@pushary/agent-hooks 1.9.27 → 1.9.29

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 1.9.29
+
+- Codex: answering "Handle on your machine" now always refuses the call, and tells you to ask Codex to run it again while you are at your computer, or to run it yourself. In Codex's default modes the call used to pass back to Codex, and a call Codex does not ask about itself, such as a remote API write or a file deletion, could run without anyone approving it.
+- In a session started from your phone, "Handle on your machine" now refuses the call with the same reason every agent without an approval prompt of its own gives.
+
+## 1.9.28
+
+- Antigravity CLI: text agy sends to a command it left running (`manage_task` with `send_input`) now goes through Pushary and is judged as the shell command it types, so your `Bash` rules and safe read-only commands apply to it. It used to run with nobody asked, because connecting agy turns off its own prompt. Sending blank input, such as pressing Enter, asks your phone. Listing, checking and stopping agy's own background tasks run without a question.
+- Antigravity CLI: a call the hook cannot read (empty or malformed input, or a tool call with no name) is refused with a reason instead of running. So is every agy call while an admission rule, a wildcard included, has switched agy's approval hook off. Pushary's own tools still run.
+- `pushary upgrade` and automatic updates now also refresh the hooks of Antigravity CLI, Qwen Code, CodeBuddy, Qoder, Droid and Devin when this CLI set them up, so a connection made on an older version picks up the current hook set without running setup again. Other entries in those files are left as they are.
+
 ## 1.9.27
 
 - A `Bash(...)` deny or ask rule you write in Pushary now catches the command it names however it is spelled. With a `Bash(git push:*)` deny and a rule that otherwise allows Bash, these used to run and are now refused: `git -C . push`, `git -c x=y push`, `git --no-pager push`, `git --git-dir=.git push`, `GIT_DIR=.git git push`, `FOO=1 git push`, a push behind `env`, `nohup`, `time`, `nice`, `timeout 60`, `exec`, `command`, `builtin`, `xargs`, `sudo` or `arch -arm64`, `"git" push`, `\git push`, `/usr/bin/git push`, `git  push` with two spaces, `(git push)`, `{ git push; }`, `bash -c "git push"`, `sh -c 'git push'`, `eval git push`, a heredoc fed to `bash`, `find . -exec git push \;`, a push inside `if ...; then ...; fi`, and a push chained after a command Pushary could not split before, such as `x=$(git rev-parse HEAD) && git push`, `echo hi > out.txt && git push`, `npm test && git push $(git remote)`, or Claude Code's heredoc commit followed by `&& git push 2>&1 | tail -5`. An ask rule now asks for every one of these. The same holds for any rule, such as `Bash(npm publish:*)` or `Bash(rm:*)`.

package/dist/bin/pushary-bell-hook.js

@@ -1,41 +1,41 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-UQTQVH5X.js";
+} from "../chunk-5L7H32JK.js";
 import {
   readHookInput
-} from "../chunk-5ZR7XFTB.js";
-import "../chunk-QMMOVPUP.js";
+} from "../chunk-LSB66XQC.js";
+import "../chunk-2FOAQ64R.js";
 import "../chunk-VTR4VRL2.js";
-import "../chunk-TYPQUHIS.js";
-import "../chunk-LY3KHTHS.js";
-import "../chunk-5LLH2TBR.js";
-import "../chunk-VWTCGKMU.js";
+import "../chunk-CJQEJWLU.js";
+import "../chunk-OUWDJIJF.js";
+import "../chunk-LRLF6PZ2.js";
+import "../chunk-AVQ6ETA7.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-TQE5VIDJ.js";
-import "../chunk-TWCWRHNK.js";
-import "../chunk-KN5ULH4O.js";
-import "../chunk-MRMIGVUI.js";
-import "../chunk-MTODICDT.js";
+import "../chunk-BJMVQ6D5.js";
+import "../chunk-TJXCBTL4.js";
+import "../chunk-UM2HNUJA.js";
+import "../chunk-WJUYWTNT.js";
+import "../chunk-BUOLA2AM.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-4LIOV4YP.js";
-import "../chunk-VGVMBY4V.js";
-import "../chunk-CSXWXXFJ.js";
-import "../chunk-AT4URLSU.js";
+import "../chunk-GMVZYB3W.js";
+import "../chunk-OSVDGVLL.js";
+import "../chunk-KMTSU366.js";
+import "../chunk-Y3OZ3CT6.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-ZWDXBLEZ.js";
-import "../chunk-MSKJRRHY.js";
-import "../chunk-W4LNR7LP.js";
-import "../chunk-U4Q3AKLU.js";
+import "../chunk-GVIPEBEL.js";
+import "../chunk-TILXDMUR.js";
+import "../chunk-35CMXPES.js";
+import "../chunk-YFEHKEGQ.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-UWEDDQHU.js";
-import "../chunk-YTTPPJZW.js";
+import "../chunk-S3DP6DCZ.js";
+import "../chunk-CBOHZ6NY.js";
 import "../chunk-AQFEP65J.js";
-import "../chunk-XTTMUQ4Z.js";
-import "../chunk-Z5AAPX3O.js";
-import "../chunk-ZQZRBPTP.js";
+import "../chunk-TXKAPRIA.js";
+import "../chunk-QOMUEL44.js";
+import "../chunk-H7QTZTIE.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,39 +5,39 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-UQTQVH5X.js";
+} from "../chunk-5L7H32JK.js";
 import {
   createIo
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-JXOCD4MG.js";
+} from "../chunk-XH7NMH3Q.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-MTODICDT.js";
+} from "../chunk-BUOLA2AM.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-4LIOV4YP.js";
+import "../chunk-GMVZYB3W.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-UWEDDQHU.js";
+import "../chunk-S3DP6DCZ.js";
 import {
   claudeSettings
-} from "../chunk-YTTPPJZW.js";
+} from "../chunk-CBOHZ6NY.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-AQFEP65J.js";
-import "../chunk-XTTMUQ4Z.js";
-import "../chunk-Z5AAPX3O.js";
+import "../chunk-TXKAPRIA.js";
+import "../chunk-QOMUEL44.js";
 import {
   isRecord
-} from "../chunk-ZQZRBPTP.js";
+} from "../chunk-H7QTZTIE.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,39 +8,39 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-M463H5LN.js";
+} from "../chunk-PRVG3COH.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-LOVDPKUU.js";
+} from "../chunk-AZMHKUUU.js";
 import {
   claudeTranscriptPath,
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-QMMOVPUP.js";
+} from "../chunk-2FOAQ64R.js";
 import "../chunk-VTR4VRL2.js";
 import {
   ensureDaemonRunning
-} from "../chunk-TYPQUHIS.js";
+} from "../chunk-CJQEJWLU.js";
 import {
   encryptRecord
-} from "../chunk-LY3KHTHS.js";
-import "../chunk-5LLH2TBR.js";
+} from "../chunk-OUWDJIJF.js";
+import "../chunk-LRLF6PZ2.js";
 import {
   transcriptsEnabled
-} from "../chunk-VWTCGKMU.js";
+} from "../chunk-AVQ6ETA7.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
-import "../chunk-TWCWRHNK.js";
-import "../chunk-KN5ULH4O.js";
-import "../chunk-MRMIGVUI.js";
-import "../chunk-MTODICDT.js";
+import "../chunk-TJXCBTL4.js";
+import "../chunk-UM2HNUJA.js";
+import "../chunk-WJUYWTNT.js";
+import "../chunk-BUOLA2AM.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-4LIOV4YP.js";
+import "../chunk-GMVZYB3W.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -58,8 +58,8 @@ import {
   reportEvent,
   savePendingCommand,
   scopePathFor
-} from "../chunk-VGVMBY4V.js";
-import "../chunk-CSXWXXFJ.js";
+} from "../chunk-OSVDGVLL.js";
+import "../chunk-KMTSU366.js";
 import {
   askUser,
   cancelQuestion,
@@ -69,36 +69,37 @@ import {
   waitForAnswer,
   waitsForThePhone,
   withdrawQuestion
-} from "../chunk-AT4URLSU.js";
+} from "../chunk-Y3OZ3CT6.js";
 import "../chunk-POFBE6ZY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-ZWDXBLEZ.js";
-import "../chunk-MSKJRRHY.js";
-import "../chunk-W4LNR7LP.js";
+} from "../chunk-GVIPEBEL.js";
+import "../chunk-TILXDMUR.js";
+import "../chunk-35CMXPES.js";
 import {
   getMachineId
-} from "../chunk-U4Q3AKLU.js";
+} from "../chunk-YFEHKEGQ.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-UWEDDQHU.js";
-import "../chunk-YTTPPJZW.js";
+import "../chunk-S3DP6DCZ.js";
+import "../chunk-CBOHZ6NY.js";
 import "../chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-XTTMUQ4Z.js";
+} from "../chunk-TXKAPRIA.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-Z5AAPX3O.js";
+} from "../chunk-QOMUEL44.js";
 import {
   DECISION_STOP_REASON,
+  HAND_BACK_WITHOUT_A_PROMPT,
   KILL_REASON,
   UNVERIFIABLE_APPROVAL_REASON,
   redactSecretsFromContent,
   resolveGate,
   timeoutActionWithoutLocalPrompt
-} from "../chunk-ZQZRBPTP.js";
+} from "../chunk-H7QTZTIE.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {
@@ -553,7 +554,7 @@ var createRemoteApprover = (deps) => {
       }
       answered = answer.answered;
       if (answer.answered) {
-        if (isDeferAnswer(answer.value)) return deny("Deferred \u2014 handle it on the machine");
+        if (isDeferAnswer(answer.value)) return deny(HAND_BACK_WITHOUT_A_PROMPT.reason);
         return answer.value === "yes" ? allow(input) : deny("Denied from your phone");
       }
       if (localHandoff) return deny(NO_LOCAL_APPROVAL_UI);

package/dist/bin/pushary-clean.js

@@ -9,12 +9,12 @@ import {
   planCliKeyRevocations,
   readCliHeldKeys,
   revokeCliKeys
-} from "../chunk-RZNJGCPR.js";
+} from "../chunk-IM73P6JT.js";
 import {
   isCursorPluginLeftover,
   releaseSoleGate,
   withoutPusharyCursorHooks
-} from "../chunk-OXOT3CGW.js";
+} from "../chunk-PX4RRHEB.js";
 import {
   HERMES_PIP_PACKAGE,
   readHermesStatus,
@@ -23,25 +23,25 @@ import {
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-6CBKIF3S.js";
+} from "../chunk-CCI2UBYR.js";
 import {
   planFxRemoval,
   removeInstructionBlock
-} from "../chunk-BZYYTJ65.js";
-import "../chunk-JK42X2VL.js";
+} from "../chunk-2XM4TGIM.js";
+import "../chunk-NRV5PIPA.js";
 import {
   disableDaemonService
-} from "../chunk-TYPQUHIS.js";
+} from "../chunk-CJQEJWLU.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-O2SMA3JN.js";
+import "../chunk-7MYGOFVX.js";
 import {
   macAppKeepsMcpEntry,
   mcpServerBearer,
   pusharyKey,
   readMacAppAgentKey,
   setupReceiptKey
-} from "../chunk-IOTR2VQN.js";
-import "../chunk-HFGTWPAD.js";
+} from "../chunk-BKOWTW5P.js";
+import "../chunk-ETLVZHRG.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -53,14 +53,14 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-5SKHXKIF.js";
+} from "../chunk-BP3WMLXJ.js";
 import {
   ansiPainter,
   useColor
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-JXOCD4MG.js";
+} from "../chunk-XH7NMH3Q.js";
 import {
   compatibleConfigFile,
   compatibleInstructionsFile,
@@ -73,7 +73,7 @@ import {
   removePusharySettings,
   removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-TQE5VIDJ.js";
+} from "../chunk-BJMVQ6D5.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
@@ -81,12 +81,12 @@ import {
   resolveBridgeStub,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-TWCWRHNK.js";
+} from "../chunk-TJXCBTL4.js";
 import {
   removeGeminiSettings
-} from "../chunk-KN5ULH4O.js";
-import "../chunk-MRMIGVUI.js";
-import "../chunk-MTODICDT.js";
+} from "../chunk-UM2HNUJA.js";
+import "../chunk-WJUYWTNT.js";
+import "../chunk-BUOLA2AM.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
@@ -96,20 +96,20 @@ import {
   isDisabledExport,
   removeClaudeAlias,
   shellProfileCandidates
-} from "../chunk-4LIOV4YP.js";
-import "../chunk-VGVMBY4V.js";
-import "../chunk-CSXWXXFJ.js";
-import "../chunk-AT4URLSU.js";
+} from "../chunk-GMVZYB3W.js";
+import "../chunk-OSVDGVLL.js";
+import "../chunk-KMTSU366.js";
+import "../chunk-Y3OZ3CT6.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-ZWDXBLEZ.js";
-import "../chunk-MSKJRRHY.js";
-import "../chunk-W4LNR7LP.js";
-import "../chunk-U4Q3AKLU.js";
+import "../chunk-GVIPEBEL.js";
+import "../chunk-TILXDMUR.js";
+import "../chunk-35CMXPES.js";
+import "../chunk-YFEHKEGQ.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-UWEDDQHU.js";
+import "../chunk-S3DP6DCZ.js";
 import {
   claudeJson,
   claudeMcpReceipt,
@@ -146,14 +146,14 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-YTTPPJZW.js";
+} from "../chunk-CBOHZ6NY.js";
 import "../chunk-AQFEP65J.js";
 import {
   getBaseUrl
-} from "../chunk-XTTMUQ4Z.js";
+} from "../chunk-TXKAPRIA.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-Z5AAPX3O.js";
+} from "../chunk-QOMUEL44.js";
 import {
   CLI_PACKAGE_NAMES,
   HOOK_COMPATIBLE_PROFILES,
@@ -165,7 +165,7 @@ import {
   globalRootFor,
   isValidApiKey,
   redactSecrets
-} from "../chunk-ZQZRBPTP.js";
+} from "../chunk-H7QTZTIE.js";
 
 // bin/pushary-clean.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync4 } from "fs";

package/dist/bin/pushary-codex-bridge.js

@@ -5,10 +5,10 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-W4DFSUZG.js";
+} from "../chunk-UW37WHVP.js";
 import {
   resolveProviderBinary
-} from "../chunk-NK2URK5A.js";
+} from "../chunk-M2L4EHYW.js";
 import "../chunk-RIVNNBEK.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
@@ -16,50 +16,50 @@ import {
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-M463H5LN.js";
-import "../chunk-LY3KHTHS.js";
-import "../chunk-5LLH2TBR.js";
+} from "../chunk-PRVG3COH.js";
+import "../chunk-OUWDJIJF.js";
+import "../chunk-LRLF6PZ2.js";
 import {
   transcriptsEnabled
-} from "../chunk-VWTCGKMU.js";
+} from "../chunk-AVQ6ETA7.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-4LIOV4YP.js";
+import "../chunk-GMVZYB3W.js";
 import {
   isAskUserResponse,
   isDecisionStopped,
   isWaitForAnswerResponse,
   withdrawQuestion,
   writeDegraded
-} from "../chunk-AT4URLSU.js";
+} from "../chunk-Y3OZ3CT6.js";
 import "../chunk-POFBE6ZY.js";
 import {
   callMcpTool
-} from "../chunk-ZWDXBLEZ.js";
-import "../chunk-MSKJRRHY.js";
-import "../chunk-W4LNR7LP.js";
+} from "../chunk-GVIPEBEL.js";
+import "../chunk-TILXDMUR.js";
+import "../chunk-35CMXPES.js";
 import {
   getMachineId
-} from "../chunk-U4Q3AKLU.js";
+} from "../chunk-YFEHKEGQ.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-UWEDDQHU.js";
-import "../chunk-YTTPPJZW.js";
+import "../chunk-S3DP6DCZ.js";
+import "../chunk-CBOHZ6NY.js";
 import "../chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-XTTMUQ4Z.js";
-import "../chunk-Z5AAPX3O.js";
+} from "../chunk-TXKAPRIA.js";
+import "../chunk-QOMUEL44.js";
 import {
   elicitationContent,
   parseAgentQuestion,
   parseAgentQuestionAnswers,
   planElicitationAsk,
   readElicitationFields
-} from "../chunk-ZQZRBPTP.js";
+} from "../chunk-H7QTZTIE.js";
 
 // bin/pushary-codex-bridge.ts
 import { existsSync } from "fs";

package/dist/bin/pushary-codex-hook.js

@@ -1,40 +1,40 @@
 #!/usr/bin/env node
 import {
   takeHookHoldBudget
-} from "../chunk-4LO6OQZ4.js";
+} from "../chunk-L7PGUSAU.js";
 import {
   defersToNativeMode,
   reportMachineDenial
-} from "../chunk-E4NITECV.js";
+} from "../chunk-WLDFMVRY.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-LUJAURFP.js";
+} from "../chunk-CPZZTS4I.js";
 import {
   triggerAutoUpdate
-} from "../chunk-WGTD4NZV.js";
+} from "../chunk-62LJB5U3.js";
 import {
   readHookInput
-} from "../chunk-5ZR7XFTB.js";
+} from "../chunk-LSB66XQC.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-LOVDPKUU.js";
-import "../chunk-QMMOVPUP.js";
+} from "../chunk-AZMHKUUU.js";
+import "../chunk-2FOAQ64R.js";
 import "../chunk-VTR4VRL2.js";
-import "../chunk-TYPQUHIS.js";
-import "../chunk-LY3KHTHS.js";
-import "../chunk-5LLH2TBR.js";
-import "../chunk-VWTCGKMU.js";
+import "../chunk-CJQEJWLU.js";
+import "../chunk-OUWDJIJF.js";
+import "../chunk-LRLF6PZ2.js";
+import "../chunk-AVQ6ETA7.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-TQE5VIDJ.js";
-import "../chunk-TWCWRHNK.js";
-import "../chunk-KN5ULH4O.js";
-import "../chunk-MRMIGVUI.js";
-import "../chunk-MTODICDT.js";
+import "../chunk-BJMVQ6D5.js";
+import "../chunk-TJXCBTL4.js";
+import "../chunk-UM2HNUJA.js";
+import "../chunk-WJUYWTNT.js";
+import "../chunk-BUOLA2AM.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-4LIOV4YP.js";
+import "../chunk-GMVZYB3W.js";
 import {
   CODEX_AGENT,
   DEFAULT_SESSION,
@@ -78,8 +78,8 @@ import {
   toPolicyLookup,
   toPolicyLookups,
   userScope
-} from "../chunk-VGVMBY4V.js";
-import "../chunk-CSXWXXFJ.js";
+} from "../chunk-OSVDGVLL.js";
+import "../chunk-KMTSU366.js";
 import {
   askUser,
   cancelQuestion,
@@ -92,31 +92,31 @@ import {
   sendNotification,
   unavailableQuestionUnlessSubscriptionRequired,
   waitForQuestion
-} from "../chunk-AT4URLSU.js";
+} from "../chunk-Y3OZ3CT6.js";
 import "../chunk-POFBE6ZY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-ZWDXBLEZ.js";
-import "../chunk-MSKJRRHY.js";
-import "../chunk-W4LNR7LP.js";
+} from "../chunk-GVIPEBEL.js";
+import "../chunk-TILXDMUR.js";
+import "../chunk-35CMXPES.js";
 import {
   getMachineId
-} from "../chunk-U4Q3AKLU.js";
+} from "../chunk-YFEHKEGQ.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-UWEDDQHU.js";
+import "../chunk-S3DP6DCZ.js";
 import {
   canonicalJson
-} from "../chunk-YTTPPJZW.js";
+} from "../chunk-CBOHZ6NY.js";
 import {
   writeFileAtomic
 } from "../chunk-AQFEP65J.js";
 import {
   getApiKey
-} from "../chunk-XTTMUQ4Z.js";
-import "../chunk-Z5AAPX3O.js";
+} from "../chunk-TXKAPRIA.js";
+import "../chunk-QOMUEL44.js";
 import {
   CODEX_RESCUE_TOOL_NAME,
   DECISION_STOP_REASON,
@@ -140,7 +140,7 @@ import {
   resolveGate,
   scopeBreachReasonOf,
   unapprovedScopeReason
-} from "../chunk-ZQZRBPTP.js";
+} from "../chunk-H7QTZTIE.js";
 
 // bin/pushary-codex-hook.ts
 import { basename } from "path";
@@ -692,7 +692,7 @@ var scopeQuestionOf = (verdict) => {
 var codexDeliveryMode = (policyMode, noPromptOfItsOwn) => noPromptOfItsOwn ? approvalModeWithoutLocalPrompt(policyMode) : policyMode;
 var unansweredOutcome = (scope, fallback) => scope ? codexDeny(unapprovedScopeReason(scope.reason)) : fallback;
 var codexDecisionOf = (ending) => ending.kind === "deny" ? codexDeny(ending.reason) : codexPass();
-var deferredPreToolUse = (scope, input) => unansweredOutcome(scope, codexDecisionOf(codexDeferredPreToolUse(!codexHasNoPromptOfItsOwn(scope?.reason, input.permission_mode))));
+var deferredPreToolUse = (scope) => unansweredOutcome(scope, codexDecisionOf(codexDeferredPreToolUse()));
 var unansweredPreToolUse = (toolPolicy, input, fullWindowServed) => codexDecisionOf(codexUnansweredPreToolUse({
   mode: toolPolicy.mode,
   timeoutAction: toolPolicy.timeoutAction,
@@ -751,7 +751,7 @@ var decidePreToolUse = async (input) => {
       if (isDecisionStopped(answer)) return codexDeny(DECISION_STOP_REASON);
       if (localHandoff) return recordPreToolUse(callKey, unansweredOutcome(scope, unansweredPreToolUse(toolPolicy, input, false)));
       if (answer.answered) {
-        if (isDeferAnswer(answer.value)) return recordPreToolUse(callKey, deferredPreToolUse(scope, input));
+        if (isDeferAnswer(answer.value)) return recordPreToolUse(callKey, deferredPreToolUse(scope));
         if (answer.value === "yes") return recordApproval(callKey, input);
         return recordPreToolUse(callKey, codexDeny(denyReasonFrom(answer.value, answer.note)));
       }
@@ -769,7 +769,7 @@ var decidePreToolUse = async (input) => {
 };
 var repairCodexHoldsQuietly = async () => {
   try {
-    const { repairCodexHolds } = await import("../reapply-CTJZBUJY.js");
+    const { repairCodexHolds } = await import("../reapply-I4YMQP7F.js");
     repairCodexHolds();
   } catch {
     return;

package/dist/bin/pushary-codex.js

@@ -1,32 +1,32 @@
 #!/usr/bin/env node
 import {
   reportEvent
-} from "../chunk-VGVMBY4V.js";
-import "../chunk-CSXWXXFJ.js";
+} from "../chunk-OSVDGVLL.js";
+import "../chunk-KMTSU366.js";
 import {
   askUser,
   isDecisionStopped,
   waitForAnswer
-} from "../chunk-AT4URLSU.js";
+} from "../chunk-Y3OZ3CT6.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-ZWDXBLEZ.js";
-import "../chunk-MSKJRRHY.js";
-import "../chunk-W4LNR7LP.js";
+import "../chunk-GVIPEBEL.js";
+import "../chunk-TILXDMUR.js";
+import "../chunk-35CMXPES.js";
 import {
   getMachineId
-} from "../chunk-U4Q3AKLU.js";
+} from "../chunk-YFEHKEGQ.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-UWEDDQHU.js";
-import "../chunk-YTTPPJZW.js";
+import "../chunk-S3DP6DCZ.js";
+import "../chunk-CBOHZ6NY.js";
 import "../chunk-AQFEP65J.js";
 import {
   getApiKey
-} from "../chunk-XTTMUQ4Z.js";
+} from "../chunk-TXKAPRIA.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-Z5AAPX3O.js";
-import "../chunk-ZQZRBPTP.js";
+} from "../chunk-QOMUEL44.js";
+import "../chunk-H7QTZTIE.js";
 
 // bin/pushary-codex.ts
 import { basename } from "path";