@pushary/agent-hooks 1.9.70 → 1.9.72

package/dist/{chunk-RQOT6QL3.js → chunk-5XKJH5GD.js}

@@ -1025,6 +1025,40 @@ var toolsCoveredByGateEntry = (coverage, matcher) => {
 var toolMatches = (match, toolName) => match.kind === "named" ? match.tools.includes(toolName) : toolName.startsWith(match.prefix);
 var cursorGateOwnsToolCall = (registration, toolName) => typeof toolName === "string" && registration.some((match) => toolMatches(match, toolName));
 
+// ../contracts/src/conversation-text.ts
+var INTERNAL_ENVELOPE = /(^|\n) {0,3}(?:<(total_tokens|task-notification)>[\s\S]*?(?:<\/\2>|$)[\t ]*)+/g;
+var INCOMPLETE_ENVELOPE = /(^|\n) {0,3}<(?:total_tokens|task-notification)$/g;
+var SUGGESTION_REQUEST = /^This is an app-generated request for a suggested next user(?: message| prompt)/;
+var visibleProse = (text2) => text2.replace(INTERNAL_ENVELOPE, "$1").replace(INCOMPLETE_ENVELOPE, "$1");
+function conversationText(text2) {
+  if (SUGGESTION_REQUEST.test(text2.trimStart())) return "";
+  const output = [];
+  let prose = [];
+  let fence = null;
+  for (const line of text2.split("\n")) {
+    const marker = /^ {0,3}(`{3,}|~{3,})/.exec(line)?.[1];
+    if (fence) {
+      output.push(line);
+      if (marker?.[0] === fence.marker && marker.length >= fence.length) fence = null;
+    } else if (marker) {
+      output.push(visibleProse(prose.join("\n")), line);
+      prose = [];
+      fence = { marker: marker.charAt(0), length: marker.length };
+    } else {
+      prose.push(line);
+    }
+  }
+  output.push(visibleProse(prose.join("\n")));
+  return output.join("\n").trim();
+}
+function extractMessageText(content) {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return "";
+  return content.flatMap(
+    (block) => block !== null && typeof block === "object" && "type" in block && block.type === "text" && "text" in block && typeof block.text === "string" ? [block.text] : []
+  ).join("\n");
+}
+
 // ../contracts/src/shell-analysis.ts
 var SHELL_WORD_SEPARATOR = /[ \t\n]/;
 var ARITHMETIC_EVALUATING_EXPANSION = /\$[#+=~^]*(?:[A-Za-z_][A-Za-z0-9_]*|[0-9]+|[-?$!@*#])?\[/;
@@ -4073,6 +4107,7 @@ var changesProduction = (invocation) => {
   const words = wordsOfInvocation(invocation);
   return words.some((word, index) => wordSelectsProduction(word, words[index - 1])) && (deployCliChangesSomething(words) || SCHEMA_CHANGE_WORD.test(normalizedInvocation(invocation)));
 };
+var SQL_WORDS_THAT_CAN_FOLLOW_A_COLUMN = String.raw`(?:from|is|in|and|or|asc|desc|between|like|then|else|end|when|having|union|order\s+by|group\s+by|limit\s+\d+|offset\s+\d+)`;
 var SQL_WRITE_STATEMENT = new RegExp([
   String.raw`\b(?:insert|update|delete|merge|upsert|alter|create|drop|truncate|grant|revoke|copy|vacuum|reindex|rename|attach|detach)\b`,
   String.raw`\breplace\s+into\b`,
@@ -4081,9 +4116,17 @@ var SQL_WRITE_STATEMENT = new RegExp([
   String.raw`\bset\s+(?:global|persist)\b`,
   String.raw`\bkill\s+(?:query|connection|\d)`,
   String.raw`\bcall\b`,
-  String.raw`\bexecute\s+immediate\b`,
+  String.raw`\bexec(?:ute)?(?:\s*\(|\s+(?!(?:${SQL_WORDS_THAT_CAN_FOLLOW_A_COLUMN}|as(?!\s+(?:login|user|caller|owner|self)\b))\b)[\w@\["])`,
+  String.raw`(?:^|;|\b(?:then|else|do|loop|declare|as|is)\b)\s*begin\s+(?!(?:transaction|work|isolation|deferred|immediate|exclusive|read\s+(?:only|write)|as|${SQL_WORDS_THAT_CAN_FOLLOW_A_COLUMN})\b)[^\s;,)]`,
+  String.raw`\bset\s+@@(?:global|persist)`,
+  String.raw`\brefresh\s+materialized\b`,
+  String.raw`\bcomment\s+(?:if\s+exists\s+)?on\s+(?:table|foreign\s+table|column|schema|database|catalog|warehouse|function|procedure|routine|procedural\s+language|aggregate|view|materialized\s+view|index|type|role|extension|trigger|event\s+trigger|constraint|sequence|policy|domain|server|foreign\s+data\s+wrapper|large\s+object|tablespace|publication|subscription|macro|collation|conversion|operator|cast|language|rule|statistics|text\s+search|transform|access\s+method)\b`,
+  String.raw`\bexport\s+database\b`,
+  String.raw`\bload_extension\b`,
+  String.raw`\blo_(?:export|import|unlink)\b`,
+  String.raw`\bdblink_exec\b`,
+  String.raw`\bpg_drop_replication_slot\b`,
   String.raw`\bprepare\s+\S+\s+from\b`,
-  String.raw`\bselect\b[^;]*\binto\b(?!\s*@)`,
   String.raw`(?:^|;)\s*lock\b`,
   String.raw`(?:^|;)\s*do\b`,
   String.raw`\bpg_terminate_backend\b`,
@@ -4092,9 +4135,17 @@ var SQL_WRITE_STATEMENT = new RegExp([
   String.raw`\.(?:insert|update|delete|replace|remove|drop|rename|create|bulkwrite|findoneand)\w*\s*\(`
 ].join("|"), "i");
 var SQL_READ_PHRASE = /\bshow\s+create\b/gi;
+var SQL_SELECT = /\bselect\b/i;
+var SQL_INTO_A_TABLE = /\binto\b(?!\s*@)/i;
+var SQL_STATEMENT_SEPARATOR = ";";
+var statementSelectsIntoATable = (statement) => {
+  const select = statement.search(SQL_SELECT);
+  return select !== -1 && SQL_INTO_A_TABLE.test(statement.slice(select));
+};
+var selectsIntoATable = (sql) => sql.split(SQL_STATEMENT_SEPARATOR).some(statementSelectsIntoATable);
 var sqlTextWrites = (text2) => {
   const statement = text2.replace(SQL_READ_PHRASE, "");
-  return SQL_WRITE_STATEMENT.test(statement) || SQL_CLIENT_FILE_COMMAND.test(statement);
+  return SQL_WRITE_STATEMENT.test(statement) || selectsIntoATable(statement) || SQL_CLIENT_FILE_COMMAND.test(statement);
 };
 var writesThroughSql = (sql, lexicon) => {
   const parsed = sqlOutsideLiterals(sql, lexicon);
@@ -5042,9 +5093,13 @@ var parseMcpToolName = (toolName) => {
   if (split <= 0 || split + 2 >= rest.length) return void 0;
   return { server: rest.slice(0, split), tool: rest.slice(split + 2) };
 };
+var INVISIBLE_CHARACTERS = /[\u200B-\u200D\u2060\uFEFF]/g;
+var readableText = (text2) => text2.normalize("NFKC").replace(INVISIBLE_CHARACTERS, "");
+var ACRONYM_BOUNDARY = /([A-Z]{1,63})([A-Z][a-z])/g;
 var CAMEL_CASE_BOUNDARY = /([a-z0-9])([A-Z])/g;
-var MCP_TOOL_NAME_WORD_SEPARATOR = /[\s_.:-]+/;
-var wordsOfMcpToolName = (toolName) => toolName.replace(CAMEL_CASE_BOUNDARY, "$1 $2").toLowerCase().split(MCP_TOOL_NAME_WORD_SEPARATOR).filter((word) => word.length > 0);
+var IDENTIFIER_WORD_SEPARATOR = /[^a-z0-9]+/;
+var wordsOfAnIdentifierAsWritten = (identifier3) => readableText(identifier3).toLowerCase().split(IDENTIFIER_WORD_SEPARATOR).filter((word) => word.length > 0);
+var wordsOfIdentifier = (identifier3) => readableText(identifier3).replace(ACRONYM_BOUNDARY, "$1 $2").replace(CAMEL_CASE_BOUNDARY, "$1 $2").toLowerCase().split(IDENTIFIER_WORD_SEPARATOR).filter((word) => word.length > 0);
 var MCP_TOOL_WORDS_THAT_MOVE_MONEY = /* @__PURE__ */ new Set([
   "pay",
   "payment",
@@ -5100,11 +5155,6 @@ var MCP_TOOL_WORDS_THAT_REACH_OTHERS = /* @__PURE__ */ new Set([
   "share"
 ]);
 var mcpToolWordNeedsAPerson = (word) => DESTRUCTIVE_SUBCOMMANDS.has(word) || MCP_TOOL_WORDS_THAT_MOVE_MONEY.has(word) || MCP_TOOL_WORDS_THAT_RUN_CODE.has(word) || MCP_TOOL_WORDS_THAT_REACH_OTHERS.has(word);
-var mcpToolNameNeedsAPerson = (toolName) => {
-  const words = wordsOfMcpToolName(toolName);
-  const phrase = words.join(" ");
-  return words.some(mcpToolWordNeedsAPerson) || classifyDecisionRisk(phrase, phrase) !== "standard";
-};
 var MCP_TOOL_VERBS_THAT_ONLY_READ = /* @__PURE__ */ new Set([
   "get",
   "list",
@@ -5121,11 +5171,429 @@ var MCP_TOOL_VERBS_THAT_ONLY_READ = /* @__PURE__ */ new Set([
   "browse",
   "count"
 ]);
-var mcpToolLeadsWithAReadVerb = (toolName) => {
-  const tool = parseMcpToolName(toolName)?.tool;
-  return tool !== void 0 && MCP_TOOL_VERBS_THAT_ONLY_READ.has(wordsOfMcpToolName(tool)[0] ?? "");
+var MCP_TOOL_VERBS_THAT_CHANGE = /* @__PURE__ */ new Set([
+  "create",
+  "update",
+  "add",
+  "insert",
+  "upsert",
+  "edit",
+  "modify",
+  "replace",
+  "put",
+  "apply",
+  "approve",
+  "reject",
+  "archive",
+  "assign",
+  "toggle",
+  "enable",
+  "disable",
+  "activate",
+  "deactivate",
+  "save",
+  "submit",
+  "trigger",
+  "invoke",
+  "reply",
+  "forward",
+  "react",
+  "append",
+  "attach",
+  "mute",
+  "unblock",
+  "unlock",
+  "grant",
+  "accept",
+  "decline",
+  "install",
+  "navigate",
+  "click",
+  "fill",
+  "generate",
+  "subscribe",
+  "unsubscribe",
+  "notify",
+  "tweet",
+  "sms",
+  "dm",
+  "sell",
+  "trade",
+  "shutdown",
+  "reboot",
+  "restart",
+  "revert",
+  "rollback",
+  "sign",
+  "authorize",
+  "evaluate",
+  "unpublish",
+  "close",
+  "reopen",
+  "mark",
+  "pin",
+  "unpin",
+  "star",
+  "unstar",
+  "snooze",
+  "copy",
+  "duplicate",
+  "join",
+  "rsvp",
+  "checkout",
+  "vote",
+  "kick",
+  "ban",
+  "unfollow"
+]);
+var MCP_TOOL_NOUNS_THAT_ALSO_ACT = /* @__PURE__ */ new Set(["email", "post", "merge", "push", "run"]);
+var MCP_TOOL_VERB_MODIFIERS = /* @__PURE__ */ new Set(["batch", "bulk"]);
+var MCP_TOOL_CLAUSE_JOINERS = /* @__PURE__ */ new Set(["and", "or", "then"]);
+var MCP_TOOL_WORDS_THAT_NAME_A_SECRET = /* @__PURE__ */ new Set([
+  "password",
+  "passwords",
+  "passcode",
+  "passkey",
+  "passphrase",
+  "secret",
+  "secrets",
+  "credential",
+  "credentials",
+  "token",
+  "tokens",
+  "apikey",
+  "otp",
+  "totp",
+  "cookie",
+  "cookies",
+  "keychain",
+  "vault",
+  "1password",
+  "onepassword",
+  "bitwarden",
+  "lastpass",
+  "dashlane",
+  "keepass",
+  "env",
+  "envs",
+  "envvar",
+  "envvars",
+  "dotenv",
+  "ssh",
+  "sshkey",
+  "sshkeys",
+  "key",
+  "keys",
+  "privatekey",
+  "certificate",
+  "cert",
+  "certs",
+  "jwt",
+  "bearer",
+  "oauth",
+  "mnemonic",
+  "seed",
+  "recovery",
+  "mfa",
+  "2fa",
+  "cvv",
+  "logins",
+  "signed",
+  "presigned"
+]);
+var MCP_TOOL_NAMESPACE_SEPARATOR = "__";
+var LONGEST_MCP_TOOL_NAME_READ = 256;
+var CODEX_CONNECTOR_SERVER = "codex_apps";
+var segmentsAfterTheConnector = (server, segments) => server === CODEX_CONNECTOR_SERVER && segments.length > 1 ? segments.slice(1) : segments;
+var mcpToolWordsOf = (toolName) => {
+  if (toolName.length > LONGEST_MCP_TOOL_NAME_READ) return void 0;
+  const parsed = parseMcpToolName(toolName);
+  if (parsed === void 0) return void 0;
+  const segments = parsed.tool.split(MCP_TOOL_NAMESPACE_SEPARATOR);
+  const action = segments[segments.length - 1] ?? "";
+  const namespace = [parsed.server, ...segments.slice(0, -1)];
+  return {
+    name: wordsOfIdentifier(toolName),
+    nameAsWritten: wordsOfAnIdentifierAsWritten(toolName),
+    namespace: new Set(namespace.flatMap(wordsOfIdentifier)),
+    namespaceAsWritten: namespace.flatMap(wordsOfAnIdentifierAsWritten),
+    afterTheConnector: segmentsAfterTheConnector(parsed.server, segments).flatMap(wordsOfIdentifier),
+    namesAConnector: parsed.server === CODEX_CONNECTOR_SERVER && segments.length > 1,
+    action: wordsOfIdentifier(action)
+  };
+};
+var isMcpReadVerb = (word) => MCP_TOOL_VERBS_THAT_ONLY_READ.has(word);
+var leadingVerbOf = ({ namespace, action }) => action.find((word) => isMcpReadVerb(word) || !namespace.has(word) && !MCP_TOOL_VERB_MODIFIERS.has(word));
+var joinsASecondAction = (action) => action.some((word) => MCP_TOOL_CLAUSE_JOINERS.has(word));
+var mcpToolWordNeedsAPersonWherever = (word) => !MCP_TOOL_NOUNS_THAT_ALSO_ACT.has(word) && mcpToolWordNeedsAPerson(word);
+var mcpToolActionWordChanges = (word) => !MCP_TOOL_NOUNS_THAT_ALSO_ACT.has(word) && MCP_TOOL_VERBS_THAT_CHANGE.has(word);
+var MCP_TOOL_PHRASE_THAT_NAMES_A_SECRET = /\benvironment (?:variables?|vars?|values?|secrets?)\b/;
+var mcpToolNameNamesASecret = ({ name, nameAsWritten }) => [...name, ...nameAsWritten].some((word) => MCP_TOOL_WORDS_THAT_NAME_A_SECRET.has(word)) || MCP_TOOL_PHRASE_THAT_NAMES_A_SECRET.test(name.join(" "));
+var mcpToolNameIsSensitive = (toolName) => {
+  const phrase = wordsOfIdentifier(toolName).join(" ");
+  return classifyDecisionRisk(phrase, phrase) !== "standard";
+};
+var mcpToolOnlyReads = (toolName) => {
+  const words = isPusharyOwnTool(toolName.toLowerCase()) ? void 0 : mcpToolWordsOf(toolName);
+  if (words === void 0) return false;
+  const verb = leadingVerbOf(words);
+  return verb !== void 0 && isMcpReadVerb(verb) && !joinsASecondAction(words.action) && !words.name.some(mcpToolWordNeedsAPersonWherever) && !words.afterTheConnector.some(mcpToolActionWordChanges) && !mcpToolNameNamesASecret(words) && !mcpToolNameIsSensitive(toolName);
+};
+var MCP_TOOL_WORDS_THAT_NAME_A_DATABASE = /* @__PURE__ */ new Set([
+  "sqlite",
+  "postgres",
+  "postgresql",
+  "psql",
+  "pg",
+  "mysql",
+  "mariadb",
+  "mssql",
+  "sqlserver",
+  "oracle",
+  "supabase",
+  "neon",
+  "planetscale",
+  "turso",
+  "libsql",
+  "cockroach",
+  "cockroachdb",
+  "bigquery",
+  "snowflake",
+  "redshift",
+  "databricks",
+  "duckdb",
+  "motherduck",
+  "clickhouse",
+  "athena",
+  "trino",
+  "presto",
+  "timescale",
+  "timescaledb",
+  "mongo",
+  "mongodb",
+  "db",
+  "database",
+  "databases",
+  "dbhub",
+  "metabase",
+  "redash",
+  "superset",
+  "looker"
+]);
+var someWordNamesADatabase = (words) => [...words].some((word) => MCP_TOOL_WORDS_THAT_NAME_A_DATABASE.has(word));
+var mcpToolNamesADatabase = (toolName) => {
+  const words = mcpToolWordsOf(toolName);
+  return words !== void 0 && someWordNamesADatabase([...words.name, ...words.nameAsWritten]);
+};
+var wordsThatNameTheApp = (words) => words.namesAConnector ? [...words.namespace, ...words.namespaceAsWritten] : [...words.name, ...words.nameAsWritten];
+var mcpToolAppNamesADatabase = (toolName) => {
+  const words = mcpToolWordsOf(toolName);
+  return words !== void 0 && someWordNamesADatabase(wordsThatNameTheApp(words));
+};
+var isCodexConnectorTool = (toolName) => parseMcpToolName(toolName)?.server === CODEX_CONNECTOR_SERVER;
+var DEEPEST_TOOL_INPUT_READ = 16;
+var LONGEST_TOOL_INPUT_TEXT_READ = 32768;
+var LONGEST_TOOL_INPUT_FIELD_NAME_READ = 256;
+var LARGEST_TOOL_INPUT_READ = 1048576;
+var TOOL_INPUT_COST_OF_EACH_VALUE = 32;
+var LONGEST_COMBINING_MARK_RUN_ANY_LANGUAGE_WRITES = 30;
+var COMBINING_MARKS = String.raw`[\p{M}\uFF9E\uFF9F]`;
+var COMBINING_MARK_RUN_LONGER_THAN_ANY_LANGUAGE_WRITES = new RegExp(`${COMBINING_MARKS}{${LONGEST_COMBINING_MARK_RUN_ANY_LANGUAGE_WRITES + 1}}`, "u");
+var UNNAMED_TOOL_INPUT_FIELD = {
+  holdsAnAddress: false,
+  holdsANamedAddress: false,
+  namesAnHttpMethod: false,
+  holdsSql: false,
+  holdsGraphql: false
+};
+var UNREADABLE_TOOL_INPUT_TEXT = { kind: "unreadable" };
+var FIELD_WORDS_THAT_HOLD_AN_ADDRESS = /* @__PURE__ */ new Set([
+  "url",
+  "urls",
+  "uri",
+  "uris",
+  "href",
+  "link",
+  "links",
+  "host",
+  "hosts",
+  "hostname",
+  "domain",
+  "domains",
+  "endpoint",
+  "endpoints",
+  "webhook",
+  "webhooks",
+  "callback",
+  "website",
+  "redirect"
+]);
+var FIELD_WORDS_FOR_THE_FORM_A_VALUE_TAKES = /* @__PURE__ */ new Set(["list", "string", "str", "value", "values", "text"]);
+var ADDRESS_WORDS_A_NAME_CAN_FOLLOW = /* @__PURE__ */ new Set(["host", "hosts", "hostname", "domain", "domains"]);
+var FIELD_WORDS_FOR_A_NAME = /* @__PURE__ */ new Set(["name", "names"]);
+var FIELD_WORDS_THAT_NAME_AN_HTTP_METHOD = /* @__PURE__ */ new Set(["method", "verb"]);
+var FIELD_WORDS_THAT_QUALIFY_AN_HTTP_METHOD = /* @__PURE__ */ new Set(["http", "request", "x", "override"]);
+var FIELD_WORDS_THAT_NAME_SQL = /* @__PURE__ */ new Set(["sql", "statement", "statements"]);
+var FIELD_WORDS_THAT_NAME_GRAPHQL = /* @__PURE__ */ new Set(["graphql", "gql"]);
+var FIELD_WORDS_THAT_QUALIFY_A_QUERY = /* @__PURE__ */ new Set(["query", "raw", "text", "string", "document"]);
+var NO_ADDRESS_WORD = -1;
+var lastAddressWordOf = (words) => words.reduce((last, word, index) => FIELD_WORDS_THAT_HOLD_AN_ADDRESS.has(word) ? index : last, NO_ADDRESS_WORD);
+var saysTheFormOfAValue = (word) => FIELD_WORDS_FOR_THE_FORM_A_VALUE_TAKES.has(word);
+var wordAfterAnAddressSaysItsForm = (addressWord) => (word) => saysTheFormOfAValue(word) || ADDRESS_WORDS_A_NAME_CAN_FOLLOW.has(addressWord) && FIELD_WORDS_FOR_A_NAME.has(word);
+var fieldWordsHoldAnAddress = (words) => {
+  const lastAddressWord = lastAddressWordOf(words);
+  const addressWord = words[lastAddressWord];
+  return addressWord !== void 0 && words.slice(lastAddressWord + 1).every(wordAfterAnAddressSaysItsForm(addressWord));
+};
+var fieldWordsHoldANamedAddress = (words) => {
+  const addressWord = words[lastAddressWordOf(words)];
+  return addressWord !== void 0 && ADDRESS_WORDS_A_NAME_CAN_FOLLOW.has(addressWord) && fieldWordsHoldAnAddress(words);
+};
+var fieldWordsNameOnly = (words, names, qualifiers) => words.some((word) => names.has(word)) && words.every((word) => names.has(word) || qualifiers.has(word));
+var describesOnlyTheValue = (words, describes) => words.length > 0 && words.every(describes);
+var namesTheValue = (word) => FIELD_WORDS_FOR_A_NAME.has(word);
+var toolInputFieldNamed = (fieldName, parent) => {
+  const words = wordsOfIdentifier(fieldName);
+  const inherited = describesOnlyTheValue(words, saysTheFormOfAValue) ? parent : UNNAMED_TOOL_INPUT_FIELD;
+  const namesTheParentsAddress = parent.holdsANamedAddress && describesOnlyTheValue(words, namesTheValue);
+  return {
+    holdsAnAddress: inherited.holdsAnAddress || namesTheParentsAddress || fieldWordsHoldAnAddress(words),
+    holdsANamedAddress: inherited.holdsANamedAddress || fieldWordsHoldANamedAddress(words),
+    namesAnHttpMethod: fieldWordsNameOnly(words, FIELD_WORDS_THAT_NAME_AN_HTTP_METHOD, FIELD_WORDS_THAT_QUALIFY_AN_HTTP_METHOD),
+    holdsSql: inherited.holdsSql || fieldWordsNameOnly(words, FIELD_WORDS_THAT_NAME_SQL, FIELD_WORDS_THAT_QUALIFY_A_QUERY),
+    holdsGraphql: inherited.holdsGraphql || fieldWordsNameOnly(words, FIELD_WORDS_THAT_NAME_GRAPHQL, FIELD_WORDS_THAT_QUALIFY_A_QUERY)
+  };
 };
-var allowsSessionToolGrant = (toolName) => SESSION_TOOL_GRANT_TOOLS.has(toolName) || mcpToolLeadsWithAReadVerb(toolName) && !isPusharyOwnTool(toolName.toLowerCase()) && !mcpToolNameNeedsAPerson(toolName);
+var readableToolInputText = (text2) => {
+  if (text2.length > LONGEST_TOOL_INPUT_TEXT_READ || COMBINING_MARK_RUN_LONGER_THAN_ANY_LANGUAGE_WRITES.test(text2)) {
+    return UNREADABLE_TOOL_INPUT_TEXT;
+  }
+  const readable = readableText(text2);
+  return readable.length > LONGEST_TOOL_INPUT_TEXT_READ ? UNREADABLE_TOOL_INPUT_TEXT : { kind: "readable", text: readable };
+};
+var toolInputTextMatches = (field, text2, test) => {
+  const readable = readableToolInputText(text2);
+  return readable.kind === "unreadable" || test(field, readable.text);
+};
+var fieldNameTooLongToRead = (fieldName) => fieldName.length > LONGEST_TOOL_INPUT_FIELD_NAME_READ;
+var anyToolInputText = (value, field, depth, test) => {
+  if (typeof value === "string") return toolInputTextMatches(field, value, test);
+  if (!Array.isArray(value) && !isRecord(value)) return false;
+  if (depth >= DEEPEST_TOOL_INPUT_READ) return true;
+  if (Array.isArray(value)) return value.some((child) => anyToolInputText(child, field, depth + 1, test));
+  return Object.entries(value).some(([fieldName, child]) => fieldNameTooLongToRead(fieldName) || toolInputTextMatches(UNNAMED_TOOL_INPUT_FIELD, fieldName, test) || anyToolInputText(child, toolInputFieldNamed(fieldName, field), depth + 1, test));
+};
+var toolInputCostFrom = (value, depth, counted) => {
+  if (counted > LARGEST_TOOL_INPUT_READ) return counted;
+  const charged = counted + TOOL_INPUT_COST_OF_EACH_VALUE;
+  if (typeof value === "string") return charged + value.length;
+  if (depth >= DEEPEST_TOOL_INPUT_READ || !Array.isArray(value) && !isRecord(value)) return charged;
+  const children = Array.isArray(value) ? value : Object.entries(value).flat();
+  return children.reduce((sum, child) => toolInputCostFrom(child, depth + 1, sum), charged);
+};
+var toolInputTooLargeToRead = (toolInput) => toolInputCostFrom(toolInput, 0, 0) > LARGEST_TOOL_INPUT_READ;
+var LINE_BREAKS_A_URL_PARSER_DROPS = /[\t\n\r]/g;
+var WRITTEN_WEB_ADDRESSES = [
+  /[a-z][a-z0-9+.-]{0,31}:\/\//i,
+  /\b(?:https?|wss?|ftp|mailto):(?=\S)/i,
+  /\bfile:\//i,
+  /(?:^|[\s"'(=<[,])\/\/[a-z0-9-]+\./i,
+  /(?:^|[\s"'(=<[,])\\\\[a-z0-9-]+/i,
+  /%3a(?:%2f|\/){2}|%2f%2f/i,
+  /\b\d{1,3}(?:\.\d{1,3}){3}(?::\d+|\/)/,
+  /(?<![\w\]])\[(?=[0-9a-f.]{0,45}:[0-9a-f.]{0,45}:)(?=[0-9a-f:.]{0,45}(?:::|[a-f]))[0-9a-f:.]{2,45}\]/i,
+  /(?<![\w\]])\[[0-9a-f:.]{2,45}\]:\d/i,
+  /\blocalhost(?::\d|\/)/i
+];
+var WHOLE_VALUE_HOST_THAT_CARRIES_DATA_IN_ITS_QUERY = /^[<"'(\[]?(?:[^@\s/]{1,64}@)?(?:[a-z0-9-]{1,63}\.)+[a-z]{2,63}(?::\d{1,5})?(?:\/[^\s?#]*)?\?[^\s#]\S*$/i;
+var textNamesAWebAddress = (field, text2) => {
+  const unbroken = text2.replace(LINE_BREAKS_A_URL_PARSER_DROPS, "");
+  return field.holdsAnAddress && text2.trim().length > 0 || WRITTEN_WEB_ADDRESSES.some((pattern) => pattern.test(unbroken)) || WHOLE_VALUE_HOST_THAT_CARRIES_DATA_IN_ITS_QUERY.test(unbroken.trim());
+};
+var HTTP_METHODS_THAT_WRITE = /* @__PURE__ */ new Set([
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "CONNECT",
+  "PURGE",
+  "ACL",
+  "BASELINE-CONTROL",
+  "BIND",
+  "CHECKIN",
+  "CHECKOUT",
+  "COPY",
+  "LABEL",
+  "LINK",
+  "LOCK",
+  "MERGE",
+  "MKACTIVITY",
+  "MKCALENDAR",
+  "MKCOL",
+  "MKREDIRECTREF",
+  "MKWORKSPACE",
+  "MOVE",
+  "ORDERPATCH",
+  "PROPPATCH",
+  "REBIND",
+  "UNBIND",
+  "UNCHECKOUT",
+  "UNLINK",
+  "UNLOCK",
+  "UPDATE",
+  "UPDATEREDIRECTREF",
+  "VERSION-CONTROL"
+]);
+var SQL_COMMENT = /\/\*(?:[^*]|\*(?!\/))*(?:\*\/|$)|--[^\n]*/g;
+var SQL_NAME = String.raw`(?:"[^"\n]{1,128}"|[\w.\x60[\]]{1,128})`;
+var SQL_USER = String.raw`(?:'[^'\n]{1,128}'(?:@'[^'\n]{1,128}')?|${SQL_NAME})`;
+var SQL_ALIAS = String.raw`(?:\s+(?:as\s+)?\w{1,64})?`;
+var SQL_STATEMENT_THAT_LEADS_A_SCRIPT = String.raw`(?:select|with|explain|analyze|describe|pragma|start|begin|commit|rollback|savepoint|prepare|declare|exec|execute|vacuum|reindex|attach|detach|abort)`;
+var STATEMENTS_THAT_CHANGE = [
+  String.raw`\binsert\s+(?:ignore\s+)?(?:into\s+)?${SQL_NAME}\s*(?:\([^)]{0,512}\)\s*)?(?:values\s*\(|select\b|default\s+values\b|set\s+${SQL_NAME}\s*=)`,
+  String.raw`\bdelete\s+from\s+(?:only\s+)?${SQL_NAME}${SQL_ALIAS}\s*(?:;|\b(?:where|using|returning|limit|order\s+by)\b)`,
+  String.raw`\bdelete\s+${SQL_NAME}\s+where\b`,
+  String.raw`\bupdate\s+(?:only\s+)?${SQL_NAME}${SQL_ALIAS}\s+set\s+(?:${SQL_NAME}|\([^)]{1,512}\))\s*=`,
+  String.raw`\b(?:replace|upsert)\s+into\s+${SQL_NAME}\s*(?:\(|values\b|select\b|set\s+${SQL_NAME}\s*=)`,
+  String.raw`\bmerge\s+into\s+${SQL_NAME}${SQL_ALIAS}\s+using\s*(?:\(|${SQL_NAME}${SQL_ALIAS}\s+on\b)`,
+  String.raw`\bdrop\s+(?:materialized\s+view|table|view|function|procedure|trigger|sequence)\s+(?:if\s+exists\s+)?${SQL_NAME}`,
+  String.raw`\bdrop\s+(?:user|role|index|schema|database)\s+(?:if\s+exists\s+${SQL_USER}|${SQL_USER}\s*(?:;|\b(?:cascade|restrict)\b))`,
+  String.raw`\balter\s+(?:table|view|materialized\s+view|sequence|index|database|schema)\s+(?:if\s+exists\s+)?(?:only\s+)?${SQL_NAME}\s+(?:add|drop|alter|rename|set|owner|enable|disable|attach|detach)\b`,
+  String.raw`\balter\s+(?:user|role)\s+${SQL_USER}\s+(?:with|superuser|nosuperuser|login|nologin|identified|password|rename|set)\b`,
+  String.raw`\btruncate\s+table\s+${SQL_NAME}`,
+  String.raw`^\s*\(*\s*${SQL_STATEMENT_THAT_LEADS_A_SCRIPT}\b[\s\S]*?;\s*(?:delete\s+from\s+(?:only\s+)?${SQL_NAME}|drop\s+(?:user|role|index|schema|database)\s+(?:if\s+exists\s+)?${SQL_USER}|truncate\s+(?:table\s+)?${SQL_NAME}|create\s+(?:user|role|database|schema)\s+(?:if\s+not\s+exists\s+)?${SQL_USER}|grant\s+${SQL_NAME}\s+to\s+${SQL_USER}|call\s+${SQL_NAME}\s*\()`,
+  String.raw`(?:^|;)\s*truncate\s+${SQL_NAME}\s*;`,
+  String.raw`\bcreate\s+(?:temp(?:orary)?\s+)?table\s+(?:if\s+not\s+exists\s+)?${SQL_NAME}\s*(?:\(|\bas\b|\blike\b)`,
+  String.raw`\bcreate\s+(?:or\s+replace\s+)?(?:materialized\s+)?view\s+(?:if\s+not\s+exists\s+)?${SQL_NAME}\s+as\b`,
+  String.raw`\bcreate\s+(?:or\s+replace\s+)?(?:function|procedure)\s+${SQL_NAME}\s*\(`,
+  String.raw`\bcreate\s+(?:or\s+replace\s+)?trigger\s+${SQL_NAME}\s+(?:before|after|instead)\b`,
+  String.raw`\bcreate\s+(?:unique\s+)?index\s+(?:concurrently\s+)?(?:if\s+not\s+exists\s+)?${SQL_NAME}\s+on\s+${SQL_NAME}`,
+  String.raw`\bcreate\s+(?:unique\s+)?index\s+(?:concurrently\s+)?on\s+${SQL_NAME}\s*\(`,
+  String.raw`\bcreate\s+(?:user|role)\s+(?:if\s+not\s+exists\s+)?${SQL_USER}\s*(?:;|\b(?:with|superuser|login|password|identified)\b)`,
+  String.raw`\bcreate\s+(?:database|schema)\s+(?:if\s+not\s+exists\s+${SQL_NAME}|${SQL_NAME}\s*;)`,
+  String.raw`\b(?:grant|revoke)\s+(?:all(?:\s+privileges)?|select|insert|update|delete|usage|execute|create|connect|references|trigger|truncate)(?:\s*,\s*\w{1,32})*\s+on\b`,
+  String.raw`\bexec(?:ute)?\s+(?:sp|xp)_\w+`,
+  String.raw`\bexecute\s+immediate\b`,
+  String.raw`\bcopy\s+${SQL_NAME}\s+(?:to|from)\s+(?:program\b|stdout\b|stdin\b|')`,
+  String.raw`\bpg_(?:terminate|cancel)_backend\b`,
+  String.raw`\bmutation\b(?:\s+[a-z_]\w{0,127})?\s*(?:\{|@[a-z_]|\(\s*\$)`
+].map((source) => new RegExp(source, "i"));
+var fieldSetsAnHttpMethodThatWrites = (field, text2) => field.namesAnHttpMethod && HTTP_METHODS_THAT_WRITE.has(text2.trim().toUpperCase());
+var sqlTextWritesAsAClientReadsIt = (text2) => writesThroughSql(text2, UNVERIFIED_SQL_LEXICON);
+var fieldHoldsSqlThatWrites = (field, text2) => field.holdsSql && sqlTextWritesAsAClientReadsIt(text2);
+var fieldHoldsAGraphqlMutation = (field, text2) => field.holdsGraphql && GRAPHQL_MUTATION.test(text2);
+var COPY_OF_A_SUBQUERY = /\bcopy\s*\((?:\s*\()*\s*(?:select|with|values|table|insert|update|delete|merge)\b/i;
+var COPY_TO_A_PROGRAM_OR_A_FILE = /\)\s*to\s+(?:program\b|')/i;
+var copiesASubqueryOut = (text2) => {
+  const copy = text2.search(COPY_OF_A_SUBQUERY);
+  return copy !== -1 && COPY_TO_A_PROGRAM_OR_A_FILE.test(text2.slice(copy));
+};
+var carriesAStatementThatChanges = (text2) => STATEMENTS_THAT_CHANGE.some((pattern) => pattern.test(text2)) || copiesASubqueryOut(text2);
+var textCarriesAStatementThatChanges = (text2) => carriesAStatementThatChanges(text2) || carriesAStatementThatChanges(text2.replace(SQL_COMMENT, " "));
+var textAsksToChange = (field, text2) => fieldSetsAnHttpMethodThatWrites(field, text2) || fieldHoldsSqlThatWrites(field, text2) || fieldHoldsAGraphqlMutation(field, text2) || textCarriesAStatementThatChanges(text2);
+var textNeedsAPersonFor = (toolNamesADatabase) => (field, text2) => textNamesAWebAddress(field, text2) || textAsksToChange(field, text2) || toolNamesADatabase && sqlTextWritesAsAClientReadsIt(text2);
+var mcpToolInputOnlyReads = (toolName, toolInput) => !toolInputTooLargeToRead(toolInput) && !anyToolInputText(toolInput, UNNAMED_TOOL_INPUT_FIELD, 0, textNeedsAPersonFor(mcpToolNamesADatabase(toolName)));
+var allowsSessionToolGrant = (toolName) => SESSION_TOOL_GRANT_TOOLS.has(toolName) || mcpToolOnlyReads(toolName);
 var isSessionToolGrant = (policy) => Boolean(policy.sessionId) && allowsSessionToolGrant(policy.tool) && isAutoApprove(policy);
 var API_KEY_PREFIX_SHAPE = "pk_[a-f0-9]+";
 var API_KEY_PREFIX_PATTERN = new RegExp(`^${API_KEY_PREFIX_SHAPE}$`);
@@ -5681,6 +6149,7 @@ var unmatchedPolicyOf = (config, toolName) => ({
   mode: config.defaultMode ?? "push_first",
   pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
 });
+var sessionToolGrantCannotCover = (toolName, arg, toolInput) => typeof arg === "string" && commandNeedsAPerson(toolName, arg) || parseMcpToolName(toolName) !== void 0 && (toolInput === void 0 || !mcpToolInputOnlyReads(toolName, toolInput));
 var stricterOfTheReadings = (asWritten, asSpelled, unmatched) => comparePolicyStrictness(asWritten?.policy ?? unmatched, asSpelled?.policy ?? unmatched) > 0 ? asWritten : asSpelled;
 var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
   const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
@@ -5696,7 +6165,7 @@ var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, se
   const governingMode = base.mode;
   const aRuleNamesASpelling = isSpecificArgumentRank(asSpelled?.rank);
   const approvedByReadOnlyFloor = !isAutoDeny(base) && (shellReadOnlyFloorApplies(toolName, arg, match?.rank) && !aRuleNamesASpelling || coordinationFloorApplies(toolName, match?.rank));
-  if (governedBySessionToolGrant && !approvedByReadOnlyFloor && typeof arg === "string" && commandNeedsAPerson(toolName, arg)) {
+  if (governedBySessionToolGrant && !approvedByReadOnlyFloor && sessionToolGrantCannotCover(toolName, arg, toolInput)) {
     return resolvePolicy(withoutSessionToolGrants(config), toolName, modeOverride, toolInput, cwd, repoKey, sessionId);
   }
   if (approvedByReadOnlyFloor) {
@@ -5935,7 +6404,9 @@ var runsADestructiveCommand = ({ toolName, toolInputs }) => SHELL_DIALECT_BY_TOO
   return command !== void 0 && commandIsDestructive(toolName, command);
 });
 var codexCallIsDestructive = (input, call) => call.deletesFiles || runsADestructiveCommand(input);
-var codexCallNeedsAPerson = (input, verdict, call) => onlyCodexPreToolUseCanAsk(verdict, call.permissionMode) || verdict.kind === "gate" && (aChosenRuleGoverns(input) || call.deletesFiles || runsACommandThatNeedsAPerson(input) || editsAFileThatNeedsAPerson(input));
+var connectorCallOnlyReads = ({ toolName, toolInputs }) => isCodexConnectorTool(toolName) && mcpToolOnlyReads(toolName) && !mcpToolAppNamesADatabase(toolName) && toolInputs.length > 0 && toolInputs.every((toolInput) => mcpToolInputOnlyReads(toolName, toolInput));
+var fullAccessRunsThisConnectorReadUnasked = (input, verdict, call) => !codexRaisesItsOwnPrompts(call.permissionMode) && scopeBreachReasonOf(verdict) === void 0 && noModeOverrideIsActive(input) && connectorCallOnlyReads(input);
+var codexCallNeedsAPerson = (input, verdict, call) => onlyCodexPreToolUseCanAsk(verdict, call.permissionMode) && !fullAccessRunsThisConnectorReadUnasked(input, verdict, call) || verdict.kind === "gate" && (aChosenRuleGoverns(input) || call.deletesFiles || runsACommandThatNeedsAPerson(input) || editsAFileThatNeedsAPerson(input));
 var CODEX_PRE_TOOL_USE_PASSES = { kind: "pass" };
 var codexPreToolUseDelivery = (input, verdict, call) => {
   if (verdict.kind !== "gate" || !codexCallNeedsAPerson(input, verdict, call)) return CODEX_PRE_TOOL_USE_PASSES;
@@ -6334,6 +6805,8 @@ var hookActivationResult = (report) => {
 };
 
 export {
+  conversationText,
+  extractMessageText,
   isRecord,
   AGENT_QUESTION_HEADER_MAX,
   AGENT_QUESTION_OPTION_MAX,

package/dist/{chunk-FZ2SHXUE.js → chunk-5XYYBB5Z.js}

@@ -1,9 +1,9 @@
 import {
   pusharyDir
-} from "./chunk-274CV7IW.js";
+} from "./chunk-N4NSX5MB.js";
 import {
   writeFileAtomic
-} from "./chunk-OXOYS3UG.js";
+} from "./chunk-GUJBS6TK.js";
 
 // src/identity.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-C4EDAHXI.js → chunk-6HTAOF6H.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-3EGEA4KH.js";
 import {
   getBaseUrl
-} from "./chunk-32OSSYGZ.js";
+} from "./chunk-BMVWGPYB.js";
 
 // src/cli/login-ui.ts
 import { hostname } from "os";

package/dist/{chunk-GZHQQP7J.js → chunk-6YZ72YP3.js}

@@ -1,19 +1,19 @@
 import {
   resolveInstallSourceFor
-} from "./chunk-METUT7V4.js";
+} from "./chunk-ZWCKS65X.js";
 import {
   backupFile,
   readJsonSafe,
   writeFileAtomic,
   writeJsonAtomic
-} from "./chunk-OXOYS3UG.js";
+} from "./chunk-GUJBS6TK.js";
 import {
   configFilePath
-} from "./chunk-32OSSYGZ.js";
+} from "./chunk-BMVWGPYB.js";
 import {
   API_KEY_PREFIX_PATTERN,
   isRecord
-} from "./chunk-RQOT6QL3.js";
+} from "./chunk-5XKJH5GD.js";
 
 // src/shell-alias.ts
 import { homedir } from "os";

package/dist/{chunk-X2MTVD4W.js → chunk-7KMLITXH.js}

@@ -2,7 +2,7 @@ import {
   DISCONNECT_AGENT_IDS,
   SETUP_AGENT_CHOICES,
   isApprovalMode
-} from "./chunk-RQOT6QL3.js";
+} from "./chunk-5XKJH5GD.js";
 
 // src/cli/mode-request.ts
 var parseDuration = (value) => {

package/dist/{chunk-32OSSYGZ.js → chunk-BMVWGPYB.js}

@@ -1,6 +1,6 @@
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-X2MTVD4W.js";
+} from "./chunk-7KMLITXH.js";
 
 // src/config.ts
 import { readFileSync } from "fs";

package/dist/{chunk-NWN6GGJL.js → chunk-CAUNUTYE.js}

@@ -1,10 +1,10 @@
 import {
   getBaseUrl
-} from "./chunk-32OSSYGZ.js";
+} from "./chunk-BMVWGPYB.js";
 import {
   compressTranscriptRecord,
   redactSecretsFromContent
-} from "./chunk-RQOT6QL3.js";
+} from "./chunk-5XKJH5GD.js";
 
 // src/transcript-api.ts
 var fetchTranscriptRecipients = async (apiKey, baseUrl = getBaseUrl()) => {