@pushary/agent-hooks 1.9.66 → 1.9.67

package/dist/{chunk-AWGBL4P3.js → chunk-B3V2WOJX.js}

@@ -4,24 +4,24 @@ import {
   outcomeOfFailedAsk,
   reportMachineDenial,
   storedWaitDeadline
-} from "./chunk-V4EOFOB2.js";
+} from "./chunk-6H4E5UBA.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-6BGVSV2Q.js";
+} from "./chunk-7YJSDXLM.js";
 import {
   isAdmitted,
   readAdmissionRules
-} from "./chunk-QN25WBXL.js";
+} from "./chunk-EQR6JSFE.js";
 import {
   isDeferAnswer,
   oncePerSession
-} from "./chunk-ZJV7SFIJ.js";
+} from "./chunk-CPLQ5OHX.js";
 import {
   activeHookSource,
   activeIdentity,
   namedSource
-} from "./chunk-3EZP5ZPS.js";
+} from "./chunk-ICQCQAUO.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -45,10 +45,10 @@ import {
   reportEvent,
   scopePathFor,
   settleQuestionsForToolUse
-} from "./chunk-2BL6KWN7.js";
+} from "./chunk-XFDWLDHG.js";
 import {
   repoKeyFor
-} from "./chunk-XXIJBYNW.js";
+} from "./chunk-GMHQYX3D.js";
 import {
   askUser,
   cancelQuestion,
@@ -65,20 +65,20 @@ import {
   waitForQuestion,
   waitsForThePhone,
   withdrawQuestion
-} from "./chunk-ZAZUDYSF.js";
+} from "./chunk-D3U6CN7T.js";
 import {
   getMachineId
-} from "./chunk-IA5VWIHV.js";
+} from "./chunk-PIBWX3EF.js";
 import {
   claudeConfigDir
-} from "./chunk-GDLT32I4.js";
+} from "./chunk-TI4JYPGQ.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-A47UKPC7.js";
+} from "./chunk-32OSSYGZ.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-GO7YKPT3.js";
+} from "./chunk-X2MTVD4W.js";
 import {
   AGENT_QUESTION_STRATEGY,
   AGENT_QUESTION_TOOL,
@@ -133,7 +133,7 @@ import {
   terminalStaysLiveForTheCall,
   timeoutActionWithoutLocalPrompt,
   unansweredRefusalReason
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/terminal-answer-watch.ts
 import { closeSync, openSync, readSync, statSync } from "fs";
@@ -296,36 +296,45 @@ var reportDecisionEpisode = async (apiKey, input) => {
 
 // src/hook.ts
 import { basename } from "path";
-var START_MS = Date.now();
-var ACTIVE_AGENT = activeIdentity(process.argv);
-var ACTIVE_SOURCE = activeHookSource(process.argv);
-var HANDED_DOWN_BY_THE_MAC_BRIDGE = namedSource(process.argv) !== void 0;
-var CLAUDE_SESSION_ATTENDED_ENV = "CLAUDE_CODE_SESSION_ATTENDED";
-var PUSHARY_IS_SOLE_GATE = ACTIVE_SOURCE !== null && hookCompatibleProfileBySource(ACTIVE_SOURCE)?.soleGate != null;
-var agentNameIn = (projectName) => `${ACTIVE_AGENT.label} - ${projectName}`;
+
+// src/pre-tool-use-output.ts
 var allow = (reason) => claudePreToolUseOutput("allow", reason);
 var deny = (reason) => claudePreToolUseOutput("deny", reason);
-var allowWithInput = (updatedInput) => claudePreToolUseOutput("allow", void 0, updatedInput);
 var ask = (reason) => claudePreToolUseOutput("ask", reason);
 var halted = (reason) => claudeStoppedPreToolUseOutput(reason);
-var undecidedCall = (reason) => PUSHARY_IS_SOLE_GATE ? deny(reason) : void 0;
+
+// src/permission-ask-outcome.ts
 var questionLimitOutput = (handBack) => handBack.kind === "refuse" ? deny(handBack.reason) : ask(QUESTION_LIMIT_PROMPT_REASON);
-var outcomeOfFailedPermissionAsk = (error, sessionId, questionLimitFacts) => {
+var outcomeOfFailedPermissionAsk = (error, sessionId, questionLimitFacts, subscriptionRequiredOutput) => {
   if (isQuestionLimitRefusal(error)) return questionLimitOutput(questionLimitHandBack(questionLimitFacts));
-  return outcomeOfFailedAsk(error, sessionId, halted(UNVERIFIABLE_APPROVAL_REASON)) ?? undecidedCall(SOLE_GATE_SUBSCRIPTION_REASON);
+  return outcomeOfFailedAsk(error, sessionId, halted(UNVERIFIABLE_APPROVAL_REASON)) ?? subscriptionRequiredOutput;
 };
-var handlePushOnly = async (apiKey, description, projectName, timeoutSeconds, timeoutAction, sessionId, machineId, toolName, toolTarget, decision, signals, agentPromptFollows) => {
+var handlePushOnly = async (apiKey, call, timeoutSeconds, timeoutAction, signals) => {
+  const {
+    description,
+    projectName,
+    agentName,
+    sessionId,
+    machineId,
+    toolName,
+    toolTarget,
+    decision,
+    agentPromptFollows,
+    startMs,
+    subscriptionRequiredOutput,
+    announceWait: announceWait2
+  } = call;
   const effectiveWait = effectiveWaitSeconds(timeoutAction, timeoutSeconds, "claude");
   const now = Date.now();
-  const requestedDeadline = hookWaitDeadline(START_MS, effectiveWait, "claude", now);
-  const clampCut = hookWaitClamped(START_MS, effectiveWait, "claude", now);
+  const requestedDeadline = hookWaitDeadline(startMs, effectiveWait, "claude", now);
+  const clampCut = hookWaitClamped(startMs, effectiveWait, "claude", now);
   let result;
   try {
     result = await askUser(apiKey, {
       question: `Allow ${description || UNNAMED_ACTION}?`,
       type: "confirm",
       context: `Agent wants to run this in ${projectName}`,
-      agentName: agentNameIn(projectName),
+      agentName,
       sessionId,
       machineId,
       toolName,
@@ -337,11 +346,11 @@ var handlePushOnly = async (apiKey, description, projectName, timeoutSeconds, ti
     return outcomeOfFailedPermissionAsk(error, sessionId, {
       refusesUnanswered: refusesWhenUnanswered({ mode: "push_only", timeoutAction }),
       agentPromptFollows
-    });
+    }, subscriptionRequiredOutput);
   }
   if (isDecisionStopped(result)) return halted(DECISION_STOP_REASON);
   const deadline = storedWaitDeadline(result, requestedDeadline);
-  if (waitsForThePhone(result)) announceWait(effectiveWait, result.answerUrl, sessionId);
+  if (waitsForThePhone(result)) announceWait2(effectiveWait, result.answerUrl, sessionId);
   const answer = await waitForQuestion(apiKey, result, deadline);
   if (isDecisionStopped(answer)) return halted(DECISION_STOP_REASON);
   if (!answer.answered && isLocalQuestionHandoff(result)) return ask("Approve in the current client.");
@@ -362,18 +371,29 @@ var handlePushOnly = async (apiKey, description, projectName, timeoutSeconds, ti
       return ask("No push response, asking in terminal");
   }
 };
-var handleTerminalOnly = () => {
-  return ask();
-};
-var handlePushFirst = async (apiKey, description, projectName, pushFirstSeconds, sessionId, machineId, toolName, toolTarget, decision, signals, agentPromptFollows) => {
-  const requestedDeadline = hookWaitDeadline(START_MS, pushFirstSeconds, "claude", Date.now());
+var handlePushFirst = async (apiKey, call, pushFirstSeconds, signals) => {
+  const {
+    description,
+    projectName,
+    agentName,
+    sessionId,
+    machineId,
+    toolName,
+    toolTarget,
+    decision,
+    agentPromptFollows,
+    startMs,
+    subscriptionRequiredOutput,
+    announceWait: announceWait2
+  } = call;
+  const requestedDeadline = hookWaitDeadline(startMs, pushFirstSeconds, "claude", Date.now());
   let result;
   try {
     result = await askUser(apiKey, {
       question: `Allow ${description || UNNAMED_ACTION}?`,
       type: "confirm",
       context: `Agent wants to run this in ${projectName}`,
-      agentName: agentNameIn(projectName),
+      agentName,
       sessionId,
       machineId,
       toolName,
@@ -382,10 +402,10 @@ var handlePushFirst = async (apiKey, description, projectName, pushFirstSeconds,
       ...decision
     });
   } catch (error) {
-    return outcomeOfFailedPermissionAsk(error, sessionId, { refusesUnanswered: false, agentPromptFollows });
+    return outcomeOfFailedPermissionAsk(error, sessionId, { refusesUnanswered: false, agentPromptFollows }, subscriptionRequiredOutput);
   }
   if (isDecisionStopped(result)) return halted(DECISION_STOP_REASON);
-  if (waitsForThePhone(result)) announceWait(pushFirstSeconds, result.answerUrl, sessionId);
+  if (waitsForThePhone(result)) announceWait2(pushFirstSeconds, result.answerUrl, sessionId);
   const deadline = storedWaitDeadline(result, requestedDeadline);
   const answer = await waitForQuestion(apiKey, result, deadline, 1500);
   if (isDecisionStopped(answer)) return halted(DECISION_STOP_REASON);
@@ -396,6 +416,20 @@ var handlePushFirst = async (apiKey, description, projectName, pushFirstSeconds,
   }
   return ask(WITHDRAWN_APPROVAL_REASON);
 };
+
+// src/hook.ts
+var START_MS = Date.now();
+var ACTIVE_AGENT = activeIdentity(process.argv);
+var ACTIVE_SOURCE = activeHookSource(process.argv);
+var HANDED_DOWN_BY_THE_MAC_BRIDGE = namedSource(process.argv) !== void 0;
+var CLAUDE_SESSION_ATTENDED_ENV = "CLAUDE_CODE_SESSION_ATTENDED";
+var PUSHARY_IS_SOLE_GATE = ACTIVE_SOURCE !== null && hookCompatibleProfileBySource(ACTIVE_SOURCE)?.soleGate != null;
+var agentNameIn = (projectName) => `${ACTIVE_AGENT.label} - ${projectName}`;
+var allowWithInput = (updatedInput) => claudePreToolUseOutput("allow", void 0, updatedInput);
+var undecidedCall = (reason) => PUSHARY_IS_SOLE_GATE ? deny(reason) : void 0;
+var handleTerminalOnly = () => {
+  return ask();
+};
 var handleNotifyOnly = async (apiKey, description, projectName, sessionId, machineId) => {
   try {
     await sendNotification(apiKey, {
@@ -522,6 +556,20 @@ var dispatchModeHandler = async (apiKey, input, toolPolicy, machineId, trainingC
     permissionMode: input.permission_mode
   };
   const signals = {};
+  const permissionAsk = {
+    description,
+    projectName,
+    agentName: agentNameIn(projectName),
+    sessionId,
+    machineId,
+    toolName: input.tool_name,
+    toolTarget,
+    decision,
+    agentPromptFollows,
+    startMs: START_MS,
+    subscriptionRequiredOutput: undecidedCall(SOLE_GATE_SUBSCRIPTION_REASON),
+    announceWait
+  };
   const runHandler = () => {
     const mode = ownPrompt ? toolPolicy.mode : approvalModeWithoutLocalPrompt(toolPolicy.mode);
     if (terminalLive && pushesToThePhone(mode)) {
@@ -529,15 +577,15 @@ var dispatchModeHandler = async (apiKey, input, toolPolicy, machineId, trainingC
     }
     switch (mode) {
       case "push_only":
-        return handlePushOnly(apiKey, description, projectName, toolPolicy.timeoutSeconds, ownPrompt ? toolPolicy.timeoutAction : timeoutActionWithoutLocalPrompt(toolPolicy), sessionId, machineId, input.tool_name, toolTarget, decision, signals, agentPromptFollows);
+        return handlePushOnly(apiKey, permissionAsk, toolPolicy.timeoutSeconds, ownPrompt ? toolPolicy.timeoutAction : timeoutActionWithoutLocalPrompt(toolPolicy), signals);
       case "terminal_only":
         return Promise.resolve(handleTerminalOnly());
       case "push_first":
-        return handlePushFirst(apiKey, description, projectName, toolPolicy.pushFirstSeconds, sessionId, machineId, input.tool_name, toolTarget, decision, signals, agentPromptFollows);
+        return handlePushFirst(apiKey, permissionAsk, toolPolicy.pushFirstSeconds, signals);
       case "notify_only":
         return handleNotifyOnly(apiKey, description, projectName, sessionId, machineId);
       default:
-        return handlePushFirst(apiKey, description, projectName, toolPolicy.pushFirstSeconds, sessionId, machineId, input.tool_name, toolTarget, decision, signals, agentPromptFollows);
+        return handlePushFirst(apiKey, permissionAsk, toolPolicy.pushFirstSeconds, signals);
     }
   };
   const result = await runHandler();

package/dist/{chunk-RJ6JEHCP.js → chunk-BBFGDYYI.js}

@@ -1,6 +1,6 @@
 import {
   isFile
-} from "./chunk-KS3O6O7E.js";
+} from "./chunk-WJLHZ6E6.js";
 
 // src/claude-native-install.ts
 import { accessSync, constants } from "fs";

package/dist/{chunk-YQDCTID4.js → chunk-BFF3ABFV.js}

@@ -1,9 +1,9 @@
 import {
   AGENT_CHOICES
-} from "./chunk-UTAARXYQ.js";
+} from "./chunk-ZK5WYAMI.js";
 import {
   BELL_HOOK_BINARY
-} from "./chunk-IQ3GKPFM.js";
+} from "./chunk-FONWVVDD.js";
 import {
   CLAUDE_HOOK_EVENTS,
   CODEX_HOOK_EVENTS,
@@ -12,13 +12,13 @@ import {
   holdBudgetOf,
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-GDLT32I4.js";
+} from "./chunk-TI4JYPGQ.js";
 import {
   CURSOR_GATE_EVENTS,
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY,
   hookCommandHoldBudget
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/diagnostics/bridge.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-R7C2FS33.js → chunk-C4EDAHXI.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-3EGEA4KH.js";
 import {
   getBaseUrl
-} from "./chunk-A47UKPC7.js";
+} from "./chunk-32OSSYGZ.js";
 
 // src/cli/login-ui.ts
 import { hostname } from "os";

package/dist/{chunk-YB3HMDKE.js → chunk-CHYBOTQN.js}

@@ -4,10 +4,10 @@ import {
   keyPrefix,
   readConfigFileKey,
   readMacAppKeyPrefix
-} from "./chunk-CNJ7SI5V.js";
+} from "./chunk-JOBSKQ2Z.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-GO7YKPT3.js";
+} from "./chunk-X2MTVD4W.js";
 
 // src/key-signed-out.ts
 var VERDICT_BY_CHECK = {

package/dist/{chunk-26W46E46.js → chunk-CJZLIAJF.js}

@@ -2,25 +2,31 @@ import {
   SIGNED_OUT_ON_MAC_MESSAGE,
   describeSignedOutKey,
   readSignedOutDiagnosis
-} from "./chunk-YB3HMDKE.js";
+} from "./chunk-CHYBOTQN.js";
+import {
+  APPROVAL_RULES_PATH
+} from "./chunk-5MOJCOCF.js";
 import {
   createIo
 } from "./chunk-FO3MDD26.js";
 import {
   readKeySource
-} from "./chunk-CNJ7SI5V.js";
+} from "./chunk-JOBSKQ2Z.js";
 import {
   absoluteUrl,
   checkApiKey,
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-QR2QWGQI.js";
+} from "./chunk-3THDNNVL.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
 import {
   getBaseUrl
-} from "./chunk-A47UKPC7.js";
+} from "./chunk-32OSSYGZ.js";
+import {
+  KEY_SCOPE
+} from "./chunk-RQOT6QL3.js";
 
 // src/cli/report-key.ts
 var { dim, yellow } = createIo();
@@ -61,16 +67,28 @@ var exitOnFailedResponse = async (response, baseUrl) => {
 };
 var REFUSED_SETTINGS_ACTION = {
   mode: "change the approval mode",
+  mode_clear: "end a temporary approval mode",
   wait: "change how long approvals wait for you",
   suggestions: "read or accept rule suggestions"
 };
-var APPROVAL_SETTINGS_PATH = "/dashboard/agent/settings";
-var AGENT_KEY_SCOPE = "agent";
-var isAgentKeyRefusal = (status, check) => status === 401 && check.kind === "ok" && check.identity.keyScope === AGENT_KEY_SCOPE;
+var settingsChangeStep = (request, baseUrl) => {
+  const approvalRules = absoluteUrl(baseUrl, APPROVAL_RULES_PATH);
+  switch (request) {
+    case "mode":
+      return `Change it in the Pushary app, or on the dashboard: ${approvalRules}`;
+    case "mode_clear":
+      return "A temporary mode ends on its own. To end it now, pick a mode in the Pushary app.";
+    case "wait":
+      return `Change it on the dashboard: ${approvalRules}`;
+    case "suggestions":
+      return `Review them on the dashboard: ${approvalRules}`;
+  }
+};
+var isAgentKeyRefusal = (status, check) => status === 401 && check.kind === "ok" && check.identity.keyScope === KEY_SCOPE.agent;
 var describeAgentKeyRefusal = (request, baseUrl = getBaseUrl()) => ({
-  message: `This computer's key cannot ${REFUSED_SETTINGS_ACTION[request]}. Keys from pushary login, phone pairing and the Mac app run approvals and notifications, not account settings.`,
+  message: `This computer's key cannot ${REFUSED_SETTINGS_ACTION[request]}. It runs approvals and notifications, not account settings.`,
   next: [
-    `Change it from the Pushary app, your phone, or the dashboard: ${absoluteUrl(baseUrl, APPROVAL_SETTINGS_PATH)}`,
+    settingsChangeStep(request, baseUrl),
     "The key itself is valid. Nothing on this computer needs fixing."
   ],
   exitCode: EXIT.USAGE,
@@ -90,6 +108,5 @@ var exitOnFailedSettingsRequest = async (response, settings) => {
 
 export {
   printKeyCheck,
-  APPROVAL_SETTINGS_PATH,
   exitOnFailedSettingsRequest
 };

package/dist/{chunk-ZJV7SFIJ.js → chunk-CPLQ5OHX.js}

@@ -1,6 +1,6 @@
 import {
   DEFAULT_SESSION
-} from "./chunk-2BL6KWN7.js";
+} from "./chunk-XFDWLDHG.js";
 
 // src/answer.ts
 var isDeferAnswer = (value) => value === "defer";

package/dist/{chunk-ZAZUDYSF.js → chunk-D3U6CN7T.js}

@@ -6,18 +6,18 @@ import {
   McpToolError,
   SubscriptionRequiredError,
   callMcpTool
-} from "./chunk-Q5RNYE2L.js";
+} from "./chunk-KNUYUQBP.js";
 import {
   installNetworkDefaults,
   isNetworkFailure
-} from "./chunk-GECU7V44.js";
+} from "./chunk-P4RXSZDT.js";
 import {
   clientReportClaims
-} from "./chunk-GDLT32I4.js";
+} from "./chunk-TI4JYPGQ.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-A47UKPC7.js";
+} from "./chunk-32OSSYGZ.js";
 import {
   ASK_AGENT_NAME_MAX,
   CLIENT_REPORT_PATH,
@@ -26,7 +26,7 @@ import {
   TOOL_FAILURE_CODES,
   degradedLine,
   truncateLine
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/api.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-MNNQEUQC.js → chunk-D7Z4USSB.js}

@@ -1,13 +1,24 @@
+import {
+  APPROVAL_RULES_PATH,
+  canChangeApprovalSettings
+} from "./chunk-5MOJCOCF.js";
 import {
   callMcpTool
-} from "./chunk-Q5RNYE2L.js";
+} from "./chunk-KNUYUQBP.js";
+import {
+  absoluteUrl
+} from "./chunk-3THDNNVL.js";
+import {
+  getBaseUrl
+} from "./chunk-32OSSYGZ.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-GO7YKPT3.js";
+} from "./chunk-X2MTVD4W.js";
 import {
+  APPROVAL_MODE_META,
   classifyConfirmResponse,
   isAnswerSource
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {
@@ -304,7 +315,15 @@ var unansweredNextStep = (appPlatforms) => {
   const step = notificationAnswerStep(appPlatforms);
   return step === null ? CHECK_THE_NOTIFICATION_OPENED : `To send another one, run pushary doctor --roundtrip. ${step}`;
 };
-var describeRoundTripOutcome = (outcome, appPlatforms = []) => {
+var PHONE_APPROVAL_MODES = ["push_only", "push_first"];
+var NOTIFY_ONLY_SENT = `Sent. This site is set to ${APPROVAL_MODE_META.notify_only.label}, so questions never wait for an answer.`;
+var phoneApprovalModeLabels = PHONE_APPROVAL_MODES.map((mode) => APPROVAL_MODE_META[mode].label).join(" or ");
+var phoneApprovalModeCommands = PHONE_APPROVAL_MODES.map((mode) => `pushary mode ${mode}`).join(" or ");
+var answerFromYourPhoneSteps = (baseUrl, keyScope) => {
+  const inTheAppOrDashboard = `To answer approvals from your phone, choose ${phoneApprovalModeLabels} in the Pushary app, or on the dashboard: ${absoluteUrl(baseUrl, APPROVAL_RULES_PATH)}`;
+  return canChangeApprovalSettings(keyScope) ? [inTheAppOrDashboard, `With this key you can also run ${phoneApprovalModeCommands}.`] : [inTheAppOrDashboard];
+};
+var describeRoundTripOutcome = (outcome, { appPlatforms = [], baseUrl = getBaseUrl(), keyScope = null } = {}) => {
   switch (outcome.kind) {
     case "answered":
       return {
@@ -324,8 +343,8 @@ var describeRoundTripOutcome = (outcome, appPlatforms = []) => {
     case "notify-only":
       return {
         ok: true,
-        message: "Sent. This site is in notify-only mode, so questions never wait for an answer.",
-        next: ["Switch with pushary mode push_first if you want approvals to hold for your phone."]
+        message: NOTIFY_ONLY_SENT,
+        next: [...answerFromYourPhoneSteps(baseUrl, keyScope)]
       };
     case "no-recipients":
       return {
@@ -344,8 +363,8 @@ var describeRoundTripOutcome = (outcome, appPlatforms = []) => {
       };
   }
 };
-var describeRoundTrip = (outcome, appPlatforms = []) => {
-  const report = describeRoundTripOutcome(outcome, appPlatforms);
+var describeRoundTrip = (outcome, context = {}) => {
+  const report = describeRoundTripOutcome(outcome, context);
   return { ...report, next: [...report.next, "Agent hook activation remains unverified. Restart your agent and check one real approval."] };
 };
 var roundTripEvidence = (outcome) => ({

package/dist/{chunk-V3YBVOTZ.js → chunk-DP6LU6BB.js}

@@ -1,11 +1,11 @@
 import {
   autoUpdateLock
-} from "./chunk-GDLT32I4.js";
+} from "./chunk-TI4JYPGQ.js";
 import {
   installPackageGlobally,
   npmErrorMessage,
   writeJsonAtomic
-} from "./chunk-KS3O6O7E.js";
+} from "./chunk-WJLHZ6E6.js";
 
 // src/upgrade-lock.ts
 import { fork } from "child_process";

package/dist/{chunk-32ZT2ATY.js → chunk-DXCHIKAN.js}

@@ -1,9 +1,9 @@
-import {
-  APPROVAL_SETTINGS_PATH
-} from "./chunk-26W46E46.js";
 import {
   readMacAppAgentKey
-} from "./chunk-CN6JFM62.js";
+} from "./chunk-LS42NV6E.js";
+import {
+  API_KEYS_PATH
+} from "./chunk-5MOJCOCF.js";
 import {
   findExportedKeyLines,
   isAdoptedMacAppKey,
@@ -13,13 +13,13 @@ import {
   readConfigFileKey,
   readKeySource,
   readMacAppKeyPrefix
-} from "./chunk-CNJ7SI5V.js";
+} from "./chunk-JOBSKQ2Z.js";
 import {
   absoluteUrl
-} from "./chunk-QR2QWGQI.js";
+} from "./chunk-3THDNNVL.js";
 import {
   isValidApiKey
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/key-revocation.ts
 var SELF_REVOKE_PATH = "/api/v1/server/keys/self/revoke";
@@ -128,7 +128,7 @@ var SPARED_KEY_WHY = {
   no_creation_record: "This CLI has no record of creating it, so it may be in use by the Mac app or on another machine."
 };
 var localRemovalOf = (dryRun) => dryRun ? "would be removed here" : "removed here";
-var settingsUrlOf = (baseUrl) => absoluteUrl(baseUrl, APPROVAL_SETTINGS_PATH);
+var settingsUrlOf = (baseUrl) => absoluteUrl(baseUrl, API_KEYS_PATH);
 var revokeYourselfHint = (reason, baseUrl) => reason === "no_creation_record" ? `Revoke it at ${settingsUrlOf(baseUrl)} if nothing else uses it.` : null;
 var describeCliKeyRevocation = (outcome, run) => {
   const label = `API key ${outcome.keyPrefix}`;

package/dist/{chunk-QN25WBXL.js → chunk-EQR6JSFE.js}

@@ -1,25 +1,25 @@
 import {
   registerTranscript
-} from "./chunk-SVKCYUYP.js";
+} from "./chunk-SB6TYV4M.js";
 import {
   namedEvent
-} from "./chunk-3EZP5ZPS.js";
+} from "./chunk-ICQCQAUO.js";
 import {
   isBridgeLocator,
   liveBridgeProbe,
   pusharyHookExecutable,
   resolveBridgeStub
-} from "./chunk-YQDCTID4.js";
+} from "./chunk-BFF3ABFV.js";
 import {
   writeDegraded
-} from "./chunk-ZAZUDYSF.js";
+} from "./chunk-D3U6CN7T.js";
 import {
   cursorUserHooks
-} from "./chunk-GDLT32I4.js";
+} from "./chunk-TI4JYPGQ.js";
 import {
   atLeast,
   parseVersion
-} from "./chunk-KS3O6O7E.js";
+} from "./chunk-WJLHZ6E6.js";
 import {
   CURSOR_GATE_COVERAGE,
   CURSOR_GATE_SCRIPT,
@@ -33,7 +33,7 @@ import {
   isGrokSessionEndStop,
   isRecord,
   toolsCoveredByGateEntry
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/tool-hook-input.ts
 var OPTIONAL_TEXT_FIELDS = ["hook_event_name", "session_id", "cwd", "transcript_path", "tool_use_id", "permission_mode", "cursor_version"];

package/dist/{chunk-IQ3GKPFM.js → chunk-FONWVVDD.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-GDLT32I4.js";
+} from "./chunk-TI4JYPGQ.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-XXIJBYNW.js → chunk-GMHQYX3D.js}

@@ -1,7 +1,7 @@
 import {
   localRepoKey,
   normalizeRepoRemote
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/repo.ts
 import { existsSync, readFileSync, statSync } from "fs";

package/dist/{chunk-3EZP5ZPS.js → chunk-ICQCQAUO.js}

@@ -1,11 +1,11 @@
 import {
   addGeminiMcpServer,
   removeGeminiMcpServer
-} from "./chunk-YQDCTID4.js";
+} from "./chunk-BFF3ABFV.js";
 import {
   CLAUDE_CODE_AGENT,
   compatibleToolLookup
-} from "./chunk-2BL6KWN7.js";
+} from "./chunk-XFDWLDHG.js";
 import {
   CLAUDE_HOOK_EVENTS,
   PUSHARY_MCP_URL,
@@ -17,7 +17,7 @@ import {
   isPusharyHook,
   registerHookEntry,
   removeClaudeMcpServers
-} from "./chunk-GDLT32I4.js";
+} from "./chunk-TI4JYPGQ.js";
 import {
   HOOK_COMPATIBLE_PROFILES,
   PHONE_ANSWERED_TOOLS,
@@ -28,7 +28,7 @@ import {
   pusharyMissingReason,
   refusalOutput,
   withHookHoldBudget
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/config-document.ts
 import { parse, stringify } from "smol-toml";

package/dist/{chunk-5J7OZBJ4.js → chunk-IPG3RS23.js}

@@ -1,9 +1,9 @@
 import {
   findNativeClaudeInstall
-} from "./chunk-RJ6JEHCP.js";
+} from "./chunk-BBFGDYYI.js";
 import {
   isFile
-} from "./chunk-KS3O6O7E.js";
+} from "./chunk-WJLHZ6E6.js";
 
 // src/wrapper/claudeBinary.ts
 import { homedir } from "os";