -2345,6 +2507,7 @@ var WRAPPER_SYNTAX = /* @__PURE__ */ new Map([
   ["stdbuf", wrapperSyntax(["-i", "-o", "-e", "--input", "--output", "--error"])],
   ["flock", wrapperSyntax(["-w", "--wait", "--timeout", "-E", "--conflict-exit-code"], 1)],
   ["caffeinate", wrapperSyntax(["-t", "-w"])],
+  ["arch", wrapperSyntax(["-arch", "-d", "-e"])],
   ["sudo", wrapperSyntax([
     "-u",
     "--user",
@@ -2467,7 +2630,8 @@ var runsADownloadedScript = (invocations) => {
 var pipedSegmentsOf = (command) => (shellSegmentsReadingAPipe(commandForReading(command)) ?? []).map((segment) => innermostInvocation(invocationOf(withoutShellGrouping(segment))));
 var pipesIntoASqlClient = (command) => pipedSegmentsOf(command).some((invocation) => sqlClientSyntaxOf(invocation) !== void 0);
 var pipesFetchedCodeIntoAnInterpreter = (command, invocations) => invocations.some(fetches) && pipedSegmentsOf(command).some(runsWhatItReads);
-var SHELL_GROUPING_PREFIX = /^\s*(?:(?:if|then|elif|else|do|while|until|!)\s+|[({]\s*)+/;
+var WORDS_THAT_OPEN_A_COMMAND = String.raw`if|then|elif|else|do|while|until|!`;
+var SHELL_GROUPING_PREFIX = new RegExp(String.raw`^\s*(?:(?:${WORDS_THAT_OPEN_A_COMMAND})\s+|[({]\s*)+`);
 var GROUP_OPENER_BY_CLOSER = /* @__PURE__ */ new Map([[")", "("], ["}", "{"]]);
 var occurrencesOf = (text, character) => text.split(character).length - 1;
 var closesAGroupItDidNotOpen = (text) => {
@@ -2584,6 +2748,116 @@ var commandHasAVisibleConsequenceAt = (toolName, command, depth) => {
   return invocations.some((invocation) => invocationHasAVisibleConsequence(toolName, invocation, depth)) || pipesIntoASqlClient(command) || pipesFetchedCodeIntoAnInterpreter(command, invocations) || runsADownloadedScript(invocations);
 };
 var commandHasAVisibleConsequence = (toolName, command) => commandHasAVisibleConsequenceAt(toolName, command, 0);
+var MAX_SPELLING_DEPTH = 3;
+var GIT_GLOBAL_OPTIONS_WITH_A_VALUE = /* @__PURE__ */ new Set([
+  "-C",
+  "-c",
+  "--git-dir",
+  "--work-tree",
+  "--namespace",
+  "--super-prefix",
+  "--config-env"
+]);
+var GIT_GLOBAL_FLAGS = /* @__PURE__ */ new Set([
+  "-p",
+  "--paginate",
+  "-P",
+  "--no-pager",
+  "--bare",
+  "--exec-path",
+  "--html-path",
+  "--man-path",
+  "--info-path",
+  "--no-replace-objects",
+  "--no-lazy-fetch",
+  "--no-optional-locks",
+  "--no-advice",
+  "--literal-pathspecs",
+  "--glob-pathspecs",
+  "--noglob-pathspecs",
+  "--icase-pathspecs"
+]);
+var GIT_OPTION_AND_ITS_VALUE = 2;
+var GIT_OPTION_ALONE = 1;
+var NOT_A_GIT_GLOBAL_OPTION = 0;
+var gitGlobalOptionWidth = (text) => {
+  if (GIT_GLOBAL_OPTIONS_WITH_A_VALUE.has(text)) return GIT_OPTION_AND_ITS_VALUE;
+  const name = longOptionName(text);
+  return GIT_GLOBAL_OPTIONS_WITH_A_VALUE.has(name) || GIT_GLOBAL_FLAGS.has(name) ? GIT_OPTION_ALONE : NOT_A_GIT_GLOBAL_OPTION;
+};
+var argsAfterGitGlobalOptions = (args) => {
+  let index = 0;
+  while (index < args.length) {
+    const width = gitGlobalOptionWidth(args[index]?.text ?? "");
+    if (width === NOT_A_GIT_GLOBAL_OPTION) break;
+    index += width;
+  }
+  return args.slice(index);
+};
+var gitReadingsPastGlobalOptions = ({ program, args }) => {
+  if (program === void 0 || basenameOf(program.text) !== GIT) return [];
+  const rest = argsAfterGitGlobalOptions(args);
+  return rest.length === args.length ? [] : [{ program, args: rest }];
+};
+var CURRENT_DIRECTORY_STEP = /\/\.(?=\/)/g;
+var LEADING_CURRENT_DIRECTORY = /^(?:\.\/+)+(?=[^/])/;
+var canonicalPathWord = (text) => text.replace(CURRENT_DIRECTORY_STEP, "").replace(LEADING_CURRENT_DIRECTORY, "");
+var verbatimInvocationText = (invocation) => wordsOfInvocation(invocation).map((word) => asOneShellWord(word.text)).join(" ");
+var canonicalInvocationText = (invocation) => invocationTextWith(invocation, (word) => asOneShellWord(canonicalPathWord(word.text)));
+var spellingsOfAnInvocation = (invocation, innermost) => [invocation, innermost, ...gitReadingsPastGlobalOptions(innermost), ...readingsPastGlobalFlags(innermost)].flatMap((reading) => [verbatimInvocationText(reading), canonicalInvocationText(reading)]);
+var NO_INLINE_SCRIPT = { kind: "none" };
+var HIDDEN_INLINE_SCRIPT = { kind: "hidden" };
+var passesAnInlineScript = ({ program, args }) => {
+  const name = basenameOf(program?.text ?? "");
+  return name === EVAL || SHELLS.has(name) && args.some((arg) => SCRIPT_FLAG_CLUSTER.test(arg.text));
+};
+var shellReadsItsScript = (invocation) => SHELLS.has(basenameOf(invocation.program?.text ?? "")) && runsWhatItReads(invocation);
+var inlineScriptsOf = (invocation, heredocs) => {
+  const script = shellScriptOf(invocation);
+  if (script !== null) return { kind: "readable", scripts: [script] };
+  if (passesAnInlineScript(invocation)) return HIDDEN_INLINE_SCRIPT;
+  if (!shellReadsItsScript(invocation)) return NO_INLINE_SCRIPT;
+  return heredocs.length > 0 ? { kind: "readable", scripts: heredocs } : HIDDEN_INLINE_SCRIPT;
+};
+var programIsHidden = ({ program }) => program?.expands ?? false;
+var SUBSTITUTION_AS_A_PROGRAM = new RegExp(String.raw`(?:^|[;&|({\n]|(?:^|[\s;&|({])(?:${WORDS_THAT_OPEN_A_COMMAND})\s)\s*"?(?:\$\(|\`)`);
+var runsASubstitutionAsAProgram = (command) => {
+  const visible = shellVisibleText(withHeredocBodiesSetAside(commandForReading(command)).text);
+  return visible !== null && SUBSTITUTION_AS_A_PROGRAM.test(visible);
+};
+var parsedSpelledSegment = (segment) => {
+  const text = withoutShellGrouping(segment);
+  return { text, invocation: invocationOf(text), heredocs: [], feedsASubstitution: false };
+};
+var roughSpelledSegment = ({ invocation, heredocs, feedsASubstitution }) => ({ text: verbatimInvocationText(invocation), invocation, heredocs, feedsASubstitution });
+var segmentHidesWhatItRuns = (segment, innermost, scripts) => programIsHidden(innermost) || scripts.kind === "hidden" || segment.feedsASubstitution && passesAnInlineScript(innermost);
+var commandsNestedIn = (innermost, scripts) => [
+  ...scripts.kind === "readable" ? scripts.scripts : [],
+  ...commandsRunByFind(innermost).map(verbatimInvocationText)
+];
+var spelledSegmentsOf = (command) => {
+  const parsed = readableCommandSegments(command);
+  return parsed === null ? roughSegmentsOf(command).map(roughSpelledSegment) : parsed.map(parsedSpelledSegment);
+};
+var SPELLINGS_OF_AN_UNREADABLE_COMMAND = { forms: [], hidesWhatItRuns: true };
+var commandSpellingsAt = (command, depth) => {
+  if (depth > MAX_SPELLING_DEPTH) return SPELLINGS_OF_AN_UNREADABLE_COMMAND;
+  const forms = [];
+  let hidesWhatItRuns = runsASubstitutionAsAProgram(command);
+  for (const segment of spelledSegmentsOf(command)) {
+    const innermost = innermostInvocation(segment.invocation);
+    const scripts = inlineScriptsOf(innermost, segment.heredocs);
+    forms.push(segment.text, ...spellingsOfAnInvocation(segment.invocation, innermost));
+    hidesWhatItRuns ||= segmentHidesWhatItRuns(segment, innermost, scripts);
+    for (const nested of commandsNestedIn(innermost, scripts)) {
+      const inner = commandSpellingsAt(nested, depth + 1);
+      forms.push(nested, ...inner.forms);
+      hidesWhatItRuns ||= inner.hidesWhatItRuns;
+    }
+  }
+  return { forms, hidesWhatItRuns };
+};
+var commandSpellings = (command) => commandSpellingsAt(command, 0);
 var withoutSessionToolGrants = (config) => ({
   ...config,
   policies: config.policies.filter((policy) => !isSessionToolGrant(policy))
@@ -3144,9 +3418,10 @@ var findBestRoute = (routes, toolName, args, repoKey) => {
   let bestWeight = 0;
   let bestScoped = -1;
   let bestLength = -1;
+  const { forms } = restrictionReadingOf(routes.map((route) => route.toolPattern), toolName, args);
   for (const candidate of routes) {
     if (!isRepoKeyMatch(candidate.repoKey, repoKey)) continue;
-    const rank = matchToolPatternAny(candidate.toolPattern, toolName, args, PATTERN_INTENT.restrict);
+    const rank = matchToolPatternAny(candidate.toolPattern, toolName, forms, PATTERN_INTENT.restrict);
     if (rank === "none") continue;
     const weight = matchRankWeight(rank);
     const scoped = candidate.repoKey ? 1 : 0;
@@ -3178,10 +3453,35 @@ var isNamedByARule = (rank) => rank !== void 0 && rank !== "wildcard";
 var isSpecificArgumentRank = (rank) => rank === "exact" || rank === "prefix";
 var shellReadOnlyFloorApplies = (toolName, arg, rank) => !isSpecificArgumentRank(rank) && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg);
 var coordinationFloorApplies = (toolName, rank) => isCodexCoordinationTool(toolName) && !isNamedByARule(rank);
+var POSIX_SHELL_TOOLS = /* @__PURE__ */ new Set(["Bash", "Monitor"]);
+var argumentsAsWritten = (args) => ({ forms: args, hidesWhatItRuns: false });
+var namesAnArgumentOf = (pattern, toolName) => pattern.startsWith(`${toolName}(`);
+var isSpelledOut = (form) => form.length > 0;
+var restrictionReadingOf = (restrictingPatterns, toolName, args) => {
+  const command = toolName in POLICY_COMMAND_KEYS ? args[0] : void 0;
+  if (command === void 0 || !restrictingPatterns.some((pattern) => namesAnArgumentOf(pattern, toolName))) {
+    return argumentsAsWritten(args);
+  }
+  const spellings = commandSpellings(command);
+  return {
+    forms: [.../* @__PURE__ */ new Set([...args, ...spellings.forms.filter(isSpelledOut)])],
+    hidesWhatItRuns: POSIX_SHELL_TOOLS.has(toolName) && spellings.hidesWhatItRuns
+  };
+};
+var restrictingPatternsOf = (policies) => policies.filter(restricts).map((policy) => policy.tool);
+var policyReadingOf = (policies, toolName, args) => restrictionReadingOf(restrictingPatternsOf(policies), toolName, args);
+var stricterRule = (current, challenger) => current !== void 0 && (challenger === void 0 || restraintRank(current.policy) > restraintRank(challenger.policy)) ? current : challenger;
+var restrictsAnArgumentOf = (policy, toolName) => restricts(policy) && namesAnArgumentOf(policy.tool, toolName);
+var strictestRuleNamingAnArgument = (pool, toolName, repoKey, sessionId) => pool.filter((policy) => restrictsAnArgumentOf(policy, toolName) && appliesToThisCall(policy, repoKey, sessionId)).reduce((strictest, policy) => stricterRule(strictest, { policy, rank: "prefix" }), void 0);
+var governingRuleForReading = (pool, toolName, args, reading, repoKey, sessionId) => {
+  const selected = selectGoverningRule(pool, toolName, args, repoKey, sessionId, reading.forms);
+  return reading.hidesWhatItRuns ? stricterRule(selected, strictestRuleNamingAnArgument(pool, toolName, repoKey, sessionId)) : selected;
+};
 var resolveAutoResolveOrigin = (config, toolName, toolInput, cwd, repoKey, sessionId) => {
   const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
   const arg = args[0];
-  const rank = selectGoverningRule(config.policies, toolName, args, repoKey, sessionId)?.rank;
+  const reading = policyReadingOf(config.policies, toolName, args);
+  const rank = governingRuleForReading(config.policies, toolName, args, reading, repoKey, sessionId)?.rank;
   if (shellReadOnlyFloorApplies(toolName, arg, rank) || coordinationFloorApplies(toolName, rank)) {
     return DECISION_ORIGIN.safeReadonly;
   }
@@ -3192,28 +3492,37 @@ var wildcardRuleOf = (pool) => {
   return wildcard ? { policy: wildcard, rank: "wildcard" } : void 0;
 };
 var withSiteDelivery = (rule, siteMode) => isAutoApprove(rule.policy) || isAutoDeny(rule.policy) ? rule : { ...rule, policy: { ...rule.policy, mode: siteMode.mode, pushFirstSeconds: siteMode.pushFirstSeconds } };
-var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
-  const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
-  const arg = args[0];
-  const specificRule = (pool) => pool.length === 0 ? void 0 : selectGoverningRule(pool, toolName, args, repoKey, sessionId);
+var layeredGoverningRule = (config, toolName, args, reading, repoKey, sessionId) => {
+  const specificRule = (pool) => pool.length === 0 ? void 0 : governingRuleForReading(pool, toolName, args, reading, repoKey, sessionId);
   const written = config.policies.filter((p) => !p.origin);
   const presets = config.policies.filter((p) => p.origin === "preset");
   const builtins = config.policies.filter((p) => p.origin === "builtin");
   const siteMode = wildcardRuleOf(written);
   const presetRule = specificRule(presets);
-  const match = specificRule(written) ?? (presetRule && siteMode ? withSiteDelivery(presetRule, siteMode.policy) : presetRule) ?? siteMode ?? wildcardRuleOf(presets) ?? specificRule(builtins) ?? wildcardRuleOf(builtins);
-  let base = match?.policy ?? {
-    tool: toolName,
-    timeoutSeconds: config.defaultTimeoutSeconds,
-    timeoutAction: config.defaultTimeoutAction,
-    mode: config.defaultMode ?? "push_first",
-    pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
-  };
+  return specificRule(written) ?? (presetRule && siteMode ? withSiteDelivery(presetRule, siteMode.policy) : presetRule) ?? siteMode ?? wildcardRuleOf(presets) ?? specificRule(builtins) ?? wildcardRuleOf(builtins);
+};
+var unmatchedPolicyOf = (config, toolName) => ({
+  tool: toolName,
+  timeoutSeconds: config.defaultTimeoutSeconds,
+  timeoutAction: config.defaultTimeoutAction,
+  mode: config.defaultMode ?? "push_first",
+  pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
+});
+var stricterOfTheReadings = (asWritten, asSpelled, unmatched) => restraintRank(asWritten?.policy ?? unmatched) > restraintRank(asSpelled?.policy ?? unmatched) ? asWritten : asSpelled;
+var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
+  const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
+  const arg = args[0];
+  const unmatched = unmatchedPolicyOf(config, toolName);
+  const asWritten = layeredGoverningRule(config, toolName, args, argumentsAsWritten(args), repoKey, sessionId);
+  const asSpelled = layeredGoverningRule(config, toolName, args, policyReadingOf(config.policies, toolName, args), repoKey, sessionId);
+  const match = stricterOfTheReadings(asWritten, asSpelled, unmatched);
+  let base = match?.policy ?? unmatched;
   const governedBySpecificRule = isSpecificArgumentRank(match?.rank);
   const governedBySessionToolGrant = match?.rank === "tool" && isSessionToolGrant(match.policy);
   const governedByStandingShellAllow = match?.rank === "tool" && isStandingShellAllow(match.policy);
   const governingMode = base.mode;
-  const approvedByReadOnlyFloor = !isAutoDeny(base) && (shellReadOnlyFloorApplies(toolName, arg, match?.rank) || coordinationFloorApplies(toolName, match?.rank));
+  const aRuleNamesASpelling = isSpecificArgumentRank(asSpelled?.rank);
+  const approvedByReadOnlyFloor = !isAutoDeny(base) && (shellReadOnlyFloorApplies(toolName, arg, match?.rank) && !aRuleNamesASpelling || coordinationFloorApplies(toolName, match?.rank));
   if (governedBySessionToolGrant && !approvedByReadOnlyFloor && typeof arg === "string" && commandNeedsAPerson(toolName, arg)) {
     return resolvePolicy(withoutSessionToolGrants(config), toolName, modeOverride, toolInput, cwd, repoKey, sessionId);
   }
@@ -3398,9 +3707,16 @@ var scopeBreachReasonOf = (verdict) => verdict.kind === "gate" && isScopeReason(
 var onlyCodexPreToolUseCanAsk = (verdict, permissionMode) => verdict.kind === "gate" && (scopeBreachReasonOf(verdict) !== void 0 || !codexRaisesItsOwnPrompts(permissionMode));
 var runsACommandThatNeedsAPerson = ({ toolName, toolInputs }) => toolName === "Bash" && toolInputs.some((toolInput) => {
   const command = extractPolicyArg(toolName, toolInput);
-  return command !== void 0 && commandNeedsAPerson(toolName, command);
+  return command !== void 0 && (commandNeedsAPerson(toolName, command) || commandWritesThroughARemoteApi(command));
+});
+var CI_WORKFLOW_FILE = /(?:^|\/)\.github\/workflows\/[^/]+$/;
+var FILE_WRITING_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+var namesASecretOrWorkflowFile = (path) => SECRET_FILE_NAME.test(basenameOf(path)) || CI_WORKFLOW_FILE.test(normalizeSeparators(path));
+var writesASecretOrWorkflowFile = ({ toolName, toolInputs }) => FILE_WRITING_TOOLS.has(toolName) && toolInputs.some((toolInput) => {
+  const path = extractPolicyArg(toolName, toolInput);
+  return path !== void 0 && namesASecretOrWorkflowFile(path);
 });
-var codexCallNeedsAPerson = (input, verdict, call) => onlyCodexPreToolUseCanAsk(verdict, call.permissionMode) || verdict.kind === "gate" && (aChosenRuleGoverns(input) || call.deletesFiles || runsACommandThatNeedsAPerson(input));
+var codexCallNeedsAPerson = (input, verdict, call) => onlyCodexPreToolUseCanAsk(verdict, call.permissionMode) || verdict.kind === "gate" && (aChosenRuleGoverns(input) || call.deletesFiles || runsACommandThatNeedsAPerson(input) || writesASecretOrWorkflowFile(input));
 var MAX_AGENT_PERMISSION_RULES_PER_KIND = 256;
 var MAX_AGENT_PERMISSION_RULE_LENGTH = 512;
 var isAgentPermissionRule = (value) => typeof value === "string" && value.length > 0 && value.length <= MAX_AGENT_PERMISSION_RULE_LENGTH;
@@ -3421,11 +3737,13 @@ var everyCommandSegmentGranted = (rules, toolName, command) => {
   const segments = readableCommandSegments(command);
   return segments !== null && segments.every((segment) => isSafeReadOnlyCommand(segment) || anyRuleGrants(rules, toolName, [segment]));
 };
-var restrictionFormsOf = (toolName, args) => {
+var agentRuleReadingOf = (rules, toolName, args) => {
+  const reading = restrictionReadingOf([...rules.ask, ...rules.deny], toolName, args);
   const command = toolName in POLICY_COMMAND_KEYS ? args[0] : void 0;
   const normalized = command === void 0 ? null : normalizedCommand(command);
-  return normalized === null ? args : [...args, normalized];
+  return normalized === null ? reading : { ...reading, forms: [...reading.forms, normalized] };
 };
+var anyRuleRestrictsReading = (rules, toolName, reading) => anyRuleRestricts(rules, toolName, reading.forms) || reading.hidesWhatItRuns && rules.some((rule) => namesAnArgumentOf(rule, toolName));
 var allowRulesGrant = (rules, toolName, args) => {
   const command = args[0];
   return toolName in POLICY_COMMAND_KEYS && command !== void 0 ? everyCommandSegmentGranted(rules, toolName, command) : anyRuleGrants(rules, toolName, args);
@@ -3437,8 +3755,8 @@ var inputNeedsAPerson = (toolName, toolInput) => {
 };
 var agentRulesAllowEveryInput = (rules, toolName, toolInputs, cwd) => rules.allow.length > 0 && toolInputs.length > 0 && toolInputs.every((toolInput) => {
   const args = policyArgForms(toolName, toolInput, cwd);
-  const restrictionForms = restrictionFormsOf(toolName, args);
-  return allowRulesGrant(rules.allow, toolName, args) && !anyRuleRestricts(rules.ask, toolName, restrictionForms) && !anyRuleRestricts(rules.deny, toolName, restrictionForms) && !inputNeedsAPerson(toolName, toolInput);
+  const reading = agentRuleReadingOf(rules, toolName, args);
+  return allowRulesGrant(rules.allow, toolName, args) && !anyRuleRestrictsReading(rules.ask, toolName, reading) && !anyRuleRestrictsReading(rules.deny, toolName, reading) && !inputNeedsAPerson(toolName, toolInput);
 });
 var isDefaultRule = (policy) => policy.origin === "builtin" || policy.tool === WILDCARD_TOOL_PATTERN;
 var isApprovalRoutePattern = (value) => typeof value === "object" && value !== null && typeof value.toolPattern === "string" && ["string", "undefined"].includes(typeof value.repoKey);
@@ -3452,7 +3770,8 @@ var aChosenRuleGoverns = (input) => {
   if (routes === null) return true;
   return input.toolInputs.some((toolInput) => {
     const args = policyArgForms(input.toolName, toolInput, input.cwd);
-    return selectGoverningRule(chosen, input.toolName, args, input.repoKey, input.sessionId) !== void 0 || findBestRoute(routes, input.toolName, args, input.repoKey) !== void 0;
+    const reading = policyReadingOf(chosen, input.toolName, args);
+    return governingRuleForReading(chosen, input.toolName, args, reading, input.repoKey, input.sessionId) !== void 0 || findBestRoute(routes, input.toolName, args, input.repoKey) !== void 0;
   });
 };
 var claudeAllowlistOwnsCall = (input, verdict, permissionMode, rules) => rules !== null && verdict.kind === "gate" && !verdict.scopeReason && !aChosenRuleGoverns(input) && !isAskedInEveryMode(input.toolName) && claudeConsultsItsAllowlist(permissionMode) && agentRulesAllowEveryInput(rules, input.toolName, input.toolInputs, input.cwd);
@@ -3640,6 +3959,9 @@ var WITHDRAWN_APPROVAL_REASON = "The phone question was withdrawn. Approve in th
 var PLAN_DECLINED_REASON = "Plan declined from the phone. Ask what to change before coding.";
 var claudeStoppedPreToolUseOutput = (reason) => stoppedOutput(claudePreToolUseOutput("deny", reason), reason);
 var claudeStoppedPermissionRequestOutput = (reason) => stoppedOutput(claudePermissionRequestOutput("deny", reason), reason);
+var UNHEARD_PUSH_WINDOW_DAYS = 14;
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var UNHEARD_PUSH_WINDOW_MS = UNHEARD_PUSH_WINDOW_DAYS * DAY_MS;
 var ELICITATION_ANSWERABLE_MODE = "form";
 var ELICITATION_MIN_OPTIONS = 2;
 var ELICITATION_MAX_MULTI_QUESTIONS = 4;
@@ -3971,6 +4293,7 @@ export {
   serializeDeclinedAgents,
   withDeclinedAgent,
   withoutDeclinedAgent,
+  isAutoUpdateResult,
   normalizeKeyScope,
   isApprovalMode,
   approvalModeWithoutLocalPrompt,

package/dist/{chunk-7V6PJFDF.js → chunk-ZWDXBLEZ.js}

@@ -1,12 +1,12 @@
 import {
   keyCheckFromResponse
-} from "./chunk-VEGS4NYF.js";
+} from "./chunk-MSKJRRHY.js";
 import {
   installNetworkDefaults
-} from "./chunk-ZV3262AA.js";
+} from "./chunk-W4LNR7LP.js";
 import {
   getBaseUrl
-} from "./chunk-5Q2QJ2AL.js";
+} from "./chunk-XTTMUQ4Z.js";
 
 // src/retry.ts
 var isRetryable = (err) => {

package/dist/{global-upgrade-4M4TJKQR.js → global-upgrade-FKQPJL5P.js}

@@ -5,15 +5,15 @@ import {
   readGlobalUpgradeSubject,
   upgradeInstalledPackage,
   withUpgradeLock
-} from "./chunk-BGJDOHNF.js";
-import "./chunk-PPGLIWOR.js";
-import "./chunk-VFF7ZBIS.js";
+} from "./chunk-MDAJO2MP.js";
+import "./chunk-XESMYZLU.js";
+import "./chunk-WGTD4NZV.js";
 import "./chunk-POFBE6ZY.js";
 import "./chunk-KZERVKTD.js";
-import "./chunk-2VQZC6DW.js";
+import "./chunk-YTTPPJZW.js";
 import "./chunk-AQFEP65J.js";
-import "./chunk-OOKIWOMK.js";
-import "./chunk-KGSN2SOL.js";
+import "./chunk-Z5AAPX3O.js";
+import "./chunk-ZQZRBPTP.js";
 export {
   finishGlobalUpgrade,
   finishUpgradeWithLock,

package/dist/{paths-6JY6J56N.js → paths-TU47TCRS.js}

@@ -32,8 +32,8 @@ import {
   pusharyDir,
   vscodePluginDir,
   vscodePluginMcp
-} from "./chunk-2VQZC6DW.js";
-import "./chunk-KGSN2SOL.js";
+} from "./chunk-YTTPPJZW.js";
+import "./chunk-ZQZRBPTP.js";
 export {
   autoUpdateLock,
   autoUpdateLog,

package/dist/{reapply-LFEQ5GF6.js → reapply-CTJZBUJY.js}

@@ -10,34 +10,34 @@ import {
   reapplyOpenCodePlugin,
   reapplyVsCodePlugin,
   repairCodexHolds
-} from "./chunk-UUOC7A7M.js";
-import "./chunk-VN5Q4KOD.js";
+} from "./chunk-OPSLFAKF.js";
+import "./chunk-GORB726L.js";
 import "./chunk-RIVNNBEK.js";
 import "./chunk-XHKBHWLX.js";
-import "./chunk-FJKV64M7.js";
-import "./chunk-5WTEKIAS.js";
-import "./chunk-ZLY7BHN4.js";
-import "./chunk-KM7AEGKF.js";
-import "./chunk-4KZP4YMV.js";
-import "./chunk-ZNT4ZZXJ.js";
+import "./chunk-5SKHXKIF.js";
+import "./chunk-TQE5VIDJ.js";
+import "./chunk-TWCWRHNK.js";
+import "./chunk-KN5ULH4O.js";
+import "./chunk-MRMIGVUI.js";
+import "./chunk-MTODICDT.js";
 import "./chunk-GMXKITVA.js";
 import "./chunk-6ICPEJY5.js";
-import "./chunk-AXB4ABUD.js";
-import "./chunk-A3QQWXIE.js";
-import "./chunk-NFH2H7PD.js";
+import "./chunk-VGVMBY4V.js";
+import "./chunk-CSXWXXFJ.js";
+import "./chunk-AT4URLSU.js";
 import "./chunk-POFBE6ZY.js";
-import "./chunk-7V6PJFDF.js";
-import "./chunk-VEGS4NYF.js";
-import "./chunk-ZV3262AA.js";
-import "./chunk-ZLGCNHJG.js";
+import "./chunk-ZWDXBLEZ.js";
+import "./chunk-MSKJRRHY.js";
+import "./chunk-W4LNR7LP.js";
+import "./chunk-U4Q3AKLU.js";
 import "./chunk-7QLSKOSU.js";
 import "./chunk-KZERVKTD.js";
-import "./chunk-EJMXZH5E.js";
-import "./chunk-2VQZC6DW.js";
+import "./chunk-UWEDDQHU.js";
+import "./chunk-YTTPPJZW.js";
 import "./chunk-AQFEP65J.js";
-import "./chunk-5Q2QJ2AL.js";
-import "./chunk-OOKIWOMK.js";
-import "./chunk-KGSN2SOL.js";
+import "./chunk-XTTMUQ4Z.js";
+import "./chunk-Z5AAPX3O.js";
+import "./chunk-ZQZRBPTP.js";
 export {
   ensureCodexTrustAfterReapply,
   inspectConfiguredManagedProviders,