pushary 1.9.117 → 1.9.119

package/dist/{chunk-KYWTX4R2.js → chunk-TRDHHF3A.js}

@@ -1378,14 +1378,29 @@ function parseCommitId(value) {
 // ../contracts/src/conversation-text.ts
 var INTERNAL_ENVELOPE = /(^|\n) {0,3}(?:<(total_tokens|task-notification)>[\s\S]*?(?:<\/\2>|$)[\t ]*)+/g;
 var INCOMPLETE_ENVELOPE = /(^|\n) {0,3}<(?:total_tokens|task-notification)$/g;
+var AGENT_MESSAGE_OPENING = /^ {0,3}<agent-message from=/;
+var AGENT_MESSAGE_CLOSING = "</agent-message>";
 var SUGGESTION_REQUEST = /^This is an app-generated request for a suggested next user(?: message| prompt)/;
 var visibleProse = (text3) => text3.replace(INTERNAL_ENVELOPE, "$1").replace(INCOMPLETE_ENVELOPE, "$1");
+var textAfterAgentMessage = (line) => {
+  const closing = line.indexOf(AGENT_MESSAGE_CLOSING);
+  return closing === -1 ? null : line.slice(closing + AGENT_MESSAGE_CLOSING.length);
+};
 function conversationText(text3) {
   if (SUGGESTION_REQUEST.test(text3.trimStart())) return "";
   const output = [];
   let prose = [];
   let fence = null;
-  for (const line of text3.split("\n")) {
+  let insideAgentMessage = false;
+  const lines = text3.split("\n").reverse();
+  while (lines.length > 0) {
+    const line = lines.pop() ?? "";
+    if (insideAgentMessage || !fence && AGENT_MESSAGE_OPENING.test(line)) {
+      const after = textAfterAgentMessage(line);
+      insideAgentMessage = after === null;
+      if (after?.trim()) lines.push(after);
+      continue;
+    }
     const marker = /^ {0,3}(`{3,}|~{3,})/.exec(line)?.[1];
     if (fence) {
       output.push(line);
@@ -1599,6 +1614,65 @@ var SEGMENT_SEPARATORS = /* @__PURE__ */ new Set([";", "\n", "&", "|"]);
 var DOUBLED_SEPARATORS = /* @__PURE__ */ new Set(["&", "|"]);
 var UNDECOMPOSABLE = /* @__PURE__ */ new Set(["`", "<", ">"]);
 var LITERAL_IN_DOUBLE_QUOTES = /* @__PURE__ */ new Set([";", "|", "&", "<", ">", "*", "?", "[", "\\"]);
+var OPENS_A_WORD_AFTER = /[ \t\n;&|()`]/;
+var COMMENT_OR_ANSI_C_QUOTE = /#|\$'/;
+var INERT_ANSI_C_ESCAPE = "__";
+var runLengthBefore = (text3, index, char) => {
+  let length = 0;
+  while (text3.charAt(index - 1 - length) === char) length += 1;
+  return length;
+};
+var opensAnsiCQuote = (text3, index) => {
+  const dollars = runLengthBefore(text3, index, "$");
+  const backslashes = runLengthBefore(text3, index - dollars, "\\");
+  return text3.charAt(index) === "'" && (dollars - backslashes % 2) % 2 === 1;
+};
+var readingWithoutCommentsOrAnsiEscapes = (text3) => {
+  if (!COMMENT_OR_ANSI_C_QUOTE.test(text3)) return null;
+  let reading = "";
+  let changed = false;
+  let quote = null;
+  let ansiC = false;
+  let inComment = false;
+  let atWordStart = true;
+  for (let index = 0; index < text3.length; index += 1) {
+    const char = text3.charAt(index);
+    const next = text3.charAt(index + 1);
+    if (inComment && char !== "\n") continue;
+    inComment = false;
+    if (ansiC && char === "\\" && next) {
+      reading += INERT_ANSI_C_ESCAPE;
+      changed = true;
+      index += 1;
+    } else if (char === "\\" && quote !== "'") {
+      reading += char + next;
+      atWordStart = next === "\n" ? atWordStart : false;
+      index += 1;
+    } else if (quote === "'") {
+      reading += char;
+      if (char === quote) {
+        quote = null;
+        ansiC = false;
+      }
+      atWordStart = false;
+    } else if (char === "'" || char === '"') {
+      reading += char;
+      if (quote === char) quote = null;
+      else if (quote === null) {
+        ansiC = opensAnsiCQuote(text3, index);
+        quote = char;
+      }
+      atWordStart = false;
+    } else if (quote === null && atWordStart && char === COMMENT_START) {
+      inComment = true;
+      changed = true;
+    } else {
+      reading += char;
+      atWordStart = quote === null && OPENS_A_WORD_AFTER.test(char);
+    }
+  }
+  return changed ? reading : null;
+};
 var scanShell = (command) => {
   const lexemes = [];
   let quote = null;
@@ -1642,6 +1716,112 @@ var splitShellSegments = (command) => {
   const present = segments.filter((segment) => segment.text.length > 0);
   return present.length > 0 ? present : null;
 };
+var COMMAND_POSITION = String.raw`(^[ \t]*|[;&|(` + "`" + String.raw`\n][ \t]*|\b(?:then|do|else|elif|if|while|until)[ \t]+|[{!][ \t]+)`;
+var COMMAND_PREFIXES = String.raw`(?:[A-Za-z_]\w*=\S*[ \t]+|(?:sudo|env|exec|command|builtin|nohup|time|nice(?:[ \t]+-n[ \t]+\S+)?|timeout[ \t]+\S+)(?:[ \t]+-[^\s<]*){0,4}[ \t]+){0,8}`;
+var A_SHELL_RUNNING_A_SUBSTITUTION = new RegExp(
+  String.raw`${COMMAND_POSITION}${COMMAND_PREFIXES}(?:[^\s;&|()<>` + "`" + String.raw`]*/)?(?:sh|bash|zsh|dash|ksh|source|\.)(?:[ \t]+-[^\s<]*){0,8}[ \t]+(?:<[ \t]*)?[<=](?=\()`,
+  "g"
+);
+var AN_EVAL_THAT_RUNS = new RegExp(String.raw`${COMMAND_POSITION}${COMMAND_PREFIXES}eval[ \t]+`, "g");
+var CASE_HEAD = /(^|[\s;&|(])case[ \t]+(?:"[^"\n]*"|'[^'\n]*'|\S+)[ \t\n]+in(?=[\s;])/g;
+var CASE_ARM_OPENING = /;[;&]{0,2}[ \t\n]*\(?[^()\s;][^()\n;]*\)[ \t\n]*/g;
+var CASE_ARM_ENDING = /;;&?|;&/g;
+var CASE_WORD = /\bcase\b/;
+var ESAC_WORD = /\besac\b/g;
+var COPROC_PREFIX = /(^|[\s;&|(])coproc[ \t]+(?:[A-Za-z_]\w*[ \t]+(?=[{(]))?/g;
+var A_FUNCTION_WITH_A_SUBSHELL_BODY = /(^|[\s;&|])(?:function[ \t]+[\w.:-]+(?:[ \t]*\(\))?|[\w.:-]+[ \t]*\(\))[ \t\n]*(?=\()/g;
+var NPX_GIVEN_A_COMMAND_STRING = /(^|[\s;&|(])npx(?:[ \t]+(?:(?:-p|--package)[ \t]+[^\s;&|]+|(?!-c\b|--call\b)-[^\s;&|]+)){0,8}?[ \t]+(?:-c|--call)(?:[ \t]+|=)/g;
+var SU_GIVEN_A_COMMAND_STRING = /(^|[\s;&|(])su(?:[ \t]+(?!-c\b|--command\b)[^\s;&|]+){0,8}?[ \t]+(?:-c|--command)(?:[ \t]+|=)/g;
+var PARALLEL_PREFIX = /(^|[\s;&|(])parallel[ \t]+(?=[^-\s])/g;
+var closingParenthesisOf = (text3, open) => {
+  let depth = 0;
+  let quote = null;
+  for (let index = open; index < text3.length; index += 1) {
+    const char = text3.charAt(index);
+    if (quote === "'") {
+      if (char === "'") quote = null;
+    } else if (char === "\\") {
+      index += 1;
+    } else if (quote === '"') {
+      if (char === '"') quote = null;
+    } else if (char === "'" || char === '"') {
+      quote = char;
+    } else if (char === "(") {
+      depth += 1;
+    } else if (char === ")") {
+      depth -= 1;
+      if (depth === 0) return index;
+    }
+  }
+  return null;
+};
+var withSubstitutionsPipedIntoAShell = (text3) => {
+  let reading = "";
+  let from = 0;
+  for (const match of text3.matchAll(A_SHELL_RUNNING_A_SUBSTITUTION)) {
+    const open = match.index + match[0].length;
+    const close = match.index < from ? null : closingParenthesisOf(text3, open);
+    if (close !== null) {
+      reading += `${text3.slice(from, match.index)}${match[1]}${text3.slice(open + 1, close)} | sh`;
+      from = close + 1;
+    }
+  }
+  return reading + text3.slice(from);
+};
+var withCaseArmsAsCommands = (text3) => CASE_WORD.test(text3) && text3.search(ESAC_WORD) !== -1 ? text3.replace(CASE_HEAD, "$1true;").replace(CASE_ARM_OPENING, ";").replace(CASE_ARM_ENDING, ";").replace(ESAC_WORD, "true") : text3;
+var withoutCoprocPrefix = (text3) => text3.replace(COPROC_PREFIX, "$1");
+var withFunctionSubshellBodiesExposed = (text3) => text3.replace(A_FUNCTION_WITH_A_SUBSHELL_BODY, "$1");
+var withCommandStringsRunByAShell = (text3) => text3.replace(NPX_GIVEN_A_COMMAND_STRING, "$1sh -c ").replace(SU_GIVEN_A_COMMAND_STRING, "$1sh -c ");
+var withoutParallelPrefix = (text3) => text3.replace(PARALLEL_PREFIX, "$1");
+var SHELL_FORM_REWRITES = [
+  withSubstitutionsPipedIntoAShell,
+  withCaseArmsAsCommands,
+  withoutCoprocPrefix,
+  withFunctionSubshellBodiesExposed,
+  withCommandStringsRunByAShell,
+  withoutParallelPrefix
+];
+var readingWithShellFormsSpelledOut = (text3) => {
+  const reading = SHELL_FORM_REWRITES.reduce((current, rewrite) => rewrite(current), text3);
+  return reading === text3 ? null : reading;
+};
+var SHELLS_THAT_RUN_A_SCRIPT_ARGUMENT = /* @__PURE__ */ new Set(["sh", "bash", "zsh", "dash", "ksh"]);
+var SHORT_FLAGS_WITH_THE_COMMAND_FLAG = /^-[A-Za-z]*c[A-Za-z]*$/;
+var SHELL_LONG_OPTIONS_WITH_A_VALUE = /* @__PURE__ */ new Set(["--rcfile", "--init-file"]);
+var SHELL_SHORT_FLAGS_ENDING_IN_AN_OPTION_NAME = /^[-+][A-Za-z]*[oO]$/;
+var SHELL_OPTION_WORD = /^[-+]/;
+var COMMAND_SEPARATOR_INSIDE_A_WORD = /[;&|()`]/;
+var DEEPEST_NESTED_SCRIPT_READ = 3;
+var MOST_SCRIPTS_READ_FROM_ONE_COMMAND = 16;
+var programNamedBy = (word) => basenameOf(word.split(COMMAND_SEPARATOR_INSIDE_A_WORD).filter((piece) => piece !== "").pop() ?? "");
+var scriptArgumentOfAShellAt = (words, index) => {
+  if (!SHELLS_THAT_RUN_A_SCRIPT_ARGUMENT.has(programNamedBy(words[index]?.text ?? ""))) return void 0;
+  for (let next = index + 1; SHELL_OPTION_WORD.test(words[next]?.text ?? ""); next += 1) {
+    const option = words[next]?.text ?? "";
+    if (SHORT_FLAGS_WITH_THE_COMMAND_FLAG.test(option)) return words[next + 1]?.text;
+    if (SHELL_LONG_OPTIONS_WITH_A_VALUE.has(option) || SHELL_SHORT_FLAGS_ENDING_IN_AN_OPTION_NAME.test(option)) next += 1;
+  }
+  return void 0;
+};
+var scriptsOfShellsIn = (text3) => {
+  const words = shellWordsOf(text3);
+  return words === null ? [] : words.flatMap((_, index) => scriptArgumentOfAShellAt(words, index) ?? []);
+};
+var scriptOfAnEvalEndingAt = (text3, end) => {
+  const words = shellWordsOf(text3.slice(end));
+  return words === null ? [] : [words.map((word) => word.text).join(" ")];
+};
+var scriptsOfEvalsIn = (text3) => [...text3.matchAll(AN_EVAL_THAT_RUNS)].slice(0, MOST_SCRIPTS_READ_FROM_ONE_COMMAND).flatMap((match) => scriptOfAnEvalEndingAt(text3, match.index + match[0].length));
+var scriptsDirectlyInside = (text3) => [...scriptsOfEvalsIn(text3), ...scriptsOfShellsIn(text3)];
+var scriptsPassedToAShell = (text3) => {
+  const found = [];
+  let level = [text3];
+  for (let depth = 0; depth < DEEPEST_NESTED_SCRIPT_READ && level.length > 0 && found.length < MOST_SCRIPTS_READ_FROM_ONE_COMMAND; depth += 1) {
+    level = level.flatMap(scriptsDirectlyInside).slice(0, MOST_SCRIPTS_READ_FROM_ONE_COMMAND - found.length);
+    found.push(...level);
+  }
+  return found;
+};
 var shellCommandSegments = (command) => splitShellSegments(command)?.map((segment) => segment.text) ?? null;
 var shellSegmentsReadingAPipe = (command) => splitShellSegments(command)?.filter((segment) => segment.readsPipe).map((segment) => segment.text) ?? null;
 var SUBSTITUTION_OPEN = "$(";
@@ -3488,10 +3668,14 @@ var readSetupOutcomeProperties = (body) => {
 // ../contracts/src/policy-capabilities.ts
 var POLICY_REQUEST_CAPABILITIES_HEADER = "x-pushary-policy-capabilities";
 var POLICY_REQUEST_CAPABILITY = {
-  readsCommandRunnersAndAVersionedCache: "command-runners-1"
+  readsCommandRunnersAndAVersionedCache: "command-runners-1",
+  readsWhereAPushLands: "push-destinations-1"
 };
 var KNOWN_POLICY_REQUEST_CAPABILITIES = Object.values(POLICY_REQUEST_CAPABILITY);
-var CLI_POLICY_REQUEST_CAPABILITIES = [POLICY_REQUEST_CAPABILITY.readsCommandRunnersAndAVersionedCache];
+var CLI_POLICY_REQUEST_CAPABILITIES = [
+  POLICY_REQUEST_CAPABILITY.readsCommandRunnersAndAVersionedCache,
+  POLICY_REQUEST_CAPABILITY.readsWhereAPushLands
+];
 var POLICY_REQUEST_CAPABILITY_SEPARATOR = ",";
 var policyRequestCapabilitiesHeaderValue = (capabilities) => capabilities.join(POLICY_REQUEST_CAPABILITY_SEPARATOR);
 
@@ -7939,8 +8123,10 @@ var denyReasonFrom = (value, note) => {
   if (trimmed) return `${PHONE_DENIAL_PREFIX}${trimmed}`;
   return value && value !== DENY_ANSWER && value !== APPROVE_ANSWER ? `${PHONE_DENIAL_PREFIX}${value}` : PHONE_DENIAL_REASON;
 };
-var APPROVE_RESPONSES = /* @__PURE__ */ new Set([APPROVE_ANSWER, "approve", "approved"]);
-var DENY_RESPONSES = /* @__PURE__ */ new Set([DENY_ANSWER, "deny", "denied", "reject", "rejected"]);
+var APPROVE_RESPONSE_WORDS = [APPROVE_ANSWER, "approve", "approved"];
+var DENY_RESPONSE_WORDS = [DENY_ANSWER, "deny", "denied", "reject", "rejected"];
+var APPROVE_RESPONSES = new Set(APPROVE_RESPONSE_WORDS);
+var DENY_RESPONSES = new Set(DENY_RESPONSE_WORDS);
 var DEFER_RESPONSES = /* @__PURE__ */ new Set([DEFER_ANSWER]);
 var classifyConfirmResponse = (response) => {
   const normalized = (response ?? "").trim().toLowerCase();
@@ -8473,13 +8659,24 @@ var bypassModeApplies = (input) => isBypassPermissionMode(input.permissionMode)
 var bypassModeAllows = (input) => bypassModeApplies(input) && (bypassStopsOf(input.config) === "nothing" ? !aChosenRuleGovernsInEitherRepository(input, ruleAsksOrRefuses) : bypassModeCoversEveryInput(input));
 var PERMISSIONS_OFF_ASK_REASON = "Permissions are off in your agent, so Pushary only stops for risky steps like this one. You can change this in Settings on pushary.com.";
 var permissionsOffLineAppliesTo = (agentType) => agentType === CLAUDE_CODE_AGENT_TYPE;
-var askAtTheRouteOfAPushOfTheCurrentBranch = (input, repoKey) => {
+var PATTERN_PREFIX_WILDCARD = /(?::\*|\*)?\)$/;
+var CONTINUES_A_COMMAND_WORD = /^[ :]/;
+var ruleNarrowsThePattern = (ruleTool, pattern) => {
+  if (ruleTool === pattern) return false;
+  if (!pattern.includes("(")) return ruleTool.includes("(");
+  const prefix = pattern.replace(PATTERN_PREFIX_WILDCARD, "");
+  return ruleTool.startsWith(prefix) && CONTINUES_A_COMMAND_WORD.test(ruleTool.slice(prefix.length));
+};
+var askAtTheRouteOfAPush = (input, repoKey, allowedBy) => {
   const routes = approvalRoutesOf(input.config);
-  if (routes === null || input.currentBranch === void 0) return void 0;
+  if (routes === null) return void 0;
+  const askRows = input.config.policies.filter((policy) => restricts(policy) && !isAutoDeny(policy) && appliesToThisCall(policy, repoKey, input.sessionId));
+  const routesWithAnAsk = routes.filter((route) => askRows.some((policy) => policy.tool === route.toolPattern));
+  const routesTheAllowDoesNotNarrow = routesWithAnAsk.filter((route) => !ruleNarrowsThePattern(allowedBy.tool, route.toolPattern));
+  const bestOf = (candidates, spellings) => spellings.length === 0 ? void 0 : findBestRoute(candidates, input.toolName, spellings, repoKey);
   for (const toolInput of input.toolInputs) {
-    const pushes = pushesOfTheCurrentBranchIn(input, toolInput);
-    const route = pushes.length === 0 ? void 0 : findBestRoute(routes, input.toolName, pushes, repoKey);
-    const ask = route && input.config.policies.find((policy) => policy.tool === route.toolPattern && restricts(policy) && !isAutoDeny(policy) && appliesToThisCall(policy, repoKey, input.sessionId));
+    const route = bestOf(routesWithAnAsk, pushesOfTheCurrentBranchIn(input, toolInput)) ?? bestOf(routesTheAllowDoesNotNarrow, pushSpellingsBeyondTheWrittenOnesIn(input, toolInput));
+    const ask = route && askRows.find((policy) => policy.tool === route.toolPattern);
     if (ask) {
       const mode = input.modeState.mode ?? input.config.modeOverride ?? ask.mode;
       return { ...ask, mode };
@@ -8488,7 +8685,37 @@ var askAtTheRouteOfAPushOfTheCurrentBranch = (input, repoKey) => {
   return void 0;
 };
 var permissionsOffAskReason = (input, verdict) => verdict.kind === "gate" && !verdict.scopeReason && !isAskedInEveryMode(input.toolName) && bypassModeApplies(input) && bypassStopsOf(input.config) === "consequences" && !aChosenRuleGovernsInEitherRepository(input) ? PERMISSIONS_OFF_ASK_REASON : void 0;
-var resolveGate = (input) => {
+var SCOPE_QUESTION_FIRST_WAIT_SECONDS = 30;
+var policyForScopeQuestion = (policy) => policy.timeoutAction === "approve" ? {
+  ...policy,
+  mode: policy.mode === "push_only" ? "push_first" : policy.mode,
+  timeoutAction: "wait",
+  pushFirstSeconds: policy.pushFirstSeconds > 0 ? policy.pushFirstSeconds : SCOPE_QUESTION_FIRST_WAIT_SECONDS
+} : policy;
+var isAReading = (reading) => reading !== null && reading.trim() !== "";
+var extraReadingsOf = (toolInput) => {
+  const { command } = toolInput;
+  if (typeof command !== "string" || command.length > LONGEST_COMMAND_READ_FOR_A_PUSH) return [];
+  const commentFree = readingWithoutCommentsOrAnsiEscapes(command);
+  const spelledOut = [command, commentFree].filter(isAReading).map(readingWithShellFormsSpelledOut);
+  const readings = [
+    commentFree,
+    ...spelledOut,
+    ...[command, commentFree, ...spelledOut].filter(isAReading).flatMap((text3) => scriptsPassedToAShell(text3)).map(readingWithoutCommentsOrAnsiEscapes)
+  ];
+  return readings.filter(isAReading).map((reading) => ({ ...toolInput, command: reading }));
+};
+var readingsNotYetJudged = (toolInputs) => {
+  const judged = new Set(toolInputs.map((toolInput) => toolInput.command));
+  return toolInputs.flatMap(extraReadingsOf).filter((reading) => {
+    const isNew = !judged.has(reading.command);
+    judged.add(reading.command);
+    return isNew;
+  });
+};
+var withExtraReadings = (input) => shellDialectOf(input.toolName) !== void 0 ? { ...input, toolInputs: [...input.toolInputs, ...readingsNotYetJudged(input.toolInputs)] } : input;
+var resolveGate = (rawInput) => {
+  const input = withExtraReadings(rawInput);
   const { modeState, config, toolName, toolInputs, cwd, sessionId } = input;
   const repoKey = input.sharedRepoKey ?? input.repoKey;
   if (isPusharyOwnTool(toolName)) {
@@ -8503,35 +8730,41 @@ var resolveGate = (input) => {
     const legacyPolicy = (toolInputs.length ? toolInputs : [void 0]).map((toolInput) => resolvePolicy(config, toolName, modeState.mode, toolInput, cwd, input.repoKey, sessionId)).find((policy2) => policy2.repoKey === input.repoKey && verdictForPolicy(policy2) === "deny");
     if (legacyPolicy) return { kind: "deny", policy: legacyPolicy, reason: `Denied by policy for ${legacyPolicy.tool}` };
   }
-  const policy = resolvePolicyAcross(config, toolName, modeState.mode, toolInputs, cwd, repoKey, sessionId);
+  const policy = toolInputs.slice(rawInput.toolInputs.length).map((reading) => resolvePolicy(config, toolName, modeState.mode, reading, cwd, repoKey, sessionId)).reduce(
+    (strictest, reading) => strictestReadingOf(reading, strictest),
+    resolvePolicyAcross(config, toolName, modeState.mode, rawInput.toolInputs, cwd, repoKey, sessionId)
+  );
   const verdict = verdictForPolicy(policy);
   const autoDenies = verdict === "deny";
   const allowedByBypassMode = !autoDenies && verdict !== "allow" && bypassModeAllows(input);
-  const askBesideARoutedPush = verdict === "allow" ? askAtTheRouteOfAPushOfTheCurrentBranch(input, repoKey) : void 0;
+  const askBesideARoutedPush = verdict === "allow" ? askAtTheRouteOfAPush(input, repoKey, policy) : void 0;
   const autoApproves = (verdict === "allow" || allowedByBypassMode) && askBesideARoutedPush === void 0;
   const askedPolicy = askBesideARoutedPush ?? policy;
   if (autoDenies) return { kind: "deny", policy, reason: `Denied by policy for ${policy.tool}` };
   if (isAskedInEveryMode(toolName)) return { kind: "gate", policy };
   if (isModeStateDegraded(modeState)) {
     if (autoApproves) {
-      return survivesDegraded(config, toolName, toolInputs, cwd, repoKey, sessionId) ? { kind: "allow", policy, source: "allowlist" } : { kind: "defer", policy };
+      return survivesDegraded(config, toolName, rawInput.toolInputs, cwd, repoKey, sessionId) ? { kind: "allow", policy, source: "allowlist" } : { kind: "defer", policy };
     }
     return { kind: "gate", policy: askedPolicy };
   }
   const scopeVerdict = modeState.scope ? strictestScopeVerdict(modeState.scope, input.scopePaths ?? []) : { outcome: "no_contract" };
   if (autoApproves) {
     if (!scopeRequiresHuman(scopeVerdict)) {
+      if (config.knownSuperseded === true && !survivesDegraded(config, toolName, rawInput.toolInputs, cwd, repoKey, sessionId)) {
+        return { kind: "defer", policy };
+      }
       return {
         kind: "allow",
         policy: allowedByBypassMode ? autoApprove(policy.tool) : policy,
-        source: toolInputs.length === 1 && resolveAutoResolveOrigin(config, toolName, toolInputs[0], cwd, repoKey, sessionId) === "safe_readonly" ? "allowlist" : "policy"
+        source: rawInput.toolInputs.length === 1 && resolveAutoResolveOrigin(config, toolName, rawInput.toolInputs[0], cwd, repoKey, sessionId) === "safe_readonly" ? "allowlist" : "policy"
       };
     }
   }
   const scopeReason = scopeChangeReason(scopeVerdict);
   return {
     kind: "gate",
-    policy: askedPolicy,
+    policy: scopeReason ? policyForScopeQuestion(askedPolicy) : askedPolicy,
     scopeReason,
     scopePath: scopeReason && "path" in scopeVerdict ? widenablePath(scopeVerdict.path) : void 0
   };
@@ -8645,13 +8878,17 @@ var approvalRoutesOf = (config) => {
   const routes = config.approvalRoutes ?? [];
   return Array.isArray(routes) && routes.every(isApprovalRoutePattern) ? routes : null;
 };
-var GIT_PUSH_OPTIONS_WITH_A_VALUE = /* @__PURE__ */ new Set(["-o", "--push-option", "--repo", "--receive-pack", "--exec"]);
-var GIT_PUSH_FLAGS_THAT_PUSH_NO_BRANCH = /* @__PURE__ */ new Set(["--dry-run", "--tags"]);
-var GIT_PUSH_SHORT_FLAGS_WITH_A_DRY_RUN = /^-[A-Za-z]*n[A-Za-z]*$/;
+var GIT_PUSH_OPTIONS_WITH_A_VALUE = /* @__PURE__ */ new Set(["--push-option", "--repo", "--receive-pack", "--exec", "--recurse-submodules"]);
+var GIT_PUSH_OPTION_WITH_ITS_VALUE_ATTACHED = /^--(?:push-option|repo|receive-pack|exec|recurse-submodules)=/;
+var GIT_PUSH_SHORT_FLAGS_ENDING_IN_THE_OPTION_FLAG = /^-[A-Za-np-z]*o$/;
+var GIT_PUSH_DRY_RUN_FLAG = "--dry-run";
+var GIT_PUSH_TAGS_FLAG = "--tags";
+var GIT_PUSH_SHORT_FLAGS_WITH_A_DRY_RUN = /^-[A-Za-mp-z]*n[A-Za-z]*$/;
 var HEAD_REFSPECS = /* @__PURE__ */ new Set(["HEAD", "@"]);
 var MOVES_BEFORE_A_PUSH = /^(?:(?:if|elif|while|until)\s+)?(?:(?:cd|pushd|popd)(?:\s|$)|git\s+(?:checkout|switch)(?:\s|$))/;
 var LONGEST_COMMAND_READ_FOR_A_PUSH = 16 * 1024;
-var pushesNoBranchItself = (word) => GIT_PUSH_FLAGS_THAT_PUSH_NO_BRANCH.has(word) || GIT_PUSH_SHORT_FLAGS_WITH_A_DRY_RUN.test(word);
+var isADryRunFlag = (word) => word === GIT_PUSH_DRY_RUN_FLAG || GIT_PUSH_SHORT_FLAGS_WITH_A_DRY_RUN.test(word);
+var takesTheNextWordAsItsValue = (word) => GIT_PUSH_OPTIONS_WITH_A_VALUE.has(word) || GIT_PUSH_SHORT_FLAGS_ENDING_IN_THE_OPTION_FLAG.test(word);
 var pointsGitAtAnotherRepository = (form) => {
   const [program, ...words] = form.split(" ");
   if (program !== "git") return false;
@@ -8662,44 +8899,86 @@ var pointsGitAtAnotherRepository = (form) => {
   }
   return false;
 };
+var wordsBeforeAComment = (form) => {
+  const words = shellWordsOf(form);
+  if (words === null) return form.split(" ");
+  const firstComment = words.findIndex((word) => word.comment);
+  return (firstComment === -1 ? words : words.slice(0, firstComment)).map((word) => word.text);
+};
 var gitPushWordsOf = (form) => {
-  const [program, subcommand, ...words] = form.split(" ");
+  const [program, subcommand, ...words] = wordsBeforeAComment(form);
   if (program !== "git" || subcommand !== "push") return null;
   const flags = [];
   const operands = [];
   for (let index = 0; index < words.length; index += 1) {
     const word = words[index] ?? "";
-    if (pushesNoBranchItself(word)) return null;
-    if (GIT_PUSH_OPTIONS_WITH_A_VALUE.has(word)) index += 1;
-    else if (word.startsWith("-")) flags.push(word);
-    else operands.push(word);
+    if (isADryRunFlag(word)) return null;
+    if (takesTheNextWordAsItsValue(word)) {
+      if (GIT_PUSH_FORCING_FLAG.test(word)) flags.push(word);
+      index += 1;
+    } else if (word.startsWith("-")) {
+      if (!GIT_PUSH_OPTION_WITH_ITS_VALUE_ATTACHED.test(word)) flags.push(word);
+    } else {
+      operands.push(word);
+    }
   }
   return { flags, operands };
 };
 var pushNamesNoBranch = ({ operands }) => operands.length <= 1 || operands.length === 2 && HEAD_REFSPECS.has(operands[1] ?? "");
+var GIT_PUSH_FORCING_FLAG = /^(?:--force(?:-with-lease|-if-includes)?(?:=.*)?|-[A-Za-z]*f[A-Za-z]*)$/;
+var GIT_PUSH_FORCE_SPELLINGS = ["--force", "-f"];
+var FORCED_REFSPEC_MARK = "+";
+var REFSPEC_SEPARATOR = ":";
+var BRANCH_REF_PREFIXES = ["refs/heads/", "heads/"];
+var DEFAULT_PUSH_REMOTE = "origin";
+var destinationOfRefspec = (refspec) => {
+  const forced = refspec.startsWith(FORCED_REFSPEC_MARK);
+  const spec = forced ? refspec.slice(FORCED_REFSPEC_MARK.length) : refspec;
+  const destination = spec.slice(spec.lastIndexOf(REFSPEC_SEPARATOR) + 1);
+  const prefix = BRANCH_REF_PREFIXES.find((candidate) => destination.startsWith(candidate));
+  return { branch: prefix === void 0 ? destination : destination.slice(prefix.length), forced };
+};
+var spellingsOfAPushToADestination = (remote, { branch, forced }, flagsForce) => [
+  `git push ${remote} ${branch}`,
+  ...forced || flagsForce ? GIT_PUSH_FORCE_SPELLINGS.map((flag) => `git push ${flag} ${remote} ${branch}`) : []
+];
+var flagsForceThePush = ({ flags }) => flags.some((flag) => GIT_PUSH_FORCING_FLAG.test(flag));
+var spellingsOfAPushToItsDestinations = (form) => {
+  const push = gitPushWordsOf(form);
+  if (push === null) return [];
+  const forced = flagsForceThePush(push) ? GIT_PUSH_FORCE_SPELLINGS.map((flag) => `git push ${flag}`) : [];
+  if (pushNamesNoBranch(push)) return forced;
+  const [remote = DEFAULT_PUSH_REMOTE, ...refspecs] = push.operands;
+  return [...forced, ...refspecs.map(destinationOfRefspec).flatMap((destination) => spellingsOfAPushToADestination(remote, destination, flagsForceThePush(push)))];
+};
 var spellingsOfAPushOfTheBranch = (form, branch) => {
   const push = gitPushWordsOf(form);
-  if (push === null || !pushNamesNoBranch(push)) return [];
-  const remote = push.operands[0] ?? "origin";
+  if (push === null || push.flags.includes(GIT_PUSH_TAGS_FLAG) || !pushNamesNoBranch(push)) return [];
+  const remote = push.operands[0] ?? DEFAULT_PUSH_REMOTE;
   return [.../* @__PURE__ */ new Set([`git push ${remote} ${branch}`, ["git push", ...push.flags, remote, branch].join(" ")])];
 };
+var forcedSpellingsOfAPushOfTheBranch = (form, branch) => {
+  const push = gitPushWordsOf(form);
+  if (push === null || !flagsForceThePush(push)) return [];
+  return spellingsOfAPushOfTheBranch(form, branch).length === 0 ? [] : GIT_PUSH_FORCE_SPELLINGS.map((flag) => `git push ${flag} ${push.operands[0] ?? DEFAULT_PUSH_REMOTE} ${branch}`);
+};
 var commandReadForAPush = (input, toolInput) => {
   const command = POSIX_SHELL_TOOLS.has(input.toolName) ? extractPolicyArg(input.toolName, toolInput) : void 0;
   return command !== void 0 && command.length <= LONGEST_COMMAND_READ_FOR_A_PUSH ? command : void 0;
 };
-var pushesInSegmentsBeforeAMove = (command, branch) => {
+var pushesInSegmentsBeforeAMove = (command, branch, spellingsOf) => {
   const pushes = [];
   for (const segment of spelledSegmentsOf(command)) {
     const { forms } = commandSpellings(segment.text, SPELLS_COMMAND_RUNNERS_TOO);
     if (forms.some((form) => MOVES_BEFORE_A_PUSH.test(form))) break;
-    if (!forms.some(pointsGitAtAnotherRepository)) pushes.push(...forms.flatMap((form) => spellingsOfAPushOfTheBranch(form, branch)));
+    if (!forms.some(pointsGitAtAnotherRepository)) pushes.push(...forms.flatMap((form) => spellingsOf(form, branch)));
   }
   return [...new Set(pushes)];
 };
-var pushesOfTheCurrentBranchIn = (input, toolInput) => {
+var pushesOfTheCurrentBranchIn = (input, toolInput, spellingsOf = spellingsOfAPushOfTheBranch) => {
   const branch = input.currentBranch;
   const command = branch !== void 0 && isGitBranch(branch) ? commandReadForAPush(input, toolInput) : void 0;
-  return branch === void 0 || command === void 0 ? [] : pushesInSegmentsBeforeAMove(command, branch);
+  return branch === void 0 || command === void 0 ? [] : pushesInSegmentsBeforeAMove(command, branch, spellingsOf);
 };
 var MENTIONS_A_GIT_PUSH = /\bgit\b[\s\S]*\bpush\b/;
 var toolInputMayPushTheCurrentBranch = (toolName, toolInput) => {
@@ -8707,13 +8986,20 @@ var toolInputMayPushTheCurrentBranch = (toolName, toolInput) => {
   return command !== void 0 && command.length <= LONGEST_COMMAND_READ_FOR_A_PUSH && MENTIONS_A_GIT_PUSH.test(command);
 };
 var callMayPushTheCurrentBranch = (toolName, toolInputs) => POSIX_SHELL_TOOLS.has(toolName) && toolInputs.some((toolInput) => toolInputMayPushTheCurrentBranch(toolName, toolInput));
-var routeArgumentsOf = (input, toolInput) => [...policyArgForms(input.toolName, toolInput, input.cwd), ...pushesOfTheCurrentBranchIn(input, toolInput)];
+var pushDestinationSpellingsIn = (input, toolInput) => {
+  const command = commandReadForAPush(input, toolInput);
+  if (command === void 0 || !MENTIONS_A_GIT_PUSH.test(command)) return [];
+  return [...new Set(spelledSegmentsOf(command).flatMap((segment) => commandSpellings(segment.text, SPELLS_COMMAND_RUNNERS_TOO).forms.flatMap(spellingsOfAPushToItsDestinations)))];
+};
+var pushSpellingsBeyondTheWrittenOnesIn = (input, toolInput) => [...pushesOfTheCurrentBranchIn(input, toolInput, forcedSpellingsOfAPushOfTheBranch), ...pushDestinationSpellingsIn(input, toolInput)];
+var writtenRouteArgumentsOf = (input, toolInput) => [...policyArgForms(input.toolName, toolInput, input.cwd), ...pushesOfTheCurrentBranchIn(input, toolInput)];
+var routeArgumentsOf = (input, toolInput) => [...writtenRouteArgumentsOf(input, toolInput), ...pushSpellingsBeyondTheWrittenOnesIn(input, toolInput)];
 var everyRule = () => true;
 var aChosenRuleGoverns = (input, counts = everyRule) => {
   const chosen = input.config.policies.filter((policy) => !isDefaultRule(policy));
   const routes = approvalRoutesOf(input.config);
   if (routes === null) return true;
-  return input.toolInputs.some((toolInput) => {
+  return withExtraReadings(input).toolInputs.some((toolInput) => {
     const args = policyArgForms(input.toolName, toolInput, input.cwd);
     const reading = policyReadingOf(chosen, input.toolName, args, SPELLS_COMMAND_RUNNERS_TOO);
     const governing = governingRuleForReading(chosen, input.toolName, args, reading, input.repoKey, input.sessionId);
@@ -8721,16 +9007,27 @@ var aChosenRuleGoverns = (input, counts = everyRule) => {
   });
 };
 var AUTO_PERMISSION_MODE = "auto";
-var routeDeliveredFor = (input, routes, toolInput) => findBestRoute(routes, input.toolName, routeArgumentsOf(input, toolInput), input.sharedRepoKey ?? input.repoKey);
+var routeWaitsForSomeoneElse = (route) => route.answeredBySomeoneElse === true;
+var routeDeliveredFor = (input, routes, toolInput) => {
+  const repoKey = input.sharedRepoKey ?? input.repoKey;
+  const written = writtenRouteArgumentsOf(input, toolInput);
+  const writtenRoute = findBestRoute(routes, input.toolName, written, repoKey);
+  if (writtenRoute?.answeredBySomeoneElse === true) return writtenRoute;
+  const spelled = pushSpellingsBeyondTheWrittenOnesIn(input, toolInput).filter((spelling) => !written.includes(spelling));
+  if (spelled.length === 0) return writtenRoute;
+  const heldSpelledRoute = findBestRoute(routes.filter(routeWaitsForSomeoneElse), input.toolName, spelled, repoKey);
+  if (heldSpelledRoute !== void 0 && heldSpelledRoute.toolPattern.length > (writtenRoute?.toolPattern.length ?? -1)) return heldSpelledRoute;
+  return writtenRoute ?? findBestRoute(routes, input.toolName, spelled, repoKey);
+};
 var callWaitsForSomeoneElse = (input) => {
   const routes = approvalRoutesOf(input.config);
   if (routes === null) return false;
-  return input.toolInputs.some((toolInput) => routeDeliveredFor(input, routes, toolInput)?.answeredBySomeoneElse === true);
+  return withExtraReadings(input).toolInputs.some((toolInput) => routeDeliveredFor(input, routes, toolInput)?.answeredBySomeoneElse === true);
 };
 var namedRouteWaitsForSomeoneElse = (input) => {
   const routes = approvalRoutesOf(input.config);
   if (routes === null) return false;
-  return input.toolInputs.some((toolInput) => {
+  return withExtraReadings(input).toolInputs.some((toolInput) => {
     const route = routeDeliveredFor(input, routes, toolInput);
     return route?.answeredBySomeoneElse === true && patternToolName(route.toolPattern) === input.toolName;
   });
@@ -8738,7 +9035,7 @@ var namedRouteWaitsForSomeoneElse = (input) => {
 var matchedRouteOf = (input) => {
   const routes = approvalRoutesOf(input.config);
   if (routes === null) return void 0;
-  const matched = input.toolInputs.flatMap((toolInput) => routeDeliveredFor(input, routes, toolInput) ?? []);
+  const matched = withExtraReadings(input).toolInputs.flatMap((toolInput) => routeDeliveredFor(input, routes, toolInput) ?? []);
   const route = matched.find((candidate) => candidate.answeredBySomeoneElse === true) ?? matched[0];
   if (route === void 0) return void 0;
   return route.repoKey ? { toolPattern: route.toolPattern, repoKey: route.repoKey } : { toolPattern: route.toolPattern };
@@ -8749,6 +9046,7 @@ var mcpCallCouldBeHeldForSomeoneElse = (toolName, permissionMode) => permissionM
 var approvalRouteHoldsMcpCall = (input, verdict, permissionMode) => mcpCallCouldBeHeldForSomeoneElse(input.toolName, permissionMode) && verdictCanHoldTheCall(verdict) && namedRouteWaitsForSomeoneElse(input);
 var claudeAllowlistOwnsCall = (input, verdict, permissionMode, rules) => rules !== null && verdict.kind === "gate" && !verdict.scopeReason && !aChosenRuleGoverns(input) && !isAskedInEveryMode(input.toolName) && claudeConsultsItsAllowlist(permissionMode) && agentRulesAllowEveryInput(rules, input.toolName, input.toolInputs, input.cwd);
 var claudePromptTakesTheCall = (facts, input, verdict) => verdict.kind === "gate" && !verdict.scopeReason && terminalStaysLiveForTheCall(facts) && noModeOverrideIsActive(input) && !aChosenRuleGoverns(input) && !editGoesToTheAgentsPrompt({ source: facts.source, event: "PreToolUse", permissionMode: facts.permissionMode }, input, verdict);
+var isProvenModeResponse = (value) => isRecord(value) && typeof value.kill === "boolean";
 var toPolicyVersion = (value) => typeof value === "string" || typeof value === "number" ? String(value) : null;
 var modeStateFromResponse = (data) => {
   const mode = data.override?.mode;
@@ -9247,6 +9545,7 @@ export {
   answersToQuestionsAsAsked,
   normalizeInstallSource,
   HOOK_BUDGETS,
+  hookMaxWaitSeconds,
   HOOK_HOLD_BUDGET_ENV,
   withHookHoldBudget,
   hookCommandHoldBudget,
@@ -9337,6 +9636,7 @@ export {
   approvalRouteHoldsMcpCall,
   claudeAllowlistOwnsCall,
   claudePromptTakesTheCall,
+  isProvenModeResponse,
   modeStateFromResponse,
   GATE_WIRE,
   GATE_MAX_TOOL_INPUTS,

package/dist/{chunk-RCCISH7T.js → chunk-TZYVXTLN.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-ARRXCME5.js";
+} from "./chunk-CBLFIWPI.js";
 import {
   writeFileAtomic
 } from "./chunk-T5I4PKOQ.js";

package/dist/{chunk-6ICAZ33G.js → chunk-U32N5JZO.js}

@@ -5,7 +5,7 @@ import {
   MCP_CREDENTIAL_REJECTION_BODY,
   isRecord,
   responseRejectsCredential
-} from "./chunk-KYWTX4R2.js";
+} from "./chunk-TRDHHF3A.js";
 
 // src/credential-rejection.ts
 import { createHash, randomUUID } from "crypto";

package/dist/{chunk-BL7ESWIQ.js → chunk-UHAUC7EO.js}

@@ -4,10 +4,10 @@ import {
   keyPrefix,
   readConfigFileKey,
   readMacAppKeyPrefix
-} from "./chunk-YU3LDR5W.js";
+} from "./chunk-YZ7V2LVG.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-R5ZMI6BM.js";
+} from "./chunk-PJSFKKZ5.js";
 
 // src/key-signed-out.ts
 var VERDICT_BY_CHECK = {

package/dist/{chunk-C32IT2TR.js → chunk-V52J2THT.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-ARRXCME5.js";
+} from "./chunk-CBLFIWPI.js";
 
 // src/bell/install.ts
 import { join } from "path";