pushary 1.9.108 → 1.9.110

package/dist/{chunk-TXMYET7E.js → chunk-MOBSQM4B.js}

@@ -1,12 +1,12 @@
 import {
   CODEX_HOOK_STATUS
-} from "./chunk-VKTW5WVB.js";
+} from "./chunk-JMQORTFD.js";
 import {
   retryAgentCommand
-} from "./chunk-FJYUB3ZK.js";
+} from "./chunk-TTDJHOYY.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-YDQ6OJMF.js";
+} from "./chunk-DLS43QDO.js";
 
 // src/setup/codex-trust.ts
 var CODEX_TRUST_TELEMETRY = {

package/dist/{chunk-DH22FQAS.js → chunk-MZDFTXXO.js}

@@ -9,7 +9,7 @@ import {
   isSetupConnectMode,
   isValidApiKey,
   normalizeAgentId
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/setup/options.ts
 var AGENT_CHOICES = SETUP_AGENT_CHOICES;

package/dist/{chunk-DA57ZI62.js → chunk-NBNWMQH4.js}

@@ -1,9 +1,12 @@
 import {
   parseSseMessages
-} from "./chunk-PFZCLG55.js";
+} from "./chunk-OJZ3CVGK.js";
+import {
+  fetchAsCredential
+} from "./chunk-DZMKNP3I.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-YDQ6OJMF.js";
+} from "./chunk-DLS43QDO.js";
 
 // src/mcp-stdio-bridge.ts
 var MCP_BRIDGE_BINARY = "pushary-mcp";
@@ -98,12 +101,13 @@ var createMcpStdioBridge = (deps) => {
       if (!answered.has(request.id)) await deps.emit(bridgeError(request.id, message));
     }
   };
-  const post = async (line, apiKey) => deps.fetchImpl(deps.endpoint, {
+  const requestFor = (line, apiKey) => ({
     method: "POST",
     headers: headersFor(apiKey),
     body: line,
     signal: AbortSignal.timeout(deps.timeoutMs ?? MCP_BRIDGE_REQUEST_TIMEOUT_MS)
   });
+  const post = async (line, apiKey) => apiKey === null ? deps.fetchImpl(deps.endpoint, requestFor(line, apiKey)) : fetchAsCredential(apiKey, deps.endpoint, requestFor(line, apiKey), deps.fetchImpl);
   const forward = async (line) => {
     const parsed = parseBridgeLine(line);
     if (!parsed.ok) {

package/dist/{chunk-CKWV3T7O.js → chunk-NGZB5BVO.js}

@@ -3,10 +3,10 @@ import {
   forkFinishWithUpgradeLock,
   installWithUpgradeLock,
   releaseAutoUpdateLock
-} from "./chunk-VCWLGM77.js";
+} from "./chunk-PKN4XIBP.js";
 import {
   phoneStartIsRequired
-} from "./chunk-GESW4OSZ.js";
+} from "./chunk-JPR4S254.js";
 import {
   describeAutoUpdateCheck,
   globalInstallLocation,
@@ -18,25 +18,25 @@ import {
   readAutoUpdateState,
   updateAutoUpdateState,
   upgradeEntryFor
-} from "./chunk-5IAW6G3K.js";
+} from "./chunk-CTBH3E3Z.js";
 import {
   autoUpdateLock,
   autoUpdateLog,
   autoUpdateState
-} from "./chunk-JCSJEMTA.js";
+} from "./chunk-FYSQQW6Q.js";
 import {
   execNpm,
   fetchLatestPublishedVersion,
   npmErrorMessage,
   readGlobalCliInstallAt,
   readGlobalPrefix
-} from "./chunk-ZCBTCW3T.js";
+} from "./chunk-DQKTKMR3.js";
 import {
   EXIT
 } from "./chunk-BG4HHB7E.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-YDQ6OJMF.js";
+} from "./chunk-DLS43QDO.js";
 import {
   commandsPackage,
   globalUpgradeEntry,

package/dist/{chunk-O5TB2LMQ.js → chunk-NMSRA7QO.js}

@@ -3317,6 +3317,11 @@ var AUTH_REJECTION_REASONS = [
   "site_not_found",
   ...AGENT_SITE_REJECTION_REASONS
 ];
+var CREDENTIAL_REJECTION_HEADER = "x-pushary-credential";
+var CREDENTIAL_REJECTED = "rejected";
+var CREDENTIAL_REJECTION_STATUS = 401;
+var MCP_CREDENTIAL_REJECTION_BODY = JSON.stringify({ error: "invalid_token", error_description: "No authorization provided" });
+var responseRejectsCredential = (status, headers) => status === CREDENTIAL_REJECTION_STATUS && headers.get(CREDENTIAL_REJECTION_HEADER)?.trim() === CREDENTIAL_REJECTED;
 var TOOL_FAILURE_META_KEY = "pushary/failure";
 var TOOL_FAILURE_CODES = {
   questionLimit: "question_limit",
@@ -3622,6 +3627,7 @@ var fileChangeQuestion = (changes) => {
   const unnamed = changes.length - FILE_CHANGES_NAMED_IN_A_QUESTION;
   return `Allow these ${changes.length} file changes once? ${named}${unnamed > 0 ? ` and ${unnamed} more` : ""}`;
 };
+var codexElicitationToolName = (serverName, toolName) => `mcp__${serverName}__${toolName}`;
 var withCodexReason = (detail, reason) => text(reason) ? `${detail}
 
 Codex's reason: ${redactSecrets(reason)}` : detail;
@@ -3657,7 +3663,7 @@ var parseCodexNativeApproval = (value) => {
       return {
         ...base,
         codexAsksForAPerson,
-        toolName: `mcp__${p.serverName}__${meta.tool_name}`,
+        toolName: codexElicitationToolName(p.serverName, meta.tool_name),
         toolInputs: [meta.tool_params],
         question: p.message,
         detail: redactSecrets([`Risk: ${meta.riskLevel}`, meta.subtitle, JSON.stringify(meta.tool_params)].filter(Boolean).join("\n")),
@@ -3667,7 +3673,7 @@ var parseCodexNativeApproval = (value) => {
     return {
       ...base,
       codexAsksForAPerson,
-      toolName: `mcp__${p.serverName}__${meta.tool_name}`,
+      toolName: codexElicitationToolName(p.serverName, meta.tool_name),
       toolInputs: [meta.tool_params],
       question: p.message,
       detail: redactSecrets(JSON.stringify(meta.tool_params)),
@@ -3980,6 +3986,7 @@ var reportableSessionId = (value) => typeof value === "string" && value.length >
 var HOOK_BATCH_MAX_BYTES = 4 * 1024 * 1024;
 var REPO_KEY_MAX_LENGTH = 200;
 var SESSION_ID_MAX_LENGTH = 200;
+var TOOL_NAME_MAX_LENGTH = 100;
 var WILDCARD_TOOL_PATTERN = "*";
 var isRepoKeyMatch = (ruleRepoKey, currentRepoKey) => {
   if (!ruleRepoKey) return true;
@@ -7748,7 +7755,7 @@ var findBestRoute = (routes, toolName, args, repoKey) => {
   let bestWeight = 0;
   let bestScoped = -1;
   let bestLength = -1;
-  const { forms } = restrictionReadingOf(routes.map((route) => route.toolPattern), toolName, args);
+  const forms = formsOfEveryCandidate(routes.map((route) => route.toolPattern), toolName, args);
   for (const candidate of routes) {
     if (!isRepoKeyMatch(candidate.repoKey, repoKey)) continue;
     const rank = matchToolPatternAny(candidate.toolPattern, toolName, forms, PATTERN_INTENT.restrict);
@@ -7800,6 +7807,7 @@ var restrictionReadingOf = (restrictingPatterns, toolName, args) => {
     hidesWhatItRuns: POSIX_SHELL_TOOLS.has(toolName) && spellings.hidesWhatItRuns
   };
 };
+var formsOfEveryCandidate = (restrictingPatterns, toolName, args) => [...new Set(args.flatMap((arg) => restrictionReadingOf(restrictingPatterns, toolName, [arg]).forms))];
 var restrictingPatternsOf = (policies) => policies.filter(restricts).map((policy) => policy.tool);
 var policyReadingOf = (policies, toolName, args) => restrictionReadingOf(restrictingPatternsOf(policies), toolName, args);
 var stricterRule = (current, challenger) => current !== void 0 && (challenger === void 0 || comparePolicyStrictness(current.policy, challenger.policy) > 0) ? current : challenger;
@@ -8632,6 +8640,11 @@ export {
   hookActivationResult,
   CLIENT_REPORT_PATH,
   clientContextHeaders,
+  CREDENTIAL_REJECTION_HEADER,
+  CREDENTIAL_REJECTED,
+  CREDENTIAL_REJECTION_STATUS,
+  MCP_CREDENTIAL_REJECTION_BODY,
+  responseRejectsCredential,
   TOOL_FAILURE_CODES,
   isToolErrorResult,
   toolFailureCodeOfResult,
@@ -8659,6 +8672,7 @@ export {
   CODEX_NATIVE_APPROVAL_METHODS,
   CODEX_NATIVE_APPROVAL_CHOICES,
   CODEX_NATIVE_APPROVAL_REPLIES,
+  codexElicitationToolName,
   parseCodexNativeApproval,
   codexNativeApprovalResponse,
   transcriptRecordPlaintext,
@@ -8704,6 +8718,7 @@ export {
   HOOK_LOCATOR_BINARY,
   isTokenCount,
   reportableSessionId,
+  TOOL_NAME_MAX_LENGTH,
   normalizeRepoRemote,
   localRepoKey,
   isSafeReadOnlyCommand,

package/dist/{chunk-S2TTGX6F.js → chunk-NQAY6G3S.js}

@@ -1,19 +1,19 @@
 import {
   macAppBridgeAvailable
-} from "./chunk-IHQRLJEP.js";
+} from "./chunk-M6EYOBLJ.js";
 import {
   keyPrefix
-} from "./chunk-B7O4CXFX.js";
+} from "./chunk-XF3K42EV.js";
 import {
   bridgeAgentKey
-} from "./chunk-JCSJEMTA.js";
+} from "./chunk-FYSQQW6Q.js";
 import {
   readJsonSafe
 } from "./chunk-T5I4PKOQ.js";
 import {
   isRecord,
   isValidApiKey
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/shared-mcp-key.ts
 var asRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;

package/dist/{chunk-PFZCLG55.js → chunk-OJZ3CVGK.js}

@@ -1,17 +1,20 @@
 import {
   keyCheckFromResponse
-} from "./chunk-EMSRB2KH.js";
+} from "./chunk-GOUUFBBP.js";
 import {
   installNetworkDefaults
-} from "./chunk-LL7SW4RL.js";
+} from "./chunk-XNMSVXB4.js";
+import {
+  fetchAsCredential
+} from "./chunk-DZMKNP3I.js";
 import {
   getBaseUrl
-} from "./chunk-GKCDMAUM.js";
+} from "./chunk-QYBQCMRP.js";
 import {
   isRecord,
   isToolErrorResult,
   toolFailureCodeOfResult
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/retry.ts
 var isRetryable = (err) => {
@@ -105,12 +108,12 @@ var sendMcpRequest = async (apiKey, message, options = {}) => {
     if (options.sessionId) {
       headers["Mcp-Session-Id"] = options.sessionId;
     }
-    const response = await fetchFn(`${baseUrl}/api/mcp/mcp`, {
+    const response = await fetchAsCredential(apiKey, `${baseUrl}/api/mcp/mcp`, {
       method: "POST",
       headers,
       body: JSON.stringify(message),
       signal: options.timeoutMs ? AbortSignal.any([AbortSignal.timeout(options.timeoutMs), ...options.signal ? [options.signal] : []]) : options.signal
-    });
+    }, fetchFn);
     const lock = response.ok ? null : await keyCheckFromResponse(response, baseUrl);
     if (lock?.kind === "locked") throw new SubscriptionRequiredError(lock.plan, lock.upgradeUrl);
     const body = await response.text();

package/dist/{chunk-OINGJICB.js → chunk-OKZR3LFO.js}

@@ -1,17 +1,17 @@
 import {
   pusharyHookExecutable
-} from "./chunk-MFJHLVIZ.js";
+} from "./chunk-T72BV3CU.js";
 import {
   bridgeResolvesToApp,
   cursorUserHooks,
   executableFileName,
   isBridgeLocator,
   liveBridgeProbe
-} from "./chunk-JCSJEMTA.js";
+} from "./chunk-FYSQQW6Q.js";
 import {
   atLeast,
   parseVersion
-} from "./chunk-ZCBTCW3T.js";
+} from "./chunk-DQKTKMR3.js";
 import {
   CURSOR_GATE_COVERAGE,
   CURSOR_GATE_SCRIPT,
@@ -21,7 +21,7 @@ import {
   isCursorHookPayload,
   isRecord,
   toolsCoveredByGateEntry
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/cursor-gate-registration.ts
 import { dirname, isAbsolute, join, resolve } from "path";

package/dist/{chunk-VCWLGM77.js → chunk-PKN4XIBP.js}

@@ -1,11 +1,11 @@
 import {
   autoUpdateLock
-} from "./chunk-JCSJEMTA.js";
+} from "./chunk-FYSQQW6Q.js";
 import {
   installPackageGlobally,
   npmErrorMessage,
   npmExitedOnPermissionDenied
-} from "./chunk-ZCBTCW3T.js";
+} from "./chunk-DQKTKMR3.js";
 import {
   writeJsonAtomic
 } from "./chunk-T5I4PKOQ.js";

package/dist/{chunk-GKCDMAUM.js → chunk-QYBQCMRP.js}

@@ -1,6 +1,6 @@
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-YDQ6OJMF.js";
+} from "./chunk-DLS43QDO.js";
 
 // src/config.ts
 import { readFileSync } from "fs";

package/dist/{chunk-772NHSQB.js → chunk-S2FLLNQI.js}

@@ -4,10 +4,10 @@ import {
   keyPrefix,
   readConfigFileKey,
   readMacAppKeyPrefix
-} from "./chunk-B7O4CXFX.js";
+} from "./chunk-XF3K42EV.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-YDQ6OJMF.js";
+} from "./chunk-DLS43QDO.js";
 
 // src/key-signed-out.ts
 var VERDICT_BY_CHECK = {

package/dist/{chunk-HH5NNPB5.js → chunk-S7ZX7V5S.js}

@@ -7,7 +7,7 @@ import {
   recordSealerFor,
   uploadTranscriptRecords,
   wrapSessionKey
-} from "./chunk-4XE3DVF7.js";
+} from "./chunk-FE4CSARF.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;

package/dist/{chunk-RKQVMFHN.js → chunk-SQR7GGOH.js}

@@ -1,22 +1,22 @@
 import {
   cursorGateOwnsClaudeCall,
   readCursorGateRegistration
-} from "./chunk-OINGJICB.js";
+} from "./chunk-OKZR3LFO.js";
 import {
   registerTranscript
-} from "./chunk-DS672F57.js";
+} from "./chunk-LJH2QDF3.js";
 import {
   namedEvent
-} from "./chunk-JLJJRBTD.js";
+} from "./chunk-WKBXLLDY.js";
 import {
   writeDegraded
-} from "./chunk-IAASPG5B.js";
+} from "./chunk-DP62DH2Q.js";
 import {
   claudeShapedHookInput,
   hookCompatibleProfileBySource,
   isGrokHookPayload,
   isGrokSessionEndStop
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/tool-hook-input.ts
 var OPTIONAL_TEXT_FIELDS = ["hook_event_name", "session_id", "cwd", "transcript_path", "tool_use_id", "permission_mode", "cursor_version"];

package/dist/{chunk-MFJHLVIZ.js → chunk-T72BV3CU.js}

@@ -1,9 +1,9 @@
 import {
   AGENT_CHOICES
-} from "./chunk-DH22FQAS.js";
+} from "./chunk-MZDFTXXO.js";
 import {
   BELL_HOOK_BINARY
-} from "./chunk-GUIS6ASL.js";
+} from "./chunk-3QZSG2L4.js";
 import {
   CLAUDE_HOOK_EVENTS,
   CODEX_HOOK_EVENTS,
@@ -15,13 +15,13 @@ import {
   isBridgeLocator,
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-JCSJEMTA.js";
+} from "./chunk-FYSQQW6Q.js";
 import {
   CURSOR_GATE_EVENTS,
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY,
   hookCommandHoldBudget
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/gemini-config.ts
 var GEMINI_HOOK_BINARY = "pushary-gemini-hook";

package/dist/{chunk-ATVZAEM5.js → chunk-TBJ4OMO4.js}

@@ -1,12 +1,12 @@
 import {
   readMacAppAgentKey
-} from "./chunk-S2TTGX6F.js";
+} from "./chunk-NQAY6G3S.js";
 import {
   API_KEYS_PATH
-} from "./chunk-2HC5ISDW.js";
+} from "./chunk-5IRJERK2.js";
 import {
   absoluteUrl
-} from "./chunk-EMSRB2KH.js";
+} from "./chunk-GOUUFBBP.js";
 import {
   findExportedKeyLines,
   isAdoptedMacAppKey,
@@ -16,10 +16,10 @@ import {
   readConfigFileKey,
   readKeySource,
   readMacAppKeyPrefix
-} from "./chunk-B7O4CXFX.js";
+} from "./chunk-XF3K42EV.js";
 import {
   isValidApiKey
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/key-revocation.ts
 var SELF_REVOKE_PATH = "/api/v1/server/keys/self/revoke";

package/dist/{chunk-IGO5NDQY.js → chunk-TJUDVI2Y.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-ROVLRXBI.js";
 import {
   parseVersion
-} from "./chunk-ZCBTCW3T.js";
+} from "./chunk-DQKTKMR3.js";
 import {
   isRecord
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/setup/agent-probe.ts
 import { execSync } from "child_process";

package/dist/{chunk-LIPMEFRA.js → chunk-TKXM3QYK.js}

@@ -1,9 +1,9 @@
 import {
   claudeConfigDir
-} from "./chunk-JCSJEMTA.js";
+} from "./chunk-FYSQQW6Q.js";
 import {
   claudePermissionRulesFromSettings
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/claude-permission-rules.ts
 import { readFileSync, statSync } from "fs";

package/dist/{chunk-HLYZEZOI.js → chunk-TR6AJV4Z.js}

@@ -1,13 +1,13 @@
 import {
   configFilePath
-} from "./chunk-GKCDMAUM.js";
+} from "./chunk-QYBQCMRP.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "./chunk-T5I4PKOQ.js";
 import {
   readSetupOutcomeProperties
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/diagnostics/service-runtime.ts
 var unescapeXml = (value) => value.replaceAll("&quot;", '"').replaceAll("&apos;", "'").replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&amp;", "&");

package/dist/{chunk-FJYUB3ZK.js → chunk-TTDJHOYY.js}

@@ -2,16 +2,16 @@ import {
   NpmInstallError,
   NpmMissingError,
   NpmPermissionError
-} from "./chunk-ZCBTCW3T.js";
+} from "./chunk-DQKTKMR3.js";
 import {
   writeFileAtomic
 } from "./chunk-T5I4PKOQ.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-YDQ6OJMF.js";
+} from "./chunk-DLS43QDO.js";
 import {
   readSetupAgentFailures
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/setup/config-write.ts
 var AgentConfigWriteError = class extends Error {

package/dist/{chunk-J5PUKKCT.js → chunk-UNHXJLHP.js}

@@ -3,24 +3,24 @@ import {
   expectedLaunchCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "./chunk-GESW4OSZ.js";
+} from "./chunk-JPR4S254.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   hasDaemonServiceDefinition,
   readDaemonNeedsLogin,
   readDaemonStatus
-} from "./chunk-HONSMBF2.js";
+} from "./chunk-3OLVEVGW.js";
 import {
   getMachineId
-} from "./chunk-I3IUS4SR.js";
+} from "./chunk-G2TL4OEY.js";
 import {
   readControlMode,
   readKeySource
-} from "./chunk-B7O4CXFX.js";
+} from "./chunk-XF3K42EV.js";
 import {
   getBaseUrl
-} from "./chunk-GKCDMAUM.js";
+} from "./chunk-QYBQCMRP.js";
 import {
   getPackageVersion
 } from "./chunk-ZVU6WMMU.js";

package/dist/{chunk-CJTJ55DR.js → chunk-UWQKGWBF.js}

@@ -1,6 +1,6 @@
 import {
   readTranscriptPreference
-} from "./chunk-B7O4CXFX.js";
+} from "./chunk-XF3K42EV.js";
 
 // src/transcript-setting.ts
 var transcriptEnvironmentPreference = () => {

package/dist/{chunk-6DKMZBRK.js → chunk-WEWTT7FE.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-BG4HHB7E.js";
 import {
   redactSecretsFromContent
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/cli/json.ts
 var writeStdoutFully = (text) => new Promise((resolve, reject) => {

package/dist/{chunk-ASCQXNCL.js → chunk-WGQIJJIS.js}

@@ -2,7 +2,7 @@ import {
   isApprovalMode,
   isRecord,
   isTimeoutAction
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/cli/settings-response.ts
 var isFiniteNumber = (value) => typeof value === "number" && Number.isFinite(value);

package/dist/{chunk-JLJJRBTD.js → chunk-WKBXLLDY.js}

@@ -1,13 +1,13 @@
 import {
   CLAUDE_CODE_AGENT
-} from "./chunk-KHZCJP7P.js";
+} from "./chunk-5RWBSMCI.js";
 import {
   addGeminiMcpServer,
   removeGeminiMcpServer
-} from "./chunk-MFJHLVIZ.js";
+} from "./chunk-T72BV3CU.js";
 import {
   compatibleToolLookup
-} from "./chunk-76JOLPST.js";
+} from "./chunk-BCZSRQ3L.js";
 import {
   CLAUDE_HOOK_EVENTS,
   PUSHARY_MCP_URL,
@@ -19,7 +19,7 @@ import {
   isPusharyHook,
   registerHookEntry,
   removeClaudeMcpServers
-} from "./chunk-JCSJEMTA.js";
+} from "./chunk-FYSQQW6Q.js";
 import {
   HOOK_COMPATIBLE_PROFILES,
   PHONE_ANSWERED_TOOLS,
@@ -30,7 +30,7 @@ import {
   pusharyMissingReason,
   refusalOutput,
   withHookHoldBudget
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/config-document.ts
 import { parse, stringify } from "smol-toml";

package/dist/{chunk-4EMPELDR.js → chunk-WKXSLMKC.js}

@@ -13,16 +13,16 @@ import {
 } from "./chunk-G66WIAST.js";
 import {
   keyPrefix
-} from "./chunk-B7O4CXFX.js";
+} from "./chunk-XF3K42EV.js";
 import {
   getBaseUrl
-} from "./chunk-GKCDMAUM.js";
+} from "./chunk-QYBQCMRP.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-YDQ6OJMF.js";
+} from "./chunk-DLS43QDO.js";
 import {
   isValidApiKey
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/cli/login-ui.ts
 import { hostname } from "os";

package/dist/{chunk-FUTFQSRA.js → chunk-X3ROGIHG.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-B7O4CXFX.js → chunk-XF3K42EV.js}

@@ -1,9 +1,9 @@
 import {
   resolveInstallSourceFor
-} from "./chunk-Z5FV7LTD.js";
+} from "./chunk-DOHQKE4Y.js";
 import {
   configFilePath
-} from "./chunk-GKCDMAUM.js";
+} from "./chunk-QYBQCMRP.js";
 import {
   backupFile,
   readJsonSafe,
@@ -14,7 +14,7 @@ import {
   API_KEY_PREFIX_PATTERN,
   isRecord,
   isValidApiKey
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/shell-alias.ts
 import { homedir } from "os";

package/dist/{chunk-LL7SW4RL.js → chunk-XNMSVXB4.js}

@@ -1,9 +1,9 @@
 import {
   readExistingMachineId
-} from "./chunk-I3IUS4SR.js";
+} from "./chunk-G2TL4OEY.js";
 import {
   getBaseUrl
-} from "./chunk-GKCDMAUM.js";
+} from "./chunk-QYBQCMRP.js";
 import {
   NetworkError
 } from "./chunk-YU2EUD7O.js";
@@ -13,7 +13,7 @@ import {
 import {
   clientContextHeaders,
   redactSecretsFromContent
-} from "./chunk-O5TB2LMQ.js";
+} from "./chunk-NMSRA7QO.js";
 
 // src/cli/net.ts
 import { createRequire } from "module";