pushary 1.8.0

package/dist/chunk-NQTHFF4W.js

@@ -0,0 +1,2830 @@
+// ../contracts/src/claude-connector.ts
+var CLAUDE_CONNECTOR_URL = "https://pushary.com/api/mcp/mcp";
+var CLAUDE_CONNECTOR_GUIDE = "https://pushary.com/docs/agents/guides/claude-desktop";
+var COWORK_CONNECTOR_LIMIT = "Pushary\u2019s Cowork connector is cooperative: Claude chooses when to ask. It does not intercept Claude\u2019s native permission prompts or start new Cowork tasks.";
+var CLAUDE_CONNECTOR_STEPS = [
+  "In Claude, open Customize > Connectors > Add custom connector and paste the Pushary connector URL.",
+  "Leave OAuth Client ID and Secret empty. Sign in with the same Pushary account used by your phone and Mac app.",
+  "Enable Pushary in the Chat or Cowork conversation. Approve access to its tools if Claude asks.",
+  "For proactive Cowork use, install the Pushary Cowork plugin/skill or paste the standing instructions into Settings > Cowork.",
+  "Ask Claude to send the test question below, answer it from Pushary, and confirm Claude receives your answer."
+];
+var CLAUDE_CONNECTOR_TEST = "Use Pushary ask_user to ask \u201CDid this setup question reach you?\u201D with type \u201Cconfirm\u201D. Use agentName \u201CClaude Cowork - Setup check\u201D in Cowork or \u201CClaude Chat - Setup check\u201D in Chat. Wait for my answer and tell me which answer you received. Do not run a command or change any files.";
+var COWORK_STANDING_INSTRUCTIONS = `Pushary is connected as a custom connector. Use it proactively to reach me on my phone or Mac notch.
+
+- When you need a decision or clarifying answer, call ask_user. Use type "confirm", "select", or "input" as appropriate. Ask once on one channel.
+- Before a risky or irreversible action outside my existing authorization, call ask_user with type "confirm" and wait for approval. Silence is never consent.
+- When a task finishes, call send_notification with context.type "task_complete" and a short summary. For an error you cannot resolve, use context.type "error"; use "info" for other updates.
+- Only keep a reply channel open when a specific unresolved decision is required: call send_notification with context.askQuestion, then poll the returned linkedCorrelationId with wait_for_answer. Do not ask for optional feedback just to keep a finished turn alive.
+- Follow handoffAction when present, otherwise nextAction. If ask_user times out on a live question, poll once with wait_for_answer. If still pending, cancel_question before asking in the current chat. If cancellation returns handoffAction "stop", stop. If cancellation returns false, poll once for 1 second and honor the answer that won the race. Expired, cancelled, missing, and unavailable questions are not new timeouts.
+- Pass agentName as "Claude Cowork - <task name>" on every call, and reuse one opaque sessionId per task so parallel tasks stay separate. Never include credentials in these identifiers.
+- Cancel a question when it is no longer needed. Once this turn ends, reopen Cowork for follow-up work; this connector cannot restart it.
+- If Pushary tools are missing or disabled, report that once and continue within my authorization. Do not claim a notification or approval was delivered.`;
+
+// ../contracts/src/agent-manifest.ts
+var AGENT_HOOKS_SETUP_COMMAND = "npx @pushary/agent-hooks@latest setup";
+var defaults = {
+  hasStoredIdentity: true,
+  hookSource: null,
+  policyAgent: null,
+  repoAware: false,
+  disconnectable: false,
+  managedProvider: false,
+  bridged: false,
+  enforcement: "cooperative",
+  connectVia: "Plain MCP",
+  setupCommand: null,
+  setupChoice: null,
+  setupGuide: "",
+  activationGuide: null,
+  enforcementDetail: "Cooperative. The agent chooses when to ask; no native permission interception.",
+  capabilityNote: "",
+  documented: true
+};
+var AGENTS = {
+  claude_code: {
+    ...defaults,
+    label: "Claude Code",
+    activationGuide: "/docs/agents/guides/claude-code#verify-a-real-approval",
+    hookSource: "claude",
+    bridged: true,
+    policyAgent: "claude_code",
+    repoAware: true,
+    disconnectable: true,
+    managedProvider: true,
+    enforcement: "enforced",
+    connectVia: "Native hooks + MCP",
+    setupCommand: AGENT_HOOKS_SETUP_COMMAND,
+    enforcementDetail: "Shell, writes and edits, subject to Claude Code permission mode and explicit policy."
+  },
+  claude_chat: {
+    ...defaults,
+    label: "Claude Chat",
+    connectVia: "Custom MCP connector",
+    setupGuide: "[Claude.ai and Claude Desktop setup](/docs/agents/guides/claude-desktop)"
+  },
+  claude_cowork: {
+    ...defaults,
+    label: "Claude Cowork",
+    connectVia: "Custom MCP connector + optional Cowork skill",
+    setupGuide: "[Cowork setup](/docs/agents/guides/claude-desktop#use-it-in-cowork)",
+    enforcementDetail: COWORK_CONNECTOR_LIMIT
+  },
+  codex: {
+    ...defaults,
+    label: "Codex",
+    hookSource: "codex",
+    bridged: true,
+    policyAgent: "codex",
+    repoAware: true,
+    disconnectable: true,
+    managedProvider: true,
+    enforcement: "enforced",
+    connectVia: "Native hooks + MCP",
+    setupCommand: AGENT_HOOKS_SETUP_COMMAND,
+    enforcementDetail: "Shell and apply_patch edits through native permission hooks; requires a compatible Codex runtime."
+  },
+  chatgpt: {
+    ...defaults,
+    label: "ChatGPT",
+    connectVia: "Custom MCP connector",
+    setupGuide: "[ChatGPT setup](/docs/agents/guides/chatgpt)"
+  },
+  gemini_cli: {
+    ...defaults,
+    label: "Gemini CLI",
+    hookSource: "gemini",
+    bridged: true,
+    policyAgent: "gemini_cli",
+    repoAware: true,
+    disconnectable: true,
+    managedProvider: true,
+    enforcement: "enforced",
+    connectVia: "Native hooks + MCP",
+    setupCommand: AGENT_HOOKS_SETUP_COMMAND,
+    enforcementDetail: "Shell, writes and edits through native BeforeTool hooks."
+  },
+  hermes: {
+    ...defaults,
+    label: "Hermes",
+    policyAgent: "hermes",
+    enforcement: "enforced",
+    connectVia: "Native Python plugin + approval transport",
+    setupCommand: AGENT_HOOKS_SETUP_COMMAND,
+    enforcementDetail: "Hermes dangerous-command approvals when the Pushary transport is selected; optional PUSHARY_GATE_TOOLS gates named tools.",
+    capabilityNote: "Uses the Python plugin, not a macOS bridge HookSource. CLI disconnect and managed-provider controls are not implemented for Hermes."
+  },
+  cursor: {
+    ...defaults,
+    label: "Cursor",
+    hookSource: "cursor",
+    bridged: true,
+    policyAgent: "cursor",
+    disconnectable: true,
+    enforcement: "enforced",
+    connectVia: "Editor plugin hooks + MCP",
+    setupCommand: AGENT_HOOKS_SETUP_COMMAND,
+    enforcementDetail: "With installed hooks: shell, MCP execution and Write/Delete/Edit tool calls. Plain MCP remains cooperative."
+  },
+  vscode: {
+    ...defaults,
+    label: "VS Code",
+    hookSource: "vscode",
+    bridged: true,
+    policyAgent: "vscode",
+    enforcement: "enforced",
+    connectVia: "Agent plugin hooks + MCP",
+    setupCommand: AGENT_HOOKS_SETUP_COMMAND,
+    enforcementDetail: "PreToolUse approval hooks from the installed agent plugin; the host decides which events it exposes.",
+    capabilityNote: "Has both a bridge HookSource and a per-agent policy profile. CLI disconnect and managed-provider controls are not implemented for VS Code."
+  },
+  opencode: {
+    ...defaults,
+    label: "OpenCode",
+    hookSource: "opencode",
+    bridged: true,
+    policyAgent: "opencode",
+    repoAware: true,
+    disconnectable: true,
+    enforcement: "enforced",
+    connectVia: "Generated plugin + MCP",
+    setupCommand: AGENT_HOOKS_SETUP_COMMAND,
+    enforcementDetail: "Shell, writes, edits and web fetches when OpenCode itself asks for permission."
+  },
+  fx: {
+    ...defaults,
+    label: "fx",
+    connectVia: "Local MCP bridge",
+    setupCommand: AGENT_HOOKS_SETUP_COMMAND,
+    capabilityNote: "fx has no hooks that other tools can register, so Pushary cannot answer fx's own approval prompts. Setup turns off fx's terminal question tool so fx's agent asks through Pushary. fx's full-access mode ignores that setting; there the agent is only instructed to ask through Pushary."
+  },
+  qwen_code: {
+    ...defaults,
+    label: "Qwen Code",
+    hookSource: "qwen",
+    bridged: true,
+    policyAgent: "qwen_code",
+    repoAware: true,
+    disconnectable: true,
+    enforcement: "enforced",
+    connectVia: "Native hooks + MCP",
+    setupCommand: AGENT_HOOKS_SETUP_COMMAND,
+    enforcementDetail: "Shell, writes and edits through native PreToolUse hooks, matched on Qwen's own tool names and their Claude-shaped aliases."
+  },
+  codebuddy: {
+    ...defaults,
+    label: "CodeBuddy",
+    hookSource: "codebuddy",
+    bridged: true,
+    policyAgent: "codebuddy",
+    repoAware: true,
+    disconnectable: true,
+    enforcement: "enforced",
+    connectVia: "Native hooks + MCP",
+    setupCommand: AGENT_HOOKS_SETUP_COMMAND,
+    enforcementDetail: "Shell, writes and edits through native PreToolUse hooks, plus PermissionRequest. CodeBuddy implements the Claude Code hook specification."
+  },
+  qoder: {
+    ...defaults,
+    label: "Qoder",
+    hookSource: "qoder",
+    bridged: true,
+    policyAgent: "qoder",
+    repoAware: true,
+    disconnectable: true,
+    enforcement: "enforced",
+    connectVia: "Native hooks + MCP",
+    setupCommand: AGENT_HOOKS_SETUP_COMMAND,
+    enforcementDetail: "Shell, writes and edits through native PreToolUse hooks, plus PermissionRequest, over Qoder's superset of the Claude Code event list.",
+    capabilityNote: "Qoder documents no user-level instructions file, so the proactive-ask block is not installed. Hooks and MCP are unaffected. Like every agent in this family, the CLI wires it; the macOS app does not yet."
+  },
+  droid: {
+    ...defaults,
+    label: "Droid",
+    hookSource: "droid",
+    bridged: true,
+    policyAgent: "droid",
+    repoAware: true,
+    disconnectable: true,
+    enforcement: "enforced",
+    connectVia: "Native hooks",
+    setupCommand: AGENT_HOOKS_SETUP_COMMAND,
+    enforcementDetail: "Execute, Create, Edit and ApplyPatch through native PreToolUse hooks in ~/.factory/hooks.json.",
+    capabilityNote: "Droid registers MCP servers through `droid mcp add` rather than a documented remote-server config shape, so setup writes hooks only. Add Pushary's MCP server yourself to let Droid send notifications and ask questions."
+  },
+  devin: {
+    ...defaults,
+    label: "Devin CLI",
+    hookSource: "devin",
+    bridged: true,
+    policyAgent: "devin",
+    repoAware: true,
+    disconnectable: true,
+    enforcement: "enforced",
+    connectVia: "Native hooks",
+    setupCommand: AGENT_HOOKS_SETUP_COMMAND,
+    enforcementDetail: "exec, write and edit through native PreToolUse hooks, answered in Devin's own approve/block schema.",
+    capabilityNote: "Devin CLI answers PreToolUse with `{decision}` rather than a permission decision. Pushary blocks an unanswered approval because this adapter cannot request a native prompt reliably. Question and plan dialogs remain with Devin; this adapter does not render their answers. It also fires no Notification event."
+  },
+  windsurf: {
+    ...defaults,
+    label: "Windsurf",
+    setupCommand: AGENT_HOOKS_SETUP_COMMAND,
+    setupChoice: "Other"
+  },
+  unknown: {
+    ...defaults,
+    label: "Agent",
+    documented: false
+  },
+  lovable: {
+    ...defaults,
+    label: "Lovable",
+    setupGuide: "[Lovable setup](/docs/agents/guides/lovable)"
+  },
+  mcp: {
+    ...defaults,
+    hasStoredIdentity: false,
+    label: "Any MCP client",
+    setupCommand: AGENT_HOOKS_SETUP_COMMAND,
+    setupChoice: "Other"
+  },
+  http: {
+    ...defaults,
+    hasStoredIdentity: false,
+    label: "No-code and HTTP",
+    connectVia: "REST with a Bearer token",
+    setupGuide: "[Connect any agent](/docs/agents/connect-any-agent)"
+  }
+};
+var HOOK_SOURCES = Object.freeze(Object.values(AGENTS).flatMap((agent) => agent.hookSource === null ? [] : [agent.hookSource]));
+var POLICY_AGENTS = [...Object.values(AGENTS).flatMap((agent) => agent.policyAgent === null ? [] : [agent.policyAgent]), "*"];
+var AGENT_LABELS_BY_TYPE = Object.fromEntries(
+  Object.entries(AGENTS).flatMap(([id, agent]) => agent.hasStoredIdentity ? [[id, agent.label]] : [])
+);
+var DISCONNECTABLE_AGENTS = Object.freeze(Object.values(AGENTS).flatMap((agent) => agent.disconnectable ? [agent.hookSource] : []));
+var REPO_AWARE_AGENTS = Object.freeze(Object.values(AGENTS).flatMap((agent) => agent.repoAware ? [agent.policyAgent] : []));
+var MANAGED_PROVIDERS = Object.freeze(Object.values(AGENTS).flatMap((agent) => agent.managedProvider ? [agent.hookSource] : []));
+var BRIDGE_HOOK_SOURCES = Object.freeze(Object.values(AGENTS).flatMap((agent) => agent.bridged ? [agent.hookSource] : []));
+
+// ../contracts/src/agent-wiring.ts
+var COMPATIBLE_AGENT_TYPES = ["qwen_code", "codebuddy", "qoder", "droid", "devin"];
+var CANONICAL_PATH_KEYS = ["file_path", "path", "notebook_path"];
+var CANONICAL_COMMAND_KEYS = ["command"];
+var SHELL_TOOLS = /* @__PURE__ */ new Set(["Bash", "PowerShell"]);
+var PATH_TOOLS = /* @__PURE__ */ new Set(["Write", "Edit", "MultiEdit", "NotebookEdit", "Read"]);
+var PHONE_ANSWERED_TOOLS = /* @__PURE__ */ new Set(["AskUserQuestion", "ExitPlanMode"]);
+var firstString = (record, keys) => {
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === "string" && value.length > 0) return value;
+  }
+  return void 0;
+};
+var canonicalToolName = (profile, toolName) => profile.toolAliases[toolName] ?? toolName;
+var toToolLookup = (profile, toolName, toolInput, resolvePath = (path) => path) => {
+  const tool = canonicalToolName(profile, toolName);
+  if (SHELL_TOOLS.has(tool)) {
+    const command = firstString(toolInput, [...profile.shellCommandKeys, ...CANONICAL_COMMAND_KEYS]);
+    if (!command) return { tool, input: toolInput, unreadable: true };
+    const context = Object.fromEntries(
+      profile.shellContextKeys.flatMap((key) => toolInput[key] === void 0 ? [] : [[key, toolInput[key]]])
+    );
+    return { tool, input: { command, ...context }, unreadable: false };
+  }
+  if (!PATH_TOOLS.has(tool)) return { tool, input: toolInput, unreadable: false };
+  const filePath = firstString(toolInput, [...profile.pathInputKeys, ...CANONICAL_PATH_KEYS]);
+  if (!filePath) return { tool, input: toolInput, unreadable: true };
+  return { tool, input: { ...toolInput, file_path: resolvePath(filePath) }, unreadable: false };
+};
+var renderPreToolUseVerdict = (profile, verdict) => {
+  if (profile.wire === "permission_decision") return verdict;
+  const { permissionDecision, permissionDecisionReason, updatedInput } = verdict.hookSpecificOutput;
+  if (permissionDecision === "ask") return { decision: "block", reason: permissionDecisionReason ?? "Pushary requires an explicit approval before this tool can run." };
+  if (updatedInput) return void 0;
+  const stop = verdict.continue === false ? { continue: false, ...verdict.stopReason ? { stopReason: verdict.stopReason } : {} } : {};
+  return {
+    decision: permissionDecision === "allow" ? "approve" : "block",
+    ...permissionDecisionReason ? { reason: permissionDecisionReason } : {},
+    ...stop
+  };
+};
+var CLAUDE_SHAPED_EVENTS = [
+  "PreToolUse",
+  "PostToolUse",
+  "Stop",
+  "UserPromptSubmit",
+  "Notification",
+  "SessionStart",
+  "SessionEnd",
+  "StopFailure",
+  "PermissionRequest",
+  "PermissionDenied",
+  "SubagentStart",
+  "SubagentStop",
+  "PreCompact",
+  "PostCompact",
+  "TeammateIdle",
+  "Elicitation"
+];
+var without = (...absent) => CLAUDE_SHAPED_EVENTS.filter((event) => !absent.includes(event));
+var QWEN_CODE = {
+  agentType: "qwen_code",
+  source: "qwen",
+  label: "Qwen Code",
+  binary: "qwen",
+  configFile: [".qwen", "settings.json"],
+  hooksKeyPath: ["hooks"],
+  toolAliases: {
+    run_shell_command: "Bash",
+    write_file: "Write",
+    edit: "Edit",
+    replace: "Edit",
+    read_file: "Read",
+    WriteFile: "Write",
+    ReadFile: "Read",
+    ask_user_question: "AskUserQuestion",
+    exit_plan_mode: "ExitPlanMode"
+  },
+  extraMatchers: ["mcp__.*"],
+  pathInputKeys: ["absolute_path"],
+  shellCommandKeys: [],
+  shellContextKeys: ["directory"],
+  events: without("TeammateIdle", "Elicitation", "PermissionDenied"),
+  wire: "permission_decision",
+  mcp: { shape: "gemini_http", file: [".qwen", "settings.json"], trusted: true },
+  instructions: { file: [".qwen", "QWEN.md"], label: "Qwen Code" },
+  permissionRuleFile: null
+};
+var CODEBUDDY = {
+  agentType: "codebuddy",
+  source: "codebuddy",
+  label: "CodeBuddy",
+  binary: "codebuddy",
+  configFile: [".codebuddy", "settings.json"],
+  hooksKeyPath: ["hooks"],
+  toolAliases: {},
+  extraMatchers: ["mcp__.*"],
+  pathInputKeys: [],
+  shellCommandKeys: [],
+  shellContextKeys: [],
+  events: without("Elicitation", "PermissionDenied"),
+  wire: "permission_decision",
+  mcp: { shape: "claude_http", file: [".codebuddy", ".mcp.json"], trusted: false },
+  instructions: { file: [".codebuddy", "CODEBUDDY.md"], label: "CodeBuddy" },
+  permissionRuleFile: [".codebuddy", "settings.json"]
+};
+var QODER = {
+  agentType: "qoder",
+  source: "qoder",
+  label: "Qoder",
+  binary: "qoder",
+  configFile: [".qoder", "settings.json"],
+  hooksKeyPath: ["hooks"],
+  toolAliases: {},
+  extraMatchers: ["mcp__.*"],
+  pathInputKeys: [],
+  shellCommandKeys: [],
+  shellContextKeys: [],
+  events: without("Elicitation", "PermissionDenied"),
+  wire: "permission_decision",
+  mcp: { shape: "claude_http", file: [".qoder", "settings.json"], trusted: true },
+  instructions: null,
+  permissionRuleFile: null
+};
+var DROID = {
+  agentType: "droid",
+  source: "droid",
+  label: "Droid",
+  binary: "droid",
+  configFile: [".factory", "hooks.json"],
+  hooksKeyPath: [],
+  toolAliases: {
+    Execute: "Bash",
+    Create: "Write",
+    ApplyPatch: "Edit",
+    FetchUrl: "WebFetch"
+  },
+  extraMatchers: ["mcp__.*"],
+  pathInputKeys: [],
+  shellCommandKeys: [],
+  shellContextKeys: [],
+  events: ["PreToolUse", "PostToolUse", "UserPromptSubmit", "Notification", "Stop", "SubagentStop", "PreCompact", "SessionStart", "SessionEnd"],
+  wire: "permission_decision",
+  mcp: null,
+  instructions: null,
+  permissionRuleFile: null
+};
+var DEVIN = {
+  agentType: "devin",
+  source: "devin",
+  label: "Devin CLI",
+  binary: "devin",
+  configFile: [".config", "devin", "config.json"],
+  hooksKeyPath: ["hooks"],
+  toolAliases: {
+    exec: "Bash",
+    write: "Write",
+    edit: "Edit",
+    apply_patch: "Edit",
+    notebook_edit: "NotebookEdit",
+    read: "Read",
+    webfetch: "WebFetch",
+    web_search: "WebSearch",
+    run_subagent: "Task"
+  },
+  extraMatchers: ["mcp__.*", "mcp_call_tool", "write_to_process"],
+  pathInputKeys: [],
+  shellCommandKeys: [],
+  shellContextKeys: [],
+  events: ["PreToolUse", "PostToolUse", "UserPromptSubmit", "Stop", "SessionStart", "SessionEnd"],
+  wire: "legacy_decision",
+  mcp: null,
+  instructions: null,
+  permissionRuleFile: null
+};
+var HOOK_COMPATIBLE_PROFILES = Object.freeze([QWEN_CODE, CODEBUDDY, QODER, DROID, DEVIN]);
+var hookCompatibleProfile = (agentType) => HOOK_COMPATIBLE_PROFILES.find((profile) => profile.agentType === agentType);
+var hookCompatibleProfileBySource = (source) => HOOK_COMPATIBLE_PROFILES.find((profile) => profile.source === source);
+var compatibleTargetFiles = (profile) => {
+  const seen = /* @__PURE__ */ new Map();
+  for (const file of [profile.configFile, profile.mcp?.file, profile.permissionRuleFile, profile.instructions?.file]) {
+    if (file) seen.set(file.join("/"), file);
+  }
+  return [...seen.values()];
+};
+
+// ../contracts/src/redaction.ts
+var CREDENTIAL_NAME = String.raw`(?:authorization|secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)["']?`;
+var CREDENTIAL_KEY = String.raw`${CREDENTIAL_NAME}\s*[=:]\s*`;
+var DISPLAYED_CREDENTIAL_KEY = String.raw`${CREDENTIAL_NAME}(?:[ \t]*:[ \t]*|[ \t]+=[ \t]*|=)`;
+var SHELL_INERT_UNIT = String.raw`(?:[A-Za-z0-9_\-./+=:@%^!#]|\\[^\s'"])`;
+var SHELL_INERT_SINGLE_QUOTED_UNIT = String.raw`[A-Za-z0-9_\-./+=:@%^!#\\]`;
+var SHELL_INERT_URL_PASSWORD_UNIT = String.raw`(?:[A-Za-z0-9_\-.+=:%^!#]|\\[^\s'"@/])`;
+var PEM_LINE_BREAK = String.raw`(?:\r?\n|(?:\\r)?\\n)`;
+var credentialAssignmentRule = (key, doubleQuoted, singleQuoted, bare) => ({
+  pattern: new RegExp(String.raw`(${key})(?:(")${doubleQuoted}|(')${singleQuoted}|(["']?)${bare})`, "gi"),
+  replacement: "$1$2$3$4[redacted]$2$3"
+});
+var DISPLAYED_SECRET_SHAPES = {
+  privateKeyBody: String.raw`${PEM_LINE_BREAK}?(?:(?:Proc-Type|DEK-Info): [A-Za-z0-9,-]+${PEM_LINE_BREAK})*(?:[A-Za-z0-9+/=\r\n]|\\[rn])*?`,
+  urlPassword: `${SHELL_INERT_URL_PASSWORD_UNIT}+`,
+  authorizationValue: `${SHELL_INERT_UNIT}+`,
+  credentialAssignment: credentialAssignmentRule(
+    DISPLAYED_CREDENTIAL_KEY,
+    `${SHELL_INERT_UNIT}*"`,
+    `${SHELL_INERT_SINGLE_QUOTED_UNIT}*'`,
+    `${SHELL_INERT_UNIT}+`
+  )
+};
+var CUT_OFF_SECRET_SHAPES = {
+  privateKeyBody: String.raw`[\s\S]*?`,
+  urlPassword: String.raw`[^\s@/]+`,
+  authorizationValue: String.raw`\S+`,
+  credentialAssignment: credentialAssignmentRule(
+    CREDENTIAL_KEY,
+    String.raw`(?:\\[\s\S]|[^"\\])*(?:"|\\?$)`,
+    "[^']*(?:'|$)",
+    String.raw`\S+`
+  )
+};
+var secretRedactionRules = (shapes) => [
+  { pattern: /\bpk_[A-Za-z0-9_]+\.[A-Za-z0-9_]+/g, replacement: "[redacted]" },
+  { pattern: new RegExp(String.raw`-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----${shapes.privateKeyBody}-----END[A-Z0-9 ]*PRIVATE KEY-----`, "g"), replacement: "[redacted key]" },
+  { pattern: /\bsk-[A-Za-z0-9_-]{16,}\b/g, replacement: "[redacted]" },
+  { pattern: /\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, replacement: "[redacted]" },
+  { pattern: /\bwhsec_[A-Za-z0-9]{16,}\b/g, replacement: "[redacted]" },
+  { pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, replacement: "[redacted]" },
+  { pattern: /\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, replacement: "[redacted]" },
+  { pattern: /\bglpat-[A-Za-z0-9_-]{20,}\b/g, replacement: "[redacted]" },
+  { pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, replacement: "[redacted]" },
+  { pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g, replacement: "[redacted]" },
+  { pattern: /\bAKIA[0-9A-Z]{16}\b/g, replacement: "[redacted]" },
+  { pattern: /\bnpm_[A-Za-z0-9]{36}\b/g, replacement: "[redacted]" },
+  { pattern: /\bxai-[A-Za-z0-9]{16,}\b/g, replacement: "[redacted]" },
+  { pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, replacement: "[redacted]" },
+  { pattern: new RegExp(String.raw`\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)${shapes.urlPassword}@`, "gi"), replacement: "$1[redacted]@" },
+  { pattern: /\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, replacement: "bearer [redacted]" },
+  { pattern: new RegExp(String.raw`\bauthorization:\s*${shapes.authorizationValue}`, "gi"), replacement: "authorization: [redacted]" },
+  shapes.credentialAssignment
+];
+var SECRET_REDACTION_RULES = secretRedactionRules(DISPLAYED_SECRET_SHAPES);
+var CUT_OFF_TEXT_REDACTION_RULES = secretRedactionRules(CUT_OFF_SECRET_SHAPES);
+var HIGH_ENTROPY_RULE = { pattern: /[A-Za-z0-9+/]{40,}={0,2}/g, replacement: "[redacted]" };
+var applyRedactionRules = (rules, text) => rules.reduce((acc, rule) => acc.replace(rule.pattern, rule.replacement), text);
+var redactSecrets = (text) => applyRedactionRules(SECRET_REDACTION_RULES, text);
+var redactSecretsFromContent = (text) => applyRedactionRules(CUT_OFF_TEXT_REDACTION_RULES, text);
+var redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE.pattern, HIGH_ENTROPY_RULE.replacement);
+
+// ../contracts/src/degraded.ts
+var DEGRADED_PREFIX = "[degraded]";
+var degradedPayload = (subsystem, report) => ({
+  subsystem,
+  reason: report.reason,
+  fallback: report.fallback,
+  ...report.siteId ? { siteId: report.siteId } : {},
+  ...report.sessionId ? { sessionId: report.sessionId } : {},
+  ...report.event ? { event: report.event } : {}
+});
+var degradedLine = (subsystem, report) => `${DEGRADED_PREFIX} ${JSON.stringify(degradedPayload(subsystem, report))}`;
+
+// ../contracts/src/setup-wire.ts
+var PAIR_TTL_SECONDS = 900;
+var SETUP_AGENT_CHOICES = [
+  "claude_code",
+  "codex",
+  "gemini_cli",
+  "hermes",
+  "cursor",
+  "vscode",
+  "opencode",
+  "fx",
+  ...COMPATIBLE_AGENT_TYPES,
+  "custom"
+];
+var SETUP_CONNECT_MODES = ["app", "browser", "web", "none"];
+var isSetupConnectMode = (value) => typeof value === "string" && SETUP_CONNECT_MODES.includes(value);
+
+// ../contracts/src/observability.ts
+var CLIENT_CONTEXT_HEADERS = {
+  surface: "x-pushary-surface",
+  clientVersion: "x-pushary-client-version",
+  machineId: "x-pushary-machine-id",
+  runId: "x-pushary-run-id",
+  platform: "x-pushary-platform"
+};
+var CLIENT_REPORT_PATH = "/api/agent/client-report";
+var CLIENT_VERSION_PATTERN = /^\d+(?:\.\d+){1,3}(?:[-+][0-9A-Za-z.-]+)?$/;
+var CONTEXT_ID_PATTERN = /^[A-Za-z0-9-]{8,64}$/;
+var PLATFORM_PATTERN = /^[a-z0-9_.-]{1,32}$/;
+var CONTEXT_VALUE_MAX_LENGTH = 64;
+var isClientVersion = (value) => typeof value === "string" && value.length <= CONTEXT_VALUE_MAX_LENGTH && CLIENT_VERSION_PATTERN.test(value);
+var isContextId = (value) => typeof value === "string" && CONTEXT_ID_PATTERN.test(value);
+var isClientPlatform = (value) => typeof value === "string" && PLATFORM_PATTERN.test(value);
+var clientContextHeaders = (source) => {
+  const headers = {
+    [CLIENT_CONTEXT_HEADERS.surface]: source.surface,
+    [CLIENT_CONTEXT_HEADERS.runId]: source.runId
+  };
+  if (isClientVersion(source.clientVersion)) headers[CLIENT_CONTEXT_HEADERS.clientVersion] = source.clientVersion;
+  if (isContextId(source.machineId)) headers[CLIENT_CONTEXT_HEADERS.machineId] = source.machineId;
+  if (isClientPlatform(source.platform)) headers[CLIENT_CONTEXT_HEADERS.platform] = source.platform;
+  return headers;
+};
+
+// ../contracts/src/index.ts
+var KEY_SCOPES = ["full_access", "agent", "connector", "bound"];
+var normalizeKeyScope = (value) => typeof value === "string" && KEY_SCOPES.includes(value) ? value : null;
+var APPROVAL_MODES = ["push_only", "terminal_only", "push_first", "notify_only"];
+var isApprovalMode = (value) => typeof value === "string" && APPROVAL_MODES.includes(value);
+var MAX_AGENT_QUESTIONS = 4;
+var parseAgentQuestion = (raw) => {
+  const q = raw;
+  if (!q || typeof q.question !== "string") return void 0;
+  const options = Array.isArray(q.options) ? q.options.flatMap((option) => {
+    if (!option || typeof option !== "object") return [];
+    const value = option;
+    if (typeof value.label !== "string" || value.label.length === 0) return [];
+    return [{
+      label: value.label,
+      ...typeof value.description === "string" ? { description: value.description } : {}
+    }];
+  }) : [];
+  if (options.length < 2) return void 0;
+  return {
+    question: q.question,
+    ...typeof q.header === "string" ? { header: q.header } : {},
+    multiSelect: q.multiSelect === true,
+    ...typeof q.allowOther === "boolean" ? { allowOther: q.allowOther } : {},
+    options
+  };
+};
+var parseAgentQuestions = (toolInput) => {
+  const questions = toolInput.questions;
+  if (!Array.isArray(questions) || questions.length === 0) return void 0;
+  if (questions.length > MAX_AGENT_QUESTIONS) return void 0;
+  const parsed = [];
+  for (const raw of questions) {
+    const one = parseAgentQuestion(raw);
+    if (!one || parsed.some((question) => question.question === one.question)) return void 0;
+    parsed.push(one);
+  }
+  return parsed;
+};
+var parseAgentQuestionAnswers = (questions, value) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  const answers = parsed;
+  if (Object.keys(answers).length !== questions.length) return null;
+  for (const question of questions) {
+    const answer = answers[question.question];
+    if (typeof answer !== "string" || answer.trim().length === 0) return null;
+    const labels = new Set(question.options.map((option) => option.label));
+    if (!question.multiSelect) {
+      if (question.allowOther === false && !labels.has(answer)) return null;
+      continue;
+    }
+    try {
+      const selected = JSON.parse(answer);
+      if (!Array.isArray(selected)) {
+        if (question.allowOther === false) return null;
+        continue;
+      }
+      if (selected.length === 0 || new Set(selected).size !== selected.length || !selected.every((label) => typeof label === "string" && labels.has(label))) return null;
+    } catch {
+      if (question.allowOther === false) return null;
+    }
+  }
+  return answers;
+};
+var INSTALL_SOURCES = [
+  /** `npx @pushary/agent-hooks@latest ...`, the documented one-liner. */
+  "npx",
+  /** A global or project npm install, invoked as `pushary`. */
+  "npm",
+  /** Claude Code plugin, from the marketplace. Detected via CLAUDE_PLUGIN_ROOT. */
+  "claude_plugin",
+  /** Cursor or VS Code plugin bundle. */
+  "editor_plugin",
+  /** Installed by the skills.sh wizard. */
+  "skills_sh",
+  /** An MCP client configured straight from the registry entry, no CLI involved. */
+  "mcp_registry",
+  /** One of the published framework adapters (ai-sdk, mastra, langgraph, ...). */
+  "framework_adapter",
+  /** The browser onboarding wizard. */
+  "dashboard",
+  /** The macOS app pairing a phone from its own onboarding. */
+  "mac_app",
+  /** The phone app's own sign-up, which provisions the agent site before any web step. */
+  "mobile_app",
+  /** The CLI's device-code sign-in page (`/cli/authorize`), which provisions a site before any web step. */
+  "cli_login",
+  /** Reported nothing, or reported something we do not recognise. */
+  "unknown"
+];
+var isInstallSource = (value) => typeof value === "string" && INSTALL_SOURCES.includes(value);
+var normalizeInstallSource = (value) => isInstallSource(value) ? value : "unknown";
+var HOOK_BUDGETS = {
+  claude: { budgetSeconds: 600, guardSeconds: 10 },
+  codex: { budgetSeconds: 180, guardSeconds: 10 },
+  gemini: { budgetSeconds: 180, guardSeconds: 10 },
+  // The Cursor gate is a dependency-free .mjs that cannot import this module; it
+  // mirrors these as MAX_BLOCK_MS (45s) inside its 60s failClosed budget.
+  cursor: { budgetSeconds: 60, guardSeconds: 15 },
+  vscode: { budgetSeconds: 60, guardSeconds: 15 },
+  // OpenCode kills nothing and waits forever: `Permission.ask` blocks on a
+  // `Deferred` with no deadline of its own, so this budget is ours to choose
+  // rather than one we are told. Chosen to match Claude Code, because what it
+  // bounds is how long the person's tool call sits unanswered before Pushary
+  // stops asking and hands it back to the terminal.
+  opencode: { budgetSeconds: 120, guardSeconds: 10 },
+  // The hook-compatible agents take a per-hook `timeout` in seconds exactly as
+  // Claude Code does, and `compatibleHookEvents` writes Claude's own numbers into
+  // their config, so what we may wait for is what we registered for.
+  qwen: { budgetSeconds: 600, guardSeconds: 10 },
+  codebuddy: { budgetSeconds: 600, guardSeconds: 10 },
+  qoder: { budgetSeconds: 600, guardSeconds: 10 },
+  droid: { budgetSeconds: 600, guardSeconds: 10 },
+  devin: { budgetSeconds: 600, guardSeconds: 10 }
+};
+var hookMaxWaitSeconds = (agent) => Math.max(HOOK_BUDGETS[agent].budgetSeconds - HOOK_BUDGETS[agent].guardSeconds, 1);
+var HOOK_HOLD_BUDGET_FLAG = "--hold-budget";
+var HOOK_HOLD_BUDGET_ENV = "PUSHARY_HOLD_BUDGET_SECONDS";
+var HOOK_BRIDGE_SOURCE_FLAG = "--source";
+var HOOK_HOLD_BUDGET_SECONDS = /^[1-9]\d{0,5}$/;
+var hookHoldBudgetSeconds = (text) => text !== void 0 && HOOK_HOLD_BUDGET_SECONDS.test(text) ? Number(text) : void 0;
+var hookHoldBudgetArgument = (seconds) => `${HOOK_HOLD_BUDGET_FLAG}=${seconds}`;
+var withHookHoldBudget = (command, holdBudgetSeconds) => holdBudgetSeconds === void 0 ? command : `${command} ${hookHoldBudgetArgument(holdBudgetSeconds)}`;
+var registeredHookHoldBudget = (args) => {
+  const prefix = `${HOOK_HOLD_BUDGET_FLAG}=`;
+  const proofs = args.filter((arg) => arg.startsWith(prefix));
+  return proofs.length === 1 ? hookHoldBudgetSeconds(proofs[0].slice(prefix.length)) : void 0;
+};
+var hookCommandHoldBudget = (command) => registeredHookHoldBudget(command.trim().split(/\s+/));
+var hookHoldBudgetProof = (args, env) => {
+  const handedDown = hookHoldBudgetSeconds(env[HOOK_HOLD_BUDGET_ENV]);
+  const registered = args.includes(HOOK_BRIDGE_SOURCE_FLAG) ? void 0 : registeredHookHoldBudget(args);
+  if (handedDown === void 0) return registered;
+  return registered === void 0 ? handedDown : Math.min(handedDown, registered);
+};
+var hookHoldWindowMs = (agent, holdBudgetSeconds) => holdBudgetSeconds === void 0 ? 0 : Math.max((Math.min(holdBudgetSeconds, HOOK_BUDGETS[agent].budgetSeconds) - HOOK_BUDGETS[agent].guardSeconds) * 1e3, 0);
+var hookWaitDeadline = (startMs, policyWaitSeconds, agent, nowMs) => {
+  const maxWait = hookMaxWaitSeconds(agent);
+  return Math.min(
+    nowMs + Math.min(Math.max(policyWaitSeconds, 0), maxWait) * 1e3,
+    startMs + maxWait * 1e3
+  );
+};
+var hookWaitClamped = (startMs, policyWaitSeconds, agent, nowMs) => startMs + hookMaxWaitSeconds(agent) * 1e3 < nowMs + Math.max(policyWaitSeconds, 0) * 1e3;
+var effectiveWaitSeconds = (timeoutAction, policySeconds, agent) => timeoutAction === "wait" ? hookMaxWaitSeconds(agent) : policySeconds;
+var OPENCODE_APPROVAL_EVENT = "permission.ask";
+var CURSOR_GATE_EVENTS = ["beforeShellExecution", "beforeMCPExecution", "preToolUse"];
+var SUPPORT_EMAIL = "business@pushary.com";
+var SUPPORT_DISCORD = "https://discord.gg/9v3VvUByrr";
+var HOOK_LOCATOR_BINARY = "pushary-bridge";
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var HOOK_BATCH_MAX_BYTES = 4 * 1024 * 1024;
+var REPO_KEY_MAX_LENGTH = 200;
+var WILDCARD_TOOL_PATTERN = "*";
+var isRepoKeyMatch = (ruleRepoKey, currentRepoKey) => {
+  if (!ruleRepoKey) return true;
+  return ruleRepoKey === currentRepoKey;
+};
+var SCP_LIKE_REMOTE = /^[A-Za-z0-9._-]+@([A-Za-z0-9._-]+):(.+)$/;
+var URL_LIKE_REMOTE = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/(.+)$/;
+var NUMERIC_PORT = /:\d+$/;
+var stripCredentials = (host) => {
+  const at = host.lastIndexOf("@");
+  return at === -1 ? host : host.slice(at + 1);
+};
+var normalizeRepoRemote = (remoteUrl) => {
+  const raw = remoteUrl.trim();
+  if (raw.length === 0) return void 0;
+  let hostAndPath;
+  const scp = SCP_LIKE_REMOTE.exec(raw);
+  if (scp) {
+    hostAndPath = `${scp[1]}/${scp[2]}`;
+  } else {
+    const url = URL_LIKE_REMOTE.exec(raw);
+    if (!url) return void 0;
+    if (/^file:/i.test(raw)) return void 0;
+    hostAndPath = url[1];
+  }
+  const slash = hostAndPath.indexOf("/");
+  if (slash <= 0) return void 0;
+  const host = stripCredentials(hostAndPath.slice(0, slash)).replace(NUMERIC_PORT, "");
+  const path = hostAndPath.slice(slash + 1).split("/").filter((segment) => segment.length > 0).join("/");
+  if (host.length === 0 || path.length === 0) return void 0;
+  const key = `${host}/${path}`.replace(/\.git$/i, "").toLowerCase();
+  return key.length > REPO_KEY_MAX_LENGTH ? key.slice(0, REPO_KEY_MAX_LENGTH) : key;
+};
+var localRepoKey = (directoryName) => {
+  const name = directoryName.trim().replace(/[/\\]+$/, "").toLowerCase();
+  if (name.length === 0 || name === "." || name === "..") return void 0;
+  const key = `local/${name}`;
+  return key.length > REPO_KEY_MAX_LENGTH ? key.slice(0, REPO_KEY_MAX_LENGTH) : key;
+};
+var MATCH_RANKS = ["none", "tool", "prefix", "exact"];
+var matchRankWeight = (rank) => MATCH_RANKS.indexOf(rank);
+var GLOB_MAX_WILDCARDS = 8;
+var GLOB_MAX_ARG_LENGTH = 4096;
+var GLOB_CACHE_MAX = 256;
+var tokenizeGlob = (glob) => {
+  let stars = 0;
+  for (const char of glob) if (char === "*") stars += 1;
+  if (stars > GLOB_MAX_WILDCARDS) return void 0;
+  const tokens = [];
+  let literal = "";
+  const flush = () => {
+    if (literal.length > 0) {
+      tokens.push({ kind: "literal", value: literal });
+      literal = "";
+    }
+  };
+  for (let i = 0; i < glob.length; i += 1) {
+    if (glob[i] !== "*") {
+      literal += glob[i];
+      continue;
+    }
+    flush();
+    if (glob[i + 1] === "*") {
+      tokens.push({ kind: "globstar" });
+      i += 1;
+      continue;
+    }
+    tokens.push({ kind: "star" });
+  }
+  flush();
+  return tokens;
+};
+var SLASH = "/".charCodeAt(0);
+var matchGlobTokens = (tokens, text) => {
+  const n = text.length;
+  let reachable = new Uint8Array(n + 1);
+  reachable[0] = 1;
+  for (const token of tokens) {
+    const next = new Uint8Array(n + 1);
+    if (token.kind === "literal") {
+      const { value } = token;
+      for (let p = 0; p <= n - value.length; p += 1) {
+        if (reachable[p] && text.startsWith(value, p)) next[p + value.length] = 1;
+      }
+    } else {
+      const spansSeparators = token.kind === "globstar";
+      let open = 0;
+      for (let p = 0; p <= n; p += 1) {
+        if (!spansSeparators && p > 0 && text.charCodeAt(p - 1) === SLASH) open = 0;
+        if (reachable[p]) open = 1;
+        if (open) next[p] = 1;
+      }
+    }
+    reachable = next;
+  }
+  return reachable[n] === 1;
+};
+var globCache = /* @__PURE__ */ new Map();
+var compiledGlob = (glob) => {
+  const cached = globCache.get(glob);
+  if (cached !== void 0 || globCache.has(glob)) return cached;
+  const compiled = tokenizeGlob(glob);
+  if (globCache.size >= GLOB_CACHE_MAX) globCache.clear();
+  globCache.set(glob, compiled);
+  return compiled;
+};
+var PATTERN_INTENT = {
+  grant: "grant",
+  restrict: "restrict"
+};
+var SHELL_ESCAPE = "\\";
+var SHELL_DOUBLE_QUOTE = '"';
+var SHELL_SUBSTITUTION_SIGIL = "$";
+var SHELL_GROUP_OPEN = "(";
+var SHELL_QUOTES = /* @__PURE__ */ new Set(["'", SHELL_DOUBLE_QUOTE]);
+var SHELL_SEGMENT_SEPARATORS = /* @__PURE__ */ new Set([";", "\n", "&", "|"]);
+var SHELL_DOUBLED_SEPARATORS = /* @__PURE__ */ new Set(["&", "|"]);
+var SHELL_UNDECOMPOSABLE = /* @__PURE__ */ new Set(["`", "<", ">"]);
+var shellCommandSegments = (command) => {
+  const segments = [];
+  let current = "";
+  let quote = null;
+  for (let index = 0; index < command.length; index += 1) {
+    const char = command[index];
+    const next = command[index + 1];
+    if (quote !== null) {
+      if (char === SHELL_ESCAPE && quote === SHELL_DOUBLE_QUOTE && next !== void 0) {
+        current += char + next;
+        index += 1;
+        continue;
+      }
+      if (quote === SHELL_DOUBLE_QUOTE && (char === "`" || char === SHELL_SUBSTITUTION_SIGIL && next === SHELL_GROUP_OPEN)) return null;
+      if (char === quote) quote = null;
+      current += char;
+      continue;
+    }
+    if (char === SHELL_ESCAPE && next !== void 0) {
+      current += char + next;
+      index += 1;
+      continue;
+    }
+    if (SHELL_QUOTES.has(char)) {
+      quote = char;
+      current += char;
+      continue;
+    }
+    if (SHELL_UNDECOMPOSABLE.has(char)) return null;
+    if (char === SHELL_SUBSTITUTION_SIGIL && next === SHELL_GROUP_OPEN) return null;
+    if (SHELL_SEGMENT_SEPARATORS.has(char)) {
+      if (next === char && SHELL_DOUBLED_SEPARATORS.has(char)) index += 1;
+      segments.push(current);
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  if (quote !== null) return null;
+  segments.push(current);
+  const present = segments.map((segment) => segment.trim()).filter((segment) => segment.length > 0);
+  return present.length > 0 ? present : null;
+};
+var everySegmentMatches = (command, matches) => {
+  const segments = shellCommandSegments(command);
+  return segments !== null && segments.every(matches);
+};
+var anySegmentMatches = (command, matches) => (shellCommandSegments(command) ?? [command]).some(matches);
+var shellSegmentsMatch = (command, intent, matches) => intent === PATTERN_INTENT.restrict ? anySegmentMatches(command, matches) : everySegmentMatches(command, matches);
+var rankWholeOrSegments = (toolName, arg, intent, matches) => {
+  const matched = toolName in POLICY_COMMAND_KEYS ? shellSegmentsMatch(arg, intent, matches) : matches(arg);
+  return matched ? "prefix" : "none";
+};
+var matchToolPattern = (pattern, toolName, arg, intent = PATTERN_INTENT.grant) => {
+  const open = pattern.indexOf("(");
+  if (open === -1 || !pattern.endsWith(")")) {
+    return pattern === toolName ? "tool" : "none";
+  }
+  if (pattern.slice(0, open) !== toolName || arg === void 0) return "none";
+  const inner = pattern.slice(open + 1, -1);
+  if (inner.endsWith(":*")) {
+    const prefix = inner.slice(0, -2);
+    return rankWholeOrSegments(toolName, arg, intent, (segment) => segment.startsWith(prefix));
+  }
+  if (inner.includes("*")) {
+    if (arg.length > GLOB_MAX_ARG_LENGTH) return "none";
+    const compiled = compiledGlob(inner);
+    if (!compiled) return "none";
+    return rankWholeOrSegments(toolName, arg, intent, (segment) => matchGlobTokens(compiled, segment));
+  }
+  return arg === inner ? "exact" : "none";
+};
+var POLICY_PATH_KEYS = {
+  Read: "file_path",
+  Edit: "file_path",
+  Write: "file_path",
+  MultiEdit: "file_path",
+  NotebookEdit: "notebook_path",
+  LS: "path"
+};
+var POLICY_COMMAND_KEYS = {
+  Bash: "command",
+  PowerShell: "command",
+  Monitor: "command"
+};
+var POLICY_ARG_KEYS = { ...POLICY_COMMAND_KEYS, ...POLICY_PATH_KEYS };
+var extractPolicyArg = (toolName, toolInput) => {
+  const key = POLICY_ARG_KEYS[toolName];
+  if (!key) return void 0;
+  const value = toolInput[key];
+  return typeof value === "string" ? value : void 0;
+};
+var normalizeSeparators = (value) => value.replace(/\\/g, "/");
+var isAbsolutePath = (value) => value.startsWith("/") || /^[A-Za-z]:\//.test(value);
+var relativeToCwd = (path, cwd) => {
+  const base = normalizeSeparators(cwd).replace(/\/+$/, "");
+  if (!base) return void 0;
+  const prefix = `${base}/`;
+  if (!path.startsWith(prefix)) return void 0;
+  const rest = path.slice(prefix.length);
+  return rest.length > 0 ? rest : void 0;
+};
+var policyArgForms = (toolName, toolInput, cwd) => {
+  const raw = extractPolicyArg(toolName, toolInput);
+  if (raw === void 0) return [];
+  if (!(toolName in POLICY_PATH_KEYS)) return [raw];
+  const forms = [raw];
+  const normalized = normalizeSeparators(raw);
+  if (normalized !== raw) forms.push(normalized);
+  if (cwd && isAbsolutePath(normalized)) {
+    const relative = relativeToCwd(normalized, cwd);
+    if (relative !== void 0) forms.push(relative);
+  }
+  return forms;
+};
+var matchToolPatternAny = (pattern, toolName, args, intent = PATTERN_INTENT.grant) => {
+  if (args.length === 0) return matchToolPattern(pattern, toolName);
+  let best = "none";
+  for (const arg of args) {
+    const rank = matchToolPattern(pattern, toolName, arg, intent);
+    if (matchRankWeight(rank) > matchRankWeight(best)) best = rank;
+  }
+  return best;
+};
+var SAFE_SHELL_COMMANDS = /* @__PURE__ */ new Set([
+  "ls",
+  "pwd",
+  "cd",
+  "cat",
+  "head",
+  "tail",
+  "wc",
+  "echo",
+  "printf",
+  "which",
+  "type",
+  "whoami",
+  "id",
+  "uname",
+  "arch",
+  "printenv",
+  "locale",
+  "tty",
+  "dirname",
+  "basename",
+  "realpath",
+  "readlink",
+  "stat",
+  "cut",
+  "nl",
+  "tr",
+  "comm",
+  "diff",
+  "cmp",
+  "grep",
+  "egrep",
+  "fgrep",
+  "jq",
+  "cksum",
+  "md5sum",
+  "sha1sum",
+  "sha256sum",
+  "du",
+  "df",
+  "ps",
+  "true"
+]);
+var SAFE_GIT_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "status",
+  "log",
+  "diff",
+  "show",
+  "rev-parse",
+  "describe",
+  "blame",
+  "shortlog",
+  "ls-files",
+  "ls-tree",
+  "cat-file",
+  "whatchanged",
+  "rev-list",
+  "name-rev",
+  "for-each-ref",
+  "var",
+  "count-objects"
+]);
+var GIT_WRITE_FLAGS = (token) => token === "--output" || token.startsWith("--output=");
+var DANGEROUS_FIND_ACTIONS = /* @__PURE__ */ new Set([
+  "-exec",
+  "-execdir",
+  "-ok",
+  "-okdir",
+  "-delete",
+  "-fprintf",
+  "-fprint",
+  "-fprint0",
+  "-fls"
+]);
+var SAFE_FIND_TOKENS = /* @__PURE__ */ new Set([
+  "-name",
+  "-iname",
+  "-path",
+  "-ipath",
+  "-wholename",
+  "-iwholename",
+  "-lname",
+  "-ilname",
+  "-regex",
+  "-iregex",
+  "-type",
+  "-xtype",
+  "-maxdepth",
+  "-mindepth",
+  "-depth",
+  "-mount",
+  "-xdev",
+  "-size",
+  "-empty",
+  "-perm",
+  "-readable",
+  "-writable",
+  "-executable",
+  "-mtime",
+  "-mmin",
+  "-atime",
+  "-amin",
+  "-ctime",
+  "-cmin",
+  "-newer",
+  "-newermt",
+  "-anewer",
+  "-cnewer",
+  "-user",
+  "-uid",
+  "-group",
+  "-gid",
+  "-nouser",
+  "-nogroup",
+  "-samefile",
+  "-inum",
+  "-links",
+  "-print",
+  "-print0",
+  "-printf",
+  "-ls",
+  "-quit",
+  "-prune",
+  "-follow",
+  "-noleaf",
+  "-ignore_readdir_race",
+  "-noignore_readdir_race",
+  "-true",
+  "-false",
+  "-not",
+  "-and",
+  "-or",
+  "-o",
+  "-a",
+  "-P",
+  "-L",
+  "-H",
+  "-D",
+  "-O"
+]);
+var SAFE_REDIRECTION = /\s*(?:[0-9]*>&[0-9-]+|(?:[0-9]*|&)>>?\s*\/dev\/null)/g;
+var basenameOf = (token) => {
+  const slash = Math.max(token.lastIndexOf("/"), token.lastIndexOf("\\"));
+  return slash === -1 ? token : token.slice(slash + 1);
+};
+var TRUSTED_EXE_PREFIXES = [
+  "/bin/",
+  "/sbin/",
+  "/usr/bin/",
+  "/usr/sbin/",
+  "/usr/local/bin/",
+  "/opt/homebrew/bin/"
+];
+var isTrustedExecutable = (first) => {
+  if (!first.includes("/")) return true;
+  if (first.includes("..")) return false;
+  return TRUSTED_EXE_PREFIXES.some((prefix) => first.startsWith(prefix));
+};
+var tokenizeShellCommand = (command) => {
+  const tokens = [];
+  let current = "";
+  let quote = null;
+  let started = false;
+  for (const ch of command) {
+    if (quote) {
+      if (ch === quote) quote = null;
+      else current += ch;
+      started = true;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      started = true;
+      continue;
+    }
+    if (ch === " " || ch === "	") {
+      if (started) {
+        tokens.push(current);
+        current = "";
+        started = false;
+      }
+      continue;
+    }
+    current += ch;
+    started = true;
+  }
+  if (quote) return null;
+  if (started) tokens.push(current);
+  return tokens;
+};
+var isSafeSimpleCommand = (segment) => {
+  const tokens = tokenizeShellCommand(segment.trim());
+  if (!tokens || tokens.length === 0) return false;
+  const first = tokens[0];
+  if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(first) || first.includes("$")) return false;
+  if (!isTrustedExecutable(first)) return false;
+  const exe = basenameOf(first);
+  if (exe === "git") {
+    const sub = tokens[1];
+    if (!sub || sub.startsWith("-")) return false;
+    if (!SAFE_GIT_SUBCOMMANDS.has(sub)) return false;
+    return !tokens.some(GIT_WRITE_FLAGS);
+  }
+  if (exe === "find") {
+    for (let i = 1; i < tokens.length; i += 1) {
+      const t = tokens[i];
+      if (t === "(" || t === ")" || t === "!" || t === "\\(" || t === "\\)" || t === "\\!") continue;
+      if (t.startsWith("-") && (DANGEROUS_FIND_ACTIONS.has(t) || !SAFE_FIND_TOKENS.has(t))) return false;
+    }
+    return true;
+  }
+  return SAFE_SHELL_COMMANDS.has(exe);
+};
+var isSafeReadOnlyCommand = (command) => {
+  const trimmed = command.trim();
+  if (!trimmed || trimmed.length > 2e3) return false;
+  if (/[`\n\r{}]/.test(trimmed)) return false;
+  if (/;|\|\|/.test(trimmed)) return false;
+  if (/\\(?![()!])/.test(trimmed)) return false;
+  if (/(?<!\\)[()]/.test(trimmed)) return false;
+  const noRedir = trimmed.replace(SAFE_REDIRECTION, " ");
+  if (/[<>]/.test(noRedir)) return false;
+  if (noRedir.replace(/&&/g, "  ").includes("&")) return false;
+  for (const andPart of noRedir.split("&&")) {
+    if (!andPart.trim()) return false;
+    for (const segment of andPart.split("|")) {
+      if (!isSafeSimpleCommand(segment)) return false;
+    }
+  }
+  return true;
+};
+var isAutoApprove = (policy) => policy.timeoutSeconds === 0 && policy.timeoutAction === "approve";
+var isAutoDeny = (policy) => policy.timeoutSeconds === 0 && policy.timeoutAction === "deny";
+var verdictForPolicy = (policy) => {
+  if (isAutoDeny(policy)) return "deny";
+  if (isAutoApprove(policy)) return "allow";
+  return "requires_human";
+};
+var policyIntent = (policy) => isAutoApprove(policy) ? PATTERN_INTENT.grant : PATTERN_INTENT.restrict;
+var selectGoverningRule = (policies, toolName, args, repoKey, sessionId) => {
+  let best;
+  let bestWeight = 0;
+  let bestScoped = -1;
+  let bestLength = -1;
+  for (const candidate of policies) {
+    if (!isRepoKeyMatch(candidate.repoKey, repoKey)) continue;
+    if (candidate.sessionId && candidate.sessionId !== sessionId) continue;
+    const rank = matchToolPatternAny(candidate.tool, toolName, args, policyIntent(candidate));
+    if (rank === "none") continue;
+    const weight = matchRankWeight(rank);
+    const scoped = candidate.sessionId ? 2 : candidate.repoKey ? 1 : 0;
+    const length = rank === "prefix" ? candidate.tool.length : -1;
+    const better = weight > bestWeight || weight === bestWeight && scoped > bestScoped || weight === bestWeight && scoped === bestScoped && length > bestLength;
+    if (better) {
+      best = { policy: candidate, rank };
+      bestWeight = weight;
+      bestScoped = scoped;
+      bestLength = length;
+    }
+  }
+  return best;
+};
+var ARG_PREFIX_TARGET_TOOLS = Object.keys(POLICY_COMMAND_KEYS);
+var FILE_TARGET_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit"]);
+var isCoveredByPolicy = (policyPatterns, toolName, toolTarget) => {
+  const candidateWeight = matchRankWeight(toolTarget ? "prefix" : "tool");
+  return policyPatterns.some(
+    (pattern) => matchRankWeight(matchToolPattern(pattern, toolName, toolTarget ?? void 0, PATTERN_INTENT.restrict)) >= candidateWeight
+  );
+};
+var COMMAND_RUNNERS = /* @__PURE__ */ new Set([
+  "sh",
+  "bash",
+  "zsh",
+  "dash",
+  "ksh",
+  "fish",
+  "csh",
+  "tcsh",
+  "eval",
+  "exec",
+  "source",
+  ".",
+  "command",
+  "builtin",
+  "env",
+  "xargs",
+  "nohup",
+  "time",
+  "nice",
+  "timeout",
+  "watch",
+  "parallel",
+  "script",
+  "su",
+  "doas",
+  "npx",
+  "bunx",
+  "pnpx",
+  "uvx"
+]);
+var INLINE_CODE_INTERPRETERS = /* @__PURE__ */ new Set([
+  "python",
+  "python2",
+  "python3",
+  "node",
+  "deno",
+  "ruby",
+  "perl",
+  "php",
+  "lua",
+  "osascript",
+  "pwsh",
+  "powershell"
+]);
+var INLINE_CODE_LONG_FLAG = /^-{1,2}(?:eval|print|require|import|command|encodedcommand|enc|ec)(?:=|$)/i;
+var INLINE_CODE_SHORT_FLAG_LETTERS = /* @__PURE__ */ new Set(["c", "e", "E", "p", "r"]);
+var SHORT_FLAG_CLUSTER = /^-([A-Za-z]+)/;
+var INLINE_CODE_SUBCOMMAND = "eval";
+var STANDARD_INPUT_ARGUMENT = "-";
+var DESTRUCTIVE_ARGUMENTS_BY_COMMAND = /* @__PURE__ */ new Map([
+  ["find", /* @__PURE__ */ new Set(["-delete", "-exec", "-execdir", "-ok", "-okdir"])],
+  ["rsync", /* @__PURE__ */ new Set([
+    "--del",
+    "--delete",
+    "--delete-before",
+    "--delete-during",
+    "--delete-delay",
+    "--delete-after",
+    "--delete-excluded",
+    "--delete-missing-args",
+    "--remove-source-files",
+    "--remove-sent-files"
+  ])],
+  ["git checkout", /* @__PURE__ */ new Set(["-f", "--force", "--", "-B"])],
+  ["git switch", /* @__PURE__ */ new Set(["-f", "--force", "--discard-changes", "-C", "--force-create"])],
+  ["git branch", /* @__PURE__ */ new Set(["-f", "--force", "-D", "-M", "-C"])]
+]);
+var DESTRUCTIVE_WORDS_IN_ANY_CASE_BY_COMMAND = /* @__PURE__ */ new Map([
+  ["redis-cli", /* @__PURE__ */ new Set(["flushall", "flushdb"])]
+]);
+var namesDestructiveWordInAnyCase = (name, texts) => {
+  const words = DESTRUCTIVE_WORDS_IN_ANY_CASE_BY_COMMAND.get(name);
+  return words !== void 0 && texts.some((text) => words.has(text.toLowerCase()));
+};
+var LONG_OPTION = /^--[A-Za-z]/;
+var namesDestructiveArgument = (text, destructiveArguments) => destructiveArguments.has(text) || LONG_OPTION.test(text) && [...destructiveArguments].some((argument) => argument.startsWith(text)) || [...SHORT_FLAG_CLUSTER.exec(text)?.[1] ?? ""].some((letter) => destructiveArguments.has(`-${letter}`));
+var RUNNER_SUBCOMMANDS = /* @__PURE__ */ new Set(["exec", "dlx"]);
+var SUBCOMMAND_CLIS = /* @__PURE__ */ new Set([
+  "git",
+  "docker",
+  "podman",
+  "kubectl",
+  "helm",
+  "terraform",
+  "npm",
+  "pnpm",
+  "yarn",
+  "bun",
+  "cargo",
+  "pip",
+  "brew",
+  "gh",
+  "glab",
+  "aws",
+  "gcloud",
+  "gsutil",
+  "az",
+  "doctl",
+  "firebase",
+  "vercel",
+  "netlify",
+  "fly",
+  "flyctl",
+  "heroku",
+  "supabase",
+  "wrangler",
+  "railway"
+]);
+var DESTRUCTIVE_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "delete",
+  "destroy",
+  "remove",
+  "rm",
+  "rb",
+  "rmi",
+  "purge",
+  "prune",
+  "drop",
+  "terminate",
+  "uninstall",
+  "wipe",
+  "reset"
+]);
+var DATA_LOSS_COMMAND_PATTERNS = [
+  "Bash(git branch -D:*)",
+  "Bash(git branch --delete:*)",
+  "Bash(git checkout:*)",
+  "Bash(git restore:*)",
+  "Bash(git stash drop:*)",
+  "Bash(git stash clear:*)",
+  "Bash(git filter-branch:*)",
+  "Bash(git update-ref -d:*)",
+  "Bash(dd :*)",
+  "Bash(shred:*)",
+  "Bash(unlink:*)",
+  "Bash(crontab:*)",
+  "Bash(chmod -R:*)",
+  "Bash(chown -R:*)",
+  "Bash(kill:*)",
+  "Bash(pkill:*)",
+  "Bash(killall:*)",
+  "Bash(launchctl:*)",
+  "Bash(systemctl:*)",
+  "Bash(diskutil:*)"
+];
+var SHELL_ENV_ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+var PLAIN_PROGRAM_WORD = /^[A-Za-z0-9_./+@:-]+$/;
+var SHELL_RESERVED_WORDS = /* @__PURE__ */ new Set([
+  "if",
+  "then",
+  "elif",
+  "else",
+  "fi",
+  "case",
+  "esac",
+  "for",
+  "select",
+  "while",
+  "until",
+  "do",
+  "done",
+  "function",
+  "coproc",
+  "!",
+  "{",
+  "}",
+  "[[",
+  "]]"
+]);
+var HARMLESS_GLOBAL_FLAGS = /* @__PURE__ */ new Set(["--no-pager", "--version", "-v", "-V", "--help", "-h"]);
+var END_OF_OPTIONS = "--";
+var SUBCOMMAND_DEPTH = 3;
+var SHELL_COMMENT_MARK = "#";
+var SHELL_LINE_CONTINUATION = /\\\n/g;
+var SHELL_WORD_BREAK = /\s/;
+var DOUBLE_QUOTE_ESCAPABLE = /* @__PURE__ */ new Set([SHELL_DOUBLE_QUOTE, SHELL_ESCAPE, SHELL_SUBSTITUTION_SIGIL, "`"]);
+var shellWordsOf = (segment) => {
+  const words = [];
+  let text = "";
+  let plain = true;
+  let expands = false;
+  let comment = false;
+  let started = false;
+  let quote = null;
+  const finishWord = () => {
+    if (started) words.push({ text, plain, expands, comment });
+    text = "";
+    plain = true;
+    expands = false;
+    comment = false;
+    started = false;
+  };
+  for (let index = 0; index < segment.length; index += 1) {
+    const char = segment[index];
+    const next = segment[index + 1];
+    if (quote === "'") {
+      if (char === quote) quote = null;
+      else text += char;
+      continue;
+    }
+    if (char === SHELL_ESCAPE && next !== void 0 && (quote === null || DOUBLE_QUOTE_ESCAPABLE.has(next))) {
+      text += next;
+      plain = false;
+      started = true;
+      index += 1;
+      continue;
+    }
+    if (quote === SHELL_DOUBLE_QUOTE) {
+      if (char === quote) quote = null;
+      else text += char;
+      expands ||= char === SHELL_SUBSTITUTION_SIGIL;
+      continue;
+    }
+    if (SHELL_QUOTES.has(char)) {
+      quote = char;
+      plain = false;
+      started = true;
+      continue;
+    }
+    if (SHELL_WORD_BREAK.test(char)) {
+      finishWord();
+      continue;
+    }
+    comment ||= !started && char === SHELL_COMMENT_MARK;
+    expands ||= char === SHELL_SUBSTITUTION_SIGIL;
+    text += char;
+    started = true;
+  }
+  finishWord();
+  return words;
+};
+var invocationOf = (segment) => {
+  const [program, ...args] = shellWordsOf(segment);
+  return { program, args };
+};
+var argsAfterHarmlessGlobalFlags = (args) => {
+  const firstMeaningful = args.findIndex((arg) => !HARMLESS_GLOBAL_FLAGS.has(arg.text));
+  return firstMeaningful === -1 ? [] : args.slice(firstMeaningful);
+};
+var subcommandWordsOf = (args) => {
+  const endOfOptions = args.findIndex((arg) => arg.text === END_OF_OPTIONS);
+  const options = endOfOptions === -1 ? args : args.slice(0, endOfOptions);
+  return options.filter((arg) => !arg.text.startsWith("-")).slice(0, SUBCOMMAND_DEPTH);
+};
+var passesInlineCode = (arg) => {
+  if (arg === INLINE_CODE_SUBCOMMAND || arg === STANDARD_INPUT_ARGUMENT || INLINE_CODE_LONG_FLAG.test(arg)) return true;
+  if (arg.startsWith(END_OF_OPTIONS)) return false;
+  const cluster = SHORT_FLAG_CLUSTER.exec(arg)?.[1] ?? "";
+  return [...cluster].some((letter) => INLINE_CODE_SHORT_FLAG_LETTERS.has(letter));
+};
+var interpreterRunsUnreadableCode = (args) => args.some(passesInlineCode) || args.every((arg) => arg.startsWith("-"));
+var programHidesItsEffect = (program) => SHELL_RESERVED_WORDS.has(program.text) || !program.plain || program.expands || SHELL_ENV_ASSIGNMENT.test(program.text) || !PLAIN_PROGRAM_WORD.test(program.text) || COMMAND_RUNNERS.has(basenameOf(program.text));
+var destructiveArgumentsOf = (name, args) => DESTRUCTIVE_ARGUMENTS_BY_COMMAND.get(name) ?? DESTRUCTIVE_ARGUMENTS_BY_COMMAND.get(`${name} ${subcommandWordsOf(argsAfterHarmlessGlobalFlags(args))[0]?.text ?? ""}`);
+var argumentsHideTheEffect = (name, args) => {
+  const texts = args.map((arg) => arg.text);
+  if (INLINE_CODE_INTERPRETERS.has(name.replace(/\d+(?:\.\d+)*$/, "")) && interpreterRunsUnreadableCode(texts)) return true;
+  const destructiveArguments = destructiveArgumentsOf(name, args);
+  if (destructiveArguments && texts.some((text) => namesDestructiveArgument(text, destructiveArguments))) return true;
+  if (namesDestructiveWordInAnyCase(name, texts)) return true;
+  if (!SUBCOMMAND_CLIS.has(name)) return false;
+  const meaningful = argsAfterHarmlessGlobalFlags(args);
+  return (meaningful[0]?.text.startsWith("-") ?? false) || subcommandWordsOf(meaningful).some((word) => word.expands || RUNNER_SUBCOMMANDS.has(word.text));
+};
+var invocationHidesItsEffect = ({ program, args }) => program !== void 0 && ([program, ...args].some((word) => word.comment) || programHidesItsEffect(program) || argumentsHideTheEffect(basenameOf(program.text), args));
+var readableCommandSegments = (command) => shellCommandSegments(command.replace(SHELL_LINE_CONTINUATION, "").replace(SAFE_REDIRECTION, ""));
+var normalizedInvocation = ({ program, args }) => {
+  if (program === void 0) return "";
+  const name = basenameOf(program.text);
+  const kept = SUBCOMMAND_CLIS.has(name) ? argsAfterHarmlessGlobalFlags(args) : args;
+  return [name, ...kept.map((arg) => arg.text)].join(" ");
+};
+var normalizedCommand = (command) => {
+  const segments = readableCommandSegments(command);
+  return segments === null ? null : segments.map((segment) => normalizedInvocation(invocationOf(segment))).join("; ");
+};
+var subcommandDestroys = ({ program, args }) => program !== void 0 && SUBCOMMAND_CLIS.has(basenameOf(program.text)) && subcommandWordsOf(argsAfterHarmlessGlobalFlags(args)).some((word) => DESTRUCTIVE_SUBCOMMANDS.has(word.text));
+var segmentNeedsAPerson = (toolName, segment) => {
+  const invocation = invocationOf(segment);
+  const normalized = normalizedInvocation(invocation);
+  return invocationHidesItsEffect(invocation) || subcommandDestroys(invocation) || classifyDecisionRisk(toolName, normalized) !== "standard" || isCoveredByPolicy(CAPABILITY_PATTERNS.destructive, toolName, normalized) || isCoveredByPolicy(CAPABILITY_PATTERNS.network, toolName, normalized) || isCoveredByPolicy(DATA_LOSS_COMMAND_PATTERNS, toolName, normalized);
+};
+var commandNeedsAPerson = (toolName, command) => {
+  const segments = readableCommandSegments(command);
+  return segments === null || classifyDecisionRisk(toolName, command) !== "standard" || segments.some((segment) => segmentNeedsAPerson(toolName, segment));
+};
+var withoutSessionToolGrants = (config) => ({
+  ...config,
+  policies: config.policies.filter((policy) => !isSessionToolGrant(policy))
+});
+var SESSION_TOOL_GRANT_TOOLS = /* @__PURE__ */ new Set(["Bash"]);
+var isSessionToolGrant = (policy) => Boolean(policy.sessionId) && SESSION_TOOL_GRANT_TOOLS.has(policy.tool) && isAutoApprove(policy);
+var API_KEY_PATTERN = /^pk_[a-f0-9]+\.[a-f0-9]+$/;
+var isValidApiKey = (value) => API_KEY_PATTERN.test(value);
+var ACTION_BODY_MAX = 4e3;
+var DECISION_LINE_MAX = 500;
+var ASK_QUESTION_MAX = 500;
+var ASK_AGENT_NAME_MAX = 100;
+var TRUNCATION_MARK = "\u2026";
+var isHighSurrogate = (code) => code >= 55296 && code <= 56319;
+var truncateLine = (text, max, mark = TRUNCATION_MARK) => {
+  if (text.length <= max) return text;
+  const end = max - mark.length;
+  const keep = isHighSurrogate(text.charCodeAt(end - 1)) ? end - 1 : end;
+  return `${text.slice(0, keep)}${mark}`;
+};
+var APPROVAL_FATIGUE_FLAG_PATTERNS = [
+  /\brm\s+-[a-z]*r/i,
+  /\brmdir\b/i,
+  /git\s+push[^\n]*(--force|--force-with-lease|\s-f\b)/i,
+  /git\s+reset\s+--hard/i,
+  /git\s+clean\s+-[a-z]*f/i,
+  /\bdrop\s+(table|database|schema)\b/i,
+  /\bdelete\s+from\b/i,
+  /\btruncate\b/i,
+  /\b(deploy|publish|release)\b/i,
+  /\bnpm\s+publish\b/i,
+  /\bsudo\b/i,
+  /chmod\s+-?R?\s*777/i,
+  /\bkubectl\s+delete\b/i,
+  /\bterraform\s+(apply|destroy)\b/i,
+  /\bdocker\s+system\s+prune\b/i
+];
+var DELTA_STOPWORDS = /* @__PURE__ */ new Set([
+  "the",
+  "a",
+  "an",
+  "to",
+  "of",
+  "for",
+  "and",
+  "is",
+  "in",
+  "on",
+  "with"
+]);
+var HIGH_CONSEQUENCE_PATTERNS = [
+  /(^|[\\/])\.env(\.|$|[\\/])/i,
+  /secrets?/i,
+  /credentials?/i,
+  /(^|[\\/])deploy/i,
+  /\.github[\\/]workflows/i,
+  /package\.json/i
+];
+var isCommandTool = (toolName) => {
+  const name = (toolName ?? "").toLowerCase();
+  return name === "bash" || name === "shell" || name === "run_shell_command" || name === "apply_patch" || name.includes("command");
+};
+var normalizeTarget = (toolName, toolTarget, actionBody) => {
+  const command = isCommandTool(toolName);
+  const target = toolTarget ?? "";
+  const body = actionBody ?? "";
+  const commandText = command ? body.length > 0 ? body : target : `${target}
+${body}`;
+  const path = command ? "" : target;
+  const scanText = command ? commandText : `${path}
+${body}`;
+  const highConsequence = HIGH_CONSEQUENCE_PATTERNS.some((re) => re.test(scanText));
+  return { isCommand: command, commandText, path, highConsequence };
+};
+var isDestructive = (toolName, commandText) => {
+  const haystack = `${toolName ?? ""}
+${commandText}`;
+  return APPROVAL_FATIGUE_FLAG_PATTERNS.some((re) => re.test(haystack));
+};
+var addAlnumTokens = (source, set) => {
+  for (const raw of source.toLowerCase().split(/[^a-z0-9]+/)) {
+    if (raw) set.add(raw);
+  }
+};
+var tokenize = (text) => {
+  const set = /* @__PURE__ */ new Set();
+  for (const raw of text.toLowerCase().split(/[^a-z0-9]+/)) {
+    if (raw && !DELTA_STOPWORDS.has(raw)) set.add(raw);
+  }
+  return set;
+};
+var targetTokenSet = (target) => {
+  const set = /* @__PURE__ */ new Set();
+  if (target.isCommand) {
+    const parts = target.commandText.trim().split(/\s+/).filter(Boolean);
+    if (parts[0]) addAlnumTokens(basenameOf(parts[0]), set);
+    if (parts[1]) addAlnumTokens(basenameOf(parts[1]), set);
+  } else {
+    addAlnumTokens(target.path, set);
+  }
+  return set;
+};
+var intersectionSize = (a, b) => {
+  const [small, large] = a.size <= b.size ? [a, b] : [b, a];
+  let count = 0;
+  for (const token of small) if (large.has(token)) count += 1;
+  return count;
+};
+var computeDeltaSignal = (input) => {
+  const target = normalizeTarget(input.toolName, input.toolTarget, input.actionBody);
+  const destructive = isDestructive(input.toolName, target.commandText);
+  if (!input.intent || input.intent.trim().length === 0) {
+    return { deltaSignal: "unclear", deltaScore: 0, remoteApprove: !destructive };
+  }
+  const intentTokens = tokenize(input.intent);
+  const targetTokens = targetTokenSet(target);
+  const overlap = intersectionSize(intentTokens, targetTokens);
+  const zeroOverlap = overlap === 0 && targetTokens.size > 0;
+  if (zeroOverlap && (destructive || target.highConsequence)) {
+    return { deltaSignal: "mismatch", deltaScore: 1, remoteApprove: false };
+  }
+  if (zeroOverlap) {
+    return { deltaSignal: "unclear", deltaScore: 0.5, remoteApprove: true };
+  }
+  return { deltaSignal: "match", deltaScore: 0, remoteApprove: !destructive };
+};
+var AUTHORIZATION_CANONICAL_VERSION = "pushary.authz.v1";
+var AUTHORIZATION_CANONICAL_FIXTURE = [
+  {
+    subject: { toolName: "refund.create" },
+    canonical: `${AUTHORIZATION_CANONICAL_VERSION}
+action:13:refund.create
+target:0:
+actor:0:
+environment:0:
+externalId:0:`
+  },
+  {
+    subject: {
+      toolName: "refund.create",
+      toolTarget: "ord_991",
+      actor: "user:u_44",
+      environment: "production",
+      externalId: "cust_7",
+      parameters: { currency: "EUR", amount: 4800, expedited: true, rate: 1.5 }
+    },
+    canonical: `${AUTHORIZATION_CANONICAL_VERSION}
+action:13:refund.create
+target:7:ord_991
+actor:9:user:u_44
+environment:10:production
+externalId:6:cust_7
+p:13:amount=n:4800
+p:14:currency=s:EUR
+p:16:expedited=b:true
+p:10:rate=n:1.5`
+  },
+  {
+    // Parameter order is not part of the subject. The same facts written in a
+    // different order are the same authorization.
+    subject: { toolName: "refund.create", parameters: { b: 2, a: 1 } },
+    canonical: `${AUTHORIZATION_CANONICAL_VERSION}
+action:13:refund.create
+target:0:
+actor:0:
+environment:0:
+externalId:0:
+p:5:a=n:1
+p:5:b=n:2`
+  },
+  {
+    // An integral float is the same number as the integer.
+    subject: { toolName: "a", parameters: { n: 49 } },
+    canonical: `${AUTHORIZATION_CANONICAL_VERSION}
+action:1:a
+target:0:
+actor:0:
+environment:0:
+externalId:0:
+p:6:n=n:49`
+  },
+  {
+    // Delimiters inside a value cannot forge another subject.
+    subject: { toolName: "a", parameters: { "x\ny": "1" } },
+    canonical: `${AUTHORIZATION_CANONICAL_VERSION}
+action:1:a
+target:0:
+actor:0:
+environment:0:
+externalId:0:
+p:7:x
+y=s:1`
+  },
+  {
+    // Every finite number, including the ones another language would render
+    // differently. One runtime computes both sides of the comparison.
+    subject: { toolName: "a", parameters: { small: 1e-7, big: 1e21 } },
+    canonical: `${AUTHORIZATION_CANONICAL_VERSION}
+action:1:a
+target:0:
+actor:0:
+environment:0:
+externalId:0:
+p:11:big=n:1e+21
+p:12:small=n:1e-7`
+  }
+];
+var AUTHORIZATION_PERMIT_TTL_SECONDS = 60 * 60;
+var ANSWER_SOURCES = [
+  "dashboard",
+  "mobile_app",
+  "mobile_background",
+  "decide_page",
+  "live_page",
+  "answer_link",
+  "inbox",
+  "slack",
+  "mac_app",
+  // Nobody. A decision opened on a workspace's sandbox site is settled by the
+  // simulator instead of being delivered, and the ledger has to say so: a
+  // sandbox row that looked like a human answer would be indistinguishable
+  // evidence of a person who was never asked.
+  "sandbox"
+];
+var isAnswerSource = (value) => typeof value === "string" && ANSWER_SOURCES.includes(value);
+var SETTLED_OUTCOMES = ["approve", "deny"];
+var SETTLED_OUTCOME = {
+  approve: "approve",
+  deny: "deny"
+};
+var isSettledOutcome = (value) => typeof value === "string" && SETTLED_OUTCOMES.includes(value);
+var classifyDecisionRisk = (toolName, toolTarget) => {
+  const parts = [toolName, toolTarget ?? ""];
+  const matchesAny = (patterns) => parts.some((part) => patterns.some((re) => re.test(part)));
+  if (matchesAny(APPROVAL_FATIGUE_FLAG_PATTERNS)) return "destructive";
+  if (matchesAny(HIGH_CONSEQUENCE_PATTERNS)) return "elevated";
+  return "standard";
+};
+var POLICY_CAPABILITIES = ["read", "edit", "shell", "network", "destructive"];
+var CAPABILITY_PATTERNS = {
+  read: ["Read", "Grep", "Glob", "LS", "NotebookRead"],
+  edit: ["Edit", "Write"],
+  shell: ["Bash"],
+  network: [
+    "WebFetch",
+    "Bash(curl:*)",
+    "Bash(wget:*)",
+    "Bash(nc:*)",
+    "Bash(ssh:*)",
+    "Bash(scp:*)",
+    "Bash(npm install:*)",
+    "Bash(npm i:*)",
+    "Bash(pnpm add:*)",
+    "Bash(yarn add:*)",
+    "Bash(bun add:*)",
+    "Bash(pip install:*)",
+    "Bash(brew install:*)",
+    "Bash(apt:*)",
+    "Bash(apt-get:*)"
+  ],
+  destructive: [
+    "Bash(rm:*)",
+    "Bash(rmdir:*)",
+    "Bash(sudo:*)",
+    "Bash(git push:*)",
+    "Bash(git reset --hard:*)",
+    "Bash(git clean:*)",
+    "Bash(npm publish:*)",
+    "Bash(kubectl delete:*)",
+    "Bash(terraform apply:*)",
+    "Bash(terraform destroy:*)",
+    "Bash(docker system prune:*)",
+    "Bash(dropdb:*)",
+    "Bash(mkfs:*)"
+  ]
+};
+var DECISION_EPISODE_SCHEMA_VERSION = 1;
+var DECISION_FEATURE_EXTRACTOR = `pushary-hooks/schema-${DECISION_EPISODE_SCHEMA_VERSION}`;
+var DECISION_ORIGIN = {
+  human: "human",
+  autopilot: "autopilot",
+  safeReadonly: "safe_readonly",
+  policyTimeout: "policy_timeout",
+  killSwitch: "kill_switch"
+};
+var EPISODE_CAPABILITIES = [...POLICY_CAPABILITIES, "other"];
+var NETWORK_COMMAND_PATTERNS = [
+  /\bcurl\b/i,
+  /\bwget\b/i,
+  /\bnc\b/i,
+  /\bssh\b/i,
+  /\bscp\b/i,
+  /\b(?:npm|pnpm|yarn|bun)\s+(?:install|i|add)\b/i,
+  /\bpip\s+install\b/i,
+  /\bbrew\s+install\b/i,
+  /\bapt(?:-get)?\s+(?:install|update|upgrade)\b/i
+];
+var SECRET_TARGET_PATTERNS = [
+  /(^|[\\/])\.env(\.|$|[\\/])/i,
+  /secrets?/i,
+  /credentials?/i,
+  /private[_-]?key/i,
+  /\.pem$/i
+];
+var READ_TOOL_NAMES = new Set(CAPABILITY_PATTERNS.read);
+var EDIT_TOOL_NAMES = new Set(CAPABILITY_PATTERNS.edit);
+var deriveEpisodeCapability = (toolName, commandText) => {
+  if (READ_TOOL_NAMES.has(toolName)) return "read";
+  if (EDIT_TOOL_NAMES.has(toolName)) return "edit";
+  if (toolName === "WebFetch" || toolName === "WebSearch") return "network";
+  if (isCommandTool(toolName)) {
+    if (isDestructive(toolName, commandText)) return "destructive";
+    if (NETWORK_COMMAND_PATTERNS.some((re) => re.test(commandText))) return "network";
+    return "shell";
+  }
+  if (isDestructive(toolName, commandText)) return "destructive";
+  return "other";
+};
+var deriveTargetClass = (path) => {
+  const p = path.toLowerCase();
+  if (!p) return "other";
+  if (SECRET_TARGET_PATTERNS.some((re) => re.test(p))) return "secret";
+  if (/(^|[\\/])(?:tests?|__tests__|spec)([\\/]|$)|\.(?:test|spec)\.[a-z0-9]+$/i.test(p)) return "test";
+  if (/\.(?:md|mdx|txt|rst)$|(^|[\\/])docs?([\\/]|$)/i.test(p)) return "docs";
+  if (/(^|[\\/])(?:package\.json|tsconfig[^\\/]*\.json|\.[a-z]+rc)$|\.(?:json|ya?ml|toml|ini|conf|cfg)$/i.test(p)) return "config";
+  if (/\.(?:ts|tsx|js|jsx|mjs|cjs|py|go|rs|java|rb|php|c|cc|cpp|h|hpp|cs|swift|kt|scala|sh)$/i.test(p)) return "source";
+  return "other";
+};
+var bucketArgCount = (n) => n <= 0 ? "none" : n <= 3 ? "few" : "many";
+var bucketLength = (n) => n < 40 ? "short" : n < 200 ? "medium" : "long";
+var deriveArgShape = (isCommand, commandText, path) => {
+  const text = isCommand ? commandText : path;
+  const tokenCount = isCommand ? text.trim().split(/\s+/).filter(Boolean).length : 0;
+  return {
+    hasPipe: isCommand && /(?<!\|)\|(?!\|)/.test(text),
+    hasRedirect: isCommand && /(?<![0-9])[<>]/.test(text),
+    hasChain: isCommand && /&&|\|\||;/.test(text),
+    hasSudo: /\bsudo\b/i.test(text),
+    hasGlob: isCommand && /[*?]/.test(text),
+    hasSubshell: isCommand && /\$\(|`/.test(text),
+    touchesSecretPath: SECRET_TARGET_PATTERNS.some((re) => re.test(text)),
+    // The command word itself is not an argument, so subtract one.
+    argCountBucket: bucketArgCount(isCommand ? Math.max(0, tokenCount - 1) : 0),
+    lengthBucket: bucketLength(text.length)
+  };
+};
+var deriveReversibility = (capability, riskClass) => {
+  if (capability === "read") return "none";
+  if (capability === "destructive" || riskClass === "destructive") return "irreversible";
+  return "reversible";
+};
+var deriveBlastRadius = (capability, riskClass, targetClass) => {
+  if (capability === "read") return "low";
+  if (capability === "destructive" || riskClass === "destructive" || targetClass === "secret") return "high";
+  if (capability === "network" || capability === "shell" || riskClass === "elevated" || targetClass === "config") return "medium";
+  return "low";
+};
+var deriveLabelTier = (origin, decision) => {
+  if (origin !== DECISION_ORIGIN.human) return "none";
+  return isSettledOutcome(decision) ? "bronze" : "none";
+};
+var buildDecisionEpisodeFeatures = (input) => {
+  const isCommand = isCommandTool(input.toolName);
+  const raw = input.commandOrPath ?? input.toolTarget ?? "";
+  const commandText = isCommand ? raw : "";
+  const path = isCommand ? "" : raw;
+  const capability = deriveEpisodeCapability(input.toolName, commandText);
+  const riskClass = classifyDecisionRisk(input.toolName, input.toolTarget ?? raw);
+  const targetClass = isCommand ? SECRET_TARGET_PATTERNS.some((re) => re.test(commandText)) ? "secret" : "other" : deriveTargetClass(path);
+  const argShape = deriveArgShape(isCommand, commandText, path);
+  const { deltaSignal } = computeDeltaSignal({
+    intent: input.intent,
+    toolName: input.toolName,
+    toolTarget: input.toolTarget,
+    actionBody: input.commandOrPath
+  });
+  return {
+    schemaVersion: DECISION_EPISODE_SCHEMA_VERSION,
+    extractorVersion: DECISION_FEATURE_EXTRACTOR,
+    capability,
+    toolFamily: input.toolName.trim().slice(0, 40),
+    riskClass,
+    targetClass,
+    argShape,
+    reversibility: deriveReversibility(capability, riskClass),
+    blastRadius: deriveBlastRadius(capability, riskClass, targetClass),
+    deltaSignal,
+    preset: input.preset,
+    // A policy artifact (usually canonical like `Bash(rm:*)`), but a user could
+    // author a custom pattern, so scrub secrets defensively before it is stored.
+    matchedPattern: input.matchedPattern ? redactSecretsDeep(input.matchedPattern).slice(0, 120) : void 0,
+    policyMode: input.policyMode,
+    requestedGate: input.requestedGate,
+    timeoutSeconds: input.timeoutSeconds,
+    timeoutAction: input.timeoutAction,
+    decision: input.decision,
+    origin: input.origin,
+    latencyMs: input.latencyMs,
+    labelTier: deriveLabelTier(input.origin, input.decision),
+    agentType: input.agentType
+  };
+};
+var matchesGlobPath = (glob, path) => {
+  if (glob === path) return true;
+  const compiled = compiledGlob(glob);
+  return compiled ? matchGlobTokens(compiled, path) : false;
+};
+var SCOPE_PATH_MAX_LENGTH = 200;
+var evaluateScope = (contract, path) => {
+  if (!contract) return { outcome: "no_contract" };
+  if (typeof path !== "string" || path.length === 0) return { outcome: "in_scope" };
+  for (const rule of contract.offLimitsPaths) {
+    if (matchesGlobPath(rule, path)) return { outcome: "off_limits", path, rule };
+  }
+  if (contract.allowedPaths.length === 0) return { outcome: "in_scope" };
+  for (const rule of contract.allowedPaths) {
+    if (matchesGlobPath(rule, path)) return { outcome: "in_scope" };
+  }
+  return { outcome: "out_of_scope", path };
+};
+var scopeRequiresHuman = (verdict) => verdict.outcome === "out_of_scope" || verdict.outcome === "off_limits";
+var widenablePath = (path) => path.length > 0 && path.length <= SCOPE_PATH_MAX_LENGTH ? path : void 0;
+var scopeChangeReason = (verdict) => {
+  if (verdict.outcome === "out_of_scope") {
+    return `Outside the scope you approved: ${verdict.path}`;
+  }
+  if (verdict.outcome === "off_limits") {
+    return `You marked this off limits: ${verdict.path} (${verdict.rule})`;
+  }
+  return void 0;
+};
+var isScopeContract = (value) => {
+  if (!value || typeof value !== "object") return false;
+  const c = value;
+  const strings = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
+  if (c.promises !== void 0 && !strings(c.promises)) return false;
+  return strings(c.allowedPaths) && strings(c.offLimitsPaths) && typeof c.doneWhen === "string";
+};
+var findBestRoute = (routes, toolName, args, repoKey) => {
+  let best;
+  let bestWeight = 0;
+  let bestScoped = -1;
+  let bestLength = -1;
+  for (const candidate of routes) {
+    if (!isRepoKeyMatch(candidate.repoKey, repoKey)) continue;
+    const rank = matchToolPatternAny(candidate.toolPattern, toolName, args, PATTERN_INTENT.restrict);
+    if (rank === "none") continue;
+    const weight = matchRankWeight(rank);
+    const scoped = candidate.repoKey ? 1 : 0;
+    const length = rank === "prefix" ? candidate.toolPattern.length : -1;
+    const better = weight > bestWeight || weight === bestWeight && scoped > bestScoped || weight === bestWeight && scoped === bestScoped && length > bestLength;
+    if (better) {
+      best = candidate;
+      bestWeight = weight;
+      bestScoped = scoped;
+      bestLength = length;
+    }
+  }
+  return best ?? routes.find((r) => r.toolPattern === "*");
+};
+var autoApprove = (tool) => ({
+  tool,
+  timeoutSeconds: 0,
+  timeoutAction: "approve",
+  mode: "terminal_only",
+  pushFirstSeconds: 0
+});
+var resolveAutoResolveOrigin = (config, toolName, toolInput, cwd, repoKey, sessionId) => {
+  const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
+  const arg = args[0];
+  const match = selectGoverningRule(config.policies, toolName, args, repoKey, sessionId);
+  const governedBySpecificRule = match?.rank === "exact" || match?.rank === "prefix";
+  if (!governedBySpecificRule && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg)) {
+    return DECISION_ORIGIN.safeReadonly;
+  }
+  return DECISION_ORIGIN.autopilot;
+};
+var wildcardRuleOf = (pool) => {
+  const wildcard = pool.find((policy) => policy.tool === WILDCARD_TOOL_PATTERN);
+  return wildcard ? { policy: wildcard, rank: "wildcard" } : void 0;
+};
+var withSiteDelivery = (rule, siteMode) => isAutoApprove(rule.policy) || isAutoDeny(rule.policy) ? rule : { ...rule, policy: { ...rule.policy, mode: siteMode.mode, pushFirstSeconds: siteMode.pushFirstSeconds } };
+var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
+  const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
+  const arg = args[0];
+  const specificRule = (pool) => pool.length === 0 ? void 0 : selectGoverningRule(pool, toolName, args, repoKey, sessionId);
+  const written = config.policies.filter((p) => !p.origin);
+  const presets = config.policies.filter((p) => p.origin === "preset");
+  const builtins = config.policies.filter((p) => p.origin === "builtin");
+  const siteMode = wildcardRuleOf(written);
+  const presetRule = specificRule(presets);
+  const match = specificRule(written) ?? (presetRule && siteMode ? withSiteDelivery(presetRule, siteMode.policy) : presetRule) ?? siteMode ?? wildcardRuleOf(presets) ?? specificRule(builtins) ?? wildcardRuleOf(builtins);
+  let base = match?.policy ?? {
+    tool: toolName,
+    timeoutSeconds: config.defaultTimeoutSeconds,
+    timeoutAction: config.defaultTimeoutAction,
+    mode: config.defaultMode ?? "push_first",
+    pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
+  };
+  const governedBySpecificRule = match?.rank === "exact" || match?.rank === "prefix";
+  const governedBySessionToolGrant = match?.rank === "tool" && isSessionToolGrant(match.policy);
+  const governingMode = base.mode;
+  const approvedByReadOnlyFloor = !governedBySpecificRule && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg);
+  if (governedBySessionToolGrant && !approvedByReadOnlyFloor && typeof arg === "string" && commandNeedsAPerson(toolName, arg)) {
+    return resolvePolicy(withoutSessionToolGrants(config), toolName, modeOverride, toolInput, cwd, repoKey, sessionId);
+  }
+  if (approvedByReadOnlyFloor) {
+    base = autoApprove(base.tool);
+  }
+  const wouldAutoApprove = isAutoApprove(base);
+  if (!governedBySpecificRule && wouldAutoApprove && toolName === "Bash" && typeof arg === "string" && classifyDecisionRisk(toolName, arg) === "destructive") {
+    base = {
+      tool: base.tool,
+      timeoutSeconds: config.defaultTimeoutSeconds,
+      timeoutAction: "wait",
+      mode: governingMode,
+      pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
+    };
+  }
+  const effectiveOverride = modeOverride ?? config.modeOverride;
+  if (effectiveOverride) {
+    return { ...base, mode: effectiveOverride };
+  }
+  return base;
+};
+var restraintRank = (policy) => {
+  if (isAutoDeny(policy)) return 4;
+  if (isAutoApprove(policy)) return 0;
+  if (policy.mode === "push_only") return 3;
+  return policy.mode === "terminal_only" || policy.mode === "notify_only" ? 1 : 2;
+};
+var strictestPolicy = (a, b) => restraintRank(b) > restraintRank(a) ? b : a;
+var resolvePolicyAcross = (config, toolName, modeOverride, toolInputs, cwd, repoKey, sessionId) => {
+  if (toolInputs.length === 0) return resolvePolicy(config, toolName, modeOverride, void 0, cwd, repoKey, sessionId);
+  return toolInputs.map((input) => resolvePolicy(config, toolName, modeOverride, input, cwd, repoKey, sessionId)).reduce(strictestPolicy);
+};
+var isModeStateDegraded = (state) => state?.degraded === true;
+var KILL_REASON = "Stopped by user, this agent was halted from Pushary";
+var GATE_ALLOW_SOURCE = {
+  allowlist: "allowlist",
+  policy: "policy"
+};
+var PUSHARY_TOOL_PREFIX = "mcp__pushary__";
+var isPusharyOwnTool = (toolName) => toolName.startsWith(PUSHARY_TOOL_PREFIX);
+var strictestScopeVerdict = (scope, paths) => {
+  if (paths.length === 0) return evaluateScope(scope, void 0);
+  let worst = { outcome: "in_scope" };
+  for (const path of paths) {
+    const verdict = evaluateScope(scope, path);
+    if (verdict.outcome === "off_limits") return verdict;
+    if (verdict.outcome === "out_of_scope") worst = verdict;
+  }
+  return worst;
+};
+var survivesDegraded = (config, toolName, toolInputs, cwd, repoKey, sessionId) => toolInputs.length === 1 && resolveAutoResolveOrigin(config, toolName, toolInputs[0], cwd, repoKey, sessionId) === "safe_readonly";
+var FULL_DEFER_MODES = /* @__PURE__ */ new Set(["plan", "auto", "dontAsk"]);
+var ACCEPT_EDITS_DEFER_TOOLS = /* @__PURE__ */ new Set([
+  "Write",
+  "Edit",
+  "MultiEdit",
+  "NotebookEdit"
+]);
+var shouldDeferToNativeMode = (permissionMode, toolName, options = {}) => {
+  if (options.respectPermissionMode === false) return false;
+  if (typeof permissionMode !== "string") return false;
+  if (FULL_DEFER_MODES.has(permissionMode)) return true;
+  if (permissionMode === "acceptEdits" && ACCEPT_EDITS_DEFER_TOOLS.has(toolName)) return true;
+  if (permissionMode === "bypassPermissions") return options.deferBypass === true;
+  return false;
+};
+var AGENT_QUESTION_TOOL = "AskUserQuestion";
+var AGENT_QUESTION_STRATEGY = { native: "native_dialog", updatedInput: "updated_input", none: "not_a_question" };
+var UPDATED_INPUT_QUESTION_SOURCES = /* @__PURE__ */ new Set(["claude", "qoder", "codebuddy", "droid"]);
+function agentQuestionStrategy(source, event, toolName) {
+  if (toolName !== AGENT_QUESTION_TOOL) return AGENT_QUESTION_STRATEGY.none;
+  if (source !== null && event === "PreToolUse" && UPDATED_INPUT_QUESTION_SOURCES.has(source)) return AGENT_QUESTION_STRATEGY.updatedInput;
+  return AGENT_QUESTION_STRATEGY.native;
+}
+var ASKED_IN_EVERY_MODE_TOOLS = [AGENT_QUESTION_TOOL, "ExitPlanMode"];
+var ASKED_IN_EVERY_MODE = new Set(ASKED_IN_EVERY_MODE_TOOLS);
+var isAskedInEveryMode = (toolName) => ASKED_IN_EVERY_MODE.has(toolName);
+var NATIVE_BLOCK_EVENTS = /* @__PURE__ */ new Set(["PermissionDenied"]);
+var isNativeBlockEvent = (event) => typeof event === "string" && NATIVE_BLOCK_EVENTS.has(event);
+var CODEX_RESCUE_TOOL_NAME = "Bash";
+var isBlockedActionEvent = ({ source, event, blockedBy }) => isNativeBlockEvent(event) || source === "codex" && event === "Stop" && blockedBy === "auto_review";
+var blockedActionRetryReachesGate = (source, toolName) => source === "claude" ? PRETOOLUSE_HANDLED_TOOLS.has(toolName) && !isAskedInEveryMode(toolName) : source === "codex" && toolName === CODEX_RESCUE_TOOL_NAME;
+var isBlockedActionRequest = (request) => isBlockedActionEvent(request) && blockedActionRetryReachesGate(request.source, request.toolName);
+var canonicalJsonText = (value) => {
+  if (Array.isArray(value)) return `[${value.map(canonicalJsonText).join(",")}]`;
+  if (value !== null && typeof value === "object") {
+    const record = value;
+    return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJsonText(record[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "null";
+};
+var BLOCKED_ACTION_IDENTITY_VERSION = "blocked-action/v1";
+var CLAUDE_BLOCKED_ACTION_IDENTITY_VERSION = "blocked-action/v2";
+var BLOCKED_ACTION_GRANT_TTL_SECONDS = 120;
+var BLOCKED_ACTION_PRESENTATION_ONLY_KEYS = ["description"];
+var isPresentationOnlyInputKey = (key) => BLOCKED_ACTION_PRESENTATION_ONLY_KEYS.includes(key);
+var identifyingBlockedActionInput = (toolInput) => Object.fromEntries(Object.entries(toolInput).filter(([key]) => !isPresentationOnlyInputKey(key)));
+var blockedActionIdentity = (subject) => {
+  const { sessionId, toolName, toolInput } = subject;
+  return subject.source === "claude" ? canonicalJsonText([CLAUDE_BLOCKED_ACTION_IDENTITY_VERSION, sessionId, subject.cwd, toolName, identifyingBlockedActionInput(toolInput)]) : canonicalJsonText([BLOCKED_ACTION_IDENTITY_VERSION, sessionId, toolName, identifyingBlockedActionInput(toolInput)]);
+};
+var PRETOOLUSE_GATED_TOOLS = [
+  "Bash",
+  "Write",
+  "Edit",
+  "MultiEdit",
+  "NotebookEdit",
+  "PowerShell",
+  "Monitor"
+];
+var PRETOOLUSE_HANDLED_TOOLS = /* @__PURE__ */ new Set([...PRETOOLUSE_GATED_TOOLS, ...ASKED_IN_EVERY_MODE_TOOLS]);
+var isPermissionRequestOwnedByPreToolUse = (toolName, permissionMode, defers = shouldDeferToNativeMode) => PRETOOLUSE_HANDLED_TOOLS.has(toolName) && (isAskedInEveryMode(toolName) || !defers(permissionMode, toolName));
+var CLAUDE_PRETOOLUSE_MATCHER = [...PRETOOLUSE_HANDLED_TOOLS].join("|");
+var resolveGate = (input) => {
+  const { modeState, config, toolName, toolInputs, cwd, repoKey, sessionId } = input;
+  if (isPusharyOwnTool(toolName)) {
+    return {
+      kind: "defer",
+      policy: resolvePolicyAcross(config, toolName, modeState.mode, toolInputs, cwd, repoKey, sessionId),
+      reason: "own_tool"
+    };
+  }
+  if (modeState.kill) return { kind: "kill", reason: KILL_REASON };
+  const policy = resolvePolicyAcross(config, toolName, modeState.mode, toolInputs, cwd, repoKey, sessionId);
+  const verdict = verdictForPolicy(policy);
+  const autoApproves = verdict === "allow";
+  const autoDenies = verdict === "deny";
+  if (autoDenies) return { kind: "deny", policy, reason: `Denied by policy for ${policy.tool}` };
+  if (isAskedInEveryMode(toolName)) return { kind: "gate", policy };
+  if (isModeStateDegraded(modeState)) {
+    if (autoApproves) {
+      return survivesDegraded(config, toolName, toolInputs, cwd, repoKey, sessionId) ? { kind: "allow", policy, source: "allowlist" } : { kind: "defer", policy };
+    }
+    return { kind: "gate", policy };
+  }
+  const scopeVerdict = modeState.scope ? strictestScopeVerdict(modeState.scope, input.scopePaths ?? []) : { outcome: "no_contract" };
+  if (autoApproves) {
+    if (!scopeRequiresHuman(scopeVerdict)) {
+      return {
+        kind: "allow",
+        policy,
+        source: toolInputs.length === 1 && resolveAutoResolveOrigin(config, toolName, toolInputs[0], cwd, repoKey, sessionId) === "safe_readonly" ? "allowlist" : "policy"
+      };
+    }
+  }
+  const scopeReason = scopeChangeReason(scopeVerdict);
+  return {
+    kind: "gate",
+    policy,
+    scopeReason,
+    scopePath: scopeReason && "path" in scopeVerdict ? widenablePath(scopeVerdict.path) : void 0
+  };
+};
+var editAsksAtTheAgentsPrompt = (input, verdict) => verdict.kind === "gate" && !verdict.scopeReason && (input.modeState.mode ?? input.config.modeOverride ?? null) === null && !aChosenRuleGoverns(input) && verdict.policy.mode === "push_first" && ACCEPT_EDITS_DEFER_TOOLS.has(input.toolName);
+var claudePromptsBeforeAnEdit = (permissionMode) => permissionMode === "default";
+var MAX_AGENT_PERMISSION_RULES_PER_KIND = 256;
+var MAX_AGENT_PERMISSION_RULE_LENGTH = 512;
+var isAgentPermissionRule = (value) => typeof value === "string" && value.length > 0 && value.length <= MAX_AGENT_PERMISSION_RULE_LENGTH;
+var settingsPermissionList = (permissions, kind) => {
+  const list = permissions[kind];
+  return Array.isArray(list) ? list.filter(isAgentPermissionRule) : [];
+};
+var boundedUnion = (lists) => [...new Set(lists.flat())].slice(0, MAX_AGENT_PERMISSION_RULES_PER_KIND);
+var claudePermissionRulesFromSettings = (documents) => {
+  const permissionBlocks = documents.flatMap((document) => isRecord(document) && isRecord(document.permissions) ? [document.permissions] : []);
+  const collect = (kind) => boundedUnion(permissionBlocks.map((permissions) => settingsPermissionList(permissions, kind)));
+  return { allow: collect("allow"), ask: collect("ask"), deny: collect("deny") };
+};
+var claudeConsultsItsAllowlist = (permissionMode) => permissionMode === "default" || permissionMode === "acceptEdits";
+var anyRuleRestricts = (rules, toolName, args) => rules.some((rule) => matchToolPatternAny(rule, toolName, args, PATTERN_INTENT.restrict) !== "none");
+var anyRuleGrants = (rules, toolName, args) => rules.some((rule) => matchToolPatternAny(rule, toolName, args, PATTERN_INTENT.grant) !== "none");
+var everyCommandSegmentGranted = (rules, toolName, command) => {
+  const segments = readableCommandSegments(command);
+  return segments !== null && segments.every((segment) => isSafeReadOnlyCommand(segment) || anyRuleGrants(rules, toolName, [segment]));
+};
+var restrictionFormsOf = (toolName, args) => {
+  const command = toolName in POLICY_COMMAND_KEYS ? args[0] : void 0;
+  const normalized = command === void 0 ? null : normalizedCommand(command);
+  return normalized === null ? args : [...args, normalized];
+};
+var allowRulesGrant = (rules, toolName, args) => {
+  const command = args[0];
+  return toolName in POLICY_COMMAND_KEYS && command !== void 0 ? everyCommandSegmentGranted(rules, toolName, command) : anyRuleGrants(rules, toolName, args);
+};
+var inputNeedsAPerson = (toolName, toolInput) => {
+  const arg = extractPolicyArg(toolName, toolInput);
+  if (arg === void 0) return false;
+  return toolName in POLICY_COMMAND_KEYS ? commandNeedsAPerson(toolName, arg) : classifyDecisionRisk(toolName, arg) !== "standard";
+};
+var agentRulesAllowEveryInput = (rules, toolName, toolInputs, cwd) => rules.allow.length > 0 && toolInputs.length > 0 && toolInputs.every((toolInput) => {
+  const args = policyArgForms(toolName, toolInput, cwd);
+  const restrictionForms = restrictionFormsOf(toolName, args);
+  return allowRulesGrant(rules.allow, toolName, args) && !anyRuleRestricts(rules.ask, toolName, restrictionForms) && !anyRuleRestricts(rules.deny, toolName, restrictionForms) && !inputNeedsAPerson(toolName, toolInput);
+});
+var isDefaultRule = (policy) => policy.origin === "builtin" || policy.tool === WILDCARD_TOOL_PATTERN;
+var isApprovalRoutePattern = (value) => typeof value === "object" && value !== null && typeof value.toolPattern === "string" && ["string", "undefined"].includes(typeof value.repoKey);
+var approvalRoutesOf = (config) => {
+  const routes = config.approvalRoutes ?? [];
+  return Array.isArray(routes) && routes.every(isApprovalRoutePattern) ? routes : null;
+};
+var aChosenRuleGoverns = (input) => {
+  const chosen = input.config.policies.filter((policy) => !isDefaultRule(policy));
+  const routes = approvalRoutesOf(input.config);
+  if (routes === null) return true;
+  return input.toolInputs.some((toolInput) => {
+    const args = policyArgForms(input.toolName, toolInput, input.cwd);
+    return selectGoverningRule(chosen, input.toolName, args, input.repoKey, input.sessionId) !== void 0 || findBestRoute(routes, input.toolName, args, input.repoKey) !== void 0;
+  });
+};
+var claudeAllowlistOwnsCall = (input, verdict, permissionMode, rules) => rules !== null && verdict.kind === "gate" && !verdict.scopeReason && !aChosenRuleGoverns(input) && !isAskedInEveryMode(input.toolName) && claudeConsultsItsAllowlist(permissionMode) && agentRulesAllowEveryInput(rules, input.toolName, input.toolInputs, input.cwd);
+var toPolicyVersion = (value) => typeof value === "string" || typeof value === "number" ? String(value) : null;
+var modeStateFromResponse = (data) => {
+  const mode = data.override?.mode;
+  return {
+    mode: isApprovalMode(mode) ? mode : null,
+    kill: data.kill === true,
+    policyVersion: toPolicyVersion(data.policyVersion),
+    relayUrl: typeof data.relayUrl === "string" && data.relayUrl.length > 0 ? data.relayUrl : null,
+    trainingConsent: data.trainingConsent === true,
+    // Validated rather than cast: a malformed contract must read as no contract,
+    // never as one that silently matches nothing.
+    scope: isScopeContract(data.scope) ? data.scope : null,
+    degraded: false,
+    askHandoff: data.askHandoff === true
+  };
+};
+var GATE_WIRE = 1;
+var GATE_MAX_TOOL_INPUTS = 32;
+var GATE_BLOCK_REASON_MAX_LENGTH = 200;
+var wireVerdictFor = (verdict, deadlineSeconds) => {
+  switch (verdict.kind) {
+    case "kill":
+      return { kind: "kill", reason: verdict.reason };
+    case "allow":
+      return { kind: "allow", source: verdict.source, policy: verdict.policy };
+    case "deny":
+      return { kind: "deny", reason: verdict.reason, policy: verdict.policy };
+    case "defer":
+      return { kind: "no_opinion", reason: verdict.reason === "own_tool" ? "not_gated" : "degraded" };
+    case "gate":
+      return {
+        kind: "ask",
+        policy: verdict.policy,
+        deadlineSeconds,
+        ...verdict.scopeReason ? { scopeReason: verdict.scopeReason } : {},
+        ...verdict.scopePath ? { scopePath: verdict.scopePath } : {}
+      };
+  }
+};
+var machineDecisionFor = (verdict) => {
+  switch (verdict.kind) {
+    case "kill":
+      return { origin: DECISION_ORIGIN.killSwitch, outcome: SETTLED_OUTCOME.deny };
+    case "allow":
+      return {
+        origin: verdict.source === GATE_ALLOW_SOURCE.allowlist ? DECISION_ORIGIN.safeReadonly : DECISION_ORIGIN.autopilot,
+        outcome: SETTLED_OUTCOME.approve
+      };
+    case "deny":
+      return { origin: DECISION_ORIGIN.autopilot, outcome: SETTLED_OUTCOME.deny };
+    case "ask":
+    case "no_opinion":
+      return null;
+  }
+};
+var claudePermissionDeniedOutput = (decision) => ({
+  hookSpecificOutput: {
+    hookEventName: "PermissionDenied",
+    retry: decision === "allow"
+  }
+});
+var CODEX_RESCUE_COMMAND_MAX_LENGTH = 2e3;
+var CODEX_RESCUE_APPROVED = "I approved this command in Pushary after the auto-reviewer denied it. If it is denied again, stop and tell me.";
+var codexRescueRetryInstruction = (command) => command.length <= CODEX_RESCUE_COMMAND_MAX_LENGTH ? `Run it again now, exactly as before: ${command}` : `Run it again now, exactly as before. It is too long to repeat in full here and begins: ${command.slice(0, CODEX_RESCUE_COMMAND_MAX_LENGTH)}`;
+var codexStopRescueOutput = (decision, command) => decision === "allow" ? { decision: "block", reason: `${CODEX_RESCUE_APPROVED} ${codexRescueRetryInstruction(command)}` } : { continue: true };
+var stoppedOutput = (output, stopReason) => ({ ...output, continue: false, stopReason });
+var claudePreToolUseOutput = (decision, reason, updatedInput) => ({
+  hookSpecificOutput: {
+    hookEventName: "PreToolUse",
+    permissionDecision: decision,
+    ...reason ? { permissionDecisionReason: reason } : {},
+    ...updatedInput ? { updatedInput } : {}
+  }
+});
+var PENDING_COMMAND_PREFIX = "The user sent a new instruction from their phone via Pushary:";
+var pendingCommandEvents = (source) => {
+  switch (source) {
+    case "claude":
+      return ["PostToolUse", "UserPromptSubmit", "Stop"];
+    // Codex carries context on its activity events and NOT on Stop, whose output
+    // schema has no context field at all. Draining for it at the turn boundary
+    // was therefore right to render nothing, and wrong to conclude that Codex
+    // could not be sent a message.
+    case "codex":
+      return ["PostToolUse", "PreToolUse", "UserPromptSubmit"];
+    case "gemini":
+      return ["AfterTool", "BeforeTool", "BeforeAgent"];
+    case "cursor":
+      return ["postToolUse"];
+    case "vscode":
+      return ["PostToolUse", "UserPromptSubmit"];
+    // The prompt is appended through the TUI rather than through a hook return,
+    // so there is nothing for this to print.
+    case "opencode":
+      return [];
+    case "qwen":
+    case "codebuddy":
+    case "qoder":
+    case "droid":
+    case "devin":
+      return compatiblePendingCommandEvents(source);
+  }
+};
+var COMPATIBLE_PENDING_COMMAND_EVENTS = ["PostToolUse", "UserPromptSubmit"];
+var compatiblePendingCommandEvents = (source) => {
+  const profile = hookCompatibleProfileBySource(source);
+  if (!profile || profile.wire !== "permission_decision") return [];
+  return COMPATIBLE_PENDING_COMMAND_EVENTS.filter((event) => profile.events.includes(event));
+};
+var claudePermissionRequestOutput = (decision, reason, updatedInput) => ({
+  hookSpecificOutput: {
+    hookEventName: "PermissionRequest",
+    decision: decision === "allow" ? { behavior: "allow", ...updatedInput ? { updatedInput } : {} } : { behavior: "deny", ...reason ? { message: reason } : {} }
+  }
+});
+var gateOutputFor = (source, event, decision, reason) => {
+  let output;
+  if (source === "claude" || source === "vscode") {
+    if (event === "PreToolUse") {
+      output = claudePreToolUseOutput(decision, reason);
+    } else if (event === "PermissionRequest" && decision !== "ask") {
+      output = claudePermissionRequestOutput(decision, reason);
+    } else if (source === "claude" && event === "PermissionDenied" && decision !== "ask") {
+      output = claudePermissionDeniedOutput(decision);
+    }
+  } else if (source === "codex") {
+    if (event === "PermissionRequest" && decision !== "ask") {
+      output = {
+        hookSpecificOutput: {
+          hookEventName: "PermissionRequest",
+          decision: decision === "allow" ? { behavior: "allow" } : { behavior: "deny", message: reason ?? "Denied from Pushary" }
+        }
+      };
+    } else if (event === "PreToolUse" && decision === "deny") {
+      output = {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: reason ?? "Denied from Pushary"
+        }
+      };
+    }
+  } else if (source === "gemini" && event === "BeforeTool" && decision !== "ask") {
+    output = decision === "allow" ? { decision: "allow" } : { decision: "deny", reason: reason ?? "Denied from Pushary" };
+  } else if (source === "opencode" && event === OPENCODE_APPROVAL_EVENT) {
+    output = decision === "deny" ? { status: "deny", reason: reason ?? "Denied from Pushary" } : { status: decision };
+  } else if (source === "cursor" && CURSOR_GATE_EVENTS.includes(event)) {
+    output = decision === "allow" ? { permission: "allow" } : decision === "ask" && event !== "preToolUse" ? { permission: "ask" } : {
+      permission: "deny",
+      user_message: "Command denied via Pushary.",
+      agent_message: reason ?? "Denied from Pushary"
+    };
+  } else {
+    const profile = hookCompatibleProfileBySource(source);
+    if (profile?.events.includes(event)) {
+      if (event === "PreToolUse") {
+        output = renderPreToolUseVerdict(profile, claudePreToolUseOutput(decision, reason));
+      } else if (event === "PermissionRequest" && decision !== "ask") {
+        output = claudePermissionRequestOutput(decision, reason);
+      }
+    }
+  }
+  return output;
+};
+var ELICITATION_EVENTS = ["Elicitation", "ElicitationResult"];
+var claudeElicitationOutput = (event, action, content) => ({
+  hookSpecificOutput: {
+    hookEventName: event,
+    action,
+    // Only ever alongside an accept. A declined elicitation has nothing to carry,
+    // and content beside a decline reads as an answer the person did not give.
+    ...action === "accept" && content ? { content } : {}
+  }
+});
+var renderElicitationOutput = (event, action, content) => ELICITATION_EVENTS.includes(event) ? JSON.stringify(claudeElicitationOutput(event, action, content)) : void 0;
+var ELICITATION_ANSWERABLE_MODE = "form";
+var ELICITATION_MIN_OPTIONS = 2;
+var ELICITATION_MAX_MULTI_QUESTIONS = 4;
+var ELICITATION_MAX_MULTI_OPTIONS = 4;
+var elicitationRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+var elicitationLabel = (name, property) => typeof property.title === "string" && property.title.trim() ? property.title.trim() : name;
+var elicitationEnum = (property) => {
+  if (!Array.isArray(property.enum)) return null;
+  const members = property.enum.filter((member) => typeof member === "string");
+  return members.length === property.enum.length && members.length >= ELICITATION_MIN_OPTIONS ? members : null;
+};
+var readElicitationFields = (schema) => {
+  const record = elicitationRecord(schema);
+  const properties = elicitationRecord(record?.properties);
+  if (!properties || record?.type !== "object") return null;
+  if (Object.keys(record).some((key) => !["type", "properties", "required", "$schema"].includes(key))) return null;
+  if (record.required !== void 0 && (!Array.isArray(record.required) || !record.required.every((name) => typeof name === "string" && Object.hasOwn(properties, name)))) return null;
+  const entries = Object.entries(properties);
+  if (entries.length === 0) return null;
+  const fields = [];
+  for (const [name, raw] of entries) {
+    const property = elicitationRecord(raw);
+    if (!property || !name) return null;
+    if (Object.keys(property).some((key) => !["type", "title", "enum"].includes(key))) return null;
+    if (property.title !== void 0 && typeof property.title !== "string") return null;
+    const label = elicitationLabel(name, property);
+    if ("enum" in property) {
+      const options = elicitationEnum(property);
+      if (property.type !== "string" || !options || options.some((option) => !option.trim()) || new Set(options).size !== options.length) return null;
+      fields.push({ kind: "choice", name, label, options });
+      continue;
+    }
+    switch (property.type) {
+      case "string":
+        fields.push({ kind: "text", name, label });
+        break;
+      case "number":
+        fields.push({ kind: "number", name, label, integer: false });
+        break;
+      case "integer":
+        fields.push({ kind: "number", name, label, integer: true });
+        break;
+      case "boolean":
+        fields.push({ kind: "boolean", name, label });
+        break;
+      default:
+        return null;
+    }
+  }
+  return fields;
+};
+var elicitationQuestionText = (message, field, alone) => alone ? message : `${message} \u2014 ${field.label}`;
+var planElicitationAsk = (message, fields) => {
+  if (fields.length === 1) {
+    const field = fields[0];
+    const question = elicitationQuestionText(message, field, true);
+    switch (field.kind) {
+      case "choice":
+        return { kind: "select", field, question, options: field.options };
+      case "boolean":
+        return { kind: "confirm", field, question };
+      case "text":
+      case "number":
+        return { kind: "input", field, question };
+    }
+  }
+  if (fields.length > ELICITATION_MAX_MULTI_QUESTIONS) return null;
+  if (!fields.every((field) => field.kind === "choice" && field.options.length <= ELICITATION_MAX_MULTI_OPTIONS)) return null;
+  const questions = fields.map((field) => ({
+    question: elicitationQuestionText(message, field, false),
+    header: field.label.slice(0, 12),
+    multiSelect: false,
+    allowOther: false,
+    options: field.options.map((label) => ({ label }))
+  }));
+  return new Set(questions.map((question) => question.question)).size === questions.length ? { kind: "questions", fields, questions } : null;
+};
+var ELICITATION_CONFIRMED = /* @__PURE__ */ new Set(["yes", "true", "approve", "approved", "allow"]);
+var ELICITATION_REFUSED = /* @__PURE__ */ new Set(["no", "false", "deny", "denied", "reject"]);
+var elicitationNumber = (raw, integer) => {
+  const trimmed = raw.trim();
+  if (!/^-?\d+(\.\d+)?$/.test(trimmed)) return null;
+  const value = Number(trimmed);
+  if (!Number.isFinite(value)) return null;
+  return integer && !Number.isInteger(value) ? null : value;
+};
+var elicitationContent = (ask, answer) => {
+  const value = answer.trim();
+  if (!value) return null;
+  if (ask.kind === "input") {
+    if (ask.field.kind === "number") {
+      const parsed = elicitationNumber(value, ask.field.integer);
+      return parsed === null ? null : { [ask.field.name]: parsed };
+    }
+    return { [ask.field.name]: value };
+  }
+  if (ask.kind === "confirm") {
+    const lowered = value.toLowerCase();
+    if (ELICITATION_CONFIRMED.has(lowered)) return { [ask.field.name]: true };
+    if (ELICITATION_REFUSED.has(lowered)) return { [ask.field.name]: false };
+    return null;
+  }
+  if (ask.kind === "select") {
+    return ask.options.includes(value) ? { [ask.field.name]: value } : null;
+  }
+  return null;
+};
+var elicitationContentFromAnswers = (ask, answers) => {
+  const content = {};
+  for (const [index, field] of ask.fields.entries()) {
+    if (field.kind !== "choice") return null;
+    const chosen = answers[ask.questions[index].question];
+    if (typeof chosen !== "string" || !field.options.includes(chosen)) return null;
+    content[field.name] = chosen;
+  }
+  return content;
+};
+
+// ../contracts/src/hook-activation.ts
+var hookWritePath = (toolName, input) => toolName === "Write" && typeof input.file_path === "string" && input.file_path.startsWith("/") && input.file_path.length <= 4096 ? input.file_path : void 0;
+var HOOK_ACTIVATION_RESULTS = ["unverified", "approved_executed", "denied_observed", "unexpected_execution", "tool_failed"];
+var isHookActivationReport = (value) => {
+  if (!value || typeof value !== "object") return false;
+  const report = value;
+  return typeof report.agentType === "string" && typeof report.machineId === "string" && typeof report.target === "string" && report.target.length > 0 && report.target.length <= 4096 && typeof report.truncated === "boolean" && Array.isArray(report.evidence) && report.evidence.length <= 20 && (!report.truncated || report.evidence.length === 0) && report.evidence.every((item) => {
+    if (!item || typeof item !== "object") return false;
+    const row = item;
+    return ["correlationId", "sessionId", "toolUseId", "toolName", "createdAt"].every((key) => typeof row[key] === "string" && row[key].length > 0 && row[key].length <= 256) && (row.answerSource === null || isAnswerSource(row.answerSource)) && HOOK_ACTIVATION_RESULTS.includes(row.result) && Number.isFinite(Date.parse(row.createdAt)) && (row.occurredAt === null || typeof row.occurredAt === "string" && Number.isFinite(Date.parse(row.occurredAt))) && (row.observedAt === null || typeof row.observedAt === "string" && Number.isFinite(Date.parse(row.observedAt))) && (row.result === "unverified" || row.occurredAt !== null && row.observedAt !== null && row.producer !== null && isAnswerSource(row.answerSource) && row.answerSource !== "sandbox") && (row.producer === null || row.producer === "hook" || row.producer === "uplink");
+  });
+};
+var hookActivationResult = (report) => {
+  if (report?.evidence.some((row) => row.result === "unexpected_execution")) return "unexpected_execution";
+  return report && !report.truncated && report.evidence.length === 1 ? report.evidence[0].result : "unverified";
+};
+
+// src/cli-package-name.ts
+var CANONICAL_PACKAGE = "pushary";
+var LEGACY_PACKAGE = "@pushary/agent-hooks";
+var CLI_PACKAGE_NAMES = [CANONICAL_PACKAGE, LEGACY_PACKAGE];
+var isCliPackageName = (value) => typeof value === "string" && CLI_PACKAGE_NAMES.some((name) => name === value);
+var cliPackagePathSegments = (name) => name.split("/");
+
+// src/global-package.ts
+import { posix, win32 } from "path";
+var OWNERSHIP_PROBE_COMMAND = "pushary-hook";
+var pathApiFor = (platform) => platform === "win32" ? win32 : posix;
+var POSIX_GLOBAL_ROOT_SEGMENTS = ["lib", "node_modules"];
+var UPGRADE_ENTRY_SEGMENTS = ["dist", "bin", "pushary-upgrade.js"];
+var globalRootFor = (prefix, platform) => platform === "win32" ? win32.join(prefix, "node_modules") : posix.join(prefix, ...POSIX_GLOBAL_ROOT_SEGMENTS);
+var globalPackageFolder = (root, name, platform) => pathApiFor(platform).join(root, ...cliPackagePathSegments(name));
+var globalUpgradeEntry = (prefix, name, platform) => pathApiFor(platform).join(globalPackageFolder(globalRootFor(prefix, platform), name, platform), ...UPGRADE_ENTRY_SEGMENTS);
+var isInsideFolder = (target, folder, platform) => {
+  const pathApi = pathApiFor(platform);
+  const relativePath = pathApi.relative(folder, target);
+  return relativePath !== "" && !relativePath.startsWith("..") && !pathApi.isAbsolute(relativePath);
+};
+var linkPointsInto = (evidence, targets, name) => evidence.globalRoots.some((root) => {
+  const folder = globalPackageFolder(root, name, evidence.platform);
+  return targets.some((target) => isInsideFolder(target, folder, evidence.platform));
+});
+var ownerFromInstalled = (installed, whenNone) => {
+  const [only, ...others] = installed;
+  if (only === void 0) return whenNone;
+  if (others.length > 0) return { kind: "unknown", reason: "both_installed" };
+  return { kind: "owned", name: only };
+};
+var decideCommandOwner = (evidence) => {
+  const { link } = evidence;
+  if (link.kind === "resolved") {
+    const name = CLI_PACKAGE_NAMES.find((candidate) => linkPointsInto(evidence, link.targets, candidate));
+    return name === void 0 ? { kind: "unknown", reason: "foreign_command" } : { kind: "owned", name };
+  }
+  const whenNone = link.kind === "absent" ? { kind: "none" } : { kind: "unknown", reason: "unreadable_command" };
+  return ownerFromInstalled(evidence.installed, whenNone);
+};
+var CMD_SHIM_TARGET = /"%(?:~dp0|dp0%)\\([^"]+?)"\s+%[*]/;
+var cmdShimTarget = (shimDir, contents) => {
+  const relativeTarget = CMD_SHIM_TARGET.exec(contents)?.[1];
+  return relativeTarget === void 0 ? void 0 : win32.resolve(shimDir, relativeTarget);
+};
+var launchedPackage = (ownName) => ownName ?? LEGACY_PACKAGE;
+var globalInstallTarget = (owner, ownName) => {
+  switch (owner.kind) {
+    case "owned":
+      return owner.name;
+    case "none":
+      return launchedPackage(ownName);
+    case "unknown":
+      return LEGACY_PACKAGE;
+  }
+};
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var declaresOwnershipProbe = (bin) => isRecord2(bin) && typeof bin[OWNERSHIP_PROBE_COMMAND] === "string";
+var cliManifestName = (manifest) => {
+  if (!isRecord2(manifest) || !isCliPackageName(manifest.name) || !declaresOwnershipProbe(manifest.bin)) return void 0;
+  return manifest.name;
+};
+var classifyGlobalFolder = (name, read) => {
+  if (read.kind === "unreadable") return { kind: "unseen" };
+  const { manifest } = read;
+  if (!isRecord2(manifest) || cliManifestName(manifest) !== name) return { kind: "foreign" };
+  return { kind: "ours", installed: { name, version: typeof manifest.version === "string" ? manifest.version : void 0 } };
+};
+var classifyGlobalInstall = (installed, owner) => {
+  const [only, ...others] = installed;
+  if (only === void 0) return { kind: "absent" };
+  if (others.length === 0) return { kind: "single", installed: only };
+  return { kind: "both", installed, owner };
+};
+var isUninstallable = (evidence) => evidence.listing !== "absent" && evidence.folder !== "foreign";
+var globalPackagesToUninstall = (evidence) => evidence.filter(isUninstallable).map((entry) => entry.name);
+var commandsPackage = (install) => {
+  if (install.kind === "single") return install.installed;
+  if (install.kind !== "both" || install.owner.kind !== "owned") return void 0;
+  const ownerName = install.owner.name;
+  return install.installed.find((installed) => installed.name === ownerName);
+};
+
+// src/cli/version.ts
+import { readFileSync } from "fs";
+import { dirname, join, parse } from "path";
+import { fileURLToPath } from "url";
+var UNKNOWN_VERSION = "0.0.0";
+var cliManifestNameAt = (manifestPath) => {
+  try {
+    return cliManifestName(JSON.parse(readFileSync(manifestPath, "utf-8")));
+  } catch {
+    return void 0;
+  }
+};
+var findOwnPackage = (start) => {
+  const { root } = parse(start);
+  let dir = start;
+  while (true) {
+    const name = cliManifestNameAt(join(dir, "package.json"));
+    if (name !== void 0) return { root: dir, name };
+    if (dir === root) return void 0;
+    const parent = dirname(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+};
+var runningPackage = () => {
+  try {
+    return findOwnPackage(dirname(fileURLToPath(import.meta.url)));
+  } catch {
+    return void 0;
+  }
+};
+var getPackageVersion = () => {
+  const root = ownPackageRoot();
+  return (root === void 0 ? void 0 : packageVersionAt(root)) ?? UNKNOWN_VERSION;
+};
+var ownPackageRoot = () => runningPackage()?.root;
+var ownPackageName = () => runningPackage()?.name;
+var packageVersionAt = (packageRoot) => {
+  try {
+    const manifest = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf-8"));
+    const version = manifest && typeof manifest === "object" && "version" in manifest ? manifest.version : void 0;
+    return typeof version === "string" ? version : void 0;
+  } catch {
+    return void 0;
+  }
+};
+var isNewerVersion = (candidate, current) => {
+  const a = candidate.split(".").map((part) => parseInt(part, 10) || 0);
+  const b = current.split(".").map((part) => parseInt(part, 10) || 0);
+  for (let i = 0; i < 3; i++) {
+    if ((a[i] ?? 0) > (b[i] ?? 0)) return true;
+    if ((a[i] ?? 0) < (b[i] ?? 0)) return false;
+  }
+  return false;
+};
+var RELEASE_VERSION = /^\d+\.\d+\.\d+$/;
+var isReleaseVersion = (value) => RELEASE_VERSION.test(value);
+var majorOf = (version) => parseInt(version.split(".")[0] ?? "", 10) || 0;
+var isSameMajorVersion = (candidate, current) => majorOf(candidate) === majorOf(current);
+
+export {
+  CLAUDE_CONNECTOR_URL,
+  CLAUDE_CONNECTOR_GUIDE,
+  COWORK_CONNECTOR_LIMIT,
+  CLAUDE_CONNECTOR_STEPS,
+  CLAUDE_CONNECTOR_TEST,
+  COWORK_STANDING_INSTRUCTIONS,
+  AGENTS,
+  HOOK_SOURCES,
+  AGENT_LABELS_BY_TYPE,
+  DISCONNECTABLE_AGENTS,
+  REPO_AWARE_AGENTS,
+  MANAGED_PROVIDERS,
+  PHONE_ANSWERED_TOOLS,
+  canonicalToolName,
+  toToolLookup,
+  renderPreToolUseVerdict,
+  HOOK_COMPATIBLE_PROFILES,
+  hookCompatibleProfile,
+  hookCompatibleProfileBySource,
+  compatibleTargetFiles,
+  redactSecrets,
+  redactSecretsFromContent,
+  redactSecretsDeep,
+  degradedLine,
+  hookWritePath,
+  isHookActivationReport,
+  hookActivationResult,
+  PAIR_TTL_SECONDS,
+  SETUP_AGENT_CHOICES,
+  SETUP_CONNECT_MODES,
+  isSetupConnectMode,
+  CLIENT_REPORT_PATH,
+  clientContextHeaders,
+  normalizeKeyScope,
+  parseAgentQuestion,
+  parseAgentQuestions,
+  parseAgentQuestionAnswers,
+  normalizeInstallSource,
+  HOOK_BUDGETS,
+  HOOK_HOLD_BUDGET_ENV,
+  withHookHoldBudget,
+  hookCommandHoldBudget,
+  hookHoldBudgetProof,
+  hookHoldWindowMs,
+  hookWaitDeadline,
+  hookWaitClamped,
+  effectiveWaitSeconds,
+  OPENCODE_APPROVAL_EVENT,
+  CURSOR_GATE_EVENTS,
+  SUPPORT_EMAIL,
+  SUPPORT_DISCORD,
+  HOOK_LOCATOR_BINARY,
+  normalizeRepoRemote,
+  localRepoKey,
+  isSafeReadOnlyCommand,
+  isAutoApprove,
+  FILE_TARGET_TOOLS,
+  isValidApiKey,
+  ACTION_BODY_MAX,
+  DECISION_LINE_MAX,
+  ASK_QUESTION_MAX,
+  ASK_AGENT_NAME_MAX,
+  truncateLine,
+  isAnswerSource,
+  buildDecisionEpisodeFeatures,
+  resolveAutoResolveOrigin,
+  resolvePolicy,
+  KILL_REASON,
+  isPusharyOwnTool,
+  shouldDeferToNativeMode,
+  AGENT_QUESTION_STRATEGY,
+  agentQuestionStrategy,
+  CODEX_RESCUE_TOOL_NAME,
+  isBlockedActionRequest,
+  BLOCKED_ACTION_GRANT_TTL_SECONDS,
+  blockedActionIdentity,
+  PRETOOLUSE_GATED_TOOLS,
+  isPermissionRequestOwnedByPreToolUse,
+  CLAUDE_PRETOOLUSE_MATCHER,
+  resolveGate,
+  editAsksAtTheAgentsPrompt,
+  claudePromptsBeforeAnEdit,
+  claudePermissionRulesFromSettings,
+  claudeConsultsItsAllowlist,
+  agentRulesAllowEveryInput,
+  claudeAllowlistOwnsCall,
+  modeStateFromResponse,
+  GATE_WIRE,
+  GATE_MAX_TOOL_INPUTS,
+  GATE_BLOCK_REASON_MAX_LENGTH,
+  wireVerdictFor,
+  machineDecisionFor,
+  claudePermissionDeniedOutput,
+  codexStopRescueOutput,
+  stoppedOutput,
+  claudePreToolUseOutput,
+  PENDING_COMMAND_PREFIX,
+  pendingCommandEvents,
+  claudePermissionRequestOutput,
+  gateOutputFor,
+  renderElicitationOutput,
+  ELICITATION_ANSWERABLE_MODE,
+  readElicitationFields,
+  planElicitationAsk,
+  elicitationContent,
+  elicitationContentFromAnswers,
+  CANONICAL_PACKAGE,
+  LEGACY_PACKAGE,
+  CLI_PACKAGE_NAMES,
+  cliPackagePathSegments,
+  OWNERSHIP_PROBE_COMMAND,
+  POSIX_GLOBAL_ROOT_SEGMENTS,
+  globalRootFor,
+  globalPackageFolder,
+  globalUpgradeEntry,
+  decideCommandOwner,
+  cmdShimTarget,
+  launchedPackage,
+  globalInstallTarget,
+  classifyGlobalFolder,
+  classifyGlobalInstall,
+  globalPackagesToUninstall,
+  commandsPackage,
+  getPackageVersion,
+  ownPackageRoot,
+  ownPackageName,
+  packageVersionAt,
+  isNewerVersion,
+  isReleaseVersion,
+  isSameMajorVersion
+};