@pushary/agent-hooks 1.9.5 → 1.9.6

package/dist/{chunk-FQKFONAS.js → chunk-75CA37FZ.js}

@@ -1,9 +1,9 @@
 import {
   configFilePath
-} from "./chunk-2DSUVY6R.js";
+} from "./chunk-2QRE6QH2.js";
 import {
   normalizeInstallSource
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/install-source.ts
 import { readFileSync } from "fs";

package/dist/{chunk-7AV2KBZC.js → chunk-7JTVYR5B.js}

@@ -1,6 +1,6 @@
 import {
   getBaseUrl
-} from "./chunk-2DSUVY6R.js";
+} from "./chunk-2QRE6QH2.js";
 
 // src/transcript-api.ts
 var fetchTranscriptRecipients = async (apiKey, baseUrl = getBaseUrl()) => {

package/dist/{chunk-ZJSII7OP.js → chunk-BSZ7VBVT.js}

@@ -1,15 +1,15 @@
 import {
   activeHookSource,
   activeIdentity
-} from "./chunk-NH63BTRO.js";
+} from "./chunk-TE5M6GGK.js";
 import {
   defersToNativeMode,
   reportMachineDenial
-} from "./chunk-VZGCXECP.js";
+} from "./chunk-BVCHY4OY.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-M7MMZURA.js";
+} from "./chunk-GQHZIBAZ.js";
 import {
   announceSubscriptionRequired,
   denyReasonFrom,
@@ -39,7 +39,7 @@ import {
   reportEvent,
   scopePathFor,
   settleQuestionsForToolUse
-} from "./chunk-JSVBVV2Q.js";
+} from "./chunk-CCDVL63C.js";
 import {
   DEFAULT_SESSION
 } from "./chunk-N6IOSZOE.js";
@@ -55,20 +55,20 @@ import {
   requestGate,
   sendNotification,
   waitForQuestion
-} from "./chunk-UM7DXK6V.js";
+} from "./chunk-WN6WYUCV.js";
 import {
   SubscriptionRequiredError
-} from "./chunk-CV2IAVD5.js";
+} from "./chunk-ZPW4MJOV.js";
 import {
   getMachineId
-} from "./chunk-K2J6OGGN.js";
+} from "./chunk-3BUAEQCY.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-2DSUVY6R.js";
+} from "./chunk-2QRE6QH2.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-HOTK2D2S.js";
+} from "./chunk-L6USMDTW.js";
 import {
   AGENT_QUESTION_STRATEGY,
   GATE_BLOCK_REASON_MAX_LENGTH,
@@ -96,7 +96,7 @@ import {
   parseAgentQuestions,
   resolveGate,
   stoppedOutput
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/claude-permission-rules.ts
 import { readFileSync, statSync } from "fs";

package/dist/{chunk-VZGCXECP.js → chunk-BVCHY4OY.js}

@@ -5,7 +5,7 @@ import {
   permissionDeniedAction,
   releaseThrottle,
   reportEvent
-} from "./chunk-JSVBVV2Q.js";
+} from "./chunk-CCDVL63C.js";
 import {
   DEFAULT_SESSION
 } from "./chunk-N6IOSZOE.js";
@@ -13,7 +13,7 @@ import {
   machineDecisionFor,
   shouldDeferToNativeMode,
   wireVerdictFor
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/machine-decision-audit.ts
 import { basename } from "path";

package/dist/{chunk-UQBJTGLX.js → chunk-CBVDW2N6.js}

@@ -1,6 +1,6 @@
 import {
   SETUP_FLAGS
-} from "./chunk-ZW7KE2GP.js";
+} from "./chunk-SPXBXN23.js";
 import {
   parseFlags
 } from "./chunk-GMXKITVA.js";
@@ -9,7 +9,7 @@ import {
 } from "./chunk-7QLSKOSU.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-HOTK2D2S.js";
+} from "./chunk-L6USMDTW.js";
 import {
   CLAUDE_CONNECTOR_GUIDE,
   CLAUDE_CONNECTOR_STEPS,
@@ -17,7 +17,7 @@ import {
   CLAUDE_CONNECTOR_URL,
   COWORK_CONNECTOR_LIMIT,
   COWORK_STANDING_INSTRUCTIONS
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/cli/cowork.ts
 import { readFileSync } from "fs";

package/dist/{chunk-JSVBVV2Q.js → chunk-CCDVL63C.js}

@@ -14,36 +14,36 @@ import {
   IDLE_PROMPT_NOTIFICATION,
   NOTIFICATION_PUSH_TYPES,
   POSTTOOLUSE_MIRROR_ONLY_TOOLS
-} from "./chunk-KSJCYP4I.js";
+} from "./chunk-DJ4BB264.js";
 import {
   cancelQuestion,
   isPolicyConfig,
   sendNotification,
   waitForAnswer
-} from "./chunk-UM7DXK6V.js";
+} from "./chunk-WN6WYUCV.js";
 import {
   clientErrorKindOf,
   reportClientError
-} from "./chunk-CPMVKL6H.js";
+} from "./chunk-DA4FTGTK.js";
 import {
   withRetry
-} from "./chunk-CV2IAVD5.js";
+} from "./chunk-ZPW4MJOV.js";
 import {
   getMachineId
-} from "./chunk-K2J6OGGN.js";
+} from "./chunk-3BUAEQCY.js";
 import {
   reportedInstallSource
-} from "./chunk-FQKFONAS.js";
+} from "./chunk-75CA37FZ.js";
 import {
   canonicalJson
-} from "./chunk-ZBF5WAP7.js";
+} from "./chunk-HJXZJF6O.js";
 import {
   writeFileAtomic
 } from "./chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-2DSUVY6R.js";
+} from "./chunk-2QRE6QH2.js";
 import {
   ACTION_BODY_MAX,
   AGENT_LABELS_BY_TYPE,
@@ -70,7 +70,7 @@ import {
   resolvePolicy,
   toToolLookup,
   truncateLine
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/policy.ts
 import { createHash } from "crypto";

package/dist/{chunk-RKEVFUBN.js → chunk-D7SOOVHX.js}

@@ -2,17 +2,17 @@ import {
   CLAUDE_HOOK_EVENTS,
   GEMINI_HOOK_EVENTS,
   hasGeminiHooks
-} from "./chunk-NI2BRIHL.js";
+} from "./chunk-UKNKYTTY.js";
 import {
   CODEX_HOOK_EVENTS,
   hasCodexHooks,
   holdBudgetOf
-} from "./chunk-ZBF5WAP7.js";
+} from "./chunk-HJXZJF6O.js";
 import {
   CURSOR_GATE_EVENTS,
   HOOK_LOCATOR_BINARY,
   hookCommandHoldBudget
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/diagnostics/wiring.ts
 var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;

package/dist/{chunk-CPMVKL6H.js → chunk-DA4FTGTK.js}

@@ -4,18 +4,18 @@ import {
 } from "./chunk-POFBE6ZY.js";
 import {
   isNetworkFailure
-} from "./chunk-ELQAQZNO.js";
+} from "./chunk-W4Q7NFXU.js";
 import {
   clientReportClaims
-} from "./chunk-ZBF5WAP7.js";
+} from "./chunk-HJXZJF6O.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-2DSUVY6R.js";
+} from "./chunk-2QRE6QH2.js";
 import {
   CLIENT_REPORT_PATH,
   degradedLine
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/client-report-claim.ts
 import { createHash } from "crypto";

package/dist/{chunk-FYEQSB6N.js → chunk-DGQTJDSJ.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-3EGEA4KH.js";
 import {
   getBaseUrl
-} from "./chunk-2DSUVY6R.js";
+} from "./chunk-2QRE6QH2.js";
 
 // src/cli/login-ui.ts
 import { hostname } from "os";

package/dist/{chunk-KSJCYP4I.js → chunk-DJ4BB264.js}

@@ -1,6 +1,6 @@
 import {
   PRETOOLUSE_GATED_TOOLS
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/claude-tools.ts
 var POSTTOOLUSE_MIRROR_ONLY_TOOLS = ["TodoWrite", "Task", "WebFetch", "WebSearch"];

package/dist/{chunk-QEY4SCXT.js → chunk-EVFY3VE6.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_HOLD_BUDGET_ENV,
   hookHoldBudgetProof
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/hold-budget.ts
 var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {

package/dist/{chunk-LSYSKKWW.js → chunk-EZAFBC2C.js}

@@ -2,7 +2,7 @@ import {
   autoUpdateLock,
   installPackageGlobally,
   npmErrorMessage
-} from "./chunk-ZBF5WAP7.js";
+} from "./chunk-HJXZJF6O.js";
 import {
   writeJsonAtomic
 } from "./chunk-T7E75EKA.js";

package/dist/{chunk-4LVFBQJ3.js → chunk-F56SB65Y.js}

@@ -3,11 +3,11 @@ import {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-IX5EFNCI.js";
+} from "./chunk-5AXCOTIT.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-7AV2KBZC.js";
+} from "./chunk-7JTVYR5B.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;

package/dist/{chunk-6WKOOF2H.js → chunk-FBD3QGVJ.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   renderCommandHelp
-} from "./chunk-HOTK2D2S.js";
+} from "./chunk-L6USMDTW.js";
 import {
   getPackageVersion
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/cli/usage.ts
 var exitOnHelpFlag = (command) => {

package/dist/{chunk-M7MMZURA.js → chunk-GQHZIBAZ.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-ZBF5WAP7.js → chunk-HJXZJF6O.js}

@@ -13,7 +13,7 @@ import {
   isReleaseVersion,
   ownPackageName,
   withHookHoldBudget
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/setup/paths.ts
 import { homedir as homedir2 } from "os";
@@ -365,9 +365,9 @@ var installGlobally = (options) => {
   }
   const started = (async () => {
     if (!npmIsOnPath()) throw new NpmMissingError();
-    const { withUpgradeLock } = await import("./global-upgrade-GWD4OADP.js");
-    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-HQP6XCER.js");
-    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-MJGE4UFY.js");
+    const { withUpgradeLock } = await import("./global-upgrade-7F5RP45B.js");
+    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-AHRBA66K.js");
+    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-MELXIVBO.js");
     let result = "skipped";
     const install = async () => {
       const platform = process.platform;

package/dist/{chunk-ORBTANP2.js → chunk-HT3WMM6Q.js}

@@ -4,7 +4,7 @@ import {
 import {
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-L5XJZKF2.js";
+} from "./chunk-4QKM44N6.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";

package/dist/{chunk-2PFD44YK.js → chunk-HWQNQVY6.js}

@@ -1,9 +1,9 @@
 import {
   registerTranscript
-} from "./chunk-V3ASMZLF.js";
+} from "./chunk-VRT3EEZN.js";
 import {
   writeDegraded
-} from "./chunk-CPMVKL6H.js";
+} from "./chunk-DA4FTGTK.js";
 
 // src/tool-hook-input.ts
 var OPTIONAL_TEXT_FIELDS = ["hook_event_name", "session_id", "cwd", "transcript_path", "tool_use_id", "permission_mode"];

package/dist/{chunk-FNOY2K4N.js → chunk-IMGJYFCX.js}

@@ -8,10 +8,10 @@ import {
   codexHooksJsonIn,
   isPusharyCodexCommand,
   resolvePathBinary
-} from "./chunk-ZBF5WAP7.js";
+} from "./chunk-HJXZJF6O.js";
 import {
   getPackageVersion
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/codex-app-server.ts
 import { existsSync, realpathSync } from "fs";

package/dist/{chunk-V3TD72QA.js → chunk-IR5FRUPQ.js}

@@ -1,17 +1,17 @@
 import {
   CLAUDE_HOOK_EVENTS,
   supportedClaudeEvents
-} from "./chunk-NI2BRIHL.js";
+} from "./chunk-UKNKYTTY.js";
 import {
   guardBinary,
   holdBudgetOf,
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-ZBF5WAP7.js";
+} from "./chunk-HJXZJF6O.js";
 import {
   HOOK_LOCATOR_BINARY,
   withHookHoldBudget
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/claude-config.ts
 import { join } from "path";

package/dist/{chunk-G7CZUI4G.js → chunk-JUFKJCZG.js}

@@ -1,6 +1,6 @@
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-HOTK2D2S.js";
+} from "./chunk-L6USMDTW.js";
 
 // src/setup/codex-trust.ts
 var CODEX_TRUST_TELEMETRY = {

package/dist/{chunk-XXBOA4ZL.js → chunk-KK54WQ74.js}

@@ -1,6 +1,6 @@
 import {
   readTranscriptPreference
-} from "./chunk-5DU7LJ7L.js";
+} from "./chunk-5BHROGRB.js";
 
 // src/transcript-setting.ts
 var transcriptEnvironmentPreference = () => {

package/dist/{chunk-HOTK2D2S.js → chunk-L6USMDTW.js}

@@ -1,6 +1,6 @@
 import {
   SETUP_AGENT_CHOICES
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/cli/commands.ts
 var NPX_LATEST_COMMAND = "npx pushary@latest";

package/dist/{chunk-NUYECJ57.js → chunk-LBLCFD5K.js}

@@ -1,6 +1,6 @@
 import {
   readConfigFileKey
-} from "./chunk-5DU7LJ7L.js";
+} from "./chunk-5BHROGRB.js";
 
 // src/bell/fleet.ts
 import { closeSync, constants, futimesSync, lstatSync, mkdirSync, openSync, readdirSync, unlinkSync } from "fs";

package/dist/{chunk-6OUATBSK.js → chunk-MKJ3RTUS.js}

@@ -10,10 +10,10 @@ import {
   resolvePackageVersionFromBinary,
   resolvePathBinary,
   resolvePathBinaryAsync
-} from "./chunk-ZBF5WAP7.js";
+} from "./chunk-HJXZJF6O.js";
 import {
   MANAGED_PROVIDERS
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/setup/codex-install.ts
 var NATIVE_BINARY_MIN_BYTES = 20 * 1024 * 1024;

package/dist/{chunk-3Z7NUGXO.js → chunk-NVGDMTX3.js}

@@ -1,15 +1,15 @@
 import {
   AGENT_CHOICES
-} from "./chunk-ZW7KE2GP.js";
+} from "./chunk-SPXBXN23.js";
 import {
   isBridgeLocator
-} from "./chunk-5T65DZBH.js";
+} from "./chunk-SJN22ADZ.js";
 import {
   pusharyHookExecutable
-} from "./chunk-RKEVFUBN.js";
+} from "./chunk-D7SOOVHX.js";
 import {
   BELL_HOOK_BINARY
-} from "./chunk-23R4BMUP.js";
+} from "./chunk-Q23MMVTD.js";
 
 // src/setup/hook-ownership.ts
 var commandsIn = (value) => {

package/dist/{chunk-LBTOB7Z7.js → chunk-PYZC54KA.js}

@@ -3,7 +3,7 @@ import {
   finishWithUpgradeLock,
   installWithUpgradeLock,
   releaseAutoUpdateLock
-} from "./chunk-LSYSKKWW.js";
+} from "./chunk-EZAFBC2C.js";
 import {
   describeAutoUpdateCheck,
   globalInstallLocation,
@@ -11,7 +11,7 @@ import {
   readAutoUpdateState,
   updateAutoUpdateState,
   upgradeEntryFor
-} from "./chunk-Q6KNNFGG.js";
+} from "./chunk-SNJ3BOCP.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
@@ -24,10 +24,10 @@ import {
   npmErrorMessage,
   readGlobalCliInstallAt,
   readGlobalPrefix
-} from "./chunk-ZBF5WAP7.js";
+} from "./chunk-HJXZJF6O.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-HOTK2D2S.js";
+} from "./chunk-L6USMDTW.js";
 import {
   commandsPackage,
   globalUpgradeEntry,
@@ -36,7 +36,7 @@ import {
   isSameMajorVersion,
   ownPackageRoot,
   packageVersionAt
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/global-upgrade.ts
 import { existsSync } from "fs";

package/dist/{chunk-23R4BMUP.js → chunk-Q23MMVTD.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-ZBF5WAP7.js";
+} from "./chunk-HJXZJF6O.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-SBR2UKUO.js → chunk-Q4E56K4X.js}

@@ -520,6 +520,8 @@ var redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE.
 
 // ../contracts/src/shell-analysis.ts
 var SHELL_WORD_SEPARATOR = /[ \t\n]/;
+var ARITHMETIC_EVALUATING_EXPANSION = /\$[#+=~^]*(?:[A-Za-z_][A-Za-z0-9_]*|[0-9]+|[-?$!@*#])?\[/;
+var VISIBLE_ESCAPE = /\\[\s\S]/g;
 var trimShellWhitespace = (command) => command.replace(/^[ \t\n]+|[ \t\n]+$/g, "");
 var DOUBLE_QUOTE_ESCAPABLE = /* @__PURE__ */ new Set(['"', "\\", "$", "`"]);
 var SEGMENT_SEPARATORS = /* @__PURE__ */ new Set([";", "\n", "&", "|"]);
@@ -576,6 +578,14 @@ var shellVisibleText = (command) => {
   }
   return visible;
 };
+var isInertOutsideExpansion = ({ quote, kind }) => kind === "escape" || kind === "text" && quote === "'";
+var opensArithmeticEvaluation = (command) => {
+  const lexemes = scanShell(command);
+  if (lexemes === null) return true;
+  const expandableText = lexemes.map((lexeme) => isInertOutsideExpansion(lexeme) ? "_".repeat(lexeme.text.length) : lexeme.text).join("");
+  return ARITHMETIC_EVALUATING_EXPANSION.test(expandableText);
+};
+var withoutShellEscapes = (visible) => visible.replace(VISIBLE_ESCAPE, (escape) => "_".repeat(escape.length));
 var shellWordsOf = (command) => {
   const lexemes = scanShell(command);
   if (lexemes === null) return null;
@@ -1047,7 +1057,6 @@ var SAFE_SHELL_COMMANDS = /* @__PURE__ */ new Set([
   "tail",
   "wc",
   "echo",
-  "printf",
   "which",
   "type",
   "whoami",
@@ -1220,6 +1229,7 @@ var isSafeSimpleCommand = (segment) => {
   }
   if (exe === "sed") return isPrintOnlySed(tokens.slice(1));
   if (exe === "date") return isReadOnlyDate(tokens.slice(1));
+  if (exe === "printf") return isOutputOnlyPrintf(tokens.slice(1));
   return SAFE_SHELL_COMMANDS.has(exe);
 };
 var SED_PRINT_ONLY_SCRIPT = /^(?:\d+|\$)(?:,(?:\d+|\$))?p$/;
@@ -1229,11 +1239,12 @@ var DATE_UTC_FLAG = "-u";
 var isFlagToken = (token) => token.startsWith("-");
 var isPrintOnlySed = (args) => args[0] === SED_QUIET_FLAG && SED_PRINT_ONLY_SCRIPT.test(args[1] ?? "") && !args.slice(2).some(isFlagToken);
 var isReadOnlyDate = (args) => args.every((arg) => arg.startsWith(DATE_FORMAT_PREFIX) || arg === DATE_UTC_FLAG);
+var isOutputOnlyPrintf = (args) => args[0] === END_OF_OPTIONS || !isFlagToken(args[0] ?? "");
 var READ_ONLY_SEGMENT_SEPARATOR = /&&|\|\||[;|]/g;
 var PIPELINE_CHAIN_SEPARATOR = /&&|\|\||;/g;
 var EXPANSION_THAT_CAN_BECOME_A_FLAG = /\$|(?:^|\s)[*?[]/;
 var SHELL_QUOTE_CHARACTERS = /['"]/g;
-var INSPECTED_ARGUMENT_COMMANDS = /* @__PURE__ */ new Set(["git", "find", "sed", "date"]);
+var INSPECTED_ARGUMENT_COMMANDS = /* @__PURE__ */ new Set(["git", "find", "sed", "date", "printf"]);
 var argumentsMayExpand = (segment) => {
   const visible = shellVisibleText(segment);
   return visible === null || EXPANSION_THAT_CAN_BECOME_A_FLAG.test(visible.replace(SHELL_QUOTE_CHARACTERS, ""));
@@ -1242,7 +1253,7 @@ var blankedSafeRedirections = (text) => text.replace(SAFE_REDIRECTION, (redirect
 var segmentsSplitWhereVisible = (command, visible, separators) => {
   const segments = [];
   let start = 0;
-  for (const separator of visible.matchAll(separators)) {
+  for (const separator of withoutShellEscapes(visible).matchAll(separators)) {
     segments.push(command.slice(start, separator.index));
     start = separator.index + separator[0].length;
   }
@@ -1257,6 +1268,7 @@ var isSafeReadOnlyCommand = (command) => {
   if (visible === null || /[`{}]|\$'/.test(visible)) return false;
   if (/\\(?![()!])/.test(visible)) return false;
   if (/(?<!\\)[()]/.test(visible)) return false;
+  if (opensArithmeticEvaluation(trimmed)) return false;
   const visibleWithoutRedirection = blankedSafeRedirections(visible);
   if (/[<>]/.test(visibleWithoutRedirection)) return false;
   if (visibleWithoutRedirection.replace(/&&/g, "  ").includes("&")) return false;

package/dist/{chunk-XEZWDDR5.js → chunk-RDK7FX5F.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-ZBF5WAP7.js";
+} from "./chunk-HJXZJF6O.js";
 import {
   readJsonSafe
 } from "./chunk-T7E75EKA.js";

package/dist/{chunk-GRFV6GPY.js → chunk-RIC6OOJX.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_BUDGETS,
   OPENCODE_APPROVAL_EVENT
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/opencode-plugin.ts
 var OPENCODE_PLUGIN_MARKER = "pushary-opencode-plugin w1";

package/dist/{chunk-5T65DZBH.js → chunk-SJN22ADZ.js}

@@ -1,6 +1,6 @@
 import {
   HOOK_LOCATOR_BINARY
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/diagnostics/bridge.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-Q6KNNFGG.js → chunk-SNJ3BOCP.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-POFBE6ZY.js";
 import {
   autoUpdateState
-} from "./chunk-ZBF5WAP7.js";
+} from "./chunk-HJXZJF6O.js";
 import {
   readJsonSafe,
   writeJsonAtomic
@@ -14,7 +14,7 @@ import {
   cliPackagePathSegments,
   globalUpgradeEntry,
   ownPackageRoot
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/auto-update.ts
 import { spawn } from "child_process";

package/dist/{chunk-ZW7KE2GP.js → chunk-SPXBXN23.js}

@@ -9,7 +9,7 @@ import {
   SETUP_CONNECT_MODES,
   isSetupConnectMode,
   isValidApiKey
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-Q4E56K4X.js";
 
 // src/setup/options.ts
 var AGENT_CHOICES = SETUP_AGENT_CHOICES;