@pushary/agent-hooks 1.9.50 → 1.9.53

package/dist/{chunk-OR5F63C2.js → chunk-LF3TLC7B.js}

@@ -2475,6 +2475,7 @@ var AUTH_REJECTION_REASONS = [
   "expired_key",
   "scope_denied",
   "oauth_rejected",
+  "session_rejected",
   "site_not_found",
   ...AGENT_SITE_REJECTION_REASONS
 ];
@@ -6156,149 +6157,6 @@ var hookActivationResult = (report) => {
   return report && !report.truncated && report.evidence.length === 1 ? report.evidence[0].result : "unverified";
 };
 
-// src/cli-package-name.ts
-var CANONICAL_PACKAGE = "pushary";
-var LEGACY_PACKAGE = "@pushary/agent-hooks";
-var CLI_PACKAGE_NAMES = [CANONICAL_PACKAGE, LEGACY_PACKAGE];
-var isCliPackageName = (value) => typeof value === "string" && CLI_PACKAGE_NAMES.some((name) => name === value);
-var cliPackagePathSegments = (name) => name.split("/");
-
-// src/global-package.ts
-import { posix, win32 } from "path";
-var OWNERSHIP_PROBE_COMMAND = "pushary-hook";
-var pathApiFor = (platform) => platform === "win32" ? win32 : posix;
-var POSIX_GLOBAL_ROOT_SEGMENTS = ["lib", "node_modules"];
-var UPGRADE_ENTRY_SEGMENTS = ["dist", "bin", "pushary-upgrade.js"];
-var globalRootFor = (prefix, platform) => platform === "win32" ? win32.join(prefix, "node_modules") : posix.join(prefix, ...POSIX_GLOBAL_ROOT_SEGMENTS);
-var globalPackageFolder = (root, name, platform) => pathApiFor(platform).join(root, ...cliPackagePathSegments(name));
-var globalUpgradeEntry = (prefix, name, platform) => pathApiFor(platform).join(globalPackageFolder(globalRootFor(prefix, platform), name, platform), ...UPGRADE_ENTRY_SEGMENTS);
-var isInsideFolder = (target, folder, platform) => {
-  const pathApi = pathApiFor(platform);
-  const relativePath = pathApi.relative(folder, target);
-  return relativePath !== "" && !relativePath.startsWith("..") && !pathApi.isAbsolute(relativePath);
-};
-var linkPointsInto = (evidence, targets, name) => evidence.globalRoots.some((root) => {
-  const folder = globalPackageFolder(root, name, evidence.platform);
-  return targets.some((target) => isInsideFolder(target, folder, evidence.platform));
-});
-var ownerFromInstalled = (installed, whenNone) => {
-  const [only, ...others] = installed;
-  if (only === void 0) return whenNone;
-  if (others.length > 0) return { kind: "unknown", reason: "both_installed" };
-  return { kind: "owned", name: only };
-};
-var decideCommandOwner = (evidence) => {
-  const { link } = evidence;
-  if (link.kind === "resolved") {
-    const name = CLI_PACKAGE_NAMES.find((candidate) => linkPointsInto(evidence, link.targets, candidate));
-    return name === void 0 ? { kind: "unknown", reason: "foreign_command" } : { kind: "owned", name };
-  }
-  const whenNone = link.kind === "absent" ? { kind: "none" } : { kind: "unknown", reason: "unreadable_command" };
-  return ownerFromInstalled(evidence.installed, whenNone);
-};
-var CMD_SHIM_TARGET = /"%(?:~dp0|dp0%)\\([^"]+?)"\s+%[*]/;
-var cmdShimTarget = (shimDir, contents) => {
-  const relativeTarget = CMD_SHIM_TARGET.exec(contents)?.[1];
-  return relativeTarget === void 0 ? void 0 : win32.resolve(shimDir, relativeTarget);
-};
-var launchedPackage = (ownName) => ownName ?? LEGACY_PACKAGE;
-var globalInstallTarget = (owner, ownName) => {
-  switch (owner.kind) {
-    case "owned":
-      return owner.name;
-    case "none":
-      return launchedPackage(ownName);
-    case "unknown":
-      return LEGACY_PACKAGE;
-  }
-};
-var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var declaresOwnershipProbe = (bin) => isRecord2(bin) && typeof bin[OWNERSHIP_PROBE_COMMAND] === "string";
-var cliManifestName = (manifest) => {
-  if (!isRecord2(manifest) || !isCliPackageName(manifest.name) || !declaresOwnershipProbe(manifest.bin)) return void 0;
-  return manifest.name;
-};
-var classifyGlobalFolder = (name, read) => {
-  if (read.kind === "unreadable") return { kind: "unseen" };
-  const { manifest } = read;
-  if (!isRecord2(manifest) || cliManifestName(manifest) !== name) return { kind: "foreign" };
-  return { kind: "ours", installed: { name, version: typeof manifest.version === "string" ? manifest.version : void 0 } };
-};
-var classifyGlobalInstall = (installed, owner) => {
-  const [only, ...others] = installed;
-  if (only === void 0) return { kind: "absent" };
-  if (others.length === 0) return { kind: "single", installed: only };
-  return { kind: "both", installed, owner };
-};
-var isUninstallable = (evidence) => evidence.listing !== "absent" && evidence.folder !== "foreign";
-var globalPackagesToUninstall = (evidence) => evidence.filter(isUninstallable).map((entry) => entry.name);
-var commandsPackage = (install) => {
-  if (install.kind === "single") return install.installed;
-  if (install.kind !== "both" || install.owner.kind !== "owned") return void 0;
-  const ownerName = install.owner.name;
-  return install.installed.find((installed) => installed.name === ownerName);
-};
-
-// src/cli/version.ts
-import { readFileSync } from "fs";
-import { dirname, join, parse } from "path";
-import { fileURLToPath } from "url";
-var UNKNOWN_VERSION = "0.0.0";
-var cliManifestNameAt = (manifestPath) => {
-  try {
-    return cliManifestName(JSON.parse(readFileSync(manifestPath, "utf-8")));
-  } catch {
-    return void 0;
-  }
-};
-var findOwnPackage = (start) => {
-  const { root } = parse(start);
-  let dir = start;
-  while (true) {
-    const name = cliManifestNameAt(join(dir, "package.json"));
-    if (name !== void 0) return { root: dir, name };
-    if (dir === root) return void 0;
-    const parent = dirname(dir);
-    if (parent === dir) return void 0;
-    dir = parent;
-  }
-};
-var runningPackage = () => {
-  try {
-    return findOwnPackage(dirname(fileURLToPath(import.meta.url)));
-  } catch {
-    return void 0;
-  }
-};
-var getPackageVersion = () => {
-  const root = ownPackageRoot();
-  return (root === void 0 ? void 0 : packageVersionAt(root)) ?? UNKNOWN_VERSION;
-};
-var ownPackageRoot = () => runningPackage()?.root;
-var ownPackageName = () => runningPackage()?.name;
-var packageVersionAt = (packageRoot) => {
-  try {
-    const manifest = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf-8"));
-    const version = manifest && typeof manifest === "object" && "version" in manifest ? manifest.version : void 0;
-    return typeof version === "string" ? version : void 0;
-  } catch {
-    return void 0;
-  }
-};
-var isNewerVersion = (candidate, current) => {
-  const a = candidate.split(".").map((part) => parseInt(part, 10) || 0);
-  const b = current.split(".").map((part) => parseInt(part, 10) || 0);
-  for (let i = 0; i < 3; i++) {
-    if ((a[i] ?? 0) > (b[i] ?? 0)) return true;
-    if ((a[i] ?? 0) < (b[i] ?? 0)) return false;
-  }
-  return false;
-};
-var RELEASE_VERSION = /^\d+\.\d+\.\d+$/;
-var isReleaseVersion = (value) => RELEASE_VERSION.test(value);
-var majorOf = (version) => parseInt(version.split(".")[0] ?? "", 10) || 0;
-var isSameMajorVersion = (candidate, current) => majorOf(candidate) === majorOf(current);
-
 export {
   CLAUDE_CONNECTOR_URL,
   CLAUDE_CONNECTOR_GUIDE,
@@ -6481,29 +6339,5 @@ export {
   readElicitationFields,
   planElicitationAsk,
   elicitationContent,
-  elicitationContentFromAnswers,
-  CANONICAL_PACKAGE,
-  LEGACY_PACKAGE,
-  CLI_PACKAGE_NAMES,
-  cliPackagePathSegments,
-  OWNERSHIP_PROBE_COMMAND,
-  POSIX_GLOBAL_ROOT_SEGMENTS,
-  globalRootFor,
-  globalPackageFolder,
-  globalUpgradeEntry,
-  decideCommandOwner,
-  cmdShimTarget,
-  launchedPackage,
-  globalInstallTarget,
-  classifyGlobalFolder,
-  classifyGlobalInstall,
-  globalPackagesToUninstall,
-  commandsPackage,
-  getPackageVersion,
-  ownPackageRoot,
-  ownPackageName,
-  packageVersionAt,
-  isNewerVersion,
-  isReleaseVersion,
-  isSameMajorVersion
+  elicitationContentFromAnswers
 };

package/dist/{chunk-XTVEW2NG.js → chunk-LIESRXK5.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-ZYYQJSIO.js";
+} from "./chunk-OML4YFBN.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-ZOKMGBPR.js → chunk-MC4VY5LK.js}

@@ -2,7 +2,7 @@ import {
   DISCONNECT_AGENT_IDS,
   SETUP_AGENT_CHOICES,
   isApprovalMode
-} from "./chunk-OR5F63C2.js";
+} from "./chunk-LF3TLC7B.js";
 
 // src/cli/mode-request.ts
 var parseDuration = (value) => {
@@ -36,7 +36,17 @@ var describeMode = (mode) => {
 var npxLatestCommandFor = (platform) => `${platform === "win32" ? "npx.cmd" : "npx"} pushary@latest`;
 var NPX_LATEST_COMMAND = npxLatestCommandFor(process.platform);
 var COMMAND_LIST = [
-  { name: "codex", module: "pushary-codex-session", summary: "Start Codex with Pushary native approvals", detail: ["Use --cwd <directory> to choose a terminal project.", "Use --desktop [app path] for an experimental fresh Desktop launch. Quit Desktop first; running apps are not attached."] },
+  {
+    name: "codex",
+    module: "pushary-codex-session",
+    summary: "Experimental Codex extras that ordinary setup does not turn on",
+    detail: [
+      "Use --app-cards on|off|status so the Codex app also asks Pushary before it uses an app on this Mac.",
+      "Use --desktop [app path] to do the same for one launch. Quit Codex first; a running app is not attached.",
+      "Use --cwd <directory> to start a managed Codex terminal session in a project."
+    ],
+    unlisted: true
+  },
   {
     name: "cowork",
     module: "pushary-cowork",
@@ -126,6 +136,7 @@ var COMMAND_LIST = [
   }
 ];
 var COMMANDS = COMMAND_LIST;
+var LISTED_COMMANDS = COMMANDS.filter((command) => !command.unlisted);
 var answersTo = (command, token) => command.name === token || (command.aliases ?? []).includes(token);
 var findCommand = (token) => COMMANDS.find((command) => answersTo(command, token));
 var isCommandName = (name) => COMMANDS.some((command) => command.name === name);
@@ -232,8 +243,8 @@ var USAGE_EXAMPLES = [
 ];
 var pad = (text, width) => text + " ".repeat(Math.max(0, width - text.length));
 var renderHelp = (version) => {
-  const width = Math.max(...COMMANDS.map((command) => command.name.length)) + 2;
-  const commandLines = COMMANDS.flatMap((command) => [
+  const width = Math.max(...LISTED_COMMANDS.map((command) => command.name.length)) + 2;
+  const commandLines = LISTED_COMMANDS.flatMap((command) => [
     `  ${pad(command.name, width)}${command.summary}`,
     ...(command.detail ?? []).map((line) => `  ${" ".repeat(width)}${line}`)
   ]);
@@ -287,7 +298,7 @@ export {
   resolveModeInput,
   describeMode,
   NPX_LATEST_COMMAND,
-  COMMANDS,
+  LISTED_COMMANDS,
   resolveCommandName,
   isInvocationOf,
   renderHelp,

package/dist/{chunk-K73CBZKW.js → chunk-MHQB62K5.js}

@@ -1,18 +1,18 @@
 import {
   macAppBridgeAvailable
-} from "./chunk-LLRYP5TR.js";
+} from "./chunk-K23WMLPY.js";
 import {
   keyPrefix
-} from "./chunk-XH3F66VD.js";
+} from "./chunk-VYBH6D4X.js";
 import {
   bridgeAgentKey
-} from "./chunk-ZYYQJSIO.js";
+} from "./chunk-OML4YFBN.js";
 import {
   readJsonSafe
 } from "./chunk-AQFEP65J.js";
 import {
   isValidApiKey
-} from "./chunk-OR5F63C2.js";
+} from "./chunk-LF3TLC7B.js";
 
 // src/shared-mcp-key.ts
 var asRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;

package/dist/{chunk-DH4BWFU7.js → chunk-MTKV4RUQ.js}

@@ -1,14 +1,14 @@
 import {
   MCP_BRIDGE_BINARY
-} from "./chunk-GDDXGBTM.js";
+} from "./chunk-46TC24ET.js";
 import {
   KEY_FILE_MODE
-} from "./chunk-XH3F66VD.js";
+} from "./chunk-VYBH6D4X.js";
 import {
   NpmInstallError,
   NpmMissingError,
   NpmPermissionError
-} from "./chunk-ZYYQJSIO.js";
+} from "./chunk-XUW2DRAQ.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -16,13 +16,13 @@ import {
 } from "./chunk-AQFEP65J.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-ZOKMGBPR.js";
+} from "./chunk-MC4VY5LK.js";
 import {
   readSetupAgentFailures
-} from "./chunk-OR5F63C2.js";
+} from "./chunk-LF3TLC7B.js";
 
 // src/instruction-file.ts
-import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from "fs";
+import { accessSync, constants, existsSync, readFileSync, statSync, writeFileSync, mkdirSync, rmSync } from "fs";
 import { dirname } from "path";
 var PUSHARY_BEGIN = "<!-- BEGIN PUSHARY (managed by @pushary/agent-hooks; do not edit this block) -->";
 var PUSHARY_END = "<!-- END PUSHARY -->";
@@ -44,6 +44,9 @@ You have Pushary MCP tools that reach the user on their phone. Use them proactiv
 
 Pass \`agentName\` as "${label} - <project folder name>" so the user knows which session is asking. If a question times out, follow \`handoffAction\` when present, otherwise \`nextAction\`: keep waiting with the same correlationId while pending. A poll ending is not question expiry. Cancel only for an explicit handoff or when the answer is no longer needed. If cancellation returns \`handoffAction: "stop"\`, stop. Otherwise, if cancellation returns false, poll once for 1 second and honor the answer that won the race.`;
 var SHARED_AGENTS_MD_LABEL = "<your agent's name, such as Codex or Hermes>";
+var CODEX_INSTRUCTIONS_LABEL = "Codex";
+var GEMINI_INSTRUCTIONS_LABEL = "Gemini";
+var OPENCODE_INSTRUCTIONS_LABEL = "OpenCode";
 var renderAgentInstructions = (label) => instructionBody(label);
 var KEYLESS_FALLBACK_LINE = "This repo uses Pushary phone approvals. Your teammates get agent questions on their lock screens; you do not have a key yet, so questions will fall back to the terminal. Get your own key (3-day trial): https://pushary.com/sign-up?utm_source=agents-md&utm_medium=teammate";
 var renderProjectAgentInstructions = (label) => `${instructionBody(label)}
@@ -52,6 +55,19 @@ If this environment has no Pushary API key (no PUSHARY_API_KEY and no key in ~/.
 var wrap = (body) => `${PUSHARY_BEGIN}
 ${body}
 ${PUSHARY_END}`;
+var withInstructionBlockAppended = (existing, body) => {
+  const prefix = existing.trim() ? existing.replace(/\s*$/, "") + "\n\n" : "";
+  return prefix + wrap(body) + "\n";
+};
+var managedBlockRange = (text) => {
+  const start = text.indexOf(PUSHARY_BEGIN);
+  const end = text.indexOf(PUSHARY_END);
+  return start !== -1 && end > start ? { start, end: end + PUSHARY_END.length } : null;
+};
+var withInstructionBlockReplaced = (existing, body) => {
+  const range = managedBlockRange(existing);
+  return range ? existing.slice(0, range.start) + wrap(body) + existing.slice(range.end) : null;
+};
 var writeInstructionBlock = (filePath, body) => {
   const dir = dirname(filePath);
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
@@ -60,17 +76,53 @@ var writeInstructionBlock = (filePath, body) => {
     existing = readFileSync(filePath, "utf-8");
   } catch {
   }
-  const block = wrap(body);
-  const start = existing.indexOf(PUSHARY_BEGIN);
-  const end = existing.indexOf(PUSHARY_END);
-  let next;
-  if (start !== -1 && end !== -1 && end > start) {
-    next = existing.slice(0, start) + block + existing.slice(end + PUSHARY_END.length);
-  } else {
-    const prefix = existing.trim() ? existing.replace(/\s*$/, "") + "\n\n" : "";
-    next = prefix + block + "\n";
+  writeFileSync(filePath, withInstructionBlockReplaced(existing, body) ?? withInstructionBlockAppended(existing, body), "utf-8");
+};
+var occurrencesOf = (marker, text) => text.split(marker).length - 1;
+var soleManagedBlock = (text) => {
+  const begins = occurrencesOf(PUSHARY_BEGIN, text);
+  const ends = occurrencesOf(PUSHARY_END, text);
+  if (begins === 0 && ends === 0) return { kind: "none" };
+  const range = managedBlockRange(text);
+  return begins === 1 && ends === 1 && range ? { kind: "one", range } : { kind: "ambiguous" };
+};
+var CRLF = "\r\n";
+var withLineEndingsOf = (sample, block) => sample.includes(CRLF) ? block.replaceAll("\n", CRLF) : block;
+var readUtf8 = (filePath) => {
+  try {
+    const bytes = readFileSync(filePath);
+    const text = bytes.toString("utf-8");
+    return Buffer.from(text, "utf-8").equals(bytes) ? { kind: "text", text } : { kind: "not_utf8" };
+  } catch {
+    return { kind: "unreadable" };
+  }
+};
+var isWritable = (filePath) => {
+  try {
+    accessSync(filePath, constants.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var refreshInstructionBlock = (filePath, body) => {
+  if (!existsSync(filePath)) return "absent";
+  const read = readUtf8(filePath);
+  if (read.kind !== "text") return read.kind;
+  const block = soleManagedBlock(read.text);
+  if (block.kind === "none") return "absent";
+  if (block.kind === "ambiguous") return "ambiguous_markers";
+  const existing = read.text.slice(block.range.start, block.range.end);
+  const fresh = withLineEndingsOf(existing, wrap(body));
+  if (existing === fresh) return "current";
+  if (!isWritable(filePath)) return "read_only";
+  try {
+    const refreshed = read.text.slice(0, block.range.start) + fresh + read.text.slice(block.range.end);
+    writeFileAtomic(filePath, refreshed, statSync(filePath).mode & 511);
+    return "refreshed";
+  } catch {
+    return "write_failed";
   }
-  writeFileSync(filePath, next, "utf-8");
 };
 var removeInstructionBlock = (filePath) => {
   let existing = "";
@@ -550,6 +602,7 @@ var agentFailureWire = (failures) => readSetupAgentFailures(failures);
 
 // src/fx-lifecycle.ts
 import { existsSync as existsSync3 } from "fs";
+import { join } from "path";
 var fxRetryHint = () => `Fix it, then run ${retryAgentCommand("fx")}.`;
 var readFxProfileForSetup = (filePath) => {
   const read = readFxFile(filePath, readFxProfile);
@@ -571,6 +624,13 @@ var writeFxProfile = (filePath, profile) => {
   }
   writeFileAtomic(filePath, rendered.text, KEY_FILE_MODE);
 };
+var macAppFxBridge = (pusharyDir) => join(pusharyDir, "bin", MCP_BRIDGE_BINARY);
+var fxServerHolder = (profilePath, appBridge) => {
+  const read = readFxFile(profilePath, readFxProfile);
+  const entry = read.kind === "profile" ? fxPusharyEntryOf(read.profile) : void 0;
+  if (!isFxPusharyEntry(entry)) return "none";
+  return fxBridgeTargetOf(entry) === appBridge ? "app" : "cli";
+};
 var fxSettingsReadRefusal = (filePath, read) => {
   if (read.kind === "unreadable") return `${filePath} could not be read`;
   if (read.kind === "refused") return `${filePath} ${FX_SETTINGS_REFUSALS[read.reason]}`;
@@ -665,9 +725,13 @@ var planFxRemoval = (profilePath, settingsPath, receiptPath) => {
 
 export {
   SHARED_AGENTS_MD_LABEL,
+  CODEX_INSTRUCTIONS_LABEL,
+  GEMINI_INSTRUCTIONS_LABEL,
+  OPENCODE_INSTRUCTIONS_LABEL,
   renderAgentInstructions,
   renderProjectAgentInstructions,
   writeInstructionBlock,
+  refreshInstructionBlock,
   removeInstructionBlock,
   hasInstructionBlock,
   FX_PUSHARY_TOOLS_RULE,
@@ -691,6 +755,8 @@ export {
   agentFailureWire,
   readFxProfileForSetup,
   writeFxProfile,
+  macAppFxBridge,
+  fxServerHolder,
   configureFxSettings,
   inspectFxInstallation,
   planFxRemoval

package/dist/{chunk-Y74IJ2IO.js → chunk-N77BH7H2.js}

@@ -3,19 +3,20 @@ import {
   addGeminiMcpServer,
   removeGeminiMcpServer,
   supportedClaudeEvents
-} from "./chunk-25SYEAW4.js";
+} from "./chunk-6C4S3QYD.js";
 import {
   CLAUDE_CODE_AGENT,
   compatibleToolLookup
-} from "./chunk-YVO4HIHX.js";
+} from "./chunk-U2L42GVI.js";
 import {
   guardBinary,
   guardBinaryRefusing,
   holdBudgetOf,
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-ZYYQJSIO.js";
+} from "./chunk-OML4YFBN.js";
 import {
+  HOOK_COMPATIBLE_PROFILES,
   HOOK_LOCATOR_BINARY,
   PHONE_ANSWERED_TOOLS,
   compatibleTargetFiles,
@@ -25,7 +26,7 @@ import {
   pusharyMissingReason,
   refusalOutput,
   withHookHoldBudget
-} from "./chunk-OR5F63C2.js";
+} from "./chunk-LF3TLC7B.js";
 
 // src/claude-config.ts
 import { join } from "path";
@@ -280,6 +281,10 @@ var compatibleDocuments = (profile, home) => {
   }
   return documents;
 };
+var compatibleRecord = (of) => HOOK_COMPATIBLE_PROFILES.reduce(
+  (record, profile) => ({ ...record, [profile.agentType]: of(profile) }),
+  {}
+);
 var compatibleTargetPaths = (profile, home) => compatibleTargetFiles(profile).map((file) => compatibleFilePath(file, home));
 var compatibleConfigFile = (profile, home) => compatibleFilePath(profile.configFile, home);
 var compatibleMcpFile = (profile, home) => profile.mcp ? compatibleFilePath(profile.mcp.file, home) : null;
@@ -489,6 +494,7 @@ export {
   grokHome,
   compatibleFilePath,
   compatibleDocuments,
+  compatibleRecord,
   compatibleTargetPaths,
   compatibleConfigFile,
   compatibleMcpFile,

package/dist/{chunk-ZTTCYHOM.js → chunk-NECZKPJN.js}

@@ -4,7 +4,7 @@ import {
   forkFinishWithUpgradeLock,
   installWithUpgradeLock,
   releaseAutoUpdateLock
-} from "./chunk-KBGKWB5T.js";
+} from "./chunk-H57DXSHR.js";
 import {
   describeAutoUpdateCheck,
   globalInstallLocation,
@@ -14,23 +14,25 @@ import {
   readAutoUpdateState,
   updateAutoUpdateState,
   upgradeEntryFor
-} from "./chunk-APASKZ2I.js";
+} from "./chunk-QKU46TK5.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
 import {
   autoUpdateLock,
   autoUpdateLog,
-  autoUpdateState,
+  autoUpdateState
+} from "./chunk-OML4YFBN.js";
+import {
   execNpm,
   fetchLatestPublishedVersion,
   npmErrorMessage,
   readGlobalCliInstallAt,
   readGlobalPrefix
-} from "./chunk-ZYYQJSIO.js";
+} from "./chunk-XUW2DRAQ.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-ZOKMGBPR.js";
+} from "./chunk-MC4VY5LK.js";
 import {
   commandsPackage,
   globalUpgradeEntry,
@@ -39,7 +41,7 @@ import {
   isSameMajorVersion,
   ownPackageRoot,
   packageVersionAt
-} from "./chunk-OR5F63C2.js";
+} from "./chunk-QTOLNRET.js";
 
 // src/global-upgrade.ts
 import { existsSync } from "fs";
@@ -50,6 +52,26 @@ import { dirname } from "path";
 
 // src/upgrade-finish.ts
 var FINISHED_UPGRADE = { kind: "finished" };
+var refreshedPartsOf = (agent) => [
+  ...agent.result.hooks ? ["hooks"] : [],
+  ...agent.result.mcp ? ["MCP key"] : [],
+  ...agent.instructions?.outcome === "refreshed" ? ["instructions"] : []
+];
+var wasRefreshed = (agent) => refreshedPartsOf(agent).length > 0;
+var INSTRUCTIONS_LEFT_BECAUSE = {
+  refreshed: null,
+  current: null,
+  absent: null,
+  read_only: "the file is read-only",
+  ambiguous_markers: "its Pushary markers do not form exactly one block",
+  not_utf8: "the file is not UTF-8 text",
+  unreadable: "the file could not be read",
+  write_failed: "the file could not be written"
+};
+var instructionsLeftNoteOf = (agent) => {
+  const reason = agent.instructions ? INSTRUCTIONS_LEFT_BECAUSE[agent.instructions.outcome] : null;
+  return agent.instructions && reason ? `${agent.instructions.file}: ${reason}` : null;
+};
 var RETRYABLE_UPGRADE_FINISH = { kind: "retryable" };
 var SETTLED_UPGRADE_FINISH = { kind: "settled" };
 var controlWaitsOnThePerson = (readings) => readings.controlPolicy === "legacy" || readings.controlMode === "on" && readings.controlPolicy === "unsupported";
@@ -273,6 +295,9 @@ var upgradeInstalledPackage = async (subject, effects) => {
 };
 
 export {
+  refreshedPartsOf,
+  wasRefreshed,
+  instructionsLeftNoteOf,
   upgradeFinishOutcome,
   upgradeFinishExitCode,
   FINISH_UPGRADE_FLAG,

package/dist/{chunk-TGCIFEDE.js → chunk-NELH25J7.js}

@@ -4,19 +4,19 @@ import {
   outcomeOfFailedAsk,
   reportMachineDenial,
   storedWaitDeadline
-} from "./chunk-EP6S6VY3.js";
+} from "./chunk-JPABKXK6.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-Y7WD72J7.js";
+} from "./chunk-7CLLWDCP.js";
 import {
   isDeferAnswer,
   oncePerSession
-} from "./chunk-IF2UPWD2.js";
+} from "./chunk-DHJSBK63.js";
 import {
   activeHookSource,
   activeIdentity
-} from "./chunk-Y74IJ2IO.js";
+} from "./chunk-N77BH7H2.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -40,7 +40,10 @@ import {
   reportEvent,
   scopePathFor,
   settleQuestionsForToolUse
-} from "./chunk-YVO4HIHX.js";
+} from "./chunk-U2L42GVI.js";
+import {
+  repoKeyFor
+} from "./chunk-JBT3ZSJS.js";
 import {
   askUser,
   cancelQuestion,
@@ -49,22 +52,21 @@ import {
   isDecisionStopped,
   isLocalQuestionHandoff,
   pollForAnswer,
-  repoKeyFor,
   requestGate,
   sendNotification,
   waitForQuestion,
   waitsForThePhone
-} from "./chunk-AWMMABVB.js";
+} from "./chunk-ZMPR436Z.js";
 import {
   getMachineId
-} from "./chunk-LY3OJFBW.js";
+} from "./chunk-T6RIKJUO.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-VUS6QGND.js";
+} from "./chunk-CQ5JGRML.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-ZOKMGBPR.js";
+} from "./chunk-MC4VY5LK.js";
 import {
   AGENT_QUESTION_STRATEGY,
   AGENT_QUESTION_TOOL,
@@ -109,7 +111,7 @@ import {
   resolveGate,
   timeoutActionWithoutLocalPrompt,
   unansweredRefusalReason
-} from "./chunk-OR5F63C2.js";
+} from "./chunk-LF3TLC7B.js";
 
 // src/claude-permission-rules.ts
 import { readFileSync, statSync } from "fs";

package/dist/{chunk-HXRH7ZCK.js → chunk-NHVEQLQC.js}

@@ -1,9 +1,9 @@
 import {
   CODEX_HOOK_STATUS
-} from "./chunk-KIO2MZQC.js";
+} from "./chunk-FCMWUYIE.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-ZOKMGBPR.js";
+} from "./chunk-MC4VY5LK.js";
 
 // src/setup/codex-trust.ts
 var CODEX_TRUST_TELEMETRY = {

package/dist/{chunk-OW4DNSQ6.js → chunk-NSY2V7XU.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_HOLD_BUDGET_ENV,
   hookHoldBudgetProof
-} from "./chunk-OR5F63C2.js";
+} from "./chunk-LF3TLC7B.js";
 
 // src/hold-budget.ts
 var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {