@pushary/agent-hooks 1.9.59 → 1.9.61

package/dist/{chunk-EBQTWH5O.js → chunk-6T5Z64KS.js}

@@ -1,6 +1,6 @@
 import {
   ensureCodexTrustsPusharyHooks
-} from "./chunk-IBXHVYN2.js";
+} from "./chunk-BUZIEL7Y.js";
 import {
   CODEX_INSTRUCTIONS_LABEL,
   GEMINI_INSTRUCTIONS_LABEL,
@@ -11,7 +11,7 @@ import {
   macAppFxBridge,
   refreshInstructionBlock,
   renderAgentInstructions
-} from "./chunk-6ONSTCDJ.js";
+} from "./chunk-4VRTSDGP.js";
 import {
   OPENCODE_HOOK_BINARY,
   agentHookOwner,
@@ -21,10 +21,10 @@ import {
   openCodeInstructionsFile,
   openCodePluginDir,
   openCodeWired
-} from "./chunk-JBCMXSBO.js";
+} from "./chunk-ZGU3NXL2.js";
 import {
   detectClaudeVersion
-} from "./chunk-M6MOQBR5.js";
+} from "./chunk-USE5IEEW.js";
 import {
   addClaudeMcpServer,
   addCompatibleHooks,
@@ -33,7 +33,7 @@ import {
   compatibleConfigFile,
   compatibleInstructionsFile,
   hasCompatibleHooks
-} from "./chunk-KQWN7C5C.js";
+} from "./chunk-GKFO5JLN.js";
 import {
   claudeUnprovenHolds,
   claudeWired,
@@ -41,7 +41,7 @@ import {
   codexWired,
   geminiWired,
   planHooks
-} from "./chunk-X4ES7QBT.js";
+} from "./chunk-BJTSKOH3.js";
 import {
   CLAUDE_HOOK_BINARY,
   CLAUDE_HOOK_EVENTS,
@@ -52,7 +52,7 @@ import {
   needsReregistration,
   registrationSignatures,
   supportedClaudeEvents
-} from "./chunk-TDOKDCFH.js";
+} from "./chunk-RGSW36XH.js";
 import {
   formatVersion
 } from "./chunk-6ICPEJY5.js";
@@ -61,11 +61,14 @@ import {
   addCodexHookTrust,
   addCodexHooks,
   addCodexMcpServer,
+  claudeJson,
   claudeRegistrationReceipt,
+  claudeSettings,
   codexAgentsMd,
   codexConfigToml,
   codexHookPositions,
   codexHooksJson,
+  codexMcpStartsCommand,
   codexRegistrationHolder,
   codexVacatedIndexes,
   dropVacatedCodexHookTrust,
@@ -80,11 +83,11 @@ import {
   registeredCommands,
   registrationHolderOf,
   vscodePluginMcp
-} from "./chunk-KZCYHWDF.js";
+} from "./chunk-MWLTTLPK.js";
 import {
   resolveGlobalBinDir,
   resolveGlobalBinary
-} from "./chunk-US3IT6ZC.js";
+} from "./chunk-CJ5TCFD4.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -94,7 +97,7 @@ import {
   HOOK_COMPATIBLE_PROFILES,
   isCompatibleAgentType,
   isRecord
-} from "./chunk-762CDAJJ.js";
+} from "./chunk-AXJLJJ3M.js";
 
 // src/reapply.ts
 import { dirname, join } from "path";
@@ -137,8 +140,6 @@ var storedSignatures = (raw) => {
 };
 
 // src/reapply.ts
-var CLAUDE_SETTINGS = join(homedir(), ".claude", "settings.json");
-var CLAUDE_JSON = join(homedir(), ".claude.json");
 var readJson = (filePath) => {
   const result = readJsonSafe(filePath);
   if (result.kind === "ok") return isRecord(result.value) ? result.value : null;
@@ -147,7 +148,7 @@ var readJson = (filePath) => {
 };
 var writeJson = (filePath, data) => writeJsonAtomic(filePath, data);
 var hasPusharyClaudeHooks = (settings) => JSON.stringify(settings.hooks ?? {}).includes(CLAUDE_HOOK_BINARY);
-var hasPusharyMcp = (claudeJson) => !!claudeJson.mcpServers?.pushary;
+var hasPusharyMcp = (claudeJson2) => !!claudeJson2.mcpServers?.pushary;
 var PRIVATE_TO_OWNER = 384;
 var modeToPreserve = (filePath) => {
   try {
@@ -158,14 +159,14 @@ var modeToPreserve = (filePath) => {
 };
 var wouldWriteBareNames = (resolve, probe) => resolve(probe) === void 0;
 var reapplyClaudeSettings = (apiKey, paths = {}) => {
-  const settingsPath = paths.settingsPath ?? CLAUDE_SETTINGS;
-  const claudeJsonPath = paths.claudeJsonPath ?? CLAUDE_JSON;
+  const settingsPath = paths.settingsPath ?? claudeSettings();
+  const claudeJsonPath = paths.claudeJsonPath ?? claudeJson();
   const settings = readJson(settingsPath);
-  const claudeJson = readJson(claudeJsonPath);
-  const configured = settings != null && hasPusharyClaudeHooks(settings) || claudeJson != null && hasPusharyMcp(claudeJson);
+  const claudeJson2 = readJson(claudeJsonPath);
+  const configured = settings != null && hasPusharyClaudeHooks(settings) || claudeJson2 != null && hasPusharyMcp(claudeJson2);
   if (!configured) return { configured: false, reapplied: false, hooks: false, mcp: false };
   const settingsWritable = settings != null;
-  const claudeJsonWritable = claudeJson != null;
+  const claudeJsonWritable = claudeJson2 != null;
   let hooks = false;
   let mcp = false;
   let failed = false;
@@ -183,7 +184,7 @@ var reapplyClaudeSettings = (apiKey, paths = {}) => {
   if (apiKey) {
     try {
       if (!claudeJsonWritable) throw new Error(".claude.json could not be parsed");
-      const cj = claudeJson;
+      const cj = claudeJson2;
       addClaudeMcpServer(cj, apiKey);
       writeJson(claudeJsonPath, cj);
       mcp = true;
@@ -196,7 +197,7 @@ var reapplyClaudeSettings = (apiKey, paths = {}) => {
 var reapplyClaudeForVersion = (apiKey, paths = {}) => {
   const idle = { verdict: "current", rewrote: false, missing: [] };
   try {
-    const settingsPath = paths.settingsPath ?? CLAUDE_SETTINGS;
+    const settingsPath = paths.settingsPath ?? claudeSettings();
     const receiptPath = paths.receiptPath ?? claudeRegistrationReceipt();
     const version = (paths.detectVersion ?? detectClaudeVersion)();
     const receipt = readJsonSafe(receiptPath);
@@ -234,9 +235,9 @@ var readToml = (filePath) => {
 };
 var inspectConfiguredManagedProviders = (paths = {}) => {
   const providers = [];
-  const claudeSettings = readJson(paths.claudeSettingsPath ?? CLAUDE_SETTINGS);
-  const claudeJson = readJson(paths.claudeJsonPath ?? CLAUDE_JSON);
-  if (claudeWired({ claudeJson, settings: claudeSettings, skillExists: false })) {
+  const claudeSettings2 = readJson(paths.claudeSettingsPath ?? claudeSettings());
+  const claudeJson2 = readJson(paths.claudeJsonPath ?? claudeJson());
+  if (claudeWired({ claudeJson: claudeJson2, settings: claudeSettings2, skillExists: false })) {
     providers.push("claude");
   }
   const codexConfig = readToml(paths.codexConfigPath ?? codexConfigToml());
@@ -250,13 +251,23 @@ var inspectConfiguredManagedProviders = (paths = {}) => {
   }
   return providers;
 };
-var reapplyCodexSettings = (apiKey, paths = {}) => {
+var codexNativeOwnershipFor = (hooksConfig, requested, macAppAvailable) => hooksConfig === null && macAppAvailable ? "preserve" : requested;
+var reapplyCodexSettings = (apiKey, paths = {}, nativeOwnership = "preserve") => {
   const configPath = paths.configPath ?? codexConfigToml();
   const hooksPath = paths.hooksPath ?? codexHooksJson();
   const config = readToml(configPath);
   const hooksConfig = readJson(hooksPath);
   const configured = config != null && !!config.mcp_servers?.pushary || hooksConfig != null && hasCodexHooks(hooksConfig);
   if (!configured) return { configured: false, reapplied: false, hooks: false, mcp: false };
+  const startedCommand = config != null && codexMcpStartsCommand(config);
+  let mcpWrite = null;
+  if (config != null && apiKey) {
+    try {
+      mcpWrite = addCodexMcpServer(config, apiKey, codexNativeOwnershipFor(hooksConfig, nativeOwnership, paths.macAppAvailable ?? true));
+    } catch {
+      return { configured: true, reapplied: false, hooks: false, mcp: false, failed: true };
+    }
+  }
   const command = guardBinary((paths.resolveBinary ?? resolveGlobalBinary)(CODEX_HOOK_BINARY) ?? CODEX_HOOK_BINARY);
   let hooks = false;
   let mcp = false;
@@ -277,12 +288,9 @@ var reapplyCodexSettings = (apiKey, paths = {}) => {
         dropVacatedCodexHookTrust(config, hooksPath, vacated);
         addCodexHookTrust(config, hooksPath, command, codexHookPositions(hooksConfig ?? void 0));
       }
-      if (apiKey) {
-        addCodexMcpServer(config, apiKey);
-      }
       if (hooks || apiKey) {
         writeFileAtomic(configPath, stringifyTOML(config), modeToPreserve(configPath), "utf-8");
-        mcp = Boolean(apiKey);
+        mcp = mcpWrite === "wrote-key";
       }
     } catch {
       failed = true;
@@ -290,7 +298,7 @@ var reapplyCodexSettings = (apiKey, paths = {}) => {
     }
   }
   if (config === null) hooks = false;
-  return { configured: true, reapplied: hooks || mcp, hooks, mcp, failed };
+  return { configured: true, reapplied: hooks || mcp, hooks, mcp, failed, ...mcp && startedCommand ? { codexRestartRequired: true } : {} };
 };
 var repairCodexHolds = (paths = {}) => {
   const idle = { configured: false, reapplied: false, hooks: false, mcp: false };
@@ -408,12 +416,13 @@ var KEPT_FOR_APP = { configured: true, reapplied: false, hooks: false, mcp: fals
 var FAILED_REAPPLY = { configured: false, reapplied: false, hooks: false, mcp: false, failed: true };
 var noInstructionBlock = () => null;
 var reapplyAllAgents = (apiKey, options = {}) => {
+  const appAvailable = (options.appAvailable ?? macAppBridgeAvailable)();
   const runners = [
     { id: "claude", label: "Claude Code", run: () => reapplyClaudeSettings(apiKey), instructions: noInstructionBlock },
     {
       id: "codex",
       label: "Codex",
-      run: () => reapplyCodexSettings(apiKey),
+      run: () => reapplyCodexSettings(apiKey, { macAppAvailable: appAvailable }, "take-over"),
       instructions: () => ({ file: codexAgentsMd(), body: renderAgentInstructions(CODEX_INSTRUCTIONS_LABEL) })
     },
     {
@@ -438,7 +447,6 @@ var reapplyAllAgents = (apiKey, options = {}) => {
       instructions: () => compatibleInstructionTarget(profile)
     }))
   ];
-  const appAvailable = (options.appAvailable ?? macAppBridgeAvailable)();
   const done = [];
   for (const runner of runners) {
     try {

package/dist/{chunk-JAKBCKEB.js → chunk-7BAO42UV.js}

@@ -1,18 +1,19 @@
 import {
   readExistingMachineId
-} from "./chunk-M46WDK64.js";
+} from "./chunk-SFAP4AJY.js";
 import {
   NetworkError
-} from "./chunk-7QLSKOSU.js";
+} from "./chunk-PPY5N2E6.js";
 import {
   getBaseUrl
-} from "./chunk-4XXZUFWN.js";
+} from "./chunk-BG4Y64FW.js";
 import {
   getPackageVersion
 } from "./chunk-QTOLNRET.js";
 import {
-  clientContextHeaders
-} from "./chunk-762CDAJJ.js";
+  clientContextHeaders,
+  redactSecretsFromContent
+} from "./chunk-AXJLJJ3M.js";
 
 // src/cli/net.ts
 import { createRequire } from "module";
@@ -112,8 +113,8 @@ var pusharyFetch = async (url, init = {}) => {
   } catch (err) {
     if (isNetworkFailure(err)) {
       const proxy = proxyFromEnv();
-      const via = proxy ? ` (via proxy ${proxy})` : "";
-      throw new NetworkError(`Could not reach ${new URL(url).host}${via}: ${err instanceof Error ? err.message : String(err)}`);
+      const via = proxy ? " (via configured proxy)" : "";
+      throw new NetworkError(redactSecretsFromContent(`Could not reach ${new URL(url).host}${via}: ${err instanceof Error ? err.message : String(err)}`));
     }
     throw err;
   }

package/dist/chunk-7BHI3PZN.js

@@ -0,0 +1,41 @@
+import {
+  exitCodeFor,
+  messageFor
+} from "./chunk-PPY5N2E6.js";
+import {
+  EXIT
+} from "./chunk-KZERVKTD.js";
+import {
+  redactSecretsFromContent
+} from "./chunk-AXJLJJ3M.js";
+
+// src/cli/json.ts
+var writeStdoutFully = (text) => new Promise((resolve, reject) => {
+  const settle = (error) => {
+    if (!error) process.stdout.off("error", settle);
+    if (error && (!("code" in error) || error.code !== "EPIPE")) reject(error);
+    else resolve();
+  };
+  process.stdout.once("error", settle);
+  process.stdout.write(text, settle);
+});
+var writeJsonError = async (command, error, argv = process.argv.slice(2)) => {
+  const exitCode = exitCodeFor(error);
+  const end = argv.indexOf("--");
+  const flags = end < 0 ? argv : argv.slice(0, end);
+  if (!flags.includes("--json") && !flags.includes("-json")) return { written: false, exitCode };
+  await writeStdoutFully(`${JSON.stringify({
+    ok: false,
+    command,
+    reason: exitCode === EXIT.USAGE ? "usage" : "failed",
+    message: redactSecretsFromContent(messageFor(error)),
+    exitCode
+  })}
+`);
+  return { written: true, exitCode };
+};
+
+export {
+  writeStdoutFully,
+  writeJsonError
+};

package/dist/{chunk-5BNXJTOZ.js → chunk-7HDGH3Z2.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-POFBE6ZY.js";
 import {
   autoUpdateState
-} from "./chunk-KZCYHWDF.js";
+} from "./chunk-MWLTTLPK.js";
 import {
   readJsonSafe,
   writeJsonAtomic
@@ -17,7 +17,7 @@ import {
 } from "./chunk-QTOLNRET.js";
 import {
   isAutoUpdateResult
-} from "./chunk-762CDAJJ.js";
+} from "./chunk-AXJLJJ3M.js";
 
 // src/auto-update.ts
 import { spawn } from "child_process";
@@ -130,15 +130,6 @@ var readLocalAutoUpdateReport = () => {
     return null;
   }
 };
-var parseAutoUpdateFlag = (args) => {
-  const token = args.find((arg) => arg === AUTO_UPDATE_FLAG || arg.startsWith(`${AUTO_UPDATE_FLAG}=`));
-  if (token === void 0) return { kind: "absent" };
-  if (token === AUTO_UPDATE_FLAG) return { kind: "run" };
-  const value = token.slice(AUTO_UPDATE_FLAG.length + 1);
-  if (value === "on") return { kind: "set", enabled: true };
-  if (value === "off") return { kind: "set", enabled: false };
-  return { kind: "invalid", value };
-};
 var AUTO_UPDATE_RESULT_LABELS = {
   updated: "updated",
   finish_pending: "installed; configuration refresh pending",
@@ -209,13 +200,13 @@ var triggerAutoUpdate = (trigger) => {
 
 export {
   AUTO_UPDATE_DISABLE_ENV,
+  AUTO_UPDATE_FLAG,
   isAutoUpdateDisabledByEnv,
   autoUpdateOffReason,
   globalInstallLocation,
   upgradeEntryFor,
   nextFinishAttempt,
   readLocalAutoUpdateReport,
-  parseAutoUpdateFlag,
   describeAutoUpdateCheck,
   isUnfinishedAutoUpdate,
   holdsUnfinishedFinish,

package/dist/{chunk-D6CXQIXO.js → chunk-7JXJJNQ5.js}

@@ -1,6 +1,6 @@
 import {
   readTranscriptPreference
-} from "./chunk-KAJDKYUM.js";
+} from "./chunk-WN3RACVD.js";
 
 // src/transcript-setting.ts
 var transcriptEnvironmentPreference = () => {

package/dist/{chunk-KHDD74MK.js → chunk-7MCCXE5Y.js}

@@ -3,24 +3,24 @@ import {
   expectedLaunchCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "./chunk-5PP4455M.js";
+} from "./chunk-G36T5LAP.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   hasDaemonServiceDefinition,
   readDaemonNeedsLogin,
   readDaemonStatus
-} from "./chunk-4QF2YLYK.js";
+} from "./chunk-LBHJJEKT.js";
 import {
   readControlMode,
   readKeySource
-} from "./chunk-KAJDKYUM.js";
+} from "./chunk-WN3RACVD.js";
 import {
   getMachineId
-} from "./chunk-M46WDK64.js";
+} from "./chunk-SFAP4AJY.js";
 import {
   getBaseUrl
-} from "./chunk-4XXZUFWN.js";
+} from "./chunk-BG4Y64FW.js";
 import {
   getPackageVersion
 } from "./chunk-QTOLNRET.js";

package/dist/{chunk-AY32RSUC.js → chunk-ADR3KHOC.js}

@@ -4,10 +4,10 @@ import {
   keyPrefix,
   readConfigFileKey,
   readMacAppKeyPrefix
-} from "./chunk-KAJDKYUM.js";
+} from "./chunk-WN3RACVD.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-BMPZ5HVJ.js";
+} from "./chunk-ERK24P76.js";
 
 // src/key-signed-out.ts
 var VERDICT_BY_CHECK = {

package/dist/{chunk-MMLIQDTG.js → chunk-ATKN4BJT.js}

@@ -1,6 +1,6 @@
 import {
   readConfigFileKey
-} from "./chunk-KAJDKYUM.js";
+} from "./chunk-WN3RACVD.js";
 
 // src/bell/fleet.ts
 import { closeSync, constants, futimesSync, lstatSync, mkdirSync, openSync, readdirSync, unlinkSync } from "fs";

package/dist/{chunk-762CDAJJ.js → chunk-AXJLJJ3M.js}

@@ -384,6 +384,13 @@ var AGENTS = {
     enforcementDetail: "Shell, edits and MCP calls through native PreToolUse hooks. Grok's own permission checks still apply after a phone approval.",
     capabilityNote: "Grok fails open if it kills a hook or cannot run it. Setup leaves Grok's permission mode unchanged. Native question and plan dialogs stay in Grok; proactive phone questions use Pushary MCP."
   },
+  grok_bot: {
+    ...defaults,
+    label: "Grok Bot",
+    connectVia: "Grok Bot app plugin (remote MCP connector)",
+    setupGuide: "[Grok Bot setup](/docs/agents/guides/grok-bot)",
+    capabilityNote: "Grok Bot keeps its own approval cards, and Pushary cannot stop a Bot in the middle of a task. A question nobody answers expires after about ten minutes and is never treated as a yes."
+  },
   windsurf: {
     ...defaults,
     label: "Windsurf",

package/dist/{chunk-4XXZUFWN.js → chunk-BG4Y64FW.js}

@@ -1,6 +1,6 @@
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-BMPZ5HVJ.js";
+} from "./chunk-ERK24P76.js";
 
 // src/config.ts
 import { readFileSync } from "fs";

package/dist/{chunk-X4ES7QBT.js → chunk-BJTSKOH3.js}

@@ -2,23 +2,24 @@ import {
   CLAUDE_HOOK_EVENTS,
   GEMINI_HOOK_EVENTS,
   hasGeminiHooks
-} from "./chunk-TDOKDCFH.js";
+} from "./chunk-RGSW36XH.js";
 import {
   AGENT_CHOICES
-} from "./chunk-75UYYIFJ.js";
+} from "./chunk-XV6S5PWW.js";
 import {
   BELL_HOOK_BINARY
-} from "./chunk-AS4Z6KS4.js";
+} from "./chunk-IFPOHFDJ.js";
 import {
   CODEX_HOOK_EVENTS,
+  HOOK_SHELL,
   hasCodexHooks,
   holdBudgetOf
-} from "./chunk-KZCYHWDF.js";
+} from "./chunk-MWLTTLPK.js";
 import {
   CURSOR_GATE_EVENTS,
   HOOK_LOCATOR_BINARY,
   hookCommandHoldBudget
-} from "./chunk-762CDAJJ.js";
+} from "./chunk-AXJLJJ3M.js";
 
 // src/diagnostics/bridge.ts
 import { execFileSync } from "child_process";
@@ -101,9 +102,10 @@ var record = (value) => value && typeof value === "object" && !Array.isArray(val
 var CLAUDE_HOOK_BINARY = /pushary-[a-z-]*hook/;
 var EXACT_HOOK_BINARY = /^pushary-[a-z-]*(hook|gate)$/;
 var pusharyHookExecutable = (command) => {
-  const tokens = command.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
+  const tokens = command.match(/"(?:\\.|[^"\\])*"|'[^']*'|\S+/g) ?? [];
   for (const raw of tokens.reverse()) {
-    const token = raw[0] === '"' && raw.at(-1) === '"' || raw[0] === "'" && raw.at(-1) === "'" ? raw.slice(1, -1) : raw;
+    const unquoted = raw[0] === '"' && raw.at(-1) === '"' || raw[0] === "'" && raw.at(-1) === "'" ? raw.slice(1, -1) : raw;
+    const token = command.startsWith(`${HOOK_SHELL} `) && raw[0] === '"' ? unquoted.replace(/\\(["\\$`])/g, "$1") : unquoted;
     const name = token.split(/[/\\]/).pop()?.replace(/\.(cmd|exe|mjs)$/i, "") ?? "";
     if (name === HOOK_LOCATOR_BINARY || EXACT_HOOK_BINARY.test(name)) return token;
   }

package/dist/{chunk-TCH5UCPR.js → chunk-BQ2VV7LY.js}

@@ -8,13 +8,13 @@ import {
   everyProgramFileIsThere,
   installedCodexApp,
   shellQuoted
-} from "./chunk-CPRA7IEK.js";
+} from "./chunk-PITQ5ZIQ.js";
 import {
   writeHuman
 } from "./chunk-QCGNGEGE.js";
 import {
   xml
-} from "./chunk-4QF2YLYK.js";
+} from "./chunk-LBHJJEKT.js";
 import {
   CODEX_APP_LAUNCH_AT_LOGIN_VERB,
   CODEX_APP_LAUNCH_VARIABLE

package/dist/{chunk-IBXHVYN2.js → chunk-BUZIEL7Y.js}

@@ -7,10 +7,10 @@ import {
   codexHome,
   codexHooksJsonIn,
   isPusharyCodexCommand
-} from "./chunk-KZCYHWDF.js";
+} from "./chunk-MWLTTLPK.js";
 import {
   resolvePathBinary
-} from "./chunk-US3IT6ZC.js";
+} from "./chunk-CJ5TCFD4.js";
 import {
   getPackageVersion
 } from "./chunk-QTOLNRET.js";

package/dist/{chunk-UFJS4RR7.js → chunk-CICLXLQN.js}

@@ -1,16 +1,16 @@
 import {
   notificationAnswerStep
-} from "./chunk-2FVP7WRP.js";
+} from "./chunk-HUI4OE43.js";
 import {
   matchMacAccountStep,
   retryAgentCommand
-} from "./chunk-6ONSTCDJ.js";
+} from "./chunk-4VRTSDGP.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-BMPZ5HVJ.js";
+} from "./chunk-ERK24P76.js";
 
 // src/setup/closing.ts
 var ACTIVITY_URL = "pushary.com/dashboard/agent/activity";

package/dist/{chunk-US3IT6ZC.js → chunk-CJ5TCFD4.js}

@@ -12,6 +12,9 @@ import {
   ownPackageName
 } from "./chunk-QTOLNRET.js";
 
+// src/shell-quote.ts
+var shellDoubleQuoted = (text) => `"${text.replace(/(["\\$`])/g, "\\$1")}"`;
+
 // src/npm.ts
 import { promisify } from "util";
 import { exec, execFile, execFileSync, execSync } from "child_process";
@@ -320,7 +323,10 @@ var resolveGlobalBinDir = (probe) => {
   const resolved = resolveGlobalBinary(probe);
   return resolved ? resolved.slice(0, resolved.length - probe.length - 1) : void 0;
 };
-var quoteIfNeeded = (path) => /\s/.test(path) ? `"${path}"` : path;
+var quoteIfNeeded = (path, platform = process.platform) => {
+  if (platform === "win32") return /\s/.test(path) ? `"${path}"` : path;
+  return /^[\w@%+=:,./-]+$/.test(path) ? path : shellDoubleQuoted(path);
+};
 var fetchLatestPublishedVersion = async (request) => {
   try {
     const response = await (request.fetchImpl ?? fetch)(latestReleaseUrl(request.packageName), {
@@ -360,9 +366,9 @@ var installGlobally = (options) => {
   }
   const started = (async () => {
     if (!npmIsOnPath()) throw new NpmMissingError();
-    const { withUpgradeLock } = await import("./global-upgrade-YWIVJIUR.js");
-    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-TJPKU5HL.js");
-    const { autoUpdateLock } = await import("./paths-ES3V7BWQ.js");
+    const { withUpgradeLock } = await import("./global-upgrade-IUXJJDWF.js");
+    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-DDB7WEWC.js");
+    const { autoUpdateLock } = await import("./paths-A5GAR5PL.js");
     let result = "skipped";
     const install = async () => {
       const platform = process.platform;
@@ -395,6 +401,7 @@ var installGlobally = (options) => {
 };
 
 export {
+  shellDoubleQuoted,
   LATEST_TAG,
   cleanNpmEnv,
   npmErrorMessage,

package/dist/{chunk-5JWCWALO.js → chunk-DQLCFGHK.js}

@@ -2,10 +2,10 @@ import {
   IDLE_PROMPT_NOTIFICATION,
   NOTIFICATION_PUSH_TYPES,
   POSTTOOLUSE_MIRROR_ONLY_TOOLS
-} from "./chunk-W47WL6JY.js";
+} from "./chunk-33OOEVPG.js";
 import {
   repoKeyFor
-} from "./chunk-XGP5VSQG.js";
+} from "./chunk-YPD3MTFU.js";
 import {
   cancelQuestion,
   clientErrorKindOf,
@@ -13,26 +13,26 @@ import {
   reportClientError,
   sendNotification,
   waitForAnswer
-} from "./chunk-WW24SG27.js";
+} from "./chunk-RJHX66EY.js";
 import {
   withRetry
-} from "./chunk-5EFNBL6V.js";
+} from "./chunk-XAO6EYGM.js";
 import {
   getMachineId
-} from "./chunk-M46WDK64.js";
+} from "./chunk-SFAP4AJY.js";
 import {
   reportedInstallSource
-} from "./chunk-3RKIJM26.js";
+} from "./chunk-Y5VKZNFN.js";
 import {
   canonicalJson
-} from "./chunk-KZCYHWDF.js";
+} from "./chunk-MWLTTLPK.js";
 import {
   writeFileAtomic
 } from "./chunk-QENTGE75.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-4XXZUFWN.js";
+} from "./chunk-BG4Y64FW.js";
 import {
   ACTION_BODY_MAX,
   AGENTS,
@@ -66,7 +66,7 @@ import {
   toToolLookup,
   truncateLine,
   unansweredRefusalReason
-} from "./chunk-762CDAJJ.js";
+} from "./chunk-AXJLJJ3M.js";
 
 // ../hook-mapping/src/describe.ts
 import { isAbsolute, relative, resolve } from "path";
@@ -224,6 +224,7 @@ var parseApplyPatchFiles = (command) => [...new Set(parseApplyPatchOps(command).
 var patchDeletesFiles = (toolName, toolInput) => toolName === "apply_patch" && parseApplyPatchOps(toolInput.command).some((entry) => entry.op === "delete");
 var OPENCODE_TOOL_NAMES = {
   bash: "Bash",
+  shell: "Bash",
   // A shell command reaching outside the worktree asks a second time under its
   // own key. It is still the same command, and still Bash.
   external_directory: "Bash",
@@ -236,7 +237,8 @@ var OPENCODE_TOOL_NAMES = {
   grep: "Grep",
   webfetch: "WebFetch",
   websearch: "WebSearch",
-  task: "Task"
+  task: "Task",
+  subagent: "Task"
 };
 var PATCH_ARG_KEYS = ["command", "patch", "input"];
 var patchedFilesIn = (input) => [...new Set(PATCH_ARG_KEYS.flatMap((key) => parseApplyPatchFiles(input[key])))];

package/dist/{chunk-V3PDUDPB.js → chunk-ELLJPP6O.js}

@@ -3,11 +3,11 @@ import {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-PVANKDWM.js";
+} from "./chunk-2AELPDMT.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-3N2ZTHZZ.js";
+} from "./chunk-GAMVAORR.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;