pushary 1.9.118 → 1.9.119

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 1.9.119
+
+- A quote or backslash inside a shell comment, or an escaped quote in a `$'...'` string, no longer hides the lines after it from deny rules, routing rules and the check on destructive commands.
+- A Team routing rule now reads a push by where it lands, so `git push origin +main`, `git push origin HEAD:refs/heads/main`, `git push --delete origin main` and `git push --no-verify origin main` count as pushes to `main`, and a push forced by a flag or a `+` counts for a force-push rule. A teammate's Always allow no longer runs them. The policy cache has a new name, and until this update a CLI loses that kept Always allow on a workspace with command routes.
+- A deny rule and the check on destructive commands now see a script fed to a shell by process substitution: `bash <(curl ...)`, `source <(...)`, `. <(...)` and `bash < <(...)` are read like the same text piped into `sh`. Before, they ran under a broad allow.
+- Deny rules and routing rules now read `case ... esac` arms, `coproc`, a function whose body is a subshell, `npx -c`, `su -c` and `parallel`.
+- A comment inside a script handed to a shell with `bash -c`, `sh -c` or `eval` no longer hides the lines after it.
+- PowerShell commands get the same reading of comments.
+
 ## 1.9.118
 
 - Every agent: silence can no longer approve a call outside the scope you agreed. Before, an Always-allow rule on Claude Code withdrew the question at once and ran the call. A scope question now waits for a real answer, then falls back to the agent's own prompt or refuses.

package/dist/{api-Q2HBBRLT.js → api-WWB7ZOLK.js}

@@ -17,25 +17,25 @@ import {
   waitForQuestion,
   waitsForThePhone,
   withdrawQuestion
-} from "./chunk-YQVZQM53.js";
+} from "./chunk-NASQPMXW.js";
 import "./chunk-POFBE6ZY.js";
-import "./chunk-PZLNBKMS.js";
-import "./chunk-QQ24SUBD.js";
-import "./chunk-FEP7FXBP.js";
-import "./chunk-7K6DZPYV.js";
-import "./chunk-A2TAWW5L.js";
-import "./chunk-A23GIPWY.js";
-import "./chunk-IKX4X4LJ.js";
-import "./chunk-KOEQIRDA.js";
+import "./chunk-W6LKC5YD.js";
+import "./chunk-4HDX77ND.js";
+import "./chunk-RGXFBS56.js";
+import "./chunk-U32N5JZO.js";
+import "./chunk-TZYVXTLN.js";
+import "./chunk-CBLFIWPI.js";
+import "./chunk-KOZBVXXC.js";
+import "./chunk-R3RTISDD.js";
 import "./chunk-YU2EUD7O.js";
 import "./chunk-T5I4PKOQ.js";
 import "./chunk-BG4HHB7E.js";
-import "./chunk-CKR43BBJ.js";
+import "./chunk-PJSFKKZ5.js";
 import "./chunk-ZVU6WMMU.js";
 import {
   DECISION_STOP_REASON,
   UNVERIFIABLE_APPROVAL_REASON
-} from "./chunk-I7LP4DKM.js";
+} from "./chunk-TRDHHF3A.js";
 import "./chunk-MLKGABMK.js";
 export {
   ABANDONED_WAIT,

package/dist/bin/pushary-audit.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   exitOnHelpFlag
-} from "../chunk-T5N42XDU.js";
+} from "../chunk-67I7QRQB.js";
 import {
   readJsonSafe,
   writeJsonAtomic
@@ -9,7 +9,7 @@ import {
 import {
   EXIT
 } from "../chunk-BG4HHB7E.js";
-import "../chunk-CKR43BBJ.js";
+import "../chunk-PJSFKKZ5.js";
 import "../chunk-ZVU6WMMU.js";
 import {
   AUDIT_CHAIN_FINDING_SEVERITY,
@@ -22,7 +22,7 @@ import {
   parseAuditChainExport,
   parseAuditKnownHead,
   verifyAuditChainSite
-} from "../chunk-I7LP4DKM.js";
+} from "../chunk-TRDHHF3A.js";
 import "../chunk-MLKGABMK.js";
 
 // src/audit-verify.ts

package/dist/bin/pushary-bell-hook.js

@@ -1,45 +1,45 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-FNT4VWXV.js";
+} from "../chunk-JJNF6QU4.js";
 import {
   readHookInput
-} from "../chunk-H7B6LLP4.js";
-import "../chunk-XSUNHOAP.js";
-import "../chunk-K5H4YAMZ.js";
+} from "../chunk-2C45MJGK.js";
+import "../chunk-EP6I3MQY.js";
+import "../chunk-PDAOZ2NF.js";
 import "../chunk-HXBQTPKC.js";
 import "../chunk-G66WIAST.js";
-import "../chunk-OP2ZDOBR.js";
-import "../chunk-UNXVORET.js";
-import "../chunk-SAISSZZA.js";
-import "../chunk-LWY2U7NZ.js";
-import "../chunk-GAYUSL24.js";
-import "../chunk-CUQOWRYT.js";
-import "../chunk-7YQPI4UE.js";
+import "../chunk-YZESBU7F.js";
+import "../chunk-G4OVFWU4.js";
+import "../chunk-EISUEJDT.js";
+import "../chunk-COXNQUDP.js";
+import "../chunk-GW3PE52Q.js";
+import "../chunk-2UE2NDCX.js";
+import "../chunk-V52J2THT.js";
 import "../chunk-YPY4YCIZ.js";
-import "../chunk-XWVEAAZO.js";
+import "../chunk-SQRS4IF2.js";
 import "../chunk-XMSDA5WA.js";
-import "../chunk-EJYLQNMC.js";
-import "../chunk-WELDACYF.js";
-import "../chunk-YQVZQM53.js";
+import "../chunk-TLCJCP5R.js";
+import "../chunk-SE7P5BBK.js";
+import "../chunk-NASQPMXW.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-PZLNBKMS.js";
-import "../chunk-QQ24SUBD.js";
-import "../chunk-FEP7FXBP.js";
+import "../chunk-W6LKC5YD.js";
+import "../chunk-4HDX77ND.js";
+import "../chunk-RGXFBS56.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-7K6DZPYV.js";
-import "../chunk-A2TAWW5L.js";
-import "../chunk-JBWEGNKE.js";
-import "../chunk-46ZIEQGC.js";
-import "../chunk-A23GIPWY.js";
-import "../chunk-IKX4X4LJ.js";
-import "../chunk-KOEQIRDA.js";
+import "../chunk-U32N5JZO.js";
+import "../chunk-TZYVXTLN.js";
+import "../chunk-YZ7V2LVG.js";
+import "../chunk-VMM6JCNQ.js";
+import "../chunk-CBLFIWPI.js";
+import "../chunk-KOZBVXXC.js";
+import "../chunk-R3RTISDD.js";
 import "../chunk-YU2EUD7O.js";
 import "../chunk-T5I4PKOQ.js";
 import "../chunk-BG4HHB7E.js";
-import "../chunk-CKR43BBJ.js";
+import "../chunk-PJSFKKZ5.js";
 import "../chunk-ZVU6WMMU.js";
-import "../chunk-I7LP4DKM.js";
+import "../chunk-TRDHHF3A.js";
 import "../chunk-MLKGABMK.js";
 
 // bin/pushary-bell-hook.ts

package/dist/bin/pushary-bell.js

@@ -5,28 +5,28 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-FNT4VWXV.js";
+} from "../chunk-JJNF6QU4.js";
 import {
   createIo
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-T5N42XDU.js";
+} from "../chunk-67I7QRQB.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-7YQPI4UE.js";
+} from "../chunk-V52J2THT.js";
 import {
   parseFlags
 } from "../chunk-YPY4YCIZ.js";
-import "../chunk-JBWEGNKE.js";
-import "../chunk-46ZIEQGC.js";
+import "../chunk-YZ7V2LVG.js";
+import "../chunk-VMM6JCNQ.js";
 import {
   claudeSettings
-} from "../chunk-A23GIPWY.js";
-import "../chunk-IKX4X4LJ.js";
-import "../chunk-KOEQIRDA.js";
+} from "../chunk-CBLFIWPI.js";
+import "../chunk-KOZBVXXC.js";
+import "../chunk-R3RTISDD.js";
 import "../chunk-YU2EUD7O.js";
 import {
   readJsonSafe,
@@ -35,11 +35,11 @@ import {
 import {
   EXIT
 } from "../chunk-BG4HHB7E.js";
-import "../chunk-CKR43BBJ.js";
+import "../chunk-PJSFKKZ5.js";
 import "../chunk-ZVU6WMMU.js";
 import {
   isRecord
-} from "../chunk-I7LP4DKM.js";
+} from "../chunk-TRDHHF3A.js";
 import "../chunk-MLKGABMK.js";
 
 // bin/pushary-bell.ts

package/dist/bin/pushary-claude.js

@@ -12,19 +12,19 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-QASBFNVD.js";
+} from "../chunk-SNKC2IQZ.js";
 import "../chunk-ROVLRXBI.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-MG5WFAND.js";
+} from "../chunk-GBVTVTDF.js";
 import {
   claudeTranscriptPath,
   redactDraft,
   registerTranscript,
   registeredTranscriptEnabled,
   startDraftPublisher
-} from "../chunk-K5H4YAMZ.js";
+} from "../chunk-PDAOZ2NF.js";
 import "../chunk-HXBQTPKC.js";
 import "../chunk-G66WIAST.js";
 import {
@@ -40,32 +40,32 @@ import {
   removePendingCommand,
   reportEvent,
   savePendingCommand
-} from "../chunk-UNXVORET.js";
+} from "../chunk-G4OVFWU4.js";
 import {
   ensureDaemonRunning
-} from "../chunk-SAISSZZA.js";
-import "../chunk-LWY2U7NZ.js";
+} from "../chunk-EISUEJDT.js";
+import "../chunk-COXNQUDP.js";
 import {
   UNNAMED_ACTION,
   deriveToolTarget,
   describeStopFailure,
   describeToolCall,
   scopePathFor
-} from "../chunk-GAYUSL24.js";
-import "../chunk-CUQOWRYT.js";
-import "../chunk-7YQPI4UE.js";
+} from "../chunk-GW3PE52Q.js";
+import "../chunk-2UE2NDCX.js";
+import "../chunk-V52J2THT.js";
 import "../chunk-YPY4YCIZ.js";
-import "../chunk-XWVEAAZO.js";
+import "../chunk-SQRS4IF2.js";
 import {
   external_exports
 } from "../chunk-XMSDA5WA.js";
 import {
   transcriptsEnabled
-} from "../chunk-EJYLQNMC.js";
+} from "../chunk-TLCJCP5R.js";
 import {
   repoKeyFor,
   repositoryScopeFor
-} from "../chunk-WELDACYF.js";
+} from "../chunk-SE7P5BBK.js";
 import {
   askUser,
   cancelQuestion,
@@ -77,37 +77,37 @@ import {
   waitForAnswer,
   waitsForThePhone,
   withdrawQuestion
-} from "../chunk-YQVZQM53.js";
+} from "../chunk-NASQPMXW.js";
 import "../chunk-POFBE6ZY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-PZLNBKMS.js";
-import "../chunk-QQ24SUBD.js";
-import "../chunk-FEP7FXBP.js";
+} from "../chunk-W6LKC5YD.js";
+import "../chunk-4HDX77ND.js";
+import "../chunk-RGXFBS56.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
-import "../chunk-7K6DZPYV.js";
+import "../chunk-U32N5JZO.js";
 import {
   getMachineId
-} from "../chunk-A2TAWW5L.js";
-import "../chunk-JBWEGNKE.js";
-import "../chunk-46ZIEQGC.js";
+} from "../chunk-TZYVXTLN.js";
+import "../chunk-YZ7V2LVG.js";
+import "../chunk-VMM6JCNQ.js";
 import {
   claudeConfigDir
-} from "../chunk-A23GIPWY.js";
-import "../chunk-IKX4X4LJ.js";
+} from "../chunk-CBLFIWPI.js";
+import "../chunk-KOZBVXXC.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-KOEQIRDA.js";
+} from "../chunk-R3RTISDD.js";
 import "../chunk-YU2EUD7O.js";
 import "../chunk-T5I4PKOQ.js";
 import "../chunk-BG4HHB7E.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-CKR43BBJ.js";
+} from "../chunk-PJSFKKZ5.js";
 import "../chunk-ZVU6WMMU.js";
 import {
   DECISION_STOP_REASON,
@@ -120,7 +120,7 @@ import {
   refusesWhenUnanswered,
   resolveGate,
   timeoutActionWithoutLocalPrompt
-} from "../chunk-I7LP4DKM.js";
+} from "../chunk-TRDHHF3A.js";
 import "../chunk-MLKGABMK.js";
 
 // src/wrapper/localPassthrough.ts

package/dist/bin/pushary-clean.js

@@ -15,30 +15,26 @@ import {
   storedMacAppState,
   storedPusharyKeychainServices,
   waitForMacAppExit
-} from "../chunk-C664L36M.js";
+} from "../chunk-G5FQU2XF.js";
 import {
   PUSHARY_SKILL_NAME,
   PUSHARY_SKILL_SOURCE,
   createGuards
 } from "../chunk-J42EAEX3.js";
-import "../chunk-D3PHTY54.js";
+import "../chunk-GAOUWLYN.js";
 import "../chunk-XCEN33UP.js";
+import {
+  shortenHome,
+  unregisterPluginLocation,
+  vscodeSettingsTargets
+} from "../chunk-ZTVBM3EZ.js";
 import {
   describeCliKeyRevocation,
   planCliKeyRevocations,
   readCliHeldKeys,
   revokeCliKeys
-} from "../chunk-H6YES2DS.js";
-import {
-  isCursorPluginLeftover,
-  releaseSoleGate,
-  withoutPusharyCursorHooks
-} from "../chunk-MTG3JLMP.js";
-import {
-  shortenHome,
-  unregisterPluginLocation,
-  vscodeSettingsTargets
-} from "../chunk-TUQ6R6DD.js";
+} from "../chunk-W5ZUDPKV.js";
+import "../chunk-E46NE7FB.js";
 import {
   configFileHoldsMacAppKey,
   macAppKeepsMcpEntry,
@@ -46,22 +42,27 @@ import {
   pusharyKey,
   readMacAppAgentKey,
   setupReceiptKey
-} from "../chunk-F5C6XZZ7.js";
-import "../chunk-NPMVVR6I.js";
+} from "../chunk-FPG7X2GS.js";
+import "../chunk-BQ673OOD.js";
 import {
   HERMES_CONFIG_FILE,
   defaultHermesHome,
   hermesReceiptPaths,
   removeHermesWiring
-} from "../chunk-X4UWBBFI.js";
+} from "../chunk-5HKU4VUL.js";
 import "../chunk-QCGNGEGE.js";
+import {
+  isCursorPluginLeftover,
+  releaseSoleGate,
+  withoutPusharyCursorHooks
+} from "../chunk-Z3OG44Z4.js";
 import {
   planClineRemoval,
   planFxRemoval,
   removeClineServer
-} from "../chunk-VIR7SCIQ.js";
-import "../chunk-B6HPULOG.js";
-import "../chunk-5FJPEDMZ.js";
+} from "../chunk-K5WTTEIQ.js";
+import "../chunk-XBH6OKHD.js";
+import "../chunk-6KX2H4I5.js";
 import {
   OPENCODE_ASKED_PERMISSIONS,
   OPENCODE_PLUGIN_SIBLING,
@@ -75,14 +76,14 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-WZZHWX7Q.js";
+} from "../chunk-AGXOTZID.js";
 import {
   ansiPainter,
   useColor
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-T5N42XDU.js";
+} from "../chunk-67I7QRQB.js";
 import "../chunk-ROVLRXBI.js";
 import {
   compatibleConfigFile,
@@ -95,40 +96,40 @@ import {
   removeCompatibleHooks,
   removeCompatibleMcpServer,
   serializeConfigDocument
-} from "../chunk-OP2ZDOBR.js";
-import "../chunk-UNXVORET.js";
+} from "../chunk-YZESBU7F.js";
+import "../chunk-G4OVFWU4.js";
 import {
   disableDaemonService
-} from "../chunk-SAISSZZA.js";
+} from "../chunk-EISUEJDT.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
   removeGeminiSettings,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-LWY2U7NZ.js";
-import "../chunk-GAYUSL24.js";
-import "../chunk-CUQOWRYT.js";
-import "../chunk-7YQPI4UE.js";
+} from "../chunk-COXNQUDP.js";
+import "../chunk-GW3PE52Q.js";
+import "../chunk-2UE2NDCX.js";
+import "../chunk-V52J2THT.js";
 import {
   parseFlags
 } from "../chunk-YPY4YCIZ.js";
-import "../chunk-WELDACYF.js";
-import "../chunk-YQVZQM53.js";
+import "../chunk-SE7P5BBK.js";
+import "../chunk-NASQPMXW.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-PZLNBKMS.js";
-import "../chunk-QQ24SUBD.js";
-import "../chunk-FEP7FXBP.js";
+import "../chunk-W6LKC5YD.js";
+import "../chunk-4HDX77ND.js";
+import "../chunk-RGXFBS56.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-7K6DZPYV.js";
-import "../chunk-A2TAWW5L.js";
+import "../chunk-U32N5JZO.js";
+import "../chunk-TZYVXTLN.js";
 import {
   CANDIDATE_RCS,
   isDisabledExport,
   removeClaudeAlias,
   shellProfileCandidates
-} from "../chunk-JBWEGNKE.js";
-import "../chunk-46ZIEQGC.js";
+} from "../chunk-YZ7V2LVG.js";
+import "../chunk-VMM6JCNQ.js";
 import {
   claudeConfigDir,
   claudeJson,
@@ -173,17 +174,17 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-A23GIPWY.js";
+} from "../chunk-CBLFIWPI.js";
 import {
   cleanNpmEnv,
   globalPackageState,
   npmIsOnPath,
   readGlobalFolder,
   readGlobalPrefix
-} from "../chunk-IKX4X4LJ.js";
+} from "../chunk-KOZBVXXC.js";
 import {
   getBaseUrl
-} from "../chunk-KOEQIRDA.js";
+} from "../chunk-R3RTISDD.js";
 import "../chunk-YU2EUD7O.js";
 import "../chunk-T5I4PKOQ.js";
 import {
@@ -191,7 +192,7 @@ import {
 } from "../chunk-BG4HHB7E.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-CKR43BBJ.js";
+} from "../chunk-PJSFKKZ5.js";
 import {
   CLI_PACKAGE_NAMES,
   globalPackageFolder,
@@ -205,8 +206,7 @@ import {
   SUPPORT_EMAIL,
   isValidApiKey,
   redactSecrets
-} from "../chunk-I7LP4DKM.js";
-import "../chunk-E46NE7FB.js";
+} from "../chunk-TRDHHF3A.js";
 import "../chunk-MLKGABMK.js";
 
 // bin/pushary-clean.ts

package/dist/bin/pushary-codex-bridge.js

@@ -1,47 +1,47 @@
 #!/usr/bin/env node
 import {
   runCodexBridge
-} from "../chunk-FLBMCN45.js";
-import "../chunk-UKCCVMI2.js";
+} from "../chunk-4SZM2HRA.js";
+import "../chunk-HYTDNEXV.js";
 import {
   resolveProviderBinary
-} from "../chunk-6UN3AUIS.js";
-import "../chunk-Q64D24NF.js";
+} from "../chunk-SSBETUYZ.js";
+import "../chunk-CXIYGD33.js";
 import "../chunk-N5P2FLOJ.js";
 import {
   withSpawnProcessOwnership
-} from "../chunk-QASBFNVD.js";
+} from "../chunk-SNKC2IQZ.js";
 import "../chunk-ROVLRXBI.js";
-import "../chunk-XWVEAAZO.js";
+import "../chunk-SQRS4IF2.js";
 import "../chunk-XMSDA5WA.js";
 import {
   transcriptsEnabled
-} from "../chunk-EJYLQNMC.js";
-import "../chunk-WELDACYF.js";
-import "../chunk-YQVZQM53.js";
+} from "../chunk-TLCJCP5R.js";
+import "../chunk-SE7P5BBK.js";
+import "../chunk-NASQPMXW.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-PZLNBKMS.js";
-import "../chunk-QQ24SUBD.js";
-import "../chunk-FEP7FXBP.js";
+import "../chunk-W6LKC5YD.js";
+import "../chunk-4HDX77ND.js";
+import "../chunk-RGXFBS56.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-7K6DZPYV.js";
+import "../chunk-U32N5JZO.js";
 import {
   getMachineId
-} from "../chunk-A2TAWW5L.js";
-import "../chunk-JBWEGNKE.js";
-import "../chunk-46ZIEQGC.js";
-import "../chunk-A23GIPWY.js";
-import "../chunk-IKX4X4LJ.js";
+} from "../chunk-TZYVXTLN.js";
+import "../chunk-YZ7V2LVG.js";
+import "../chunk-VMM6JCNQ.js";
+import "../chunk-CBLFIWPI.js";
+import "../chunk-KOZBVXXC.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-KOEQIRDA.js";
+} from "../chunk-R3RTISDD.js";
 import "../chunk-YU2EUD7O.js";
 import "../chunk-T5I4PKOQ.js";
 import "../chunk-BG4HHB7E.js";
-import "../chunk-CKR43BBJ.js";
+import "../chunk-PJSFKKZ5.js";
 import "../chunk-ZVU6WMMU.js";
-import "../chunk-I7LP4DKM.js";
+import "../chunk-TRDHHF3A.js";
 import "../chunk-MLKGABMK.js";
 
 // bin/pushary-codex-bridge.ts