pushary 1.9.108 → 1.9.110

package/dist/{chunk-A37RKFI3.js → chunk-CUOFHW7F.js}

@@ -1,17 +1,17 @@
 import {
   compatibleConfigFile,
   hasCompatibleHooks
-} from "./chunk-JLJJRBTD.js";
+} from "./chunk-WKBXLLDY.js";
 import {
   pusharyHookExecutable
-} from "./chunk-MFJHLVIZ.js";
+} from "./chunk-T72BV3CU.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-JCSJEMTA.js";
+} from "./chunk-FYSQQW6Q.js";
 import {
   isRecord
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/cursor-config.ts
 var hookCommandOf = (entry) => {

package/dist/{chunk-YDQ6OJMF.js → chunk-DLS43QDO.js}

@@ -2,7 +2,7 @@ import {
   DISCONNECT_AGENT_IDS,
   SETUP_AGENT_CHOICES,
   isApprovalMode
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/cli/mode-request.ts
 var parseDuration = (value) => {

package/dist/{chunk-Z5FV7LTD.js → chunk-DOHQKE4Y.js}

@@ -1,9 +1,9 @@
 import {
   configFilePath
-} from "./chunk-GKCDMAUM.js";
+} from "./chunk-QYBQCMRP.js";
 import {
   normalizeInstallSource
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/install-source.ts
 import { readFileSync } from "fs";

package/dist/{chunk-IAASPG5B.js → chunk-DP62DH2Q.js}

@@ -6,18 +6,21 @@ import {
   McpToolError,
   SubscriptionRequiredError,
   callMcpTool
-} from "./chunk-PFZCLG55.js";
+} from "./chunk-OJZ3CVGK.js";
 import {
   installNetworkDefaults,
   isNetworkFailure
-} from "./chunk-LL7SW4RL.js";
+} from "./chunk-XNMSVXB4.js";
+import {
+  fetchAsCredential
+} from "./chunk-DZMKNP3I.js";
 import {
   clientReportClaims
-} from "./chunk-JCSJEMTA.js";
+} from "./chunk-FYSQQW6Q.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-GKCDMAUM.js";
+} from "./chunk-QYBQCMRP.js";
 import {
   ASK_AGENT_NAME_MAX,
   CLIENT_REPORT_PATH,
@@ -26,7 +29,7 @@ import {
   TOOL_FAILURE_CODES,
   degradedLine,
   truncateLine
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/api.ts
 import { randomUUID } from "crypto";
@@ -153,12 +156,12 @@ var createClientErrorReporter = (deps) => {
       const signal = AbortSignal.timeout(CLIENT_REPORT_TIMEOUT_MS);
       for (let attempt = 0; attempt < CLIENT_REPORT_MAX_ATTEMPTS && !signal.aborted; attempt++) {
         try {
-          const response = await deps.fetchImpl(`${deps.baseUrl()}${CLIENT_REPORT_PATH}`, {
+          const response = await fetchAsCredential(apiKey, `${deps.baseUrl()}${CLIENT_REPORT_PATH}`, {
             method: "POST",
             headers: { "Authorization": `Bearer ${apiKey}`, "Content-Type": "application/json" },
             body: JSON.stringify({ ...event, occurredAt: new Date(now).toISOString() }),
             signal
-          });
+          }, deps.fetchImpl);
           await response.body?.cancel();
           if (response.ok || response.status < 500 && response.status !== 429) return;
         } catch {
@@ -295,7 +298,7 @@ var sendNotification = async (apiKey, params, timeoutMs = 15e3, signal) => {
 var GATE_PATH = "/api/agent/gate";
 var BLOCKED_ACTION_CLAIM_PATH = "/api/agent/blocked-action/claim";
 var postAgentRequest = async (apiKey, path, body, timeoutMs) => {
-  const response = await fetch(`${getBaseUrl()}${path}`, {
+  const response = await fetchAsCredential(apiKey, `${getBaseUrl()}${path}`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
     body: JSON.stringify(body),

package/dist/{chunk-ZCBTCW3T.js → chunk-DQKTKMR3.js}

@@ -399,9 +399,9 @@ var installGlobally = (options) => {
   }
   const started = (async () => {
     if (!npmIsOnPath()) throw new NpmMissingError();
-    const { withUpgradeLock } = await import("./global-upgrade-NBSY5436.js");
-    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-LWTVHYAJ.js");
-    const { autoUpdateLock } = await import("./paths-OE5APZ4Q.js");
+    const { withUpgradeLock } = await import("./global-upgrade-CBBBQIWS.js");
+    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-J6MD575X.js");
+    const { autoUpdateLock } = await import("./paths-GMKZGF5F.js");
     let result = "skipped";
     const install = async () => {
       const platform = process.platform;

package/dist/{chunk-UXIUCMFO.js → chunk-DSA5E7IB.js}

@@ -4,13 +4,13 @@ import {
   configFailureKind,
   retryAgentCommand,
   writeSetupConfigFile
-} from "./chunk-FJYUB3ZK.js";
+} from "./chunk-TTDJHOYY.js";
 import {
   MCP_BRIDGE_BINARY
-} from "./chunk-DA57ZI62.js";
+} from "./chunk-NBNWMQH4.js";
 import {
   KEY_FILE_MODE
-} from "./chunk-B7O4CXFX.js";
+} from "./chunk-XF3K42EV.js";
 import {
   CLINE_SERVER_NAME_TAKEN,
   CLINE_SETTINGS_REFUSALS,
@@ -32,10 +32,10 @@ import {
   withClinePusharyServer,
   withRefreshedClineKey,
   withoutClinePusharyServer
-} from "./chunk-JCSJEMTA.js";
+} from "./chunk-FYSQQW6Q.js";
 import {
   resolveGlobalBinary
-} from "./chunk-ZCBTCW3T.js";
+} from "./chunk-DQKTKMR3.js";
 import {
   readJsonSafe,
   writeFileAtomic,

package/dist/chunk-DZMKNP3I.js

@@ -0,0 +1,81 @@
+import {
+  CREDENTIAL_REJECTED,
+  CREDENTIAL_REJECTION_HEADER,
+  CREDENTIAL_REJECTION_STATUS,
+  MCP_CREDENTIAL_REJECTION_BODY,
+  isRecord,
+  responseRejectsCredential
+} from "./chunk-NMSRA7QO.js";
+
+// src/credential-rejection.ts
+import { createHash, randomUUID } from "crypto";
+import { readFileSync, renameSync, unlinkSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+var CREDENTIAL_REJECTION_TTL_MS = 6e4;
+var REMEMBERED_REJECTION_MODE = 384;
+var serverOf = (url) => {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return url;
+  }
+};
+var credentialFingerprint = (credential, url) => createHash("sha256").update(`credential:${serverOf(url)}
+${credential}`).digest("hex");
+var credentialRejectionFile = (credential, url) => join(tmpdir(), `pushary-credential-${credentialFingerprint(credential, url).slice(0, 12)}.json`);
+var isRememberedRejection = (value) => isRecord(value) && typeof value.fingerprint === "string" && typeof value.rejectedAt === "number" && Number.isFinite(value.rejectedAt);
+var readRememberedRejection = (credential, url) => {
+  try {
+    const parsed = JSON.parse(readFileSync(credentialRejectionFile(credential, url), "utf-8"));
+    return isRememberedRejection(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+};
+var credentialRecentlyRejected = (credential, url, now) => {
+  const remembered = readRememberedRejection(credential, url);
+  if (!remembered || remembered.fingerprint !== credentialFingerprint(credential, url)) return false;
+  const age = (now ?? Date.now()) - remembered.rejectedAt;
+  return age >= 0 && age < CREDENTIAL_REJECTION_TTL_MS;
+};
+var discardStagedRejection = (staged) => {
+  try {
+    unlinkSync(staged);
+  } catch {
+    return;
+  }
+};
+var rememberRejectedCredential = (credential, url, now = Date.now()) => {
+  const remembered = { fingerprint: credentialFingerprint(credential, url), rejectedAt: now };
+  const file = credentialRejectionFile(credential, url);
+  const staged = `${file}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(staged, JSON.stringify(remembered), { encoding: "utf-8", mode: REMEMBERED_REJECTION_MODE, flag: "wx" });
+  } catch {
+    return;
+  }
+  try {
+    renameSync(staged, file);
+  } catch {
+    discardStagedRejection(staged);
+  }
+};
+var rememberedRejectionResponse = () => new Response(MCP_CREDENTIAL_REJECTION_BODY, {
+  status: CREDENTIAL_REJECTION_STATUS,
+  statusText: "Unauthorized",
+  headers: { "content-type": "application/json", [CREDENTIAL_REJECTION_HEADER]: CREDENTIAL_REJECTED }
+});
+var fetchAsCredential = async (credential, url, init, fetchImpl = fetch) => {
+  if (credentialRecentlyRejected(credential, url)) {
+    init.signal?.throwIfAborted();
+    return rememberedRejectionResponse();
+  }
+  const response = await fetchImpl(url, init);
+  if (responseRejectsCredential(response.status, response.headers)) rememberRejectedCredential(credential, url);
+  return response;
+};
+
+export {
+  fetchAsCredential
+};

package/dist/{chunk-B5Q44HKN.js → chunk-E4ZZMAWF.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-BG4HHB7E.js";
 import {
   renderCommandHelp
-} from "./chunk-YDQ6OJMF.js";
+} from "./chunk-DLS43QDO.js";
 import {
   getPackageVersion
 } from "./chunk-ZVU6WMMU.js";

package/dist/{chunk-XN527J4W.js → chunk-FBDUY6RN.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_HOLD_BUDGET_ENV,
   hookHoldBudgetProof
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/hold-budget.ts
 var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {

package/dist/{chunk-4XE3DVF7.js → chunk-FE4CSARF.js}

@@ -1,14 +1,17 @@
 import {
   external_exports
 } from "./chunk-XMSDA5WA.js";
+import {
+  fetchAsCredential
+} from "./chunk-DZMKNP3I.js";
 import {
   getBaseUrl
-} from "./chunk-GKCDMAUM.js";
+} from "./chunk-QYBQCMRP.js";
 import {
   compressTranscriptRecord,
   redactSecretsFromContent,
   transcriptRecordPlaintext
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/transcript-api.ts
 var providerRecipientSchema = external_exports.object({
@@ -32,7 +35,7 @@ var retentionDaysOf = (sessionHistory) => {
 var fetchTranscriptRecipients = async (apiKey, baseUrl = getBaseUrl(), unavailable) => {
   unavailable?.("capture_failed");
   try {
-    const res = await fetch(`${baseUrl}/api/agent/encryption-account`, {
+    const res = await fetchAsCredential(apiKey, `${baseUrl}/api/agent/encryption-account`, {
       headers: { Authorization: `Bearer ${apiKey}` },
       signal: AbortSignal.timeout(5e3)
     });

package/dist/{chunk-LK3WA6MK.js → chunk-FLH5MJOS.js}

@@ -1,6 +1,6 @@
 import {
   SETUP_FLAGS
-} from "./chunk-DH22FQAS.js";
+} from "./chunk-MZDFTXXO.js";
 import {
   parseFlags
 } from "./chunk-YPY4YCIZ.js";
@@ -9,7 +9,7 @@ import {
 } from "./chunk-YU2EUD7O.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-YDQ6OJMF.js";
+} from "./chunk-DLS43QDO.js";
 import {
   CLAUDE_CONNECTOR_GUIDE,
   CLAUDE_CONNECTOR_STEPS,
@@ -17,7 +17,7 @@ import {
   CLAUDE_CONNECTOR_URL,
   COWORK_CONNECTOR_LIMIT,
   COWORK_STANDING_INSTRUCTIONS
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/cli/cowork.ts
 import { readFileSync } from "fs";

package/dist/{chunk-GBHP3LML.js → chunk-FRY3LB5N.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-JCSJEMTA.js";
+} from "./chunk-FYSQQW6Q.js";
 import {
   readRegularJsonFile,
   writeFileAtomic
@@ -13,7 +13,7 @@ import {
   serializeDeclinedAgents,
   withDeclinedAgent,
   withoutDeclinedAgent
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/declined-agents-file.ts
 import { join } from "path";

package/dist/{chunk-JCSJEMTA.js → chunk-FYSQQW6Q.js}

@@ -3,7 +3,7 @@ import {
   formatVersion,
   quoteIfNeeded,
   shellDoubleQuoted
-} from "./chunk-ZCBTCW3T.js";
+} from "./chunk-DQKTKMR3.js";
 import {
   writeFileAtomic
 } from "./chunk-T5I4PKOQ.js";
@@ -17,7 +17,7 @@ import {
   HOOK_LOCATOR_BINARY,
   PRETOOLUSE_GATED_TOOLS,
   withHookHoldBudget
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/setup/paths.ts
 import { createHash as createHash2 } from "crypto";

package/dist/{chunk-I3IUS4SR.js → chunk-G2TL4OEY.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-JCSJEMTA.js";
+} from "./chunk-FYSQQW6Q.js";
 import {
   writeFileAtomic
 } from "./chunk-T5I4PKOQ.js";

package/dist/{chunk-EMSRB2KH.js → chunk-GOUUFBBP.js}

@@ -1,9 +1,9 @@
 import {
   pusharyFetch
-} from "./chunk-LL7SW4RL.js";
+} from "./chunk-XNMSVXB4.js";
 import {
   getBaseUrl
-} from "./chunk-GKCDMAUM.js";
+} from "./chunk-QYBQCMRP.js";
 import {
   NetworkError
 } from "./chunk-YU2EUD7O.js";
@@ -13,7 +13,7 @@ import {
 import {
   isValidApiKey,
   normalizeKeyScope
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/session.ts
 var samePusharyAccount = (left, right) => left.kind === "ok" && right.kind === "ok" && left.identity.workspaceId !== "" && left.identity.workspaceId === right.identity.workspaceId && left.identity.siteId === right.identity.siteId;

package/dist/{chunk-DIVVLBZZ.js → chunk-HENHPRJN.js}

@@ -4,7 +4,7 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "./chunk-HH5NNPB5.js";
+} from "./chunk-S7ZX7V5S.js";
 import {
   CommandReceipts,
   controllerCommandSchema
@@ -14,21 +14,21 @@ import {
   describeIdleWindow,
   idleDeadlinePassed,
   startProcessOwnership
-} from "./chunk-FE5JENEJ.js";
+} from "./chunk-YLLQZ6MR.js";
 import {
   repositoryScopeFor
-} from "./chunk-LMDXQIYT.js";
+} from "./chunk-ALA2OMOM.js";
 import {
   isAskUserResponse,
   isDecisionStopped,
   isWaitForAnswerResponse,
   withdrawQuestion,
   writeDegraded
-} from "./chunk-IAASPG5B.js";
+} from "./chunk-DP62DH2Q.js";
 import {
   callMcpTool,
   isRetryable
-} from "./chunk-PFZCLG55.js";
+} from "./chunk-OJZ3CVGK.js";
 import {
   spawnClaude
 } from "./chunk-XHKBHWLX.js";
@@ -52,7 +52,7 @@ import {
   parseCodexQuestions,
   planElicitationAsk,
   readElicitationFields
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/codex-question-owner.ts
 import { createHash } from "crypto";

package/dist/{chunk-7X55ZQS3.js → chunk-I2LPRMDP.js}

@@ -1,19 +1,19 @@
 import {
   notificationAnswerStep
-} from "./chunk-VK4PPVWB.js";
+} from "./chunk-KAG2BWDB.js";
 import {
   canChangeApprovalSettings
-} from "./chunk-2HC5ISDW.js";
+} from "./chunk-5IRJERK2.js";
 import {
   matchMacAccountStep,
   retryAgentCommand
-} from "./chunk-FJYUB3ZK.js";
+} from "./chunk-TTDJHOYY.js";
 import {
   EXIT
 } from "./chunk-BG4HHB7E.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-YDQ6OJMF.js";
+} from "./chunk-DLS43QDO.js";
 
 // src/setup/closing.ts
 var ACTIVITY_URL = "pushary.com/dashboard/agent/activity";

package/dist/{chunk-43PNDDB3.js → chunk-JDIWIRUN.js}

@@ -2,10 +2,10 @@ import {
   SIGNED_OUT_ON_MAC_MESSAGE,
   describeSignedOutKey,
   readSignedOutDiagnosis
-} from "./chunk-772NHSQB.js";
+} from "./chunk-S2FLLNQI.js";
 import {
   APPROVAL_RULES_PATH
-} from "./chunk-2HC5ISDW.js";
+} from "./chunk-5IRJERK2.js";
 import {
   createIo
 } from "./chunk-FO3MDD26.js";
@@ -14,19 +14,19 @@ import {
   checkApiKey,
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-EMSRB2KH.js";
+} from "./chunk-GOUUFBBP.js";
 import {
   readKeySource
-} from "./chunk-B7O4CXFX.js";
+} from "./chunk-XF3K42EV.js";
 import {
   getBaseUrl
-} from "./chunk-GKCDMAUM.js";
+} from "./chunk-QYBQCMRP.js";
 import {
   EXIT
 } from "./chunk-BG4HHB7E.js";
 import {
   KEY_SCOPE
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/cli/report-key.ts
 var { dim, yellow } = createIo();

package/dist/{chunk-VKTW5WVB.js → chunk-JMQORTFD.js}

@@ -7,10 +7,10 @@ import {
   codexHome,
   codexHooksJsonIn,
   isPusharyCodexCommand
-} from "./chunk-JCSJEMTA.js";
+} from "./chunk-FYSQQW6Q.js";
 import {
   resolvePathBinary
-} from "./chunk-ZCBTCW3T.js";
+} from "./chunk-DQKTKMR3.js";
 import {
   getPackageVersion
 } from "./chunk-ZVU6WMMU.js";

package/dist/{chunk-GESW4OSZ.js → chunk-JPR4S254.js}

@@ -1,6 +1,6 @@
 import {
   realpath
-} from "./chunk-IGO5NDQY.js";
+} from "./chunk-TJUDVI2Y.js";
 import {
   findNativeClaudeInstall
 } from "./chunk-ROVLRXBI.js";
@@ -13,10 +13,10 @@ import {
   resolvePackageVersionFromBinary,
   resolvePathBinary,
   resolvePathBinaryAsync
-} from "./chunk-ZCBTCW3T.js";
+} from "./chunk-DQKTKMR3.js";
 import {
   MANAGED_PROVIDERS
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/live-capabilities.ts
 import { homedir } from "os";

package/dist/{chunk-VK4PPVWB.js → chunk-KAG2BWDB.js}

@@ -1,19 +1,19 @@
 import {
   APPROVAL_RULES_PATH,
   canChangeApprovalSettings
-} from "./chunk-2HC5ISDW.js";
+} from "./chunk-5IRJERK2.js";
 import {
   callMcpTool
-} from "./chunk-PFZCLG55.js";
+} from "./chunk-OJZ3CVGK.js";
 import {
   absoluteUrl
-} from "./chunk-EMSRB2KH.js";
+} from "./chunk-GOUUFBBP.js";
 import {
   getBaseUrl
-} from "./chunk-GKCDMAUM.js";
+} from "./chunk-QYBQCMRP.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-YDQ6OJMF.js";
+} from "./chunk-DLS43QDO.js";
 import {
   AGENT_STOP_DEFAULT_SECONDS,
   APPROVAL_MODE_META,
@@ -21,7 +21,7 @@ import {
   classifyConfirmResponse,
   isAnswerSource,
   roundTripAsk
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {

package/dist/{chunk-G5HGV6D4.js → chunk-KS3OJ4C2.js}

@@ -9,13 +9,13 @@ import {
   installedCodexApp,
   readCodexAppRuntime,
   shellQuoted
-} from "./chunk-S75UO75C.js";
+} from "./chunk-6ZPGNVXS.js";
 import {
   writeHuman
 } from "./chunk-QCGNGEGE.js";
 import {
   xml
-} from "./chunk-HONSMBF2.js";
+} from "./chunk-3OLVEVGW.js";
 import {
   writeFileAtomic
 } from "./chunk-T5I4PKOQ.js";

package/dist/{chunk-DS672F57.js → chunk-LJH2QDF3.js}

@@ -7,13 +7,13 @@ import {
 } from "./chunk-G66WIAST.js";
 import {
   ensureDaemonRunning
-} from "./chunk-HONSMBF2.js";
+} from "./chunk-3OLVEVGW.js";
 import {
   hookOwnerOf
-} from "./chunk-MFJHLVIZ.js";
+} from "./chunk-T72BV3CU.js";
 import {
   hookMeaning
-} from "./chunk-76JOLPST.js";
+} from "./chunk-BCZSRQ3L.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
@@ -24,26 +24,29 @@ import {
   recordSealerFor,
   uploadTranscriptRecords,
   wrapSessionKey
-} from "./chunk-4XE3DVF7.js";
+} from "./chunk-FE4CSARF.js";
 import {
   external_exports
 } from "./chunk-XMSDA5WA.js";
 import {
   transcriptEnvironmentPreference,
   transcriptsEnabled
-} from "./chunk-CJTJ55DR.js";
+} from "./chunk-UWQKGWBF.js";
+import {
+  fetchAsCredential
+} from "./chunk-DZMKNP3I.js";
 import {
   readTranscriptPreference
-} from "./chunk-B7O4CXFX.js";
+} from "./chunk-XF3K42EV.js";
 import {
   claudeConfigDir,
   codexHome,
   pusharyDir
-} from "./chunk-JCSJEMTA.js";
+} from "./chunk-FYSQQW6Q.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-GKCDMAUM.js";
+} from "./chunk-QYBQCMRP.js";
 import {
   writeJsonAtomic,
   writeJsonAtomicDurable
@@ -55,7 +58,7 @@ import {
   isHookSource,
   isRecord,
   redactSecretsFromContent
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/transcript-recipient-pin.ts
 import { createHash } from "crypto";
@@ -1493,7 +1496,7 @@ var startRegisteredTranscripts = (apiKey, machineId, options = {}) => {
         if (raw.expectedSiteId && !verifiedSiteId && Date.now() >= nextVerification && raw.expectedBaseUrl && sameServer(raw.expectedBaseUrl, registry)) {
           nextVerification = Date.now() + 3e4;
           try {
-            const response = await fetch(`${registry.baseUrl}/api/agent/encryption-account`, {
+            const response = await fetchAsCredential(apiKey, `${registry.baseUrl}/api/agent/encryption-account`, {
               headers: { Authorization: `Bearer ${apiKey}` },
               signal: AbortSignal.timeout(5e3)
             });

package/dist/{chunk-IHQRLJEP.js → chunk-M6EYOBLJ.js}

@@ -1,13 +1,13 @@
 import {
   compatibleConfigFile
-} from "./chunk-JLJJRBTD.js";
+} from "./chunk-WKBXLLDY.js";
 import {
   hookOwnerOf,
   hookOwnerOfCommands
-} from "./chunk-MFJHLVIZ.js";
+} from "./chunk-T72BV3CU.js";
 import {
   AGENT_CHOICES
-} from "./chunk-DH22FQAS.js";
+} from "./chunk-MZDFTXXO.js";
 import {
   bridgeStub,
   claudeSettings,
@@ -19,7 +19,7 @@ import {
   resolveBridgeStub,
   vscodePluginDir,
   windowsNodeLauncherFor
-} from "./chunk-JCSJEMTA.js";
+} from "./chunk-FYSQQW6Q.js";
 import {
   readJsonSafe
 } from "./chunk-T5I4PKOQ.js";
@@ -29,7 +29,7 @@ import {
   OPENCODE_APPROVAL_EVENT,
   hookCompatibleProfile,
   isRecord
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/opencode-plugin.ts
 var OPENCODE_PLUGIN_MARKER = "pushary-opencode-plugin w1";