@pushary/agent-hooks 1.9.60 → 1.9.61

package/dist/{chunk-RLVJ6TVL.js → chunk-6T5Z64KS.js}

@@ -1,6 +1,6 @@
 import {
   ensureCodexTrustsPusharyHooks
-} from "./chunk-56JCQQLS.js";
+} from "./chunk-BUZIEL7Y.js";
 import {
   CODEX_INSTRUCTIONS_LABEL,
   GEMINI_INSTRUCTIONS_LABEL,
@@ -11,7 +11,7 @@ import {
   macAppFxBridge,
   refreshInstructionBlock,
   renderAgentInstructions
-} from "./chunk-WXZHQ3TT.js";
+} from "./chunk-4VRTSDGP.js";
 import {
   OPENCODE_HOOK_BINARY,
   agentHookOwner,
@@ -21,7 +21,7 @@ import {
   openCodeInstructionsFile,
   openCodePluginDir,
   openCodeWired
-} from "./chunk-QGSHV3WO.js";
+} from "./chunk-ZGU3NXL2.js";
 import {
   detectClaudeVersion
 } from "./chunk-USE5IEEW.js";
@@ -33,7 +33,7 @@ import {
   compatibleConfigFile,
   compatibleInstructionsFile,
   hasCompatibleHooks
-} from "./chunk-PUHP4IBA.js";
+} from "./chunk-GKFO5JLN.js";
 import {
   claudeUnprovenHolds,
   claudeWired,
@@ -41,7 +41,7 @@ import {
   codexWired,
   geminiWired,
   planHooks
-} from "./chunk-CDQHQAS7.js";
+} from "./chunk-BJTSKOH3.js";
 import {
   CLAUDE_HOOK_BINARY,
   CLAUDE_HOOK_EVENTS,
@@ -52,7 +52,7 @@ import {
   needsReregistration,
   registrationSignatures,
   supportedClaudeEvents
-} from "./chunk-IF26ZGZ7.js";
+} from "./chunk-RGSW36XH.js";
 import {
   formatVersion
 } from "./chunk-6ICPEJY5.js";
@@ -68,6 +68,7 @@ import {
   codexConfigToml,
   codexHookPositions,
   codexHooksJson,
+  codexMcpStartsCommand,
   codexRegistrationHolder,
   codexVacatedIndexes,
   dropVacatedCodexHookTrust,
@@ -82,11 +83,11 @@ import {
   registeredCommands,
   registrationHolderOf,
   vscodePluginMcp
-} from "./chunk-6MJWYYAS.js";
+} from "./chunk-MWLTTLPK.js";
 import {
   resolveGlobalBinDir,
   resolveGlobalBinary
-} from "./chunk-2QREHU4O.js";
+} from "./chunk-CJ5TCFD4.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -250,13 +251,23 @@ var inspectConfiguredManagedProviders = (paths = {}) => {
   }
   return providers;
 };
-var reapplyCodexSettings = (apiKey, paths = {}) => {
+var codexNativeOwnershipFor = (hooksConfig, requested, macAppAvailable) => hooksConfig === null && macAppAvailable ? "preserve" : requested;
+var reapplyCodexSettings = (apiKey, paths = {}, nativeOwnership = "preserve") => {
   const configPath = paths.configPath ?? codexConfigToml();
   const hooksPath = paths.hooksPath ?? codexHooksJson();
   const config = readToml(configPath);
   const hooksConfig = readJson(hooksPath);
   const configured = config != null && !!config.mcp_servers?.pushary || hooksConfig != null && hasCodexHooks(hooksConfig);
   if (!configured) return { configured: false, reapplied: false, hooks: false, mcp: false };
+  const startedCommand = config != null && codexMcpStartsCommand(config);
+  let mcpWrite = null;
+  if (config != null && apiKey) {
+    try {
+      mcpWrite = addCodexMcpServer(config, apiKey, codexNativeOwnershipFor(hooksConfig, nativeOwnership, paths.macAppAvailable ?? true));
+    } catch {
+      return { configured: true, reapplied: false, hooks: false, mcp: false, failed: true };
+    }
+  }
   const command = guardBinary((paths.resolveBinary ?? resolveGlobalBinary)(CODEX_HOOK_BINARY) ?? CODEX_HOOK_BINARY);
   let hooks = false;
   let mcp = false;
@@ -277,12 +288,9 @@ var reapplyCodexSettings = (apiKey, paths = {}) => {
         dropVacatedCodexHookTrust(config, hooksPath, vacated);
         addCodexHookTrust(config, hooksPath, command, codexHookPositions(hooksConfig ?? void 0));
       }
-      if (apiKey) {
-        addCodexMcpServer(config, apiKey);
-      }
       if (hooks || apiKey) {
         writeFileAtomic(configPath, stringifyTOML(config), modeToPreserve(configPath), "utf-8");
-        mcp = Boolean(apiKey);
+        mcp = mcpWrite === "wrote-key";
       }
     } catch {
       failed = true;
@@ -290,7 +298,7 @@ var reapplyCodexSettings = (apiKey, paths = {}) => {
     }
   }
   if (config === null) hooks = false;
-  return { configured: true, reapplied: hooks || mcp, hooks, mcp, failed };
+  return { configured: true, reapplied: hooks || mcp, hooks, mcp, failed, ...mcp && startedCommand ? { codexRestartRequired: true } : {} };
 };
 var repairCodexHolds = (paths = {}) => {
   const idle = { configured: false, reapplied: false, hooks: false, mcp: false };
@@ -408,12 +416,13 @@ var KEPT_FOR_APP = { configured: true, reapplied: false, hooks: false, mcp: fals
 var FAILED_REAPPLY = { configured: false, reapplied: false, hooks: false, mcp: false, failed: true };
 var noInstructionBlock = () => null;
 var reapplyAllAgents = (apiKey, options = {}) => {
+  const appAvailable = (options.appAvailable ?? macAppBridgeAvailable)();
   const runners = [
     { id: "claude", label: "Claude Code", run: () => reapplyClaudeSettings(apiKey), instructions: noInstructionBlock },
     {
       id: "codex",
       label: "Codex",
-      run: () => reapplyCodexSettings(apiKey),
+      run: () => reapplyCodexSettings(apiKey, { macAppAvailable: appAvailable }, "take-over"),
       instructions: () => ({ file: codexAgentsMd(), body: renderAgentInstructions(CODEX_INSTRUCTIONS_LABEL) })
     },
     {
@@ -438,7 +447,6 @@ var reapplyAllAgents = (apiKey, options = {}) => {
       instructions: () => compatibleInstructionTarget(profile)
     }))
   ];
-  const appAvailable = (options.appAvailable ?? macAppBridgeAvailable)();
   const done = [];
   for (const runner of runners) {
     try {

package/dist/{chunk-4MWRR5IT.js → chunk-7BAO42UV.js}

@@ -1,6 +1,6 @@
 import {
   readExistingMachineId
-} from "./chunk-O6IUZGWV.js";
+} from "./chunk-SFAP4AJY.js";
 import {
   NetworkError
 } from "./chunk-PPY5N2E6.js";

package/dist/{chunk-5RU35K57.js → chunk-7HDGH3Z2.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-POFBE6ZY.js";
 import {
   autoUpdateState
-} from "./chunk-6MJWYYAS.js";
+} from "./chunk-MWLTTLPK.js";
 import {
   readJsonSafe,
   writeJsonAtomic

package/dist/{chunk-J4KQL7YZ.js → chunk-7MCCXE5Y.js}

@@ -3,21 +3,21 @@ import {
   expectedLaunchCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "./chunk-6LOQE4J4.js";
+} from "./chunk-G36T5LAP.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   hasDaemonServiceDefinition,
   readDaemonNeedsLogin,
   readDaemonStatus
-} from "./chunk-HC3FHDKB.js";
+} from "./chunk-LBHJJEKT.js";
 import {
   readControlMode,
   readKeySource
 } from "./chunk-WN3RACVD.js";
 import {
   getMachineId
-} from "./chunk-O6IUZGWV.js";
+} from "./chunk-SFAP4AJY.js";
 import {
   getBaseUrl
 } from "./chunk-BG4Y64FW.js";

package/dist/{chunk-CDQHQAS7.js → chunk-BJTSKOH3.js}

@@ -2,19 +2,19 @@ import {
   CLAUDE_HOOK_EVENTS,
   GEMINI_HOOK_EVENTS,
   hasGeminiHooks
-} from "./chunk-IF26ZGZ7.js";
+} from "./chunk-RGSW36XH.js";
 import {
   AGENT_CHOICES
 } from "./chunk-XV6S5PWW.js";
 import {
   BELL_HOOK_BINARY
-} from "./chunk-4MUFZU2G.js";
+} from "./chunk-IFPOHFDJ.js";
 import {
   CODEX_HOOK_EVENTS,
   HOOK_SHELL,
   hasCodexHooks,
   holdBudgetOf
-} from "./chunk-6MJWYYAS.js";
+} from "./chunk-MWLTTLPK.js";
 import {
   CURSOR_GATE_EVENTS,
   HOOK_LOCATOR_BINARY,

package/dist/{chunk-4PZXI7WU.js → chunk-BQ2VV7LY.js}

@@ -8,13 +8,13 @@ import {
   everyProgramFileIsThere,
   installedCodexApp,
   shellQuoted
-} from "./chunk-Y5V4PA2Z.js";
+} from "./chunk-PITQ5ZIQ.js";
 import {
   writeHuman
 } from "./chunk-QCGNGEGE.js";
 import {
   xml
-} from "./chunk-HC3FHDKB.js";
+} from "./chunk-LBHJJEKT.js";
 import {
   CODEX_APP_LAUNCH_AT_LOGIN_VERB,
   CODEX_APP_LAUNCH_VARIABLE

package/dist/{chunk-56JCQQLS.js → chunk-BUZIEL7Y.js}

@@ -7,10 +7,10 @@ import {
   codexHome,
   codexHooksJsonIn,
   isPusharyCodexCommand
-} from "./chunk-6MJWYYAS.js";
+} from "./chunk-MWLTTLPK.js";
 import {
   resolvePathBinary
-} from "./chunk-2QREHU4O.js";
+} from "./chunk-CJ5TCFD4.js";
 import {
   getPackageVersion
 } from "./chunk-QTOLNRET.js";

package/dist/{chunk-QUBIEZXC.js → chunk-CICLXLQN.js}

@@ -1,10 +1,10 @@
 import {
   notificationAnswerStep
-} from "./chunk-DJ7EZIQA.js";
+} from "./chunk-HUI4OE43.js";
 import {
   matchMacAccountStep,
   retryAgentCommand
-} from "./chunk-WXZHQ3TT.js";
+} from "./chunk-4VRTSDGP.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";

package/dist/{chunk-2QREHU4O.js → chunk-CJ5TCFD4.js}

@@ -366,9 +366,9 @@ var installGlobally = (options) => {
   }
   const started = (async () => {
     if (!npmIsOnPath()) throw new NpmMissingError();
-    const { withUpgradeLock } = await import("./global-upgrade-ETDP32LO.js");
-    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-T6ILR644.js");
-    const { autoUpdateLock } = await import("./paths-IIOQZESZ.js");
+    const { withUpgradeLock } = await import("./global-upgrade-IUXJJDWF.js");
+    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-DDB7WEWC.js");
+    const { autoUpdateLock } = await import("./paths-A5GAR5PL.js");
     let result = "skipped";
     const install = async () => {
       const platform = process.platform;

package/dist/{chunk-W2IVTHIG.js → chunk-DQLCFGHK.js}

@@ -13,19 +13,19 @@ import {
   reportClientError,
   sendNotification,
   waitForAnswer
-} from "./chunk-EZHY65QA.js";
+} from "./chunk-RJHX66EY.js";
 import {
   withRetry
-} from "./chunk-SEILUNWB.js";
+} from "./chunk-XAO6EYGM.js";
 import {
   getMachineId
-} from "./chunk-O6IUZGWV.js";
+} from "./chunk-SFAP4AJY.js";
 import {
   reportedInstallSource
 } from "./chunk-Y5VKZNFN.js";
 import {
   canonicalJson
-} from "./chunk-6MJWYYAS.js";
+} from "./chunk-MWLTTLPK.js";
 import {
   writeFileAtomic
 } from "./chunk-QENTGE75.js";
@@ -224,6 +224,7 @@ var parseApplyPatchFiles = (command) => [...new Set(parseApplyPatchOps(command).
 var patchDeletesFiles = (toolName, toolInput) => toolName === "apply_patch" && parseApplyPatchOps(toolInput.command).some((entry) => entry.op === "delete");
 var OPENCODE_TOOL_NAMES = {
   bash: "Bash",
+  shell: "Bash",
   // A shell command reaching outside the worktree asks a second time under its
   // own key. It is still the same command, and still Bash.
   external_directory: "Bash",
@@ -236,7 +237,8 @@ var OPENCODE_TOOL_NAMES = {
   grep: "Grep",
   webfetch: "WebFetch",
   websearch: "WebSearch",
-  task: "Task"
+  task: "Task",
+  subagent: "Task"
 };
 var PATCH_ARG_KEYS = ["command", "patch", "input"];
 var patchedFilesIn = (input) => [...new Set(PATCH_ARG_KEYS.flatMap((key) => parseApplyPatchFiles(input[key])))];

package/dist/{chunk-CEQ2AZH4.js → chunk-EUIPTDLX.js}

@@ -6,10 +6,10 @@ import {
 } from "./chunk-QW3FRUFB.js";
 import {
   ensureDaemonRunning
-} from "./chunk-HC3FHDKB.js";
+} from "./chunk-LBHJJEKT.js";
 import {
   hookOwnerOf
-} from "./chunk-CDQHQAS7.js";
+} from "./chunk-BJTSKOH3.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
@@ -31,7 +31,7 @@ import {
   claudeConfigDir,
   codexHome,
   pusharyDir
-} from "./chunk-6MJWYYAS.js";
+} from "./chunk-MWLTTLPK.js";
 import {
   writeJsonAtomic
 } from "./chunk-QENTGE75.js";

package/dist/{chunk-6LOQE4J4.js → chunk-G36T5LAP.js}

@@ -13,7 +13,7 @@ import {
   resolvePackageVersionFromBinary,
   resolvePathBinary,
   resolvePathBinaryAsync
-} from "./chunk-2QREHU4O.js";
+} from "./chunk-CJ5TCFD4.js";
 import {
   MANAGED_PROVIDERS
 } from "./chunk-AXJLJJ3M.js";

package/dist/{chunk-S54C6TQC.js → chunk-GDKQUB52.js}

@@ -1,19 +1,19 @@
 import {
   openCodeConfigDirFrom
-} from "./chunk-QGSHV3WO.js";
+} from "./chunk-ZGU3NXL2.js";
 import {
   nativeClaudeInstallPath
 } from "./chunk-VUFHYMSP.js";
 import {
   grokHome
-} from "./chunk-PUHP4IBA.js";
+} from "./chunk-GKFO5JLN.js";
 import {
   claudeConfigDir,
   codexHomeFrom
-} from "./chunk-6MJWYYAS.js";
+} from "./chunk-MWLTTLPK.js";
 import {
   resolvePathBinary
-} from "./chunk-2QREHU4O.js";
+} from "./chunk-CJ5TCFD4.js";
 import {
   HOOK_COMPATIBLE_PROFILES
 } from "./chunk-AXJLJJ3M.js";

package/dist/{chunk-PUHP4IBA.js → chunk-GKFO5JLN.js}

@@ -3,18 +3,18 @@ import {
   addGeminiMcpServer,
   removeGeminiMcpServer,
   supportedClaudeEvents
-} from "./chunk-IF26ZGZ7.js";
+} from "./chunk-RGSW36XH.js";
 import {
   CLAUDE_CODE_AGENT,
   compatibleToolLookup
-} from "./chunk-W2IVTHIG.js";
+} from "./chunk-DQLCFGHK.js";
 import {
   guardBinary,
   guardBinaryRefusing,
   holdBudgetOf,
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-6MJWYYAS.js";
+} from "./chunk-MWLTTLPK.js";
 import {
   HOOK_COMPATIBLE_PROFILES,
   HOOK_LOCATOR_BINARY,

package/dist/{chunk-WXPVVXBU.js → chunk-GZCSWDAS.js}

@@ -1,14 +1,14 @@
 import {
   compatibleConfigFile,
   hasCompatibleHooks
-} from "./chunk-PUHP4IBA.js";
+} from "./chunk-GKFO5JLN.js";
 import {
   pusharyHookExecutable
-} from "./chunk-CDQHQAS7.js";
+} from "./chunk-BJTSKOH3.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-6MJWYYAS.js";
+} from "./chunk-MWLTTLPK.js";
 import {
   isRecord
 } from "./chunk-AXJLJJ3M.js";

package/dist/{chunk-DJ7EZIQA.js → chunk-HUI4OE43.js}

@@ -1,6 +1,6 @@
 import {
   callMcpTool
-} from "./chunk-SEILUNWB.js";
+} from "./chunk-XAO6EYGM.js";
 import {
   NPX_LATEST_COMMAND
 } from "./chunk-ERK24P76.js";

package/dist/{chunk-4MUFZU2G.js → chunk-IFPOHFDJ.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-6MJWYYAS.js";
+} from "./chunk-MWLTTLPK.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-SOCJ2N3E.js → chunk-JGQV4MDQ.js}

@@ -3,10 +3,10 @@ import {
   forkFinishWithUpgradeLock,
   installWithUpgradeLock,
   releaseAutoUpdateLock
-} from "./chunk-VIJIG5YL.js";
+} from "./chunk-4N5E4JNF.js";
 import {
   phoneStartIsRequired
-} from "./chunk-6LOQE4J4.js";
+} from "./chunk-G36T5LAP.js";
 import {
   describeAutoUpdateCheck,
   globalInstallLocation,
@@ -18,7 +18,7 @@ import {
   readAutoUpdateState,
   updateAutoUpdateState,
   upgradeEntryFor
-} from "./chunk-5RU35K57.js";
+} from "./chunk-7HDGH3Z2.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
@@ -26,14 +26,14 @@ import {
   autoUpdateLock,
   autoUpdateLog,
   autoUpdateState
-} from "./chunk-6MJWYYAS.js";
+} from "./chunk-MWLTTLPK.js";
 import {
   execNpm,
   fetchLatestPublishedVersion,
   npmErrorMessage,
   readGlobalCliInstallAt,
   readGlobalPrefix
-} from "./chunk-2QREHU4O.js";
+} from "./chunk-CJ5TCFD4.js";
 import {
   NPX_LATEST_COMMAND
 } from "./chunk-ERK24P76.js";

package/dist/{chunk-U7NR4JVD.js → chunk-KPNZ7JUL.js}

@@ -1,12 +1,12 @@
 import {
   macAppBridgeAvailable
-} from "./chunk-QGSHV3WO.js";
+} from "./chunk-ZGU3NXL2.js";
 import {
   keyPrefix
 } from "./chunk-WN3RACVD.js";
 import {
   bridgeAgentKey
-} from "./chunk-6MJWYYAS.js";
+} from "./chunk-MWLTTLPK.js";
 import {
   readJsonSafe
 } from "./chunk-QENTGE75.js";

package/dist/{chunk-HC3FHDKB.js → chunk-LBHJJEKT.js}

@@ -7,13 +7,13 @@ import {
 } from "./chunk-WN3RACVD.js";
 import {
   getMachineId
-} from "./chunk-O6IUZGWV.js";
+} from "./chunk-SFAP4AJY.js";
 import {
   pusharyDir
-} from "./chunk-6MJWYYAS.js";
+} from "./chunk-MWLTTLPK.js";
 import {
   resolveGlobalBinary
-} from "./chunk-2QREHU4O.js";
+} from "./chunk-CJ5TCFD4.js";
 import {
   readJsonSafe,
   writeFileAtomic,

package/dist/{chunk-L3AFVFGQ.js → chunk-LN7DE5LY.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-6MJWYYAS.js";
+} from "./chunk-MWLTTLPK.js";
 import {
   readJsonSafe,
   writeFileAtomic

package/dist/chunk-MLKGABMK.js

@@ -0,0 +1,9 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+export {
+  __export
+};

package/dist/{chunk-6MJWYYAS.js → chunk-MWLTTLPK.js}

@@ -1,7 +1,7 @@
 import {
   quoteIfNeeded,
   shellDoubleQuoted
-} from "./chunk-2QREHU4O.js";
+} from "./chunk-CJ5TCFD4.js";
 import {
   CODEX_QUESTION_TOOLS,
   HOOK_BUDGETS,
@@ -201,18 +201,59 @@ var ensureRecord = (target, key) => {
   return created;
 };
 var CODEX_MCP_URL = "https://pushary.com/api/mcp/mcp";
-var addCodexMcpServer = (config, apiKey) => {
+var CODEX_HTTP_ONLY_FIELDS = ["url", "http_headers", "env_http_headers", "http_headers_helper", "bearer_token", "bearer_token_env_var", "auth", "oauth", "oauth_resource"];
+var NATIVE_MCP_TRANSPORT_FIELDS = [...CODEX_HTTP_ONLY_FIELDS, "args", "env", "env_vars", "cwd"];
+var OLD_CLI_HTTP_FIELDS = /* @__PURE__ */ new Set(["url", "http_headers"]);
+var nativeCodexMcpCommand = () => join2(homedir2(), ".pushary", "bin", "pushary-mcp");
+var isNativeCodexMcpEntry = (entry, command) => {
+  const server = asRecord2(entry);
+  return server?.command === command && NATIVE_MCP_TRANSPORT_FIELDS.every((field) => !(field in server));
+};
+var carriesOnlyAnAuthorizationHeader = (headers) => {
+  const record = asRecord2(headers);
+  return record !== void 0 && Object.keys(record).length === 1 && typeof record.Authorization === "string";
+};
+var isOldCliMixedCodexMcpEntry = (entry, command) => {
+  const server = asRecord2(entry);
+  return server?.command === command && server.url === CODEX_MCP_URL && carriesOnlyAnAuthorizationHeader(server.http_headers) && NATIVE_MCP_TRANSPORT_FIELDS.every((field) => OLD_CLI_HTTP_FIELDS.has(field) || !(field in server));
+};
+var codexMcpMixesCommandWithHttp = (entry) => {
+  const server = asRecord2(entry);
+  return server !== void 0 && "command" in server && CODEX_HTTP_ONLY_FIELDS.some((field) => field in server);
+};
+var CODEX_RESTART_AFTER_TRANSPORT_CHANGE = "Fully quit and reopen Codex to load the updated Pushary configuration.";
+var codexMcpStartsCommand = (config) => {
+  const pushary = asRecord2(asRecord2(config.mcp_servers)?.pushary);
+  return pushary !== void 0 && "command" in pushary && pushary.enabled !== false;
+};
+var addCodexMcpServer = (config, apiKey, nativeOwnership = "preserve") => {
+  const existing = asRecord2(asRecord2(config.mcp_servers)?.pushary);
+  if (existing !== void 0 && "command" in existing) {
+    const command = nativeCodexMcpCommand();
+    if (!isOldCliMixedCodexMcpEntry(existing, command) && !isNativeCodexMcpEntry(existing, command)) {
+      throw new Error("Pushary MCP has an unrecognized or mixed transport. Its configuration was left unchanged.");
+    }
+    if (nativeOwnership === "preserve") {
+      for (const field of OLD_CLI_HTTP_FIELDS) delete existing[field];
+      return "kept-native";
+    }
+  }
   const servers = ensureRecord(config, "mcp_servers");
   const pushary = ensureRecord(servers, "pushary");
+  delete pushary.command;
   pushary.url = CODEX_MCP_URL;
   ensureRecord(pushary, "http_headers").Authorization = `Bearer ${apiKey}`;
   pushary.default_tools_approval_mode = "approve";
   delete pushary.bearer_token_env_var;
   delete pushary.tools;
+  return "wrote-key";
 };
 var readCodexMcpAuth = (config) => {
   const pushary = asRecord2(asRecord2(config.mcp_servers)?.pushary);
   if (!pushary) return void 0;
+  if ("command" in pushary) {
+    return isNativeCodexMcpEntry(pushary, nativeCodexMcpCommand()) ? { method: "native" } : void 0;
+  }
   const authorization = asRecord2(pushary.http_headers)?.Authorization;
   if (typeof authorization === "string" && authorization.startsWith("Bearer ")) {
     return { method: "embedded", key: authorization.slice("Bearer ".length).trim() };
@@ -517,6 +558,9 @@ export {
   codexSkillDir,
   CODEX_HOOK_EVENTS,
   CODEX_REQUIRED_APPROVAL_EVENTS,
+  codexMcpMixesCommandWithHttp,
+  CODEX_RESTART_AFTER_TRANSPORT_CHANGE,
+  codexMcpStartsCommand,
   addCodexMcpServer,
   readCodexMcpAuth,
   isPusharyCodexCommand,

package/dist/{chunk-MUNL23WE.js → chunk-O65F2IIN.js}

@@ -10,7 +10,7 @@ import {
   describeIdleWindow,
   idleDeadlinePassed,
   startProcessOwnership
-} from "./chunk-7WFRY6OL.js";
+} from "./chunk-SHJVFW22.js";
 import {
   spawnClaude
 } from "./chunk-XHKBHWLX.js";
@@ -23,11 +23,11 @@ import {
   isWaitForAnswerResponse,
   withdrawQuestion,
   writeDegraded
-} from "./chunk-EZHY65QA.js";
+} from "./chunk-RJHX66EY.js";
 import {
   callMcpTool,
   isRetryable
-} from "./chunk-SEILUNWB.js";
+} from "./chunk-XAO6EYGM.js";
 import {
   AGENT_QUESTION_DESCRIPTION_MAX,
   AGENT_QUESTION_HEADER_MAX,

package/dist/{chunk-625DZLT5.js → chunk-ORX5BTV4.js}

@@ -1,7 +1,7 @@
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "./chunk-RPPXQNIA.js";
+} from "./chunk-ZEWIMY63.js";
 import {
   AUTO_DECISION_WINDOW_MS,
   DEFAULT_SESSION,
@@ -10,18 +10,18 @@ import {
   permissionDeniedAction,
   releaseThrottle,
   reportEvent
-} from "./chunk-W2IVTHIG.js";
+} from "./chunk-DQLCFGHK.js";
 import {
   askUser,
   isDecisionStopped,
   waitForQuestion
-} from "./chunk-EZHY65QA.js";
+} from "./chunk-RJHX66EY.js";
 import {
   SubscriptionRequiredError
-} from "./chunk-SEILUNWB.js";
+} from "./chunk-XAO6EYGM.js";
 import {
   getMachineId
-} from "./chunk-O6IUZGWV.js";
+} from "./chunk-SFAP4AJY.js";
 import {
   ASK_CONTEXT_MAX,
   agentQuestionContext,