pushary 1.9.103 → 1.9.104

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 1.9.104
+
+- New: `pushary audit verify <file>` checks a verifiable audit export from Dashboard > Agent > Activity > Verifiable, with no account and no network. It recomputes every hash in the chain, checks the signatures, and compares the file against what it verified on earlier runs (signed checkpoints, the newest entry seen, and every site seen), kept in `~/.local/share/pushary/audit-checkpoints.json`, where `pushary clean` leaves it. A changed row, an answered decision changed afterwards, a missing entry, a bad signature, or a history that was rewritten or cut short prints `CHANGED` and exits with code 5. A file where something could not be confirmed, such as an older page, a file with no signed checkpoint or only an old one, a row removed early, a signing key this version does not pin, or checkpoints this run could not save, exits with code 9, never 0. A file with no entries yet exits with code 3. Nothing else in the CLI or the hooks changed.
+
 ## 1.9.103
 
 - The Hermes plugin Pushary installs is now 1.0.1. When it hands a Hermes session to Pushary's history helper, the helper now gets only what it reads: the home folder, the search path, the temporary folder and locale, the Pushary settings it uses, and the Pushary key Hermes holds. Hermes' other provider keys no longer reach it. Checking whether history is allowed sends the key on standard input only.

package/README.md

@@ -219,6 +219,7 @@ clean        Remove Pushary from this machine (--everything: the Mac app's setup
 mode         Choose where approval requests appear
 wait         Show or set the "wait for your phone" ladder (pushary wait 45)
 stats        Show the approval moments your agents hit while not connected
+audit        Check a verifiable audit export: every hash, every signature, and the checkpoints you verified before
 suggestions  List rules mined from your own approvals
 upgrade      Update the globally installed hooks to the latest version
 hook         Run as a PreToolUse hook (reads stdin, writes stdout)

package/dist/{api-3O3GJV3V.js → api-QOG7JVXE.js}

@@ -17,23 +17,24 @@ import {
   waitForQuestion,
   waitsForThePhone,
   withdrawQuestion
-} from "./chunk-ZCYLCD6L.js";
+} from "./chunk-CC4LGKEZ.js";
 import "./chunk-POFBE6ZY.js";
-import "./chunk-V5DV7XZN.js";
-import "./chunk-7BIVBOD5.js";
-import "./chunk-KLJ2CTT7.js";
-import "./chunk-6N5DQG5F.js";
-import "./chunk-O7ITTNDD.js";
-import "./chunk-BQHZRH6S.js";
-import "./chunk-KOUB4ZLX.js";
-import "./chunk-PPY5N2E6.js";
-import "./chunk-KZERVKTD.js";
-import "./chunk-PWGD5EP6.js";
+import "./chunk-PK6LBL3Z.js";
+import "./chunk-NGY2WS3X.js";
+import "./chunk-ID4BZRBW.js";
+import "./chunk-PYUN7HNY.js";
+import "./chunk-AYWX6M7J.js";
+import "./chunk-VAZCGOLS.js";
+import "./chunk-3A7REECH.js";
+import "./chunk-YU2EUD7O.js";
+import "./chunk-QENTGE75.js";
+import "./chunk-BG4HHB7E.js";
+import "./chunk-YDT6TVGN.js";
 import "./chunk-ZVU6WMMU.js";
 import {
   DECISION_STOP_REASON,
   UNVERIFIABLE_APPROVAL_REASON
-} from "./chunk-4FAJQPFY.js";
+} from "./chunk-5YVBVJOH.js";
 import "./chunk-MLKGABMK.js";
 export {
   ABANDONED_WAIT,

package/dist/bin/pushary-audit.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/bin/pushary-audit.js

@@ -0,0 +1,263 @@
+#!/usr/bin/env node
+import {
+  exitOnHelpFlag
+} from "../chunk-JMTOQXHV.js";
+import {
+  readJsonSafe,
+  writeJsonAtomic
+} from "../chunk-QENTGE75.js";
+import {
+  EXIT
+} from "../chunk-BG4HHB7E.js";
+import "../chunk-YDT6TVGN.js";
+import "../chunk-ZVU6WMMU.js";
+import {
+  AUDIT_CHAIN_FINDING_SEVERITY,
+  AUDIT_CHECKPOINT_MAX_AGE_MS,
+  AUDIT_CHECKPOINT_PINNED_KEY_IDS,
+  auditChainVerdictTampered,
+  auditHeadsToRemember,
+  isRecord,
+  parseAllOrNothing,
+  parseAuditChainExport,
+  parseAuditKnownHead,
+  verifyAuditChainSite
+} from "../chunk-5YVBVJOH.js";
+import "../chunk-MLKGABMK.js";
+
+// src/audit-verify.ts
+import { createHash, createPublicKey, verify } from "crypto";
+import { readFileSync } from "fs";
+import { homedir } from "os";
+import { isAbsolute, join } from "path";
+var nodeAuditCrypto = {
+  sha256Hex: (text) => createHash("sha256").update(text).digest("hex"),
+  verifyEd25519: (message, signature, publicKey) => {
+    try {
+      return verify(null, Buffer.from(message), createPublicKey({ key: Buffer.from(publicKey, "base64"), format: "der", type: "spki" }), Buffer.from(signature, "base64"));
+    } catch {
+      return false;
+    }
+  }
+};
+var absoluteOrNull = (path2) => {
+  const trimmed = path2?.trim();
+  return trimmed && isAbsolute(trimmed) ? trimmed : null;
+};
+var userDataDirectory = () => absoluteOrNull(process.env.XDG_DATA_HOME) ?? join(homedir(), ".local", "share");
+var auditCheckpointStorePath = () => absoluteOrNull(process.env.PUSHARY_AUDIT_CHECKPOINTS_FILE) ?? join(userDataDirectory(), "pushary", "audit-checkpoints.json");
+var readAuditExport = (path2) => {
+  let text;
+  try {
+    text = readFileSync(path2, "utf8");
+  } catch (error) {
+    return { kind: "unreadable", reason: error instanceof Error ? error.message : String(error) };
+  }
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    return { kind: "not_an_export" };
+  }
+  const file = parseAuditChainExport(json);
+  return file ? { kind: "read", file } : { kind: "not_an_export" };
+};
+var EMPTY_MEMORY = { heads: [], siteIds: [] };
+var parseSiteId = (value) => typeof value === "string" ? value : null;
+var parseVerifierMemory = (value) => {
+  if (!isRecord(value)) return null;
+  const { heads, siteIds } = value;
+  const parsedHeads = parseAllOrNothing(heads, parseAuditKnownHead);
+  const parsedSiteIds = parseAllOrNothing(siteIds, parseSiteId);
+  return parsedHeads && parsedSiteIds ? { heads: parsedHeads, siteIds: parsedSiteIds } : null;
+};
+var readVerifierMemory = (path2) => {
+  const read2 = readJsonSafe(path2);
+  if (read2.kind === "missing") return { kind: "none_yet" };
+  if (read2.kind === "unreadable") return { kind: "unreadable", reason: read2.error.message };
+  if (read2.kind === "unparseable") return { kind: "unreadable", reason: "it is not valid JSON" };
+  const memory2 = parseVerifierMemory(read2.value);
+  return memory2 ? { kind: "read", memory: memory2 } : { kind: "unreadable", reason: "it is not a file this command wrote" };
+};
+var verifierMemoryOf = (read2) => read2.kind === "read" ? read2.memory : EMPTY_MEMORY;
+var headKey = (head) => `${head.siteId}:${head.seq}`;
+var earliestSighting = (kept, seen) => kept && kept.exportedAt <= seen.exportedAt ? kept : seen;
+var rememberRun = (memory2, verdicts2) => {
+  const heads = new Map(memory2.heads.map((head) => [headKey(head), head]));
+  for (const head of verdicts2.flatMap(auditHeadsToRemember)) heads.set(headKey(head), earliestSighting(heads.get(headKey(head)), head));
+  const siteIds = /* @__PURE__ */ new Set([...memory2.siteIds, ...verdicts2.filter((verdict) => verdict.entryCount > 0).map((verdict) => verdict.siteId)]);
+  return {
+    heads: [...heads.values()].sort((left, right) => left.siteId.localeCompare(right.siteId) || left.seq - right.seq),
+    siteIds: [...siteIds].sort()
+  };
+};
+var saveVerifierMemory = (path2, memory2) => {
+  try {
+    writeJsonAtomic(path2, memory2, 384);
+    return { saved: true };
+  } catch (error) {
+    return { saved: false, reason: error instanceof Error ? error.message : String(error) };
+  }
+};
+var verifyAuditExport = (file, memory2) => file.sites.map((site) => verifyAuditChainSite(site, nodeAuditCrypto, {
+  pinnedKeyIds: AUDIT_CHECKPOINT_PINNED_KEY_IDS,
+  knownHeads: memory2.heads,
+  exportedAt: file.exportedAt
+}));
+var verifierMemoryStateOf = (read2, saved) => {
+  const memory2 = verifierMemoryOf(read2);
+  return {
+    readable: read2.kind !== "unreadable",
+    saved,
+    knownSiteIds: /* @__PURE__ */ new Set([...memory2.siteIds, ...memory2.heads.map((head) => head.siteId)])
+  };
+};
+var siteUnknownToEarlierRuns = (verdict, state2) => state2.knownSiteIds.size > 0 && !state2.knownSiteIds.has(verdict.siteId);
+var nothingRecordedYet = (verdict, state2) => verdict.entryCount === 0 && verdict.findings.length === 0 && state2.knownSiteIds.size === 0;
+var siteLeftOpen = (verdict, state2) => verdict.findings.length > 0 || verdict.entryCount === 0 || siteUnknownToEarlierRuns(verdict, state2);
+var auditVerifyOutcome = (verdicts2, state2) => {
+  if (verdicts2.some(auditChainVerdictTampered)) return "changed";
+  if (!state2.readable || !state2.saved) return "inconclusive";
+  if (verdicts2.every((verdict) => nothingRecordedYet(verdict, state2))) return "nothing_recorded";
+  return verdicts2.some((verdict) => siteLeftOpen(verdict, state2)) ? "inconclusive" : "no_changes";
+};
+var STATUS_LABEL = {
+  included: "checked against its row",
+  aged_out: "past retention",
+  superseded: "superseded by a later decision",
+  changed_since_recorded: "changed since recorded"
+};
+var MINUTE_MS = 60 * 1e3;
+var utcMinuteOf = (timestamp) => `${timestamp.slice(0, 16).replace("T", " ")} UTC`;
+var describeAuditFinding = (finding) => {
+  switch (finding.kind) {
+    case "entry_altered":
+      return `entry ${finding.seq}: the entry itself was edited after it was chained`;
+    case "entry_changed":
+      return `entry ${finding.seq}: the row no longer matches the hash recorded for it`;
+    case "unrecorded_change":
+      return `entry ${finding.seq}: an unanswered question's outcome changed after it was last recorded, as a late answer does. Export again in a few minutes: once recorded it verifies`;
+    case "invalid_status":
+      return `entry ${finding.seq}: the file marks it ${STATUS_LABEL[finding.status]}, which cannot be true for it`;
+    case "decision_rewritten":
+      return `entry ${finding.seq}: a decision was recorded after this question had already been answered, which the audit trail forbids`;
+    case "asked_twice":
+      return `entry ${finding.seq}: this question was recorded a second time`;
+    case "row_missing":
+      return `entry ${finding.seq}: its row is gone although it is inside the retention window. A per-request retention setting can remove a row early; otherwise it was deleted`;
+    case "broken_link":
+      return `entry ${finding.seq}: it does not link to the entry before it`;
+    case "sequence_gap":
+      return `entries ${finding.afterSeq + 1} to ${finding.seq - 1} are missing`;
+    case "genesis_mismatch":
+      return "entry 1 does not start the chain";
+    case "checkpoint_mismatch":
+      return `checkpoint at entry ${finding.seq}: the signed hash does not match the entry`;
+    case "checkpoint_outside_export":
+      return `checkpoint at entry ${finding.seq} covers an entry outside this file`;
+    case "bad_signature":
+      return `checkpoint at entry ${finding.seq}: the signature is not valid`;
+    case "wrong_key_id":
+      return `checkpoint at entry ${finding.seq}: the key id does not match its key`;
+    case "unpinned_key":
+      return `checkpoint at entry ${finding.seq}: signed by key ${finding.keyId}, which this version of pushary does not pin yet`;
+    case "history_rewritten":
+      return `entry ${finding.seq} differs from what you verified on an earlier run, so history was rewritten`;
+    case "conflicting_checkpoint":
+      return `checkpoint at entry ${finding.seq} conflicts with one you verified on an earlier run`;
+    case "rolled_back":
+      return `entries up to ${finding.seq}, which you verified on an earlier run, are missing from the end of this file`;
+    case "unsigned":
+      return "this file holds no signed checkpoint, so no entry in it is covered by a signature";
+    case "older_export":
+      return `this file was exported no later than one an earlier run verified, which reached entry ${finding.seq} (exported ${utcMinuteOf(finding.exportedAt)}). A file from that moment or earlier cannot show whether newer entries were removed`;
+    case "stale_signature":
+      return `the newest signature covers entries up to ${finding.seq} and was made ${utcMinuteOf(finding.signedAt)}, more than ${AUDIT_CHECKPOINT_MAX_AGE_MS / MINUTE_MS} minutes before this file was exported. New entries are signed within about an hour, so the entries after it are covered by no signature`;
+    case "older_page":
+      return `this file is an older page, holding entries before ${finding.beforeSeq} only. It cannot show whether a newer entry was removed or changed; verify the newest export for that`;
+  }
+};
+var plural = (count, one, many) => `${count} ${count === 1 ? one : many}`;
+var rangeOf = (verdict) => verdict.firstSeq === null || verdict.lastSeq === null ? "no entries yet" : `entries ${verdict.firstSeq} to ${verdict.lastSeq}`;
+var retentionLineOf = (verdict) => verdict.retentionFloor === null ? "  This file says your plan keeps rows without a time limit." : `  This file says rows created before ${verdict.retentionFloor.slice(0, 10)} are past your plan's retention.`;
+var resultLineOf = (verdict, state2) => {
+  if (auditChainVerdictTampered(verdict)) return "  Result: this audit trail was changed after it was recorded.";
+  if (!state2.readable) return "  Result: no changes found in this file, but it was not compared with your earlier runs.";
+  if (!state2.saved) return "  Result: no changes found in this file, but this run could not be saved, so later runs cannot compare against it.";
+  if (siteUnknownToEarlierRuns(verdict, state2)) return "  Result: no changes found in this file, but no earlier run of yours covers this site id.";
+  if (nothingRecordedYet(verdict, state2)) return "  Result: nothing to check. No entries have been recorded for this workspace yet.";
+  if (verdict.entryCount === 0 && verdict.findings.length === 0) return "  Result: this file has no entries, although an earlier run saw entries for this site.";
+  return verdict.findings.length > 0 ? `  Result: no changes found in what could be checked. ${plural(verdict.findings.length, "note", "notes")} above could not be confirmed either way.` : "  Result: no changes found.";
+};
+var earlierRunsLineOf = (verdict, state2) => {
+  if (!state2.readable || state2.knownSiteIds.has(verdict.siteId)) return null;
+  if (state2.knownSiteIds.size > 0) return "  Your earlier runs verified other site ids, never this one. If you checked this site before, its id has changed.";
+  if (verdict.entryCount === 0) return null;
+  if (auditHeadsToRemember(verdict).length === 0) return "  First run for this site. Only its id is kept from a changed file, so later runs know the site but have no entries to compare against.";
+  return state2.saved ? "  First run for this site: later runs compare against what this run saved." : "  First run for this site, but what it found could not be saved for later runs.";
+};
+var describeAuditSiteReport = (verdict, state2) => {
+  const counts = verdict.payloadCounts;
+  const lines = [
+    `${verdict.siteName} (${verdict.siteId}): ${rangeOf(verdict)}, ${plural(verdict.signedCheckpoints, "signed checkpoint", "signed checkpoints")}, exported ${utcMinuteOf(verdict.exportedAt)}`,
+    `  ${counts.included} checked against their row, ${counts.superseded} superseded by a later decision, ${counts.aged_out} past retention, ${counts.changed_since_recorded} changed since recorded`
+  ];
+  const earlierRuns = earlierRunsLineOf(verdict, state2);
+  if (earlierRuns) lines.push(earlierRuns);
+  if (verdict.entryCount > 0) lines.push(retentionLineOf(verdict));
+  if (verdict.truncated) lines.push(`  This file starts at entry ${verdict.firstSeq ?? 1}. For older entries, add &beforeSeq=${verdict.firstSeq ?? 1} to the Verifiable export link.`);
+  for (const finding of verdict.findings) {
+    lines.push(`  ${AUDIT_CHAIN_FINDING_SEVERITY[finding.kind] === "tampered" ? "CHANGED" : "note"}: ${describeAuditFinding(finding)}`);
+  }
+  lines.push(resultLineOf(verdict, state2));
+  return lines;
+};
+
+// bin/pushary-audit.ts
+exitOnHelpFlag("audit");
+var USAGE = "Usage: pushary audit verify <file>\nDownload the file from Dashboard > Agent > Activity > Verifiable.";
+var EXIT_FOR_OUTCOME = {
+  changed: EXIT.PROBLEMS_FOUND,
+  nothing_recorded: EXIT.NOT_CONFIGURED,
+  inconclusive: EXIT.INCONCLUSIVE,
+  no_changes: EXIT.OK
+};
+var raw = process.argv.slice(2);
+var [subcommand, path] = raw[0] === "audit" ? raw.slice(1) : raw;
+if (subcommand !== "verify" || !path) {
+  process.stderr.write(`${USAGE}
+`);
+  process.exit(EXIT.USAGE);
+}
+var read = readAuditExport(path);
+if (read.kind === "unreadable") {
+  process.stderr.write(`Could not read ${path}: ${read.reason}
+`);
+  process.exit(EXIT.USAGE);
+}
+if (read.kind === "not_an_export") {
+  process.stderr.write(`${path} is not a Pushary verifiable audit export.
+${USAGE}
+`);
+  process.exit(EXIT.USAGE);
+}
+var storePath = auditCheckpointStorePath();
+var memory = readVerifierMemory(storePath);
+if (memory.kind === "unreadable") {
+  process.stderr.write(
+    `What earlier runs saved at ${storePath} could not be read: ${memory.reason}.
+This run cannot compare against earlier runs and leaves that file as it is. Repair it, or move it aside to start a new one.
+`
+  );
+}
+var verdicts = verifyAuditExport(read.file, verifierMemoryOf(memory));
+var save = memory.kind === "unreadable" ? null : saveVerifierMemory(storePath, rememberRun(verifierMemoryOf(memory), verdicts));
+if (save && !save.saved) {
+  process.stderr.write(`Could not save what this run found to ${storePath}: ${save.reason}
+The next run cannot compare against this one, so this run cannot count as clean.
+`);
+}
+var state = verifierMemoryStateOf(memory, save?.saved ?? false);
+for (const verdict of verdicts) process.stdout.write(`${describeAuditSiteReport(verdict, state).join("\n")}
+`);
+process.exit(EXIT_FOR_OUTCOME[auditVerifyOutcome(verdicts, state)]);

package/dist/bin/pushary-bell-hook.js

@@ -1,42 +1,43 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-IOQ3ZCAE.js";
+} from "../chunk-FQNMUJTK.js";
 import {
   readHookInput
-} from "../chunk-SA4PCB6N.js";
-import "../chunk-KTM2X3XQ.js";
-import "../chunk-G7RMOSRX.js";
+} from "../chunk-I3T5YV5I.js";
+import "../chunk-FXTUSTQG.js";
+import "../chunk-M7BDKARZ.js";
 import "../chunk-G66WIAST.js";
-import "../chunk-UOE26LPT.js";
-import "../chunk-NZQEABRO.js";
-import "../chunk-VD6CAELE.js";
-import "../chunk-WVAJSBI2.js";
-import "../chunk-VJOMBYY5.js";
-import "../chunk-NMUI3ZWG.js";
-import "../chunk-3OIUMHHO.js";
+import "../chunk-5BX57BGT.js";
+import "../chunk-UUYLBSAU.js";
+import "../chunk-OPV6724W.js";
+import "../chunk-RYUIXLZ5.js";
+import "../chunk-OFRQNTJD.js";
+import "../chunk-ZBT3U2VB.js";
+import "../chunk-U5DBYW63.js";
+import "../chunk-YPY4YCIZ.js";
+import "../chunk-HJ4EBHK4.js";
 import "../chunk-XMSDA5WA.js";
-import "../chunk-3Q2X3T3U.js";
-import "../chunk-XHKBHWLX.js";
-import "../chunk-HYAQIKYB.js";
-import "../chunk-Z2TX7DVU.js";
-import "../chunk-MP3SEXXJ.js";
-import "../chunk-4QO267OY.js";
-import "../chunk-ZCYLCD6L.js";
+import "../chunk-SVZPRTCK.js";
+import "../chunk-GV5TEADP.js";
+import "../chunk-CC4LGKEZ.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-V5DV7XZN.js";
-import "../chunk-7BIVBOD5.js";
-import "../chunk-KLJ2CTT7.js";
-import "../chunk-6N5DQG5F.js";
-import "../chunk-AFGMZZEB.js";
-import "../chunk-O7ITTNDD.js";
-import "../chunk-BQHZRH6S.js";
-import "../chunk-KOUB4ZLX.js";
-import "../chunk-PPY5N2E6.js";
-import "../chunk-KZERVKTD.js";
-import "../chunk-PWGD5EP6.js";
+import "../chunk-PK6LBL3Z.js";
+import "../chunk-NGY2WS3X.js";
+import "../chunk-ID4BZRBW.js";
+import "../chunk-XHKBHWLX.js";
+import "../chunk-PYUN7HNY.js";
+import "../chunk-NKA2PEQQ.js";
+import "../chunk-FH6PHTUD.js";
+import "../chunk-AYWX6M7J.js";
+import "../chunk-VAZCGOLS.js";
+import "../chunk-3A7REECH.js";
+import "../chunk-YU2EUD7O.js";
+import "../chunk-QENTGE75.js";
+import "../chunk-BG4HHB7E.js";
+import "../chunk-YDT6TVGN.js";
 import "../chunk-ZVU6WMMU.js";
-import "../chunk-4FAJQPFY.js";
+import "../chunk-5YVBVJOH.js";
 import "../chunk-MLKGABMK.js";
 
 // bin/pushary-bell-hook.ts

package/dist/bin/pushary-bell.js

@@ -5,40 +5,41 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-IOQ3ZCAE.js";
+} from "../chunk-FQNMUJTK.js";
 import {
   createIo
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-WPK2UWDU.js";
+} from "../chunk-JMTOQXHV.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-VJOMBYY5.js";
+} from "../chunk-U5DBYW63.js";
 import {
   parseFlags
-} from "../chunk-NMUI3ZWG.js";
-import "../chunk-HYAQIKYB.js";
-import "../chunk-AFGMZZEB.js";
+} from "../chunk-YPY4YCIZ.js";
+import "../chunk-NKA2PEQQ.js";
+import "../chunk-FH6PHTUD.js";
 import {
   claudeSettings
-} from "../chunk-O7ITTNDD.js";
+} from "../chunk-AYWX6M7J.js";
+import "../chunk-VAZCGOLS.js";
+import "../chunk-3A7REECH.js";
+import "../chunk-YU2EUD7O.js";
 import {
   readJsonSafe,
   writeJsonAtomic
-} from "../chunk-BQHZRH6S.js";
-import "../chunk-KOUB4ZLX.js";
-import "../chunk-PPY5N2E6.js";
+} from "../chunk-QENTGE75.js";
 import {
   EXIT
-} from "../chunk-KZERVKTD.js";
-import "../chunk-PWGD5EP6.js";
+} from "../chunk-BG4HHB7E.js";
+import "../chunk-YDT6TVGN.js";
 import "../chunk-ZVU6WMMU.js";
 import {
   isRecord
-} from "../chunk-4FAJQPFY.js";
+} from "../chunk-5YVBVJOH.js";
 import "../chunk-MLKGABMK.js";
 
 // bin/pushary-bell.ts

package/dist/bin/pushary-claude.js

@@ -2,7 +2,7 @@
 import {
   WRAPPER_ACTIVE_ENV,
   findClaudeBinary
-} from "../chunk-AWF5WICI.js";
+} from "../chunk-FVERRWDP.js";
 import {
   CommandReceipts,
   controllerCommandSchema
@@ -12,40 +12,21 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-T7G6IIV4.js";
-import "../chunk-LURFSDCL.js";
+} from "../chunk-HHEFOGT2.js";
+import "../chunk-VUFHYMSP.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-CQ7QE4W2.js";
+} from "../chunk-CFTPHNBY.js";
 import {
   claudeTranscriptPath,
   redactDraft,
   registerTranscript,
   registeredTranscriptEnabled,
   startDraftPublisher
-} from "../chunk-KTM2X3XQ.js";
-import "../chunk-G7RMOSRX.js";
+} from "../chunk-FXTUSTQG.js";
+import "../chunk-M7BDKARZ.js";
 import "../chunk-G66WIAST.js";
-import {
-  ensureDaemonRunning
-} from "../chunk-NZQEABRO.js";
-import "../chunk-VD6CAELE.js";
-import "../chunk-WVAJSBI2.js";
-import "../chunk-VJOMBYY5.js";
-import "../chunk-NMUI3ZWG.js";
-import "../chunk-3OIUMHHO.js";
-import {
-  external_exports
-} from "../chunk-XMSDA5WA.js";
-import {
-  transcriptsEnabled
-} from "../chunk-3Q2X3T3U.js";
-import {
-  needsShell,
-  spawnClaude
-} from "../chunk-XHKBHWLX.js";
-import "../chunk-HYAQIKYB.js";
 import {
   DEFAULT_SESSION,
   PHONE_DRIVER,
@@ -59,18 +40,32 @@ import {
   removePendingCommand,
   reportEvent,
   savePendingCommand
-} from "../chunk-Z2TX7DVU.js";
+} from "../chunk-UUYLBSAU.js";
+import {
+  ensureDaemonRunning
+} from "../chunk-OPV6724W.js";
+import "../chunk-RYUIXLZ5.js";
 import {
   UNNAMED_ACTION,
   deriveToolTarget,
   describeStopFailure,
   describeToolCall,
   scopePathFor
-} from "../chunk-MP3SEXXJ.js";
+} from "../chunk-OFRQNTJD.js";
+import "../chunk-ZBT3U2VB.js";
+import "../chunk-U5DBYW63.js";
+import "../chunk-YPY4YCIZ.js";
+import "../chunk-HJ4EBHK4.js";
+import {
+  external_exports
+} from "../chunk-XMSDA5WA.js";
+import {
+  transcriptsEnabled
+} from "../chunk-SVZPRTCK.js";
 import {
   repoKeyFor,
   repositoryScopeFor
-} from "../chunk-4QO267OY.js";
+} from "../chunk-GV5TEADP.js";
 import {
   askUser,
   cancelQuestion,
@@ -82,30 +77,36 @@ import {
   waitForAnswer,
   waitsForThePhone,
   withdrawQuestion
-} from "../chunk-ZCYLCD6L.js";
+} from "../chunk-CC4LGKEZ.js";
 import "../chunk-POFBE6ZY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-V5DV7XZN.js";
-import "../chunk-7BIVBOD5.js";
-import "../chunk-KLJ2CTT7.js";
+} from "../chunk-PK6LBL3Z.js";
+import "../chunk-NGY2WS3X.js";
+import "../chunk-ID4BZRBW.js";
+import {
+  needsShell,
+  spawnClaude
+} from "../chunk-XHKBHWLX.js";
 import {
   getMachineId
-} from "../chunk-6N5DQG5F.js";
-import "../chunk-AFGMZZEB.js";
+} from "../chunk-PYUN7HNY.js";
+import "../chunk-NKA2PEQQ.js";
+import "../chunk-FH6PHTUD.js";
 import {
   claudeConfigDir
-} from "../chunk-O7ITTNDD.js";
-import "../chunk-BQHZRH6S.js";
+} from "../chunk-AYWX6M7J.js";
+import "../chunk-VAZCGOLS.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-KOUB4ZLX.js";
-import "../chunk-PPY5N2E6.js";
-import "../chunk-KZERVKTD.js";
+} from "../chunk-3A7REECH.js";
+import "../chunk-YU2EUD7O.js";
+import "../chunk-QENTGE75.js";
+import "../chunk-BG4HHB7E.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-PWGD5EP6.js";
+} from "../chunk-YDT6TVGN.js";
 import "../chunk-ZVU6WMMU.js";
 import {
   DECISION_STOP_REASON,
@@ -118,7 +119,7 @@ import {
   refusesWhenUnanswered,
   resolveGate,
   timeoutActionWithoutLocalPrompt
-} from "../chunk-4FAJQPFY.js";
+} from "../chunk-5YVBVJOH.js";
 import "../chunk-MLKGABMK.js";
 
 // src/wrapper/localPassthrough.ts