pushary 1.8.0

package/dist/bin/pushary-claude.js

@@ -0,0 +1,1916 @@
+#!/usr/bin/env node
+import {
+  WRAPPER_ACTIVE_ENV,
+  findClaudeBinary
+} from "../chunk-PQ4K74WL.js";
+import {
+  SESSION_IDLE_TIMEOUT_MS,
+  describeIdleWindow,
+  startProcessOwnership,
+  withSpawnProcessOwnership
+} from "../chunk-ZSZSSJCV.js";
+import {
+  announceSubscriptionRequired,
+  isDeferAnswer
+} from "../chunk-5OP5MQI7.js";
+import {
+  claudeTranscriptPath,
+  loadSessionKey,
+  registerTranscript,
+  registeredTranscriptEnabled
+} from "../chunk-JZTHGAPA.js";
+import "../chunk-SGZJ5LYH.js";
+import "../chunk-EYK3GSRH.js";
+import "../chunk-ZVSKMPBZ.js";
+import "../chunk-C2WCPBF7.js";
+import "../chunk-6J2JC2RT.js";
+import {
+  ensureDaemonRunning
+} from "../chunk-WE2J62NC.js";
+import "../chunk-3EVPNIBE.js";
+import "../chunk-OKXS7WDZ.js";
+import {
+  encryptRecord
+} from "../chunk-MPWXGONV.js";
+import "../chunk-SAXBC4AZ.js";
+import {
+  transcriptsEnabled
+} from "../chunk-OLQRRFBX.js";
+import {
+  needsShell,
+  spawnClaude
+} from "../chunk-XHKBHWLX.js";
+import {
+  UNNAMED_ACTION,
+  deriveToolTarget,
+  describeToolCall,
+  fetchModeState,
+  getPolicy,
+  phoneDrivenEnv,
+  repoKeyFor,
+  reportEvent,
+  scopePathFor
+} from "../chunk-CULUZTWQ.js";
+import {
+  DEFAULT_SESSION,
+  markPendingCommandDelivered,
+  markPendingCommandFailed,
+  readPendingCommand,
+  readPendingCommandById,
+  removePendingCommand,
+  savePendingCommand
+} from "../chunk-N6IOSZOE.js";
+import "../chunk-EPCXUP3P.js";
+import {
+  DECISION_STOP_REASON,
+  UNVERIFIABLE_APPROVAL_REASON,
+  askUser,
+  cancelQuestion,
+  isDecisionStopped,
+  isLocalQuestionHandoff,
+  nextLongPollMs,
+  waitForAnswer,
+  withdrawQuestion
+} from "../chunk-NGDD6TXY.js";
+import "../chunk-CVQYGMSR.js";
+import "../chunk-POFBE6ZY.js";
+import "../chunk-GMXKITVA.js";
+import "../chunk-P7WQEVWA.js";
+import {
+  SubscriptionRequiredError
+} from "../chunk-M5ICYGHT.js";
+import "../chunk-2ABTSGFT.js";
+import "../chunk-2OY3ZZ5N.js";
+import {
+  getMachineId
+} from "../chunk-LXQ5FBBD.js";
+import "../chunk-7QLSKOSU.js";
+import "../chunk-KZERVKTD.js";
+import "../chunk-DB3ONZB4.js";
+import "../chunk-A2A2YTMG.js";
+import "../chunk-T7E75EKA.js";
+import {
+  getApiKey,
+  getBaseUrl
+} from "../chunk-GPEGOGRJ.js";
+import {
+  NPX_LATEST_COMMAND
+} from "../chunk-E4FJTUH4.js";
+import {
+  KILL_REASON,
+  redactSecretsFromContent,
+  resolveGate
+} from "../chunk-NQTHFF4W.js";
+
+// src/wrapper/localPassthrough.ts
+var SIGNAL_NUMBERS = {
+  SIGHUP: 1,
+  SIGINT: 2,
+  SIGQUIT: 3,
+  SIGKILL: 9,
+  SIGTERM: 15
+};
+var FORWARDED_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+var runLocalPassthrough = (binary, args2) => {
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawnClaude(binary, args2, {
+        stdio: "inherit",
+        env: { ...process.env, [WRAPPER_ACTIVE_ENV]: "1" }
+      });
+    } catch {
+      resolve(127);
+      return;
+    }
+    const forward = (signal) => {
+      try {
+        child.kill(signal);
+      } catch {
+      }
+    };
+    for (const signal of FORWARDED_SIGNALS) process.on(signal, forward);
+    const cleanup = () => {
+      for (const signal of FORWARDED_SIGNALS) process.off(signal, forward);
+    };
+    child.on("error", () => {
+      cleanup();
+      resolve(127);
+    });
+    child.on("exit", (code2, signal) => {
+      cleanup();
+      if (typeof code2 === "number") resolve(code2);
+      else if (signal) resolve(128 + (SIGNAL_NUMBERS[signal] ?? 0));
+      else resolve(0);
+    });
+  });
+};
+
+// src/wrapper/dualMode.ts
+import { existsSync as existsSync2 } from "fs";
+
+// src/transcript-draft.ts
+var redactDraft = (text, complete = false) => {
+  let end = complete ? text.length : text.lastIndexOf("\n") + 1;
+  const pem = /-----BEGIN [^\n]*PRIVATE KEY-----/g;
+  for (const match of text.matchAll(pem)) {
+    if (!/-----END [^\n]*PRIVATE KEY-----/.test(text.slice(match.index, end))) end = Math.min(end, match.index);
+  }
+  const quoted = /(?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[=:]\s*(["'])/gi;
+  for (const match of text.matchAll(quoted)) {
+    const close = text.indexOf(match[1], match.index + match[0].length);
+    if (close < 0 || close >= end) end = Math.min(end, match.index);
+  }
+  return redactSecretsFromContent(text.slice(0, end));
+};
+var DraftText = class {
+  messageId = "";
+  text = "";
+  complete = false;
+  interrupted = false;
+  add(message) {
+    if (message.parent_tool_use_id) return;
+    const event = message.event;
+    if (message.type === "stream_event" && event?.type === "message_start") {
+      this.messageId = event.message?.id ?? "";
+      this.text = "";
+      this.complete = false;
+      this.interrupted = false;
+    } else if (message.type === "stream_event" && event?.type === "content_block_delta" && event.delta?.type === "text_delta") {
+      this.text = (this.text + (event.delta.text ?? "")).slice(0, 32 * 1024);
+    } else if (message.type === "assistant") {
+      const body = message.message;
+      if (body?.id === this.messageId && Array.isArray(body.content)) {
+        this.text = body.content.filter((block) => block.type === "text").map((block) => block.text).join("").slice(0, 32 * 1024);
+        this.complete = true;
+      }
+    }
+  }
+  interrupt() {
+    if (!this.complete) this.interrupted = true;
+  }
+  snapshot() {
+    const text = redactDraft(this.text, this.complete);
+    return this.messageId && text ? { messageId: this.messageId, text, status: this.interrupted ? "interrupted" : this.complete ? "complete" : "streaming" } : null;
+  }
+};
+var startTranscriptDraft = (apiKey, getSessionId) => {
+  const text = new DraftText();
+  const startedAt = Date.now();
+  let revision = 0;
+  let stopped = false;
+  let pending;
+  let ending = false;
+  let sent = "";
+  const flush = async () => {
+    if (stopped || pending || !transcriptsEnabled()) return;
+    const sessionId = getSessionId();
+    const snapshot = text.snapshot();
+    if (!sessionId || !snapshot || !registeredTranscriptEnabled(apiKey, sessionId)) return;
+    const raw = JSON.stringify(snapshot);
+    if (raw === sent) return;
+    const key = loadSessionKey(sessionId);
+    if (!key?.keyUploaded) return;
+    pending = (async () => {
+      try {
+        const response = await fetch(`${getBaseUrl()}/api/agent/transcript`, {
+          method: "POST",
+          headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
+          body: JSON.stringify({ sessionId, draft: { startedAt, revision: ++revision, content: encryptRecord(raw, key.sessionKey) } }),
+          signal: AbortSignal.timeout(5e3)
+        });
+        if (response.ok) sent = raw;
+      } catch {
+      }
+    })();
+    try {
+      await pending;
+    } finally {
+      pending = void 0;
+    }
+  };
+  const timer = setInterval(() => void flush(), 800);
+  timer.unref();
+  return {
+    add: (message) => {
+      if (!ending) text.add(message);
+    },
+    stop: async () => {
+      if (ending) return;
+      ending = true;
+      clearInterval(timer);
+      text.interrupt();
+      await pending;
+      await flush();
+      stopped = true;
+    }
+  };
+};
+
+// src/wrapper/dualMode.ts
+import { basename } from "path";
+
+// src/wrapper/sdkLoader.ts
+import { spawn } from "child_process";
+import { existsSync, mkdirSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+import { pathToFileURL } from "url";
+var userMessage = (text) => ({
+  type: "user",
+  message: { role: "user", content: text },
+  parent_tool_use_id: null
+});
+var SDK_VERSION = "0.3.207";
+var SDK_PACKAGE = "@anthropic-ai/claude-agent-sdk";
+var SDK_SPEC = `${SDK_PACKAGE}@${SDK_VERSION}`;
+var sdkCacheDir = () => process.env.PUSHARY_REMOTE_SDK_DIR?.trim() || join(homedir(), ".pushary", "remote-sdk");
+var cachedSdkEntry = () => join(sdkCacheDir(), "node_modules", "@anthropic-ai", "claude-agent-sdk", "sdk.mjs");
+var importSdk = async (specifierOrUrl) => {
+  try {
+    const mod = await import(specifierOrUrl);
+    if (typeof mod.query === "function") return mod;
+    if (mod.default && typeof mod.default.query === "function") return mod.default;
+    return null;
+  } catch {
+    return null;
+  }
+};
+var loadClaudeSdk = async () => {
+  const fromResolution = await importSdk(SDK_PACKAGE);
+  if (fromResolution) return fromResolution;
+  const entry = cachedSdkEntry();
+  if (existsSync(entry)) return importSdk(pathToFileURL(entry).href);
+  return null;
+};
+var ensureClaudeSdk = async (log) => {
+  const present = await loadClaudeSdk();
+  if (present) return present;
+  const dir = sdkCacheDir();
+  try {
+    mkdirSync(dir, { recursive: true });
+    const pkgJson = join(dir, "package.json");
+    if (!existsSync(pkgJson)) {
+      writeFileSync(pkgJson, `${JSON.stringify({ name: "pushary-remote-sdk", private: true })}
+`);
+    }
+  } catch {
+    return null;
+  }
+  log?.("[pushary] setting up phone control (one-time, fetching the Claude Agent SDK)...");
+  const npmCmd = process.platform === "win32" ? "npm.cmd" : "npm";
+  const installed = await new Promise((resolve) => {
+    const child = spawn(
+      npmCmd,
+      ["install", "--no-optional", "--no-audit", "--no-fund", "--loglevel=error", SDK_SPEC],
+      { cwd: dir, stdio: "ignore", shell: process.platform === "win32" }
+    );
+    child.on("error", () => resolve(false));
+    child.on("close", (code2) => resolve(code2 === 0));
+  });
+  if (!installed) {
+    log?.(`[pushary] could not auto-install the SDK. Install it manually: npm i -g ${SDK_SPEC}`);
+    return null;
+  }
+  return loadClaudeSdk();
+};
+
+// src/wrapper/messageQueue.ts
+var BoundedInputQueue = class {
+  buffer = [];
+  waiter;
+  closed = false;
+  generation = 0;
+  cap;
+  onDrop;
+  coalesce;
+  pushedCount = 0;
+  deliveredCount = 0;
+  droppedCount = 0;
+  constructor(options = {}) {
+    this.cap = Math.max(1, options.cap ?? 32);
+    this.onDrop = options.onDrop;
+    this.coalesce = options.coalesce;
+  }
+  push(item) {
+    if (this.closed) return false;
+    this.pushedCount++;
+    if (this.waiter) {
+      const resolve = this.waiter;
+      this.waiter = void 0;
+      this.deliveredCount++;
+      resolve({ value: item, done: false });
+      return true;
+    }
+    if (this.buffer.length >= this.cap) {
+      this.droppedCount++;
+      this.onDrop?.(item, this.droppedCount);
+      return false;
+    }
+    this.buffer.push(item);
+    return true;
+  }
+  // Mark done. Any parked consumer completes; further push() is ignored. The
+  // buffer is cleared so nothing is retained after shutdown.
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    this.buffer.length = 0;
+    if (this.waiter) {
+      const resolve = this.waiter;
+      this.waiter = void 0;
+      resolve({ value: void 0, done: true });
+    }
+  }
+  // End the CURRENT consumer without closing the queue, so a fresh query can
+  // attach after a restart and keep draining the same buffered items. Resolving
+  // the parked waiter as done lets the abandoned query's for-await unwind cleanly
+  // instead of hanging on a promise that would otherwise never settle.
+  detachConsumer() {
+    this.generation++;
+    if (this.waiter) {
+      const resolve = this.waiter;
+      this.waiter = void 0;
+      resolve({ value: void 0, done: true });
+    }
+  }
+  // Drop every buffered item without closing the queue. Used when phone control
+  // turns out to be unavailable (offline SDK setup) so a pending instruction does
+  // not make the local leg switch again into a mode that cannot run. Returns how
+  // many were dropped, because these are somebody's words and the caller has to
+  // be able to say they are gone.
+  clear() {
+    const dropped = this.buffer.length;
+    this.buffer.length = 0;
+    return dropped;
+  }
+  get isClosed() {
+    return this.closed;
+  }
+  get bufferedCount() {
+    return this.buffer.length;
+  }
+  get stats() {
+    return { pushed: this.pushedCount, delivered: this.deliveredCount, dropped: this.droppedCount };
+  }
+  [Symbol.asyncIterator]() {
+    const generation = this.generation;
+    return {
+      next: () => {
+        if (generation !== this.generation || this.closed) {
+          return Promise.resolve({ value: void 0, done: true });
+        }
+        if (this.buffer.length > 0) {
+          if (this.coalesce && this.buffer.length > 1) {
+            const items = this.buffer.splice(0, this.buffer.length);
+            this.deliveredCount += items.length;
+            return Promise.resolve({ value: this.coalesce(items), done: false });
+          }
+          const value = this.buffer.shift();
+          this.deliveredCount++;
+          return Promise.resolve({ value, done: false });
+        }
+        if (this.closed) {
+          return Promise.resolve({ value: void 0, done: true });
+        }
+        if (this.waiter) {
+          return Promise.reject(
+            new Error("BoundedInputQueue: concurrent consumers are not supported")
+          );
+        }
+        return new Promise((resolve) => {
+          this.waiter = resolve;
+        });
+      },
+      return: () => {
+        if (generation === this.generation) this.detachConsumer();
+        return Promise.resolve({ value: void 0, done: true });
+      }
+    };
+  }
+};
+
+// src/wrapper/approver.ts
+var DEFAULT_MAX_CONCURRENT = 16;
+var NO_LOCAL_APPROVAL_UI = "This remote session has no local approval UI. Continue in an interactive session or choose a mode that permits remote approval.";
+var SUBSCRIPTION_REQUIRED_NO_LOCAL_APPROVAL_UI = "Your Pushary workspace has no active subscription, so approvals cannot reach your phone, and this remote session has no local approval UI. Continue in an interactive session.";
+var DEFAULT_APPROVAL_WINDOW_MS = 5 * 6e4;
+var MAX_APPROVAL_WINDOW_MS = 30 * 6e4;
+var allow = (input) => ({
+  behavior: "allow",
+  updatedInput: input
+});
+var deny = (message) => ({ behavior: "deny", message });
+var createRemoteApprover = (deps) => {
+  const fetchModeState2 = deps.fetchModeState ?? fetchModeState;
+  const getPolicy2 = deps.getPolicy ?? getPolicy;
+  const askUser2 = deps.askUser ?? askUser;
+  const waitForAnswer2 = deps.waitForAnswer ?? waitForAnswer;
+  const cancelQuestion2 = deps.cancelQuestion ?? cancelQuestion;
+  const now = deps.now ?? (() => Date.now());
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const maxConcurrent = Math.max(1, deps.maxConcurrent ?? DEFAULT_MAX_CONCURRENT);
+  const pending = /* @__PURE__ */ new Set();
+  let tornDown = false;
+  const windowFor = (policy) => {
+    const base = policy.timeoutSeconds > 0 ? policy.timeoutSeconds * 1e3 : deps.approvalWindowMs ?? DEFAULT_APPROVAL_WINDOW_MS;
+    const ceiling = policy.timeoutAction === "wait" ? MAX_APPROVAL_WINDOW_MS : base;
+    return Math.min(Math.max(base, 15e3), Math.max(ceiling, 15e3));
+  };
+  const applyTimeout = (policy, input) => policy.timeoutAction === "approve" ? allow(input) : deny("No approval received in time");
+  const waitForPhone = async (entry, correlationId, windowMs) => {
+    const deadline = now() + windowMs;
+    while (now() < deadline && !entry.controller.signal.aborted) {
+      const hold = nextLongPollMs(deadline, now());
+      if (hold === null) {
+        await sleep(Math.min(500, Math.max(0, deadline - now())));
+        continue;
+      }
+      const abortPromise = new Promise((resolve) => {
+        entry.controller.signal.addEventListener("abort", () => resolve({ answered: false, aborted: true }), {
+          once: true
+        });
+      });
+      let outcome;
+      try {
+        outcome = await Promise.race([
+          waitForAnswer2(deps.apiKey, correlationId, hold, AbortSignal.any([entry.controller.signal, AbortSignal.timeout(Math.max(1, deadline - now()))])),
+          abortPromise
+        ]);
+      } catch {
+        return { answered: false, status: "unavailable" };
+      }
+      if ("aborted" in outcome) return { answered: false, status: "cancelled" };
+      if (isDecisionStopped(outcome) || outcome.answered) return outcome;
+      await sleep(Math.min(500, Math.max(0, deadline - now())));
+    }
+    return { answered: false };
+  };
+  const canUseTool = async (toolName, input, options) => {
+    if (toolName.startsWith("mcp__pushary__")) return allow(input);
+    if (tornDown) return deny("Remote session is shutting down");
+    if (pending.size >= maxConcurrent) {
+      deps.log?.(`[pushary] too many concurrent approvals (${pending.size}); denying ${toolName}`);
+      return deny("Too many pending approvals; try again");
+    }
+    const controller = new AbortController();
+    const entry = { controller };
+    let answered = false;
+    pending.add(entry);
+    const outerAbort = () => controller.abort();
+    if (options?.signal) {
+      if (options.signal.aborted) controller.abort();
+      else options.signal.addEventListener("abort", outerAbort, { once: true });
+    }
+    try {
+      const sessionId = deps.getSessionId?.();
+      const modeState = await fetchModeState2(deps.apiKey, sessionId);
+      const policyConfig = await getPolicy2(deps.apiKey, modeState.policyVersion, "claude_code", true, sessionId);
+      const scopePath = modeState.scope ? scopePathFor(toolName, input, deps.cwd) : void 0;
+      const verdict = resolveGate({
+        modeState,
+        config: policyConfig,
+        toolName,
+        toolInputs: [input],
+        scopePaths: scopePath ? [scopePath] : [],
+        cwd: deps.cwd,
+        repoKey: repoKeyFor(deps.cwd),
+        sessionId
+      });
+      if (verdict.kind === "kill") return deny(KILL_REASON);
+      if (verdict.kind === "allow") return allow(input);
+      if (verdict.kind === "deny") return deny(verdict.reason);
+      if (verdict.kind === "defer") return deny("Approval state unavailable; denied by default");
+      const policy = verdict.policy;
+      const description = describeToolCall(toolName, input, "hook");
+      const toolTarget = deriveToolTarget(toolName, input);
+      let question;
+      try {
+        question = await askUser2(deps.apiKey, {
+          question: `Allow ${description || UNNAMED_ACTION}?`,
+          type: "confirm",
+          context: `Your agent wants to run this in ${deps.projectName} (you are away)`,
+          agentName: `Claude Code - ${deps.projectName}`,
+          sessionId,
+          machineId: deps.machineId,
+          toolName,
+          toolTarget,
+          repoKey: repoKeyFor(deps.cwd)
+        });
+      } catch (error) {
+        if (!(error instanceof SubscriptionRequiredError)) return deny(UNVERIFIABLE_APPROVAL_REASON);
+        announceSubscriptionRequired(error.upgradeUrl, sessionId);
+        return deny(SUBSCRIPTION_REQUIRED_NO_LOCAL_APPROVAL_UI);
+      }
+      if (isDecisionStopped(question)) return deny(DECISION_STOP_REASON);
+      entry.correlationId = question.correlationId;
+      const localHandoff = isLocalQuestionHandoff(question);
+      let answer = question.answered ? { ...question, answered: true } : localHandoff ? { answered: false } : await waitForPhone(entry, question.correlationId, windowFor(policy));
+      if (isDecisionStopped(answer) || entry.controller.signal.aborted) return deny(DECISION_STOP_REASON);
+      if (!answer.answered) {
+        answer = await withdrawQuestion(deps.apiKey, question.correlationId, { cancelQuestion: cancelQuestion2, waitForAnswer: waitForAnswer2 });
+        entry.correlationId = void 0;
+        if (isDecisionStopped(answer)) return deny(DECISION_STOP_REASON);
+      }
+      answered = answer.answered;
+      if (answer.answered) {
+        if (isDeferAnswer(answer.value)) return deny("Deferred \u2014 handle it on the machine");
+        return answer.value === "yes" ? allow(input) : deny("Denied from your phone");
+      }
+      if (localHandoff) return deny(NO_LOCAL_APPROVAL_UI);
+      return applyTimeout(policy, input);
+    } catch {
+      return deny("Approval unavailable; denied by default");
+    } finally {
+      if (options?.signal) options.signal.removeEventListener("abort", outerAbort);
+      if (entry.correlationId && !answered && !tornDown) {
+        await cancelQuestion2(deps.apiKey, entry.correlationId).catch(() => {
+        });
+      }
+      pending.delete(entry);
+    }
+  };
+  const teardown = () => {
+    tornDown = true;
+    for (const entry of pending) {
+      entry.controller.abort();
+      if (entry.correlationId) {
+        void cancelQuestion2(deps.apiKey, entry.correlationId).catch(() => {
+        });
+      }
+    }
+    pending.clear();
+  };
+  return {
+    canUseTool,
+    teardown,
+    pendingCount: () => pending.size
+  };
+};
+
+// src/wrapper/authRejection.ts
+var isAuthRejection = (status) => status === 401 || status === 403;
+
+// src/wrapper/drainClient.ts
+var drainPendingCommand = async (apiKey, sessionId, signal, baseUrl = getBaseUrl()) => {
+  try {
+    const response = await fetch(`${baseUrl}/api/agent/command/drain`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${apiKey}`
+      },
+      body: JSON.stringify(sessionId ? { sessionId } : {}),
+      signal
+    });
+    if (!response.ok) return { command: null, rejected: isAuthRejection(response.status) };
+    const data = await response.json();
+    const command = typeof data.command === "string" && data.command.length > 0 ? data.command : null;
+    return { command, rejected: false };
+  } catch {
+    return { command: null, rejected: false };
+  }
+};
+
+// src/wrapper/commandPoller.ts
+var SLOW_POLL_MS = 3e4;
+var FAST_POLL_MS = 2e3;
+var FAST_DECAY_TICKS = 3;
+var MAX_ERROR_BACKOFF_MS = 12e4;
+var MAX_ERROR_STREAK = 6;
+var REQUEST_TIMEOUT_MS = 1e4;
+var PollRejectedError = class extends Error {
+};
+var EMPTY_DRAIN = { command: null, rejected: false };
+var startCommandPoller = (opts) => {
+  const drain = opts.drain ?? drainPendingCommand;
+  const slow = opts.slowPollMs ?? SLOW_POLL_MS;
+  const fast = opts.fastPollMs ?? FAST_POLL_MS;
+  const requestTimeout = opts.requestTimeoutMs ?? REQUEST_TIMEOUT_MS;
+  let stopped = false;
+  let timer;
+  let inflight;
+  let idleTicks = 0;
+  let errorStreak = 0;
+  let authRejectionReported = false;
+  const reportAuthRejection = () => {
+    if (authRejectionReported) return;
+    authRejectionReported = true;
+    try {
+      opts.onAuthRejected?.();
+    } catch {
+      return;
+    }
+  };
+  const jitter = (ms) => {
+    const r = opts.jitter ? opts.jitter() : Math.random();
+    return Math.max(1, Math.round(ms * (0.85 + r * 0.3)));
+  };
+  const nextDelay = () => {
+    if (errorStreak > 0) {
+      return Math.min(slow * 2 ** (errorStreak - 1), MAX_ERROR_BACKOFF_MS);
+    }
+    return idleTicks >= FAST_DECAY_TICKS ? slow : fast;
+  };
+  const schedule = (delayMs) => {
+    if (stopped) return;
+    timer = setTimeout(tick, jitter(delayMs));
+  };
+  const fetchMode = async () => {
+    if (!opts.fetchModeState || !opts.onModeState) return;
+    try {
+      const state = await opts.fetchModeState(opts.apiKey, opts.getSessionId?.());
+      try {
+        opts.onModeState(state);
+      } catch {
+      }
+    } catch {
+    }
+  };
+  const tick = async () => {
+    if (stopped) return;
+    const controller = new AbortController();
+    inflight = controller;
+    const timeout = setTimeout(() => controller.abort(), requestTimeout);
+    try {
+      const wantCommands = opts.shouldDrainCommands ? opts.shouldDrainCommands() : true;
+      let command;
+      if (opts.poll) {
+        const result = await opts.poll(opts.apiKey, opts.getSessionId?.(), wantCommands, controller.signal);
+        if (result.rejected) {
+          reportAuthRejection();
+          throw new PollRejectedError();
+        }
+        command = result.command;
+        if (result.mode && opts.onModeState) {
+          try {
+            opts.onModeState(result.mode);
+          } catch {
+          }
+        }
+      } else {
+        const [drained] = await Promise.all([
+          wantCommands ? drain(opts.apiKey, opts.getSessionId?.(), controller.signal) : Promise.resolve(EMPTY_DRAIN),
+          fetchMode()
+        ]);
+        if (drained.rejected) {
+          reportAuthRejection();
+          throw new PollRejectedError();
+        }
+        command = drained.command;
+      }
+      errorStreak = 0;
+      if (command) {
+        idleTicks = 0;
+        const text = typeof command === "string" ? command : command.text;
+        let accepted = false;
+        try {
+          accepted = await opts.onCommand(text) !== false;
+        } catch {
+        }
+        if (typeof command !== "string") {
+          const state = accepted ? "delivered" : "failed";
+          if (command.acknowledge) {
+            await command.acknowledge(state).catch(() => false);
+          } else if (opts.ackCommand) {
+            await opts.ackCommand(opts.apiKey, command.id, state).catch(() => false);
+          }
+        }
+      } else {
+        idleTicks++;
+      }
+    } catch {
+      errorStreak = Math.min(errorStreak + 1, MAX_ERROR_STREAK);
+    } finally {
+      clearTimeout(timeout);
+      inflight = void 0;
+    }
+    schedule(nextDelay());
+  };
+  schedule(fast);
+  opts.log?.("[pushary] command poller active");
+  return {
+    stop() {
+      stopped = true;
+      if (timer) clearTimeout(timer);
+      inflight?.abort();
+      inflight = void 0;
+    }
+  };
+};
+
+// src/wrapper/pollClient.ts
+var APPROVAL_MODES = /* @__PURE__ */ new Set(["push_only", "terminal_only", "push_first", "notify_only"]);
+var pollAgent = async (apiKey, sessionId, wantCommand, signal, baseUrl = getBaseUrl(), machineId, controlMode, takeoverDeclined) => {
+  try {
+    const sessionKey = sessionId || DEFAULT_SESSION;
+    const receiptNamespace = `${apiKey}:${machineId}:claude_code`;
+    let storedCommand = machineId ? readPendingCommand(sessionKey, receiptNamespace) : null;
+    let acknowledgedCommandId = null;
+    const acknowledge = async (id, state) => {
+      const persisted = state === "delivered" ? markPendingCommandDelivered(sessionKey, id, receiptNamespace) : markPendingCommandFailed(sessionKey, id, receiptNamespace);
+      if (!persisted) return false;
+      try {
+        const acknowledged = await fetch(`${baseUrl}/api/agent/command/ack`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+          body: JSON.stringify({
+            commandId: id,
+            sessionId: sessionId ?? null,
+            machineId,
+            state,
+            ...state === "failed" ? { failureCode: "consumer_rejected" } : {}
+          }),
+          signal
+        });
+        if (acknowledged.ok) removePendingCommand(sessionKey, id, receiptNamespace);
+        return acknowledged.ok;
+      } catch {
+        return false;
+      }
+    };
+    if (storedCommand?.delivered || storedCommand?.failed) {
+      const acknowledged = await acknowledge(
+        storedCommand.id,
+        storedCommand.failed ? "failed" : "delivered"
+      );
+      if (acknowledged) {
+        acknowledgedCommandId = storedCommand.id;
+        storedCommand = null;
+      }
+    }
+    const response = await fetch(`${baseUrl}/api/agent/poll`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify({
+        ...sessionId ? { sessionId } : {},
+        ...controlMode ? { controlMode } : {},
+        ...takeoverDeclined ? { takeoverDeclined } : {},
+        ...machineId ? { machineId } : {},
+        ...wantCommand && !storedCommand ? {} : { drain: false },
+        ...wantCommand && !storedCommand && machineId ? { ackMode: true } : {}
+      }),
+      signal
+    });
+    if (!response.ok) return { command: null, mode: null, rejected: isAuthRejection(response.status) };
+    const data = await response.json();
+    const claimedCommand = (id, text) => ({
+      id,
+      text,
+      acknowledge: (state) => acknowledge(id, state)
+    });
+    let command = typeof data.command === "string" && data.command.length > 0 ? data.command : null;
+    if (storedCommand) {
+      command = storedCommand.delivered || storedCommand.failed ? null : claimedCommand(storedCommand.id, storedCommand.text);
+    } else if (data.command && typeof data.command === "object") {
+      const claimed = data.command;
+      if (typeof claimed.id === "string" && typeof claimed.text === "string" && claimed.id !== acknowledgedCommandId) {
+        const saved = savePendingCommand(sessionKey, {
+          id: claimed.id,
+          text: claimed.text,
+          expiresAtMs: typeof claimed.expiresAtMs === "number" ? claimed.expiresAtMs : Date.now() + 36e5,
+          delivered: false
+        }, receiptNamespace);
+        command = saved ? claimedCommand(claimed.id, claimed.text) : null;
+      }
+    }
+    const m = data.override?.mode;
+    const mode = {
+      mode: typeof m === "string" && APPROVAL_MODES.has(m) ? m : null,
+      kill: data.kill === true,
+      policyVersion: typeof data.policyVersion === "string" && data.policyVersion.length > 0 ? data.policyVersion : null,
+      relayUrl: typeof data.relayUrl === "string" && data.relayUrl.length > 0 ? data.relayUrl : null
+    };
+    return { command, mode, rejected: false, ...data.takeoverRequested === true ? { takeoverRequested: true } : {} };
+  } catch {
+    return { command: null, mode: null, rejected: false };
+  }
+};
+
+// src/wrapper/wsProtocol.ts
+var PROTOCOL_VERSION = 1;
+var encodeFrame = (frame) => JSON.stringify(frame);
+var helloFrame = (fields) => ({ v: PROTOCOL_VERSION, t: "hello", ...fields });
+var parse = (raw) => {
+  try {
+    const value = JSON.parse(raw);
+    if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+    const obj = value;
+    if (obj.v !== PROTOCOL_VERSION) return null;
+    return obj;
+  } catch {
+    return null;
+  }
+};
+var isString = (v) => typeof v === "string";
+var decodeServerFrame = (raw) => {
+  const f = parse(raw);
+  if (!f) return null;
+  switch (f.t) {
+    case "welcome":
+      return { v: PROTOCOL_VERSION, t: "welcome" };
+    case "ping":
+      return { v: PROTOCOL_VERSION, t: "ping" };
+    case "pong":
+      return { v: PROTOCOL_VERSION, t: "pong" };
+    case "command":
+      return isString(f.id) && isString(f.text) ? { v: PROTOCOL_VERSION, t: "command", id: f.id, text: f.text } : null;
+    case "error":
+      if (isString(f.code) && isString(f.message)) {
+        return { v: PROTOCOL_VERSION, t: "error", code: f.code, message: f.message, fatal: f.fatal === true };
+      }
+      return null;
+    default:
+      return null;
+  }
+};
+
+// src/wrapper/relayClient.ts
+var DEFAULT_HEARTBEAT_MS = 2e4;
+var DEFAULT_PONG_TIMEOUT_MS = 1e4;
+var DEFAULT_MAX_SEEN_COMMANDS = 256;
+var COMMAND_RECEIPT_TTL_MS = 36e5;
+var defaultBackoff = (attempt) => Math.min(1e3 * 2 ** attempt, 3e4);
+var defaultSocketFactory = (url) => {
+  const WS = globalThis.WebSocket;
+  if (!WS) throw new Error("no WebSocket in this runtime");
+  const socket = new WS(url);
+  return {
+    send: (data) => socket.send(data),
+    close: () => socket.close(),
+    onOpen: (cb) => socket.addEventListener("open", () => cb()),
+    onMessage: (cb) => socket.addEventListener("message", (event) => cb(String(event.data))),
+    onClose: (cb) => socket.addEventListener("close", () => cb()),
+    onError: (cb) => socket.addEventListener("error", (event) => cb(event))
+  };
+};
+var createRelayClient = (options) => {
+  const factory = options.socketFactory ?? defaultSocketFactory;
+  const heartbeatMs = options.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;
+  const pongTimeoutMs = options.pongTimeoutMs ?? DEFAULT_PONG_TIMEOUT_MS;
+  const backoff = options.backoffMs ?? defaultBackoff;
+  const maxSeenCommands = Math.max(1, options.maxSeenCommands ?? DEFAULT_MAX_SEEN_COMMANDS);
+  let socket;
+  let isConnected = false;
+  let stopped = false;
+  let attempt = 0;
+  let reconnectTimer;
+  let heartbeatTimer;
+  let pongTimer;
+  const seenCommands = [];
+  const seenSet = /* @__PURE__ */ new Set();
+  const pendingCommands = /* @__PURE__ */ new Map();
+  const log = (message) => options.log?.(message);
+  const receiptNamespace = `${options.apiKey}:${options.machineId}:${options.agentType}`;
+  const acknowledgeStored = (id) => {
+    const receipt = readPendingCommandById(
+      options.getSessionId() || DEFAULT_SESSION,
+      id,
+      receiptNamespace
+    );
+    if (!receipt || !receipt.delivered && !receipt.failed) return false;
+    sendFrame(receipt.failed ? { v: PROTOCOL_VERSION, t: "ack", id, state: "failed", failureCode: "consumer_rejected" } : { v: PROTOCOL_VERSION, t: "ack", id, state: "delivered" });
+    return true;
+  };
+  const clearTimers = () => {
+    if (heartbeatTimer) clearInterval(heartbeatTimer);
+    if (pongTimer) clearTimeout(pongTimer);
+    if (reconnectTimer) clearTimeout(reconnectTimer);
+    heartbeatTimer = void 0;
+    pongTimer = void 0;
+    reconnectTimer = void 0;
+  };
+  const rememberCommand = (id) => {
+    if (seenSet.has(id)) return false;
+    seenSet.add(id);
+    seenCommands.push(id);
+    while (seenCommands.length > maxSeenCommands) {
+      const evicted = seenCommands.shift();
+      if (evicted) seenSet.delete(evicted);
+    }
+    return true;
+  };
+  const sendFrame = (frame) => {
+    if (!socket || !isConnected) return;
+    try {
+      socket.send(encodeFrame(frame));
+    } catch {
+    }
+  };
+  const sendHello = () => sendFrame(
+    helloFrame({
+      apiKey: options.apiKey,
+      machineId: options.machineId,
+      agentType: options.agentType,
+      sessionId: options.getSessionId()
+    })
+  );
+  const armPong = () => {
+    if (pongTimer) clearTimeout(pongTimer);
+    pongTimer = setTimeout(() => {
+      log("[pushary] relay heartbeat timed out; reconnecting");
+      dropAndReconnect();
+    }, pongTimeoutMs);
+  };
+  const startHeartbeat = () => {
+    if (heartbeatTimer) clearInterval(heartbeatTimer);
+    heartbeatTimer = setInterval(() => {
+      sendFrame({ v: PROTOCOL_VERSION, t: "ping" });
+      armPong();
+    }, heartbeatMs);
+  };
+  const onServerFrame = async (raw) => {
+    const frame = decodeServerFrame(raw);
+    if (!frame) return;
+    switch (frame.t) {
+      case "welcome":
+        attempt = 0;
+        log("[pushary] relay connected");
+        break;
+      case "command":
+        if (pendingCommands.has(frame.id)) {
+          await pendingCommands.get(frame.id);
+          acknowledgeStored(frame.id);
+          break;
+        }
+        if (seenSet.has(frame.id)) {
+          sendFrame({ v: PROTOCOL_VERSION, t: "ack", id: frame.id, state: "delivered" });
+          break;
+        }
+        if (acknowledgeStored(frame.id)) break;
+        const sessionKey = options.getSessionId() || DEFAULT_SESSION;
+        if (!savePendingCommand(sessionKey, {
+          id: frame.id,
+          text: frame.text,
+          expiresAtMs: Date.now() + COMMAND_RECEIPT_TTL_MS,
+          delivered: false,
+          failed: true
+        }, receiptNamespace)) {
+          acknowledgeStored(frame.id);
+          break;
+        }
+        let completePending;
+        pendingCommands.set(frame.id, new Promise((resolve) => {
+          completePending = resolve;
+        }));
+        let accepted = false;
+        try {
+          const result = options.onCommand(frame.text);
+          accepted = (result instanceof Promise ? await result : result) !== false;
+        } catch {
+        }
+        if (accepted && markPendingCommandDelivered(sessionKey, frame.id, receiptNamespace)) {
+          rememberCommand(frame.id);
+          sendFrame({ v: PROTOCOL_VERSION, t: "ack", id: frame.id, state: "delivered" });
+        } else {
+          sendFrame({
+            v: PROTOCOL_VERSION,
+            t: "ack",
+            id: frame.id,
+            state: "failed",
+            failureCode: "consumer_rejected"
+          });
+        }
+        completePending();
+        pendingCommands.delete(frame.id);
+        break;
+      case "ping":
+        sendFrame({ v: PROTOCOL_VERSION, t: "pong" });
+        break;
+      case "pong":
+        if (pongTimer) clearTimeout(pongTimer);
+        pongTimer = void 0;
+        break;
+      case "error":
+        if (frame.fatal) {
+          log(`[pushary] relay fatal: ${frame.message}`);
+          fatal(frame.message);
+        } else {
+          log(`[pushary] relay error: ${frame.message}`);
+        }
+        break;
+    }
+  };
+  const dropSocket = () => {
+    isConnected = false;
+    if (heartbeatTimer) clearInterval(heartbeatTimer);
+    if (pongTimer) clearTimeout(pongTimer);
+    heartbeatTimer = void 0;
+    pongTimer = void 0;
+    if (socket) {
+      try {
+        socket.close();
+      } catch {
+      }
+    }
+    socket = void 0;
+  };
+  const scheduleReconnect = () => {
+    if (stopped) return;
+    if (reconnectTimer) return;
+    const delay = backoff(attempt);
+    attempt++;
+    const jittered = Math.max(1, Math.round(delay * (0.85 + Math.random() * 0.3)));
+    reconnectTimer = setTimeout(() => {
+      reconnectTimer = void 0;
+      connect();
+    }, jittered);
+  };
+  const dropAndReconnect = () => {
+    dropSocket();
+    scheduleReconnect();
+  };
+  const fatal = (message) => {
+    stopped = true;
+    clearTimers();
+    dropSocket();
+    options.onFatal?.(message);
+  };
+  const connect = () => {
+    if (stopped) return;
+    let created;
+    try {
+      created = factory(options.url);
+    } catch (error) {
+      fatal(error instanceof Error ? error.message : String(error));
+      return;
+    }
+    socket = created;
+    created.onOpen(() => {
+      isConnected = true;
+      sendHello();
+      startHeartbeat();
+    });
+    created.onMessage((data) => onServerFrame(data));
+    created.onClose(() => {
+      if (stopped) return;
+      dropAndReconnect();
+    });
+    created.onError(() => {
+    });
+  };
+  return {
+    start() {
+      if (stopped) return;
+      connect();
+    },
+    connected() {
+      return isConnected;
+    },
+    reannounce() {
+      if (stopped || !isConnected) return;
+      sendHello();
+    },
+    stop() {
+      if (stopped) return;
+      stopped = true;
+      sendFrame({ v: PROTOCOL_VERSION, t: "bye" });
+      clearTimers();
+      dropSocket();
+    }
+  };
+};
+
+// src/wrapper/stdinHandoff.ts
+var isTty = () => Boolean(process.stdin.isTTY);
+var createStdinHandoff = () => {
+  let listener;
+  let captured = false;
+  const removeListener = () => {
+    if (listener) {
+      process.stdin.off("data", listener);
+      listener = void 0;
+    }
+  };
+  const setRaw = (on) => {
+    if (!isTty()) return;
+    try {
+      process.stdin.setRawMode(on);
+    } catch {
+    }
+  };
+  const captureForWrapper = (onKey) => {
+    removeListener();
+    listener = onKey;
+    if (!isTty()) return;
+    try {
+      process.stdin.resume();
+      setRaw(true);
+      process.stdin.setEncoding("utf8");
+      process.stdin.on("data", listener);
+      captured = true;
+    } catch {
+      removeListener();
+    }
+  };
+  const releaseToChild = () => {
+    removeListener();
+    setRaw(false);
+    if (captured && isTty()) {
+      try {
+        process.stdin.pause();
+      } catch {
+      }
+    }
+    captured = false;
+  };
+  return {
+    captureForWrapper,
+    releaseToChild,
+    dispose: releaseToChild
+  };
+};
+
+// src/wrapper/args.ts
+var resolveClaudeArgs = (argv) => {
+  const rest = argv.slice(2);
+  return rest[0] === "claude" ? rest.slice(1) : rest;
+};
+var extractRemoteFlag = (args2) => ({
+  remote: args2.includes("--remote"),
+  rest: args2.filter((arg) => arg !== "--remote")
+});
+var flagValue = (args2, index) => {
+  const inline = args2[index];
+  const eq = inline?.indexOf("=") ?? -1;
+  if (inline && eq > 0) return inline.slice(eq + 1);
+  const next = args2[index + 1];
+  return next && !next.startsWith("-") ? next : void 0;
+};
+var PASS_THROUGH_VALUE_FLAGS = /* @__PURE__ */ new Set(["--cwd", "--add-dir"]);
+var parseRemoteArgs = (args2) => {
+  let initialPrompt;
+  let resume;
+  let permissionMode;
+  let model;
+  let settings;
+  for (let i = 0; i < args2.length; i++) {
+    const arg = args2[i];
+    if (arg === "--model" || arg === "-m" || arg?.startsWith("--model=")) {
+      model = flagValue(args2, i);
+      if (!arg.includes("=")) i++;
+    } else if (arg === "--settings" || arg?.startsWith("--settings=")) {
+      settings = flagValue(args2, i);
+      if (!arg.includes("=")) i++;
+    } else if (PASS_THROUGH_VALUE_FLAGS.has(arg ?? "")) {
+      i++;
+    } else if (arg === "-p" || arg === "--print" || arg?.startsWith("--print=")) {
+      initialPrompt = flagValue(args2, i);
+    } else if (arg === "-r" || arg === "--resume" || arg?.startsWith("--resume=")) {
+      resume = flagValue(args2, i);
+    } else if (arg === "--permission-mode" || arg?.startsWith("--permission-mode=")) {
+      permissionMode = flagValue(args2, i);
+    }
+  }
+  return { initialPrompt, resume, permissionMode, ...model ? { model } : {}, ...settings ? { settings } : {} };
+};
+var remoteCompatibilityIssue = (args2) => {
+  const values = /* @__PURE__ */ new Set(["--model", "-m", "--settings", "--permission-mode", "--resume", "-r", "--session-id", "-p", "--print", "--cwd", "--add-dir"]);
+  const switches = /* @__PURE__ */ new Set(["--continue", "-c", "--verbose", "--debug", "--dangerously-skip-permissions"]);
+  for (let index = 0; index < args2.length; index++) {
+    const arg = args2[index];
+    if (!arg.startsWith("-")) continue;
+    const flag = arg.split("=")[0];
+    if (switches.has(flag)) continue;
+    if (!values.has(flag)) return `Phone takeover does not yet preserve ${flag}; keep using this terminal.`;
+    if (!arg.includes("=") && args2[index + 1] && !args2[index + 1].startsWith("-")) index++;
+  }
+  return null;
+};
+
+// src/wrapper/localLeg.ts
+import { readFileSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+var SIGNAL_EXIT_BASE = 128;
+var SIGNAL_NUMBERS2 = { SIGHUP: 1, SIGINT: 2, SIGTERM: 15 };
+var nativeArgs = (session) => {
+  let args2 = [...session.claudeArgs];
+  const id = session.getSessionId();
+  if (id && session.userManagesSession && session.isSessionCreated()) {
+    args2 = args2.filter((arg, index, all) => {
+      if (/^(--resume|-r|--session-id)(=|$)|^(--continue|-c)$/.test(arg)) return false;
+      return !/^(--resume|-r|--session-id)$/.test(all[index - 1] ?? "") || arg.startsWith("-");
+    });
+    return [...args2, "--resume", id];
+  }
+  if (id && !session.userManagesSession) {
+    args2.push(session.isSessionCreated() ? "--resume" : "--session-id", id);
+  }
+  return args2;
+};
+var runLocalLeg = (session, deps = {}) => {
+  const spawn2 = deps.spawn ?? spawnClaude;
+  return new Promise((resolve) => {
+    const legAbort = new AbortController();
+    let exitReason = null;
+    let settled = false;
+    let identityTimer;
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      if (identityTimer) clearInterval(identityTimer);
+      session.setActiveLeg(null);
+      resolve(exitReason ?? { type: "exit", code: 0 });
+    };
+    const control = {
+      onPhoneCommand: () => {
+        if (!exitReason) exitReason = "switch";
+        if (!legAbort.signal.aborted) {
+          process.stderr.write(
+            "\n[pushary] phone takeover requested \u2014 resuming this conversation with phone control (Ctrl-] hands the terminal back)\n"
+          );
+          legAbort.abort();
+        }
+      },
+      stop: (reason) => {
+        if (!exitReason) exitReason = { type: "exit", code: reason === "signal" ? 130 : 0 };
+        if (!legAbort.signal.aborted) legAbort.abort();
+      }
+    };
+    session.setActiveLeg(control);
+    if (session.input.bufferedCount > 0) {
+      exitReason = "switch";
+      finish();
+      return;
+    }
+    session.stdin.releaseToChild();
+    let child;
+    try {
+      child = spawn2(session.binary, nativeArgs(session), {
+        stdio: "inherit",
+        env: { ...process.env, [WRAPPER_ACTIVE_ENV]: "1" },
+        signal: legAbort.signal
+      });
+    } catch {
+      exitReason = exitReason ?? { type: "exit", code: 127 };
+      finish();
+      return;
+    }
+    const spawnedAt = Date.now();
+    const readIdentity = () => {
+      if (!child.pid) return;
+      try {
+        const root = process.env.CLAUDE_CONFIG_DIR || join2(homedir2(), ".claude");
+        const record = JSON.parse(readFileSync(join2(root, "sessions", `${child.pid}.json`), "utf8"));
+        if (record.pid !== child.pid || record.cwd !== process.cwd() || record.startedAt < spawnedAt - 5e3 || typeof record.startedAt !== "number" || !/^[a-f0-9-]{36}$/i.test(record.sessionId)) return;
+        if (record.sessionId !== session.getSessionId()) session.setSessionId(record.sessionId);
+        session.markSessionCreated();
+      } catch {
+      }
+    };
+    session.markSessionCreated();
+    readIdentity();
+    identityTimer = setInterval(readIdentity, 500);
+    identityTimer.unref();
+    child.on("error", (error) => {
+      if (legAbort.signal.aborted && error.name === "AbortError") return;
+      if (!legAbort.signal.aborted && !exitReason) {
+        exitReason = { type: "exit", code: 127 };
+      }
+      finish();
+    });
+    child.on("exit", (code2, signal) => {
+      if (signal === "SIGTERM" && legAbort.signal.aborted) {
+      } else if (!exitReason) {
+        if (session.input.bufferedCount > 0) {
+          exitReason = "switch";
+        } else if (typeof code2 === "number") {
+          exitReason = { type: "exit", code: code2 };
+        } else if (signal) {
+          exitReason = { type: "exit", code: SIGNAL_EXIT_BASE + (SIGNAL_NUMBERS2[signal] ?? 0) };
+        } else {
+          exitReason = { type: "exit", code: 0 };
+        }
+      }
+      finish();
+    });
+  });
+};
+
+// src/wrapper/remoteLoop.ts
+var errMsg = (err) => err instanceof Error ? err.message : String(err);
+var scheduleWithTimer = (fire, delayMs) => {
+  const timer = setTimeout(fire, delayMs);
+  timer.unref?.();
+  return () => clearTimeout(timer);
+};
+var isTurnActivity = (message) => message.type !== "system" && message.type !== "result";
+var isInit = (message) => message.type === "system" && message.subtype === "init";
+var DEFAULT_MAX_RESTARTS = 5;
+var runRemoteLoop = async (deps) => {
+  const maxRestarts = deps.maxRestarts ?? DEFAULT_MAX_RESTARTS;
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const backoff = deps.backoffMs ?? ((attempt) => Math.min(1e3 * 2 ** attempt, 15e3));
+  const idleTimeoutMs = deps.idleTimeoutMs ?? SESSION_IDLE_TIMEOUT_MS;
+  const scheduleIdle = deps.scheduleIdle ?? scheduleWithTimer;
+  let resumeId = deps.initialResume;
+  let totalCost = 0;
+  let restarts = 0;
+  let idleExpired = false;
+  let cancelIdle;
+  const disarmIdle = () => {
+    cancelIdle?.();
+    cancelIdle = void 0;
+  };
+  const ended = (exitCode, endedBy) => ({ exitCode, totalCostUsd: totalCost, endedBy });
+  while (!deps.signal.aborted) {
+    deps.input.detachConsumer();
+    let query;
+    try {
+      query = deps.sdk.query({
+        prompt: deps.input,
+        options: {
+          resume: resumeId,
+          includePartialMessages: true,
+          permissionMode: deps.permissionMode,
+          model: deps.model,
+          settings: deps.settings,
+          canUseTool: deps.canUseTool,
+          env: deps.env,
+          cwd: deps.cwd,
+          pathToClaudeCodeExecutable: deps.pathToClaudeCodeExecutable
+        }
+      });
+    } catch (err) {
+      deps.log?.(`[pushary] remote mode: query failed to start: ${errMsg(err)}`);
+      return ended(1, "failed");
+    }
+    const onAbort = () => {
+      deps.input.detachConsumer();
+      if (query.close) query.close();
+      else void query.interrupt?.().catch(() => {
+      });
+    };
+    if (deps.signal.aborted) onAbort();
+    else deps.signal.addEventListener("abort", onAbort, { once: true });
+    let turnOpen = false;
+    const stillResting = (deliveredAtRest) => !turnOpen && deps.input.bufferedCount === 0 && deps.input.stats.delivered === deliveredAtRest;
+    const armIdle = () => {
+      disarmIdle();
+      const deliveredAtRest = deps.input.stats.delivered;
+      cancelIdle = scheduleIdle(() => {
+        cancelIdle = void 0;
+        if (!stillResting(deliveredAtRest)) return;
+        idleExpired = true;
+        deps.log?.(`[pushary] remote mode: no phone instruction for ${describeIdleWindow(idleTimeoutMs)}, ending the session`);
+        onAbort();
+      }, idleTimeoutMs);
+    };
+    const restsAfter = (message) => deps.input.bufferedCount === 0 && (message.type === "result" || isInit(message) && !turnOpen);
+    try {
+      for await (const message of query) {
+        deps.onMessage?.(message);
+        if (isInit(message) && typeof message.session_id === "string") {
+          if (resumeId && message.session_id !== resumeId) {
+            disarmIdle();
+            deps.signal.removeEventListener("abort", onAbort);
+            deps.input.detachConsumer();
+            query.close?.();
+            deps.log?.("[pushary] refused a different session ID during resume");
+            return ended(1, "failed");
+          }
+          resumeId = message.session_id;
+          deps.onSessionId?.(resumeId);
+        }
+        if (message.type === "result" && typeof message.total_cost_usd === "number") {
+          totalCost = message.total_cost_usd;
+          deps.onCost?.(totalCost);
+        }
+        if (message.type === "result") turnOpen = false;
+        else if (isTurnActivity(message)) turnOpen = true;
+        if (restsAfter(message)) armIdle();
+      }
+      disarmIdle();
+      deps.signal.removeEventListener("abort", onAbort);
+      query.close?.();
+      if (idleExpired) return ended(0, "idle");
+      return deps.signal.aborted ? ended(130, "aborted") : ended(0, "input-closed");
+    } catch (err) {
+      disarmIdle();
+      deps.signal.removeEventListener("abort", onAbort);
+      query.close?.();
+      if (idleExpired) return ended(0, "idle");
+      if (deps.signal.aborted) return ended(130, "aborted");
+      restarts++;
+      if (restarts > maxRestarts) {
+        deps.log?.(`[pushary] remote mode: too many restarts, giving up: ${errMsg(err)}`);
+        return ended(1, "failed");
+      }
+      deps.log?.(
+        `[pushary] remote mode: transient error, resuming session (attempt ${restarts}/${maxRestarts}): ${errMsg(err)}`
+      );
+      await sleep(backoff(restarts));
+    }
+  }
+  return ended(130, "aborted");
+};
+
+// src/wrapper/remoteLeg.ts
+var CTRL_RIGHT_BRACKET = "";
+var CTRL_C = "";
+var terminalAttended = () => Boolean(process.stdin.isTTY);
+var runRemoteLeg = async (session, sdk, deps = {}) => {
+  const legAbort = new AbortController();
+  const launchArgs = parseRemoteArgs(session.claudeArgs);
+  const attended = deps.attended ?? terminalAttended();
+  let switchBack = false;
+  let idleEnded = false;
+  const control = {
+    // The running query already drains the shared input queue, so a freshly pushed
+    // phone command is delivered without any action here.
+    onPhoneCommand: () => {
+    },
+    stop: () => {
+      if (!legAbort.signal.aborted) legAbort.abort();
+    }
+  };
+  session.setActiveLeg(control);
+  session.stdin.captureForWrapper((data) => {
+    if (data.includes(CTRL_RIGHT_BRACKET)) {
+      switchBack = true;
+      if (!legAbort.signal.aborted) legAbort.abort();
+    } else if (data.includes(CTRL_C)) {
+      if (!legAbort.signal.aborted) legAbort.abort();
+    }
+  });
+  process.stderr.write(
+    "[pushary] remote \u2014 driving from your phone \xB7 press Ctrl-] for the local terminal\n"
+  );
+  let exitCode = 0;
+  try {
+    const result = await runRemoteLoop({
+      sdk,
+      input: session.input,
+      canUseTool: session.approver.canUseTool,
+      signal: legAbort.signal,
+      // Resume the session the local leg (or a prior turn) created, so the
+      // conversation is continuous across the switch. Undefined = fresh session.
+      initialResume: session.getSessionId(),
+      permissionMode: session.permissionMode,
+      model: launchArgs.model,
+      settings: launchArgs.settings,
+      // The SDK REPLACES the subprocess env; spread process.env and mark the
+      // recursion guard so a wrapper-spawned claude cannot re-enter the wrapper.
+      env: phoneDrivenEnv({ ...process.env, [WRAPPER_ACTIVE_ENV]: "1" }),
+      cwd: process.cwd(),
+      // Run the user's OWN claude (auth + version parity); Windows .cmd shims keep
+      // the SDK's bundled binary since the SDK cannot spawn a shim directly.
+      pathToClaudeCodeExecutable: needsShell(session.binary) ? void 0 : session.binary,
+      onSessionId: (id) => session.setSessionId(id),
+      onMessage: (message) => session.streamMessage(message),
+      log: (message) => process.stderr.write(`${message}
+`),
+      idleTimeoutMs: deps.idleTimeoutMs,
+      scheduleIdle: deps.scheduleIdle
+    });
+    exitCode = result.exitCode;
+    idleEnded = result.endedBy === "idle";
+  } finally {
+    session.stdin.releaseToChild();
+    session.setActiveLeg(null);
+  }
+  if (idleEnded && attended) {
+    process.stderr.write("[pushary] handing the terminal back to local mode\n");
+    return "switch";
+  }
+  return switchBack ? "switch" : { type: "exit", code: exitCode };
+};
+
+// src/wrapper/modeLoop.ts
+var DEFAULT_MIN_DWELL_MS = 300;
+var driveModeLoop = async (deps) => {
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? (() => Date.now());
+  const minDwell = deps.minDwellMs ?? DEFAULT_MIN_DWELL_MS;
+  let mode = deps.startingMode;
+  let lastSwitchAt = 0;
+  while (true) {
+    const result = mode === "local" ? await deps.runLocal() : await deps.runRemote();
+    if (result !== "switch" || deps.isFinished()) {
+      return result === "switch" ? 0 : result.code;
+    }
+    const since = now() - lastSwitchAt;
+    if (since < minDwell) await sleep(minDwell - since);
+    lastSwitchAt = now();
+    mode = mode === "local" ? "remote" : "local";
+  }
+};
+
+// src/wrapper/dualMode.ts
+var INPUT_QUEUE_CAP = 32;
+var MIN_MODE_DWELL_MS = 300;
+var PRESENCE_HEARTBEAT_MS = 6e4;
+var SESSION_FLAG_RE = /^(-r|--resume|-c|--continue|--session-id)(=.*)?$/;
+var extractAssistantText = (message) => {
+  const content = message.message?.content;
+  if (typeof content === "string") return content || void 0;
+  if (Array.isArray(content)) {
+    const text = content.filter((block) => !!block && typeof block === "object").filter((block) => block.type === "text" && typeof block.text === "string").map((block) => block.text).join("");
+    return text || void 0;
+  }
+  return void 0;
+};
+var runDualMode = async (binary, args2, startingMode) => {
+  const compatibilityIssue = remoteCompatibilityIssue(args2);
+  if (startingMode === "remote" && compatibilityIssue) {
+    process.stderr.write(`[pushary] ${compatibilityIssue}
+`);
+    return { implemented: false };
+  }
+  let apiKey;
+  try {
+    apiKey = getApiKey();
+  } catch {
+    process.stderr.write(
+      `[pushary] phone control needs an API key. Run \`${NPX_LATEST_COMMAND} setup\`. Running the normal passthrough for now.
+`
+    );
+    return { implemented: false };
+  }
+  let sdk;
+  let sdkLoading;
+  let remoteAvailable = true;
+  let noticedUnavailable = false;
+  const ensureSdk = async () => {
+    if (sdk === void 0) {
+      sdkLoading ??= ensureClaudeSdk((message) => process.stderr.write(`${message}
+`));
+      sdk = await sdkLoading;
+      if (!sdk) remoteAvailable = false;
+    }
+    return sdk;
+  };
+  if (startingMode === "remote" && !await ensureSdk()) {
+    process.stderr.write("[pushary] phone control is unavailable; running the normal passthrough.\n");
+    return { implemented: false };
+  }
+  const projectName = basename(process.cwd());
+  const agentName = `Claude Code - ${projectName}`;
+  const machineId = getMachineId();
+  const stdin = createStdinHandoff();
+  const verbose = process.env.PUSHARY_VERBOSE === "1";
+  const verboseLog = (message) => {
+    if (verbose) process.stderr.write(`${message}
+`);
+  };
+  const { initialPrompt, resume, permissionMode } = parseRemoteArgs(args2);
+  const userManagesSession = args2.some((a) => SESSION_FLAG_RE.test(a));
+  const explicitIdIndex = args2.findIndex((arg) => arg === "--session-id" || arg.startsWith("--session-id="));
+  const explicitId = explicitIdIndex < 0 ? void 0 : args2[explicitIdIndex].split("=")[1] ?? args2[explicitIdIndex + 1];
+  let sessionId = resume ?? explicitId;
+  let sessionCreated = Boolean(resume);
+  if (!sessionId && startingMode === "local" && !userManagesSession) {
+    sessionId = crypto.randomUUID();
+  }
+  let totalCostUsd = 0;
+  let killed = false;
+  let finished = false;
+  let activeLeg = null;
+  let controlMode = startingMode;
+  let takeoverPending = false;
+  let takeoverDecline;
+  const input = new BoundedInputQueue({
+    cap: INPUT_QUEUE_CAP,
+    onDrop: (_dropped, total) => process.stderr.write(`[pushary] input queue full; refused ${total} instruction(s)
+`),
+    coalesce: (items) => userMessage(items.map((m) => m.message.content).join("\n\n"))
+  });
+  const approver = createRemoteApprover({
+    apiKey,
+    machineId,
+    projectName,
+    cwd: process.cwd(),
+    getSessionId: () => sessionId
+  });
+  const initialModeState = await fetchModeState(apiKey).catch(() => null);
+  let relay;
+  const startRelay = () => {
+    if (!initialModeState?.relayUrl || relay) return;
+    relay = createRelayClient({
+      url: initialModeState.relayUrl,
+      apiKey,
+      machineId,
+      agentType: "claude_code",
+      getSessionId: () => sessionId,
+      onCommand: (command) => onPhoneCommand(command),
+      onFatal: (message) => verboseLog(`[pushary] relay unavailable (${message}); using polling`),
+      log: verboseLog
+    });
+    relay.start();
+  };
+  let ownership;
+  let ownershipSessionId;
+  const ensureOwnership = async () => {
+    if (!sessionId || ownershipSessionId === sessionId) return ownership?.ready;
+    ownership?.stop();
+    ownershipSessionId = sessionId;
+    ownership = startProcessOwnership({
+      sessionId,
+      pid: process.pid,
+      ...process.env.PUSHARY_SPAWN_ID ? { spawnId: process.env.PUSHARY_SPAWN_ID } : {}
+    });
+    await ownership.ready;
+  };
+  const announcePresence = async (event, action) => {
+    if (!sessionId) return Promise.resolve();
+    try {
+      await ensureOwnership();
+      ownership?.touch();
+      await reportEvent(
+        { event, agentType: "claude_code", agentName, action, sessionId, machineId, pid: process.pid },
+        { maxAttempts: event === "session_start" ? 4 : 2, timeoutMs: 4e3, requireOk: event === "session_start" }
+      );
+    } catch {
+    }
+  };
+  let presenceHeartbeat;
+  let transcriptStarted;
+  const ensureTranscriptSync = () => {
+    if (transcriptStarted === sessionId || !transcriptsEnabled() || !sessionId) return;
+    transcriptStarted = sessionId;
+    registerTranscript("claude", { session_id: sessionId, cwd: process.cwd() });
+  };
+  const ensurePresenceHeartbeat = () => {
+    if (presenceHeartbeat || !sessionId) return;
+    presenceHeartbeat = setInterval(
+      () => void announcePresence("heartbeat", "Session online"),
+      PRESENCE_HEARTBEAT_MS
+    );
+    presenceHeartbeat.unref();
+  };
+  const setSessionId = (id) => {
+    const isNew = sessionId !== id;
+    sessionId = id;
+    sessionCreated = true;
+    relay?.reannounce();
+    if (isNew) void announcePresence("session_start", "Remote session ready \u2014 reachable from your phone");
+    ensurePresenceHeartbeat();
+    ensureTranscriptSync();
+  };
+  const onPhoneCommand = async (command) => {
+    if (controlMode !== "remote") return false;
+    if (!sessionId || finished || !await ensureSdk() || !remoteAvailable) {
+      if (!noticedUnavailable) {
+        noticedUnavailable = true;
+        process.stderr.write("[pushary] phone control is unavailable this run; the instruction was not delivered.\n");
+      }
+      return false;
+    }
+    if (finished || !input.push(userMessage(command))) return false;
+    activeLeg?.onPhoneCommand();
+    return true;
+  };
+  let draft;
+  const streamMessage = (message) => {
+    draft?.add(message);
+    if (message.type === "assistant") {
+      const text = extractAssistantText(message);
+      if (text) process.stdout.write(`${text}
+`);
+    } else if (message.type === "result") {
+      if (typeof message.total_cost_usd === "number") totalCostUsd = message.total_cost_usd;
+      process.stderr.write("[pushary] turn complete \u2014 standing by for phone commands\n");
+      void announcePresence("stop", "Turn complete");
+    }
+  };
+  const declineTakeover = (reason, message) => {
+    takeoverDecline = reason;
+    process.stderr.write(`[pushary] ${message}
+`);
+  };
+  const takeOver = async () => {
+    if (controlMode !== "local" || takeoverPending || finished) return;
+    if (compatibilityIssue) {
+      declineTakeover("unsupported_flags", compatibilityIssue);
+      return;
+    }
+    takeoverPending = true;
+    try {
+      if (!sessionId || !existsSync2(claudeTranscriptPath(process.cwd(), sessionId))) {
+        declineTakeover("no_transcript", "phone takeover needs a turn in this session first; your terminal and queued instructions are unchanged.");
+        return;
+      }
+      if (!await ensureSdk()) {
+        declineTakeover("sdk_unavailable", "phone takeover could not start the Agent SDK; your terminal and queued instructions are unchanged.");
+        return;
+      }
+      if (!finished && controlMode === "local") activeLeg?.onPhoneCommand();
+    } finally {
+      takeoverPending = false;
+    }
+  };
+  const poller = startCommandPoller({
+    apiKey,
+    getSessionId: () => sessionId,
+    onCommand: (command) => onPhoneCommand(command),
+    shouldDrainCommands: () => controlMode === "remote" && Boolean(sessionId) && !(relay?.connected() ?? false),
+    // Unified poll: one request per tick for both command + mode/kill (half the
+    // requests and the per-poll DB write of the old drain + mode pair).
+    poll: async (key, id, wantCommand, signal) => {
+      const declined = takeoverDecline;
+      takeoverDecline = void 0;
+      const result = await pollAgent(key, id, wantCommand, signal, void 0, machineId, controlMode, declined);
+      if (result.takeoverRequested) void takeOver();
+      return result;
+    },
+    fetchModeState,
+    // Observe explicit takeover promptly even when the command queue is idle.
+    // Not faster than this: the poll runs for the life of every wrapper, including
+    // local mode where it cannot return a command, and each tick costs a handful
+    // of Redis round trips. Takeover already sits behind a confirm and a biometric.
+    slowPollMs: 15e3,
+    onAuthRejected: () => {
+      process.stderr.write(
+        "[pushary] this key was rejected \u2014 remote stop and phone messages are NOT active; run `pushary login` to reconnect\n"
+      );
+    },
+    onModeState: (state) => {
+      if (state.kill && !killed) {
+        killed = true;
+        finished = true;
+        process.stderr.write("[pushary] halted from Pushary \u2014 stopping the agent\n");
+        activeLeg?.stop("kill");
+      }
+    },
+    log: verboseLog
+  });
+  const signals = ["SIGINT", "SIGTERM", "SIGHUP"];
+  const onSignal = () => {
+    finished = true;
+    activeLeg?.stop("signal");
+  };
+  for (const signal of signals) process.on(signal, onSignal);
+  const restoreStdin = () => stdin.dispose();
+  process.once("exit", restoreStdin);
+  const session = {
+    apiKey,
+    machineId,
+    projectName,
+    agentName,
+    binary,
+    input,
+    approver,
+    stdin,
+    claudeArgs: args2,
+    permissionMode,
+    userManagesSession,
+    getSessionId: () => sessionId,
+    setSessionId,
+    isSessionCreated: () => sessionCreated,
+    markSessionCreated: () => {
+      sessionCreated = true;
+    },
+    relayConnected: () => relay?.connected() ?? false,
+    streamMessage,
+    setActiveLeg: (control) => {
+      activeLeg = control;
+    }
+  };
+  try {
+    if (sessionId && startingMode === "local") {
+      process.stderr.write(
+        "[pushary] phone messages queue for the next turn. Choose Continue on phone in the app for idle control (Ctrl-] returns the terminal).\n"
+      );
+      void announcePresence("session_start", "Session ready \u2014 reachable from your phone");
+      ensurePresenceHeartbeat();
+      ensureTranscriptSync();
+      void ensureSdk();
+    }
+    if (startingMode === "remote" && initialPrompt) input.push(userMessage(initialPrompt));
+    const exitCode = await driveModeLoop({
+      startingMode,
+      runLocal: async () => {
+        controlMode = "local";
+        await draft?.stop();
+        draft = void 0;
+        relay?.stop();
+        relay = void 0;
+        return runLocalLeg(session);
+      },
+      runRemote: async () => {
+        controlMode = "remote";
+        startRelay();
+        const ready = await ensureSdk();
+        if (!ready) {
+          remoteAvailable = false;
+          const dropped = input.clear();
+          if (!noticedUnavailable) {
+            noticedUnavailable = true;
+            process.stderr.write(
+              "[pushary] could not start phone control (offline?); staying in the terminal. Relaunch when online to enable.\n"
+            );
+          }
+          if (dropped > 0) {
+            process.stderr.write(
+              `[pushary] ${dropped} instruction(s) from your phone could not be delivered and were dropped.
+`
+            );
+          }
+          return "switch";
+        }
+        draft = startTranscriptDraft(apiKey, () => sessionId);
+        return runRemoteLeg(session, ready);
+      },
+      isFinished: () => finished,
+      minDwellMs: MIN_MODE_DWELL_MS
+    });
+    return { implemented: true, exitCode };
+  } finally {
+    for (const signal of signals) process.off(signal, onSignal);
+    process.removeListener("exit", restoreStdin);
+    await draft?.stop();
+    relay?.stop();
+    poller.stop();
+    if (presenceHeartbeat) clearInterval(presenceHeartbeat);
+    approver.teardown();
+    input.close();
+    stdin.dispose();
+    if (sessionId) registerTranscript("claude", { session_id: sessionId, cwd: process.cwd() }, void 0, { ended: true });
+    await announcePresence("session_closed", "Session ended");
+    ownership?.stop();
+    if (totalCostUsd > 0) {
+      process.stderr.write(`[pushary] session cost: $${totalCostUsd.toFixed(4)}
+`);
+    }
+  }
+};
+
+// src/wrapper/runClaudeWrapper.ts
+var hasPrintFlag = (args2) => args2.some((a) => a === "-p" || a === "--print" || a.startsWith("--print="));
+var isInteractiveTty = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
+var runClaudeWrapper = async (args2) => {
+  const binary = findClaudeBinary();
+  if (!binary) {
+    process.stderr.write(
+      "[pushary] Could not find the `claude` binary on your PATH. Install Claude Code, or set PUSHARY_CLAUDE_BIN to its full path.\n"
+    );
+    return 127;
+  }
+  const nested = process.env[WRAPPER_ACTIVE_ENV] === "1";
+  const { remote: wantRemote, rest } = extractRemoteFlag(args2);
+  const useDual = !nested && (wantRemote || isInteractiveTty() && !hasPrintFlag(rest));
+  if (useDual) {
+    try {
+      const result = await runDualMode(binary, rest, wantRemote ? "remote" : "local");
+      if (result.implemented) return result.exitCode ?? 0;
+    } catch {
+    }
+  }
+  return runLocalPassthrough(binary, rest);
+};
+
+// bin/pushary-claude.ts
+var args = resolveClaudeArgs(process.argv);
+var spawnId = process.env.PUSHARY_SPAWN_ID?.trim() || void 0;
+var code = await withSpawnProcessOwnership(spawnId, async () => {
+  await ensureDaemonRunning();
+  return runClaudeWrapper(args);
+}).catch((err) => {
+  process.stderr.write(
+    `[pushary] wrapper error: ${err instanceof Error ? err.message : String(err)}
+`
+  );
+  return 1;
+});
+process.exit(code);