pushary 1.9.119 → 1.9.121

package/dist/{chunk-W5ZUDPKV.js → chunk-RK7QHQTY.js}

@@ -1,12 +1,12 @@
 import {
   readMacAppAgentKey
-} from "./chunk-FPG7X2GS.js";
+} from "./chunk-J7WPO2M2.js";
 import {
   API_KEYS_PATH
-} from "./chunk-BQ673OOD.js";
+} from "./chunk-JK7GROFO.js";
 import {
   absoluteUrl
-} from "./chunk-4HDX77ND.js";
+} from "./chunk-HINZZUOB.js";
 import {
   findExportedKeyLines,
   isAdoptedMacAppKey,
@@ -16,10 +16,10 @@ import {
   readConfigFileKey,
   readKeySource,
   readMacAppKeyPrefix
-} from "./chunk-YZ7V2LVG.js";
+} from "./chunk-SZV5SLSD.js";
 import {
   isValidApiKey
-} from "./chunk-TRDHHF3A.js";
+} from "./chunk-HI5YJFKW.js";
 
 // src/key-revocation.ts
 var SELF_REVOKE_PATH = "/api/v1/server/keys/self/revoke";

package/dist/{chunk-SSBETUYZ.js → chunk-S6TMCUU7.js}

@@ -1,6 +1,6 @@
 import {
   realpath
-} from "./chunk-CXIYGD33.js";
+} from "./chunk-KRKH26TX.js";
 import {
   findNativeClaudeInstall
 } from "./chunk-ROVLRXBI.js";
@@ -13,10 +13,10 @@ import {
   resolvePackageVersionFromBinary,
   resolvePathBinary,
   resolvePathBinaryAsync
-} from "./chunk-KOZBVXXC.js";
+} from "./chunk-IGMI36FA.js";
 import {
   MANAGED_PROVIDERS
-} from "./chunk-TRDHHF3A.js";
+} from "./chunk-HI5YJFKW.js";
 
 // src/live-capabilities.ts
 import { homedir } from "os";

package/dist/{chunk-EISUEJDT.js → chunk-SFMJMQJC.js}

@@ -4,19 +4,19 @@ import {
 } from "./chunk-XHKBHWLX.js";
 import {
   getMachineId
-} from "./chunk-TZYVXTLN.js";
+} from "./chunk-4LR27PGD.js";
 import {
   readControlMode
-} from "./chunk-YZ7V2LVG.js";
+} from "./chunk-SZV5SLSD.js";
 import {
   pusharyDir
-} from "./chunk-CBLFIWPI.js";
+} from "./chunk-GZ3D46PV.js";
 import {
   resolveGlobalBinary
-} from "./chunk-KOZBVXXC.js";
+} from "./chunk-IGMI36FA.js";
 import {
   getApiKey
-} from "./chunk-R3RTISDD.js";
+} from "./chunk-2M7FELUY.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -32,7 +32,7 @@ import {
 } from "./chunk-ZVU6WMMU.js";
 import {
   isRecord
-} from "./chunk-TRDHHF3A.js";
+} from "./chunk-HI5YJFKW.js";
 
 // src/daemon-lifecycle.ts
 import { dirname, join, win32 as win32Path } from "path";

package/dist/{chunk-W6LKC5YD.js → chunk-SQPAX33Q.js}

@@ -1,20 +1,20 @@
 import {
   keyCheckFromResponse
-} from "./chunk-4HDX77ND.js";
+} from "./chunk-HINZZUOB.js";
 import {
   installNetworkDefaults
-} from "./chunk-RGXFBS56.js";
+} from "./chunk-UIHY3ANL.js";
 import {
   fetchAsCredential
-} from "./chunk-U32N5JZO.js";
+} from "./chunk-E5LU5MJ2.js";
 import {
   getBaseUrl
-} from "./chunk-R3RTISDD.js";
+} from "./chunk-2M7FELUY.js";
 import {
   isRecord,
   isToolErrorResult,
   toolFailureCodeOfResult
-} from "./chunk-TRDHHF3A.js";
+} from "./chunk-HI5YJFKW.js";
 
 // src/retry.ts
 var isRetryable = (err) => {

package/dist/{chunk-YZ7V2LVG.js → chunk-SZV5SLSD.js}

@@ -1,9 +1,9 @@
 import {
   resolveInstallSourceFor
-} from "./chunk-VMM6JCNQ.js";
+} from "./chunk-NCHNITQW.js";
 import {
   configFilePath
-} from "./chunk-R3RTISDD.js";
+} from "./chunk-2M7FELUY.js";
 import {
   backupFile,
   readJsonSafe,
@@ -14,7 +14,7 @@ import {
   API_KEY_PREFIX_PATTERN,
   isRecord,
   isValidApiKey
-} from "./chunk-TRDHHF3A.js";
+} from "./chunk-HI5YJFKW.js";
 
 // src/shell-alias.ts
 import { homedir } from "os";

package/dist/{chunk-RIAELZYW.js → chunk-T2WDQ3NT.js}

@@ -1,13 +1,13 @@
 import {
   configFilePath
-} from "./chunk-R3RTISDD.js";
+} from "./chunk-2M7FELUY.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "./chunk-T5I4PKOQ.js";
 import {
   readSetupOutcomeProperties
-} from "./chunk-TRDHHF3A.js";
+} from "./chunk-HI5YJFKW.js";
 
 // src/diagnostics/service-runtime.ts
 var unescapeXml = (value) => value.replaceAll("&quot;", '"').replaceAll("&apos;", "'").replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&amp;", "&");

package/dist/{chunk-KILSIJTF.js → chunk-TZHTLLXJ.js}

@@ -1,41 +1,43 @@
 import {
   claudeSettingsLocationFor,
   readClaudePermissionRules
-} from "./chunk-DXJUASTS.js";
+} from "./chunk-D2LPVOG5.js";
 import {
   askAgentQuestions,
   defersToNativeMode,
   outcomeOfFailedAsk,
   storedWaitDeadline
-} from "./chunk-XNCKBVZX.js";
+} from "./chunk-IEZXEY7L.js";
 import {
   reportMachineDenial
-} from "./chunk-VFZ2PE6U.js";
+} from "./chunk-N47MAVYX.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-ISVHV2DP.js";
+} from "./chunk-7EYXAM63.js";
 import {
   isAdmitted,
   readAdmissionRules
-} from "./chunk-2C45MJGK.js";
+} from "./chunk-FEJP2I44.js";
 import {
   isDeferAnswer,
   oncePerSession
-} from "./chunk-GBVTVTDF.js";
+} from "./chunk-7FDDOT2A.js";
 import {
   activeHookSource,
   activeIdentity,
   namedSource
-} from "./chunk-YZESBU7F.js";
+} from "./chunk-6RME4X3J.js";
 import {
   DEFAULT_SESSION,
   approvalAwaitingRetry,
   blockedActionFingerprint,
   claimThrottle,
+  fetchLiveModeState,
   fetchModeState,
   forgetBlockedActionHint,
   getPolicy,
+  getPolicyForStandingDenies,
   hasBlockedActionHint,
   markApprovalReminded,
   readCachedPolicy,
@@ -46,7 +48,7 @@ import {
   settleQuestionsForToolUse,
   sweepFilesOlderThan,
   userScope
-} from "./chunk-G4OVFWU4.js";
+} from "./chunk-X4CDZLUK.js";
 import {
   UNNAMED_ACTION,
   deriveAction,
@@ -57,12 +59,12 @@ import {
   patchDeletesFiles,
   permissionDeniedAction,
   scopePathFor
-} from "./chunk-GW3PE52Q.js";
+} from "./chunk-7OSBFMRV.js";
 import {
   branchFor,
   repoKeyFor,
   repositoryScopeFor
-} from "./chunk-SE7P5BBK.js";
+} from "./chunk-2QWQCU7L.js";
 import {
   askUser,
   cancelQuestion,
@@ -79,20 +81,20 @@ import {
   waitForQuestion,
   waitsForThePhone,
   withdrawQuestion
-} from "./chunk-NASQPMXW.js";
+} from "./chunk-QK4I4CHR.js";
 import {
   getMachineId
-} from "./chunk-TZYVXTLN.js";
+} from "./chunk-4LR27PGD.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-R3RTISDD.js";
+} from "./chunk-2M7FELUY.js";
 import {
   writeFileAtomic
 } from "./chunk-T5I4PKOQ.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-PJSFKKZ5.js";
+} from "./chunk-5S32WI3B.js";
 import {
   AGENT_QUESTION_STRATEGY,
   AGENT_QUESTION_TOOL,
@@ -100,6 +102,7 @@ import {
   GATE_BLOCK_REASON_MAX_LENGTH,
   GATE_WIRE,
   HANDED_BACK_REASON,
+  KILL_REASON,
   MCP_TOOL_PREFIX,
   PLAN_DECLINED_REASON,
   PRETOOLUSE_HANDLED_TOOLS,
@@ -138,8 +141,10 @@ import {
   hookWaitDeadline,
   hookWritePath,
   isBlockedActionRequest,
+  isClaudeRefusalsOnlyTool,
   isCursorHookPayload,
   isPermissionRequestOwnedByPreToolUse,
+  isPusharyConnectorTool,
   isPusharyOwnTool,
   isRecord,
   matchedRouteOf,
@@ -152,12 +157,13 @@ import {
   questionLimitHandBack,
   refusesWhenUnanswered,
   resolveGate,
+  standingDenyOfSubagentAlias,
   terminalLiveWait,
   terminalStaysLiveForTheCall,
   timeoutActionWithoutLocalPrompt,
   unansweredRefusalReason,
   unapprovedScopeReason
-} from "./chunk-TRDHHF3A.js";
+} from "./chunk-HI5YJFKW.js";
 
 // src/terminal-answer-watch.ts
 import { closeSync, openSync, readSync, statSync } from "fs";
@@ -829,9 +835,40 @@ var rememberHandbackToThePrompt = (input, heldForMcpRoute, result) => {
   if (heldForMcpRoute && result?.hookSpecificOutput?.permissionDecision === "ask") recordMcpHoldHandback(blockedActionFingerprintFor(input));
   return result;
 };
+var isRefusalsOnlyCallInClaudeCode = (input) => ACTIVE_SOURCE === "claude" && isClaudeRefusalsOnlyTool(input.tool_name);
+var STANDING_REFUSAL_NETWORK_BUDGET_MS = 800;
+var standingRefusalOf = async (input) => {
+  let apiKey;
+  try {
+    apiKey = getApiKey();
+  } catch {
+    return void 0;
+  }
+  try {
+    const networkBudget = AbortSignal.timeout(STANDING_REFUSAL_NETWORK_BUDGET_MS);
+    const { state: modeState, answeredLive } = await fetchLiveModeState(apiKey, input.session_id, networkBudget);
+    if (modeState.kill) {
+      await reportMachineDenial(input, { kind: "kill", reason: KILL_REASON }, ACTIVE_AGENT);
+      return halted(KILL_REASON);
+    }
+    const policy = answeredLive ? await getPolicyForStandingDenies(apiKey, modeState.policyVersion, ACTIVE_AGENT.type, true, input.session_id, networkBudget) : readCachedPolicy(apiKey, ACTIVE_AGENT.type, true);
+    if (policy === null) return void 0;
+    const gateInputFor = (toolName) => claudeGateInput(modeState, policy, { ...input, tool_name: toolName });
+    const asCalled = resolveGate(gateInputFor(input.tool_name));
+    const denied = asCalled.kind === "deny" ? asCalled : standingDenyOfSubagentAlias(input.tool_name, (toolName) => resolveGate(gateInputFor(toolName)));
+    if (denied === void 0) return void 0;
+    await reportMachineDenial(input, denied, ACTIVE_AGENT);
+    return deny(denied.reason);
+  } catch (error) {
+    await reportHookFailure("pre_tool_use_failed", error);
+    return void 0;
+  }
+};
 var handlePreToolUse = async (input, canonical) => {
   if (isPusharyOwnTool(input.tool_name)) return void 0;
-  if (isMcpCallInClaudeCode(input) && !mcpCallWaitsForSomeoneElse(input)) return void 0;
+  if (isRefusalsOnlyCallInClaudeCode(input) && !mcpCallWaitsForSomeoneElse(input)) {
+    return isPusharyConnectorTool(input.tool_name) ? void 0 : standingRefusalOf(input);
+  }
   let apiKey;
   try {
     apiKey = getApiKey();

package/dist/{chunk-4D23TNCL.js → chunk-UI7XS3MN.js}

@@ -1,19 +1,19 @@
 import {
   notificationAnswerStep
-} from "./chunk-YCCLWG7G.js";
+} from "./chunk-JY2DOJKN.js";
 import {
   canChangeApprovalSettings
-} from "./chunk-BQ673OOD.js";
+} from "./chunk-JK7GROFO.js";
 import {
   matchMacAccountStep,
   retryAgentCommand
-} from "./chunk-XBH6OKHD.js";
+} from "./chunk-5UT5EFMH.js";
 import {
   EXIT
 } from "./chunk-BG4HHB7E.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-PJSFKKZ5.js";
+} from "./chunk-5S32WI3B.js";
 
 // src/setup/closing.ts
 var ACTIVITY_URL = "pushary.com/dashboard/agent/activity";

package/dist/{chunk-RGXFBS56.js → chunk-UIHY3ANL.js}

@@ -1,9 +1,9 @@
 import {
   readExistingMachineId
-} from "./chunk-TZYVXTLN.js";
+} from "./chunk-4LR27PGD.js";
 import {
   getBaseUrl
-} from "./chunk-R3RTISDD.js";
+} from "./chunk-2M7FELUY.js";
 import {
   NetworkError
 } from "./chunk-YU2EUD7O.js";
@@ -13,7 +13,7 @@ import {
 import {
   clientContextHeaders,
   redactSecretsFromContent
-} from "./chunk-TRDHHF3A.js";
+} from "./chunk-HI5YJFKW.js";
 
 // src/cli/net.ts
 import { createRequire } from "module";

package/dist/{chunk-B7BOENW7.js → chunk-UV2JM3PZ.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_HOLD_BUDGET_ENV,
   hookHoldBudgetProof
-} from "./chunk-TRDHHF3A.js";
+} from "./chunk-HI5YJFKW.js";
 
 // src/hold-budget.ts
 var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {

package/dist/{chunk-6YLVNFQZ.js → chunk-VUNQZNKR.js}

@@ -1,6 +1,6 @@
 import {
   SETUP_FLAGS
-} from "./chunk-2UE2NDCX.js";
+} from "./chunk-LS3CQ536.js";
 import {
   parseFlags
 } from "./chunk-YPY4YCIZ.js";
@@ -9,7 +9,7 @@ import {
 } from "./chunk-YU2EUD7O.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-PJSFKKZ5.js";
+} from "./chunk-5S32WI3B.js";
 import {
   CLAUDE_CONNECTOR_GUIDE,
   CLAUDE_CONNECTOR_STEPS,
@@ -17,7 +17,7 @@ import {
   CLAUDE_CONNECTOR_URL,
   COWORK_CONNECTOR_LIMIT,
   COWORK_STANDING_INSTRUCTIONS
-} from "./chunk-TRDHHF3A.js";
+} from "./chunk-HI5YJFKW.js";
 
 // src/cli/cowork.ts
 import { readFileSync } from "fs";

package/dist/{chunk-3IESC326.js → chunk-W4OWC34V.js}

@@ -1,12 +1,12 @@
 import {
   CODEX_HOOK_STATUS
-} from "./chunk-NVV3YUTX.js";
+} from "./chunk-3HZ374VU.js";
 import {
   retryAgentCommand
-} from "./chunk-XBH6OKHD.js";
+} from "./chunk-5UT5EFMH.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-PJSFKKZ5.js";
+} from "./chunk-5S32WI3B.js";
 
 // src/setup/codex-trust.ts
 var CODEX_TRUST_TELEMETRY = {

package/dist/{chunk-EP6I3MQY.js → chunk-WJUFRGJS.js}

@@ -1,17 +1,17 @@
 import {
   pusharyHookExecutable
-} from "./chunk-COXNQUDP.js";
+} from "./chunk-XOYPF2BI.js";
 import {
   bridgeResolvesToApp,
   cursorUserHooks,
   executableFileName,
   isBridgeLocator,
   liveBridgeProbe
-} from "./chunk-CBLFIWPI.js";
+} from "./chunk-GZ3D46PV.js";
 import {
   atLeast,
   parseVersion
-} from "./chunk-KOZBVXXC.js";
+} from "./chunk-IGMI36FA.js";
 import {
   CURSOR_GATE_COVERAGE,
   CURSOR_GATE_SCRIPT,
@@ -21,7 +21,7 @@ import {
   isCursorHookPayload,
   isRecord,
   toolsCoveredByGateEntry
-} from "./chunk-TRDHHF3A.js";
+} from "./chunk-HI5YJFKW.js";
 
 // src/cursor-gate-registration.ts
 import { dirname, isAbsolute, join, resolve } from "path";

package/dist/{chunk-R67NTMBY.js → chunk-WS37PSC5.js}

@@ -1,28 +1,28 @@
+import {
+  canOpenBrowser,
+  openInBrowser
+} from "./chunk-PUZZELE6.js";
 import {
   generateKeypair,
   openSealedKey,
   publicKeyFingerprint
 } from "./chunk-3EGEA4KH.js";
-import {
-  canOpenBrowser,
-  openInBrowser
-} from "./chunk-PUZZELE6.js";
 import {
   PLAN_CONFIGS,
   PLAN_TYPES
 } from "./chunk-G66WIAST.js";
 import {
   keyPrefix
-} from "./chunk-YZ7V2LVG.js";
+} from "./chunk-SZV5SLSD.js";
 import {
   getBaseUrl
-} from "./chunk-R3RTISDD.js";
+} from "./chunk-2M7FELUY.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-PJSFKKZ5.js";
+} from "./chunk-5S32WI3B.js";
 import {
   isValidApiKey
-} from "./chunk-TRDHHF3A.js";
+} from "./chunk-HI5YJFKW.js";
 
 // src/cli/login-ui.ts
 import { hostname } from "os";

package/dist/{chunk-MEPYLTWF.js → chunk-WSYWK4I3.js}

@@ -1,31 +1,31 @@
+import {
+  MANAGED_CLAUDE_SETTINGS_BY_PLATFORM
+} from "./chunk-D2LPVOG5.js";
 import {
   declinedAgentsFile,
   readDeclinedAgents
-} from "./chunk-VRZOUCIK.js";
-import {
-  MANAGED_CLAUDE_SETTINGS_BY_PLATFORM
-} from "./chunk-DXJUASTS.js";
+} from "./chunk-6LP6G2NA.js";
 import {
   OPENCODE_HOOK_BINARY,
   openCodeConfigDir,
   openCodePluginArgv,
   openCodePluginFile
-} from "./chunk-AGXOTZID.js";
+} from "./chunk-O7VVRTOR.js";
 import {
   liveCursorGateCoverage
-} from "./chunk-EP6I3MQY.js";
+} from "./chunk-WJUFRGJS.js";
 import {
   compatibleConfigFile,
   compatibleHookEvents,
   grokHome,
   parseConfigDocument
-} from "./chunk-YZESBU7F.js";
+} from "./chunk-6RME4X3J.js";
 import {
   DEFAULT_HOOKS_KEY_PATH,
   GEMINI_HOOK_BINARY,
   GEMINI_HOOK_EVENTS,
   hooksAt
-} from "./chunk-COXNQUDP.js";
+} from "./chunk-XOYPF2BI.js";
 import {
   CODEX_EARLIER_APPROVAL_MATCHERS,
   CODEX_HOOK_BINARY,
@@ -53,7 +53,7 @@ import {
   parseHookArgv,
   parseHookCommand,
   supportedClaudeEvents
-} from "./chunk-CBLFIWPI.js";
+} from "./chunk-GZ3D46PV.js";
 import {
   readRegularJsonFile,
   readRegularTextFile
@@ -67,7 +67,7 @@ import {
   OPENCODE_APPROVAL_EVENT,
   isRecord,
   matcherMatchesEveryCall
-} from "./chunk-TRDHHF3A.js";
+} from "./chunk-HI5YJFKW.js";
 
 // src/hook-wiring.ts
 import { createHash } from "crypto";

package/dist/{chunk-3B7S2H4R.js → chunk-X2PN3XNW.js}

@@ -2,7 +2,7 @@ import {
   isApprovalMode,
   isRecord,
   isTimeoutAction
-} from "./chunk-TRDHHF3A.js";
+} from "./chunk-HI5YJFKW.js";
 
 // src/cli/settings-response.ts
 var isFiniteNumber = (value) => typeof value === "number" && Number.isFinite(value);