pushary 1.9.103 → 1.9.105

package/dist/{chunk-SA4PCB6N.js → chunk-RKQVMFHN.js}

@@ -1,39 +1,22 @@
+import {
+  cursorGateOwnsClaudeCall,
+  readCursorGateRegistration
+} from "./chunk-OINGJICB.js";
 import {
   registerTranscript
-} from "./chunk-KTM2X3XQ.js";
+} from "./chunk-DS672F57.js";
 import {
   namedEvent
-} from "./chunk-UOE26LPT.js";
-import {
-  isBridgeLocator,
-  liveBridgeProbe,
-  pusharyHookExecutable,
-  resolveBridgeStub
-} from "./chunk-VD6CAELE.js";
+} from "./chunk-JLJJRBTD.js";
 import {
   writeDegraded
-} from "./chunk-ZCYLCD6L.js";
-import {
-  cursorUserHooks
-} from "./chunk-O7ITTNDD.js";
+} from "./chunk-IAASPG5B.js";
 import {
-  atLeast,
-  parseVersion
-} from "./chunk-BQHZRH6S.js";
-import {
-  CURSOR_GATE_COVERAGE,
-  CURSOR_GATE_SCRIPT,
-  HOOK_VERSION_PATTERN,
-  NO_CURSOR_GATE,
   claudeShapedHookInput,
-  cursorGateOwnsToolCall,
   hookCompatibleProfileBySource,
-  isCursorHookPayload,
   isGrokHookPayload,
-  isGrokSessionEndStop,
-  isRecord,
-  toolsCoveredByGateEntry
-} from "./chunk-4FAJQPFY.js";
+  isGrokSessionEndStop
+} from "./chunk-O5TB2LMQ.js";
 
 // src/tool-hook-input.ts
 var OPTIONAL_TEXT_FIELDS = ["hook_event_name", "session_id", "cwd", "transcript_path", "tool_use_id", "permission_mode", "cursor_version"];
@@ -58,72 +41,7 @@ function parseToolHookInput(value) {
 // src/admission.ts
 import { readFileSync } from "fs";
 import { homedir } from "os";
-import { join as join2 } from "path";
-
-// src/cursor-gate-registration.ts
-import { dirname, isAbsolute, join, resolve } from "path";
-var FIRST_PLUGIN_VERSION_HANDLING = {
-  beforeShellExecution: [0, 1, 0],
-  beforeMCPExecution: [0, 2, 1],
-  preToolUse: [0, 2, 2]
-};
-var COMMAND_HOOK_TYPE = "command";
-var PLUGIN_MANIFEST = join(".cursor-plugin", "plugin.json");
-var NO_SPOTLIGHT = () => [];
-var executableName = (executable) => executable.split(/[/\\]/).pop() ?? "";
-var isCursorGateScript = (executable) => executableName(executable) === CURSOR_GATE_SCRIPT;
-var fromHooksDirectory = (path, environment) => isAbsolute(path) ? path : resolve(dirname(environment.hooksFile), path);
-var pluginManifestBeside = (script) => join(dirname(dirname(script)), PLUGIN_MANIFEST);
-var versionIn = (manifest) => {
-  try {
-    const parsed = JSON.parse(manifest);
-    return isRecord(parsed) && typeof parsed.version === "string" && HOOK_VERSION_PATTERN.test(parsed.version) ? parseVersion(parsed.version) : null;
-  } catch {
-    return null;
-  }
-};
-var pluginVersionOf = (script, probe) => {
-  const manifest = probe.readFile(pluginManifestBeside(script));
-  return manifest === null ? null : versionIn(manifest);
-};
-var gateScriptHandles = (script, event, probe) => {
-  if (!probe.exists(script)) return false;
-  const version = pluginVersionOf(script, probe);
-  return version !== null && atLeast(version, FIRST_PLUGIN_VERSION_HANDLING[event]);
-};
-var appBundleResolves = (locator, probe) => resolveBridgeStub(locator, { ...probe, mdfind: NO_SPOTLIGHT }).kind === "bundle";
-var isLiveCursorGateCommand = (command, event, environment) => {
-  const executable = pusharyHookExecutable(command);
-  if (executable === null) return false;
-  const target = fromHooksDirectory(executable, environment);
-  if (isCursorGateScript(executable)) return gateScriptHandles(target, event, environment.probe);
-  return isBridgeLocator(executable) && appBundleResolves(target, environment.probe);
-};
-var isCommandHook = (entry) => entry.type === void 0 || entry.type === COMMAND_HOOK_TYPE;
-var entriesOn = (hooks, event) => {
-  const entries = Object.hasOwn(hooks, event) ? hooks[event] : void 0;
-  return Array.isArray(entries) ? entries.filter(isRecord) : [];
-};
-var runsALiveGate = (entry, event, isLiveGate) => isCommandHook(entry) && typeof entry.command === "string" && isLiveGate(entry.command, event);
-var toolsCoveredOn = (hooks, coverage, isLiveGate) => entriesOn(hooks, coverage.event).filter((entry) => runsALiveGate(entry, coverage.event, isLiveGate)).flatMap((entry) => toolsCoveredByGateEntry(coverage, entry.matcher) ?? []);
-var cursorGateRegistrationOf = (document, isLiveGate) => {
-  if (!isRecord(document) || !isRecord(document.hooks)) return NO_CURSOR_GATE;
-  const hooks = document.hooks;
-  return CURSOR_GATE_COVERAGE.flatMap((coverage) => toolsCoveredOn(hooks, coverage, isLiveGate));
-};
-var userCursorGateEnvironment = () => ({ hooksFile: cursorUserHooks(), probe: liveBridgeProbe() });
-var readCursorGateRegistration = (environment = userCursorGateEnvironment()) => {
-  try {
-    const raw = environment.probe.readFile(environment.hooksFile);
-    if (raw === null) return NO_CURSOR_GATE;
-    return cursorGateRegistrationOf(JSON.parse(raw), (command, event) => isLiveCursorGateCommand(command, event, environment));
-  } catch {
-    return NO_CURSOR_GATE;
-  }
-};
-var cursorGateOwnsClaudeCall = (payload, readRegistration) => isCursorHookPayload(payload) && cursorGateOwnsToolCall(readRegistration(), payload.tool_name);
-
-// src/admission.ts
+import { join } from "path";
 var NO_RULES = { version: 1, disabled: [] };
 var SUPPORTED_VERSION = 1;
 var parseAdmissionRules = (raw) => {
@@ -140,7 +58,7 @@ var parseAdmissionRules = (raw) => {
     return NO_RULES;
   }
 };
-var admissionRulesFile = () => process.env.PUSHARY_ADMISSION_FILE?.trim() || join2(homedir(), ".pushary", "admission-rules.json");
+var admissionRulesFile = () => process.env.PUSHARY_ADMISSION_FILE?.trim() || join(homedir(), ".pushary", "admission-rules.json");
 var readAdmissionRules = () => {
   try {
     return parseAdmissionRules(readFileSync(admissionRulesFile(), "utf-8"));

package/dist/{chunk-LURFSDCL.js → chunk-ROVLRXBI.js}

@@ -1,6 +1,6 @@
 import {
   isFile
-} from "./chunk-BQHZRH6S.js";
+} from "./chunk-T5I4PKOQ.js";
 
 // src/claude-native-install.ts
 import { accessSync, constants } from "fs";

package/dist/{chunk-JKOAAIJD.js → chunk-S2TTGX6F.js}

@@ -1,19 +1,19 @@
 import {
   macAppBridgeAvailable
-} from "./chunk-PM34Z5WX.js";
+} from "./chunk-IHQRLJEP.js";
 import {
   keyPrefix
-} from "./chunk-HYAQIKYB.js";
+} from "./chunk-B7O4CXFX.js";
 import {
   bridgeAgentKey
-} from "./chunk-O7ITTNDD.js";
+} from "./chunk-JCSJEMTA.js";
 import {
   readJsonSafe
-} from "./chunk-BQHZRH6S.js";
+} from "./chunk-T5I4PKOQ.js";
 import {
   isRecord,
   isValidApiKey
-} from "./chunk-4FAJQPFY.js";
+} from "./chunk-O5TB2LMQ.js";
 
 // src/shared-mcp-key.ts
 var asRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;

package/dist/{chunk-Y3SZVZF6.js → chunk-S75UO75C.js}

@@ -521,7 +521,7 @@ var loadedOnce = (load) => {
 };
 
 // src/codex-desktop-proxy.ts
-var loadThePhone = () => import("./api-3O3GJV3V.js");
+var loadThePhone = () => import("./api-RL5CPDTH.js");
 var theFirstCardLoadsAgain = () => {
 };
 var APP_SERVER_COMMAND = "app-server";
@@ -1062,7 +1062,7 @@ var codexDesktopCommand = async (args, entry, readAccount) => {
     return runCodexDesktopProxy(engine2, args.slice(3), readAccount, { watchesForCards: layoutIsKnown });
   }
   if (args[0] === APP_CARDS_FLAG) {
-    const { codexAppCardsCommandOnThisMac } = await import("./codex-app-cards-switch-D475JLP5.js");
+    const { codexAppCardsCommandOnThisMac } = await import("./codex-app-cards-switch-FD2ZWLYL.js");
     return codexAppCardsCommandOnThisMac(args.slice(1), entry, readAccount);
   }
   if (args.length > 2) throw new Error("Usage: pushary codex --desktop [path/to/Codex.app]");

package/dist/chunk-T5I4PKOQ.js

@@ -0,0 +1,122 @@
+// src/cli/fsx.ts
+import { constants as fsConstants, copyFileSync, fstatSync, lstatSync, realpathSync, existsSync, fchmodSync, fsyncSync, mkdirSync, openSync, closeSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+var readJsonSafe = (filePath) => {
+  let raw;
+  try {
+    raw = readFileSync(filePath, "utf-8");
+  } catch (err) {
+    const error = err;
+    if (error.code === "ENOENT") return { kind: "missing" };
+    return { kind: "unreadable", error };
+  }
+  if (raw.trim() === "") return { kind: "ok", value: {} };
+  try {
+    const value = JSON.parse(raw);
+    return { kind: "ok", value };
+  } catch (err) {
+    return { kind: "unparseable", error: err, raw };
+  }
+};
+var MISSING_FILE_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
+var isMissingFileError = (error) => error instanceof Error && "code" in error && typeof error.code === "string" && MISSING_FILE_CODES.has(error.code);
+var READ_WITHOUT_WAITING = fsConstants.O_RDONLY | (fsConstants.O_NONBLOCK ?? 0);
+var notARegularFile = (filePath, maxBytes) => new Error(`${filePath} is not a regular file of at most ${maxBytes} bytes`);
+var regularFileTextOf = (fd, filePath, maxBytes) => {
+  const stats = fstatSync(fd);
+  if (!stats.isFile() || stats.size > maxBytes) return { kind: "unreadable", error: notARegularFile(filePath, maxBytes) };
+  return { kind: "ok", value: readFileSync(fd, "utf-8") };
+};
+var readRegularTextFile = (filePath, maxBytes) => {
+  let fd;
+  try {
+    fd = openSync(filePath, READ_WITHOUT_WAITING);
+  } catch (error) {
+    return isMissingFileError(error) ? { kind: "missing" } : { kind: "unreadable", error: error instanceof Error ? error : new Error(String(error)) };
+  }
+  try {
+    return regularFileTextOf(fd, filePath, maxBytes);
+  } catch (error) {
+    return { kind: "unreadable", error: error instanceof Error ? error : new Error(String(error)) };
+  } finally {
+    closeSync(fd);
+  }
+};
+var readRegularJsonFile = (filePath, maxBytes) => {
+  const text = readRegularTextFile(filePath, maxBytes);
+  if (text.kind !== "ok") return text;
+  if (text.value.trim() === "") return { kind: "ok", value: {} };
+  try {
+    return { kind: "ok", value: JSON.parse(text.value) };
+  } catch (error) {
+    return { kind: "unparseable", error: error instanceof Error ? error : new Error(String(error)), raw: text.value };
+  }
+};
+var isFile = (path) => {
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+};
+var readFileOrMissing = (path) => {
+  try {
+    return readFileSync(path, "utf-8");
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
+    throw error;
+  }
+};
+var stamp = () => (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+var backupFile = (filePath) => {
+  const target = `${filePath}.pushary-backup-${stamp()}`;
+  copyFileSync(filePath, target);
+  return target;
+};
+var writeFileAtomic = (filePath, contents, mode, encoding = "utf-8") => {
+  const target = lstatSync(filePath, { throwIfNoEntry: false })?.isSymbolicLink() ? realpathSync(filePath) : filePath;
+  const dir = dirname(target);
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  const temp = join(dir, `.${process.pid}-${stamp()}.pushary-tmp`);
+  try {
+    writeFileSync(temp, contents, mode === void 0 ? encoding : { encoding, mode });
+    const handle = openSync(temp, "r+");
+    try {
+      if (mode !== void 0) fchmodSync(handle, mode);
+      fsyncSync(handle);
+    } finally {
+      closeSync(handle);
+    }
+    renameSync(temp, target);
+  } catch (err) {
+    try {
+      if (existsSync(temp)) unlinkSync(temp);
+    } catch {
+    }
+    throw err;
+  }
+};
+var writeJsonAtomic = (filePath, data, mode) => writeFileAtomic(filePath, `${JSON.stringify(data, null, 2)}
+`, mode);
+var writeJsonAtomicDurable = (filePath, data, mode) => {
+  writeJsonAtomic(filePath, data, mode);
+  if (process.platform === "win32") return;
+  const directory = openSync(dirname(filePath), "r");
+  try {
+    fsyncSync(directory);
+  } finally {
+    closeSync(directory);
+  }
+};
+
+export {
+  readJsonSafe,
+  readRegularTextFile,
+  readRegularJsonFile,
+  isFile,
+  readFileOrMissing,
+  backupFile,
+  writeFileAtomic,
+  writeJsonAtomic,
+  writeJsonAtomicDurable
+};

package/dist/{chunk-3K7PB5LI.js → chunk-TXMYET7E.js}

@@ -1,12 +1,12 @@
 import {
   CODEX_HOOK_STATUS
-} from "./chunk-RVSRPDRF.js";
+} from "./chunk-VKTW5WVB.js";
 import {
   retryAgentCommand
-} from "./chunk-JECH4NJL.js";
+} from "./chunk-FJYUB3ZK.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-PWGD5EP6.js";
+} from "./chunk-YDQ6OJMF.js";
 
 // src/setup/codex-trust.ts
 var CODEX_TRUST_TELEMETRY = {

package/dist/{chunk-CQ7QE4W2.js → chunk-UUJQK7DJ.js}

@@ -1,6 +1,6 @@
 import {
   DEFAULT_SESSION
-} from "./chunk-Z2TX7DVU.js";
+} from "./chunk-KHZCJP7P.js";
 
 // src/answer.ts
 var isDeferAnswer = (value) => value === "defer";

package/dist/{chunk-SXAZPWL7.js → chunk-UXIUCMFO.js}

@@ -4,13 +4,13 @@ import {
   configFailureKind,
   retryAgentCommand,
   writeSetupConfigFile
-} from "./chunk-JECH4NJL.js";
+} from "./chunk-FJYUB3ZK.js";
 import {
   MCP_BRIDGE_BINARY
-} from "./chunk-AZSOH2SF.js";
+} from "./chunk-DA57ZI62.js";
 import {
   KEY_FILE_MODE
-} from "./chunk-HYAQIKYB.js";
+} from "./chunk-B7O4CXFX.js";
 import {
   CLINE_SERVER_NAME_TAKEN,
   CLINE_SETTINGS_REFUSALS,
@@ -32,13 +32,15 @@ import {
   withClinePusharyServer,
   withRefreshedClineKey,
   withoutClinePusharyServer
-} from "./chunk-O7ITTNDD.js";
+} from "./chunk-JCSJEMTA.js";
+import {
+  resolveGlobalBinary
+} from "./chunk-ZCBTCW3T.js";
 import {
   readJsonSafe,
-  resolveGlobalBinary,
   writeFileAtomic,
   writeJsonAtomic
-} from "./chunk-BQHZRH6S.js";
+} from "./chunk-T5I4PKOQ.js";
 
 // src/fx-config.ts
 var FX_SERVER_NAME = "pushary";

package/dist/{chunk-JVE4P54I.js → chunk-VCWLGM77.js}

@@ -1,12 +1,14 @@
 import {
   autoUpdateLock
-} from "./chunk-O7ITTNDD.js";
+} from "./chunk-JCSJEMTA.js";
 import {
   installPackageGlobally,
   npmErrorMessage,
-  npmExitedOnPermissionDenied,
+  npmExitedOnPermissionDenied
+} from "./chunk-ZCBTCW3T.js";
+import {
   writeJsonAtomic
-} from "./chunk-BQHZRH6S.js";
+} from "./chunk-T5I4PKOQ.js";
 
 // src/upgrade-lock.ts
 import { fork } from "child_process";

package/dist/{chunk-RVSRPDRF.js → chunk-VKTW5WVB.js}

@@ -7,10 +7,10 @@ import {
   codexHome,
   codexHooksJsonIn,
   isPusharyCodexCommand
-} from "./chunk-O7ITTNDD.js";
+} from "./chunk-JCSJEMTA.js";
 import {
   resolvePathBinary
-} from "./chunk-BQHZRH6S.js";
+} from "./chunk-ZCBTCW3T.js";
 import {
   getPackageVersion
 } from "./chunk-ZVU6WMMU.js";

package/dist/{chunk-T6TQETDN.js → chunk-WTREXZGS.js}

@@ -12,7 +12,7 @@ import {
   reachVerdict,
   reachesYou,
   verifyDelivery
-} from "./chunk-O5ZKMUTP.js";
+} from "./chunk-X4TZN52V.js";
 import {
   humanIsTty,
   writeHuman
@@ -24,14 +24,14 @@ import {
 } from "./chunk-FO3MDD26.js";
 import {
   reportedInstallSource
-} from "./chunk-AFGMZZEB.js";
+} from "./chunk-Z5FV7LTD.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-PWGD5EP6.js";
+} from "./chunk-YDQ6OJMF.js";
 import {
   NO_PAIRING_COMPUTER,
   PAIR_TTL_SECONDS
-} from "./chunk-4FAJQPFY.js";
+} from "./chunk-O5TB2LMQ.js";
 
 // src/onboarding.ts
 import qrcodeTerminal from "qrcode-terminal";

package/dist/chunk-WUIWHGKF.js

@@ -0,0 +1,56 @@
+import {
+  claudeConfigDir
+} from "./chunk-JCSJEMTA.js";
+import {
+  claudePermissionRulesFromSettings
+} from "./chunk-O5TB2LMQ.js";
+
+// src/claude-permission-rules.ts
+import { readFileSync, statSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var MANAGED_CLAUDE_SETTINGS_BY_PLATFORM = {
+  darwin: "/Library/Application Support/ClaudeCode/managed-settings.json",
+  linux: "/etc/claude-code/managed-settings.json",
+  win32: "C:\\ProgramData\\ClaudeCode\\managed-settings.json"
+};
+var MAX_CLAUDE_SETTINGS_BYTES = 1048576;
+var claudeSettingsLocationFor = (cwd, environment = process.env, home = homedir(), platform = process.platform) => ({
+  configDir: claudeConfigDir(home, environment),
+  projectDir: environment.CLAUDE_PROJECT_DIR || cwd || void 0,
+  managedSettingsPath: MANAGED_CLAUDE_SETTINGS_BY_PLATFORM[platform]
+});
+var claudeSettingsSources = (location) => [
+  ...location.managedSettingsPath ? [{ path: location.managedSettingsPath, trust: "grants" }] : [],
+  { path: join(location.configDir, "settings.json"), trust: "grants" },
+  ...location.projectDir ? [
+    { path: join(location.projectDir, ".claude", "settings.json"), trust: "restricts_only" },
+    { path: join(location.projectDir, ".claude", "settings.local.json"), trust: "grants" }
+  ] : []
+];
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var restrictionsOnly = (document) => {
+  if (!isRecord(document) || !isRecord(document.permissions)) return null;
+  const { ask, deny } = document.permissions;
+  return { permissions: { ask, deny } };
+};
+var readSettingsDocument = (path) => {
+  try {
+    const stats = statSync(path);
+    if (!stats.isFile() || stats.size > MAX_CLAUDE_SETTINGS_BYTES) return null;
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+};
+var trustedDocument = ({ path, trust }) => {
+  const document = readSettingsDocument(path);
+  return trust === "grants" ? document : restrictionsOnly(document);
+};
+var readClaudePermissionRules = (location) => claudePermissionRulesFromSettings(claudeSettingsSources(location).map(trustedDocument));
+
+export {
+  MANAGED_CLAUDE_SETTINGS_BY_PLATFORM,
+  claudeSettingsLocationFor,
+  readClaudePermissionRules
+};

package/dist/{chunk-IOQ3ZCAE.js → chunk-X3QG5RT5.js}

@@ -1,6 +1,6 @@
 import {
   readConfigFileKey
-} from "./chunk-HYAQIKYB.js";
+} from "./chunk-B7O4CXFX.js";
 
 // src/bell/fleet.ts
 import { closeSync, constants, futimesSync, lstatSync, mkdirSync, openSync, readdirSync, unlinkSync } from "fs";

package/dist/{chunk-O5ZKMUTP.js → chunk-X4TZN52V.js}

@@ -1,19 +1,19 @@
 import {
   APPROVAL_RULES_PATH,
   canChangeApprovalSettings
-} from "./chunk-WYJ6QM7K.js";
+} from "./chunk-2HC5ISDW.js";
 import {
   callMcpTool
-} from "./chunk-V5DV7XZN.js";
+} from "./chunk-PFZCLG55.js";
 import {
   absoluteUrl
-} from "./chunk-7BIVBOD5.js";
+} from "./chunk-EMSRB2KH.js";
 import {
   getBaseUrl
-} from "./chunk-KOUB4ZLX.js";
+} from "./chunk-GKCDMAUM.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-PWGD5EP6.js";
+} from "./chunk-YDQ6OJMF.js";
 import {
   AGENT_STOP_DEFAULT_SECONDS,
   APPROVAL_MODE_META,
@@ -21,7 +21,7 @@ import {
   classifyConfirmResponse,
   isAnswerSource,
   roundTripAsk
-} from "./chunk-4FAJQPFY.js";
+} from "./chunk-O5TB2LMQ.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {

package/dist/{chunk-AHIAB7JQ.js → chunk-XN527J4W.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_HOLD_BUDGET_ENV,
   hookHoldBudgetProof
-} from "./chunk-4FAJQPFY.js";
+} from "./chunk-O5TB2LMQ.js";
 
 // src/hold-budget.ts
 var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {

package/dist/{chunk-PWGD5EP6.js → chunk-YDQ6OJMF.js}

@@ -2,7 +2,7 @@ import {
   DISCONNECT_AGENT_IDS,
   SETUP_AGENT_CHOICES,
   isApprovalMode
-} from "./chunk-4FAJQPFY.js";
+} from "./chunk-O5TB2LMQ.js";
 
 // src/cli/mode-request.ts
 var parseDuration = (value) => {
@@ -112,6 +112,12 @@ var COMMAND_LIST = [
   { name: "mode", module: "pushary-mode", summary: "Choose where approval requests appear" },
   { name: "wait", module: "pushary-wait", summary: 'Show or set the "wait for your phone" ladder (pushary wait 45)' },
   { name: "stats", module: "pushary-stats", summary: "Show the approval moments your agents hit while not connected" },
+  {
+    name: "audit",
+    module: "pushary-audit",
+    summary: "Check a verifiable audit export: every hash, every signature, and the checkpoints you verified before",
+    detail: ["Download the file from Dashboard > Agent > Activity > Verifiable, then run: pushary audit verify <file>"]
+  },
   {
     name: "suggestions",
     module: "pushary-suggestions",

package/dist/{chunk-NMUI3ZWG.js → chunk-YPY4YCIZ.js}

@@ -1,6 +1,6 @@
 import {
   UsageError
-} from "./chunk-PPY5N2E6.js";
+} from "./chunk-YU2EUD7O.js";
 
 // src/cli/flags.ts
 var normalize = (raw) => raw.replace(/^--?/, "");

package/dist/{chunk-PPY5N2E6.js → chunk-YU2EUD7O.js}

@@ -1,6 +1,6 @@
 import {
   EXIT
-} from "./chunk-KZERVKTD.js";
+} from "./chunk-BG4HHB7E.js";
 
 // src/cli/errors.ts
 var UsageError = class extends Error {

package/dist/{chunk-AFGMZZEB.js → chunk-Z5FV7LTD.js}

@@ -1,9 +1,9 @@
 import {
   configFilePath
-} from "./chunk-KOUB4ZLX.js";
+} from "./chunk-GKCDMAUM.js";
 import {
   normalizeInstallSource
-} from "./chunk-4FAJQPFY.js";
+} from "./chunk-O5TB2LMQ.js";
 
 // src/install-source.ts
 import { readFileSync } from "fs";