pushary 1.9.120 → 1.9.121

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.9.121
+
+- An `eval` is read only to the end of its own command, so a script written to a file with a line such as `eval "$(fnm env)" # setup` is no longer refused by an unrelated deny rule.
+- A `Bash` allow beside a `*` routing rule keeps working for an explicit push.
+- A long run of harmless `sh -c` commands can no longer hide a later script from a deny rule, and a command with more commented scripts than Pushary reads is refused under a deny rule.
+
 ## 1.9.120
 
 - Claude Code: the kill switch and standing deny rules now apply to MCP tools, WebFetch and Task (Agent) even when Claude Code would not have shown a prompt, in every permission mode. Nothing new is ever asked on these calls: any other rule, a scope contract and every failure leave them exactly as before. Update or run setup to write the new hook entry. Terminal only for now; the Mac app does not write it yet.

package/dist/{api-QFUMNTEQ.js → api-RI52IA65.js}

@@ -17,25 +17,25 @@ import {
   waitForQuestion,
   waitsForThePhone,
   withdrawQuestion
-} from "./chunk-KG7UZSCD.js";
+} from "./chunk-QK4I4CHR.js";
 import "./chunk-POFBE6ZY.js";
-import "./chunk-UZL3VQCE.js";
-import "./chunk-ZV7G73KH.js";
-import "./chunk-XRRY45XB.js";
-import "./chunk-47HCNA5U.js";
-import "./chunk-6FR5ZYMS.js";
-import "./chunk-ZRTUS6WD.js";
-import "./chunk-ODXZPMKN.js";
-import "./chunk-MZX35RFX.js";
+import "./chunk-SQPAX33Q.js";
+import "./chunk-HINZZUOB.js";
+import "./chunk-UIHY3ANL.js";
+import "./chunk-E5LU5MJ2.js";
+import "./chunk-4LR27PGD.js";
+import "./chunk-GZ3D46PV.js";
+import "./chunk-IGMI36FA.js";
+import "./chunk-2M7FELUY.js";
 import "./chunk-YU2EUD7O.js";
 import "./chunk-T5I4PKOQ.js";
 import "./chunk-BG4HHB7E.js";
-import "./chunk-7VRL6XYM.js";
+import "./chunk-5S32WI3B.js";
 import "./chunk-ZVU6WMMU.js";
 import {
   DECISION_STOP_REASON,
   UNVERIFIABLE_APPROVAL_REASON
-} from "./chunk-W744DTUT.js";
+} from "./chunk-HI5YJFKW.js";
 import "./chunk-MLKGABMK.js";
 export {
   ABANDONED_WAIT,

package/dist/bin/pushary-audit.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   exitOnHelpFlag
-} from "../chunk-YZORQXN7.js";
+} from "../chunk-IA3E675D.js";
 import {
   readJsonSafe,
   writeJsonAtomic
@@ -9,7 +9,7 @@ import {
 import {
   EXIT
 } from "../chunk-BG4HHB7E.js";
-import "../chunk-7VRL6XYM.js";
+import "../chunk-5S32WI3B.js";
 import "../chunk-ZVU6WMMU.js";
 import {
   AUDIT_CHAIN_FINDING_SEVERITY,
@@ -22,7 +22,7 @@ import {
   parseAuditChainExport,
   parseAuditKnownHead,
   verifyAuditChainSite
-} from "../chunk-W744DTUT.js";
+} from "../chunk-HI5YJFKW.js";
 import "../chunk-MLKGABMK.js";
 
 // src/audit-verify.ts

package/dist/bin/pushary-bell-hook.js

@@ -1,45 +1,45 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-IYUAMUO6.js";
+} from "../chunk-BVI2N7QA.js";
 import {
   readHookInput
-} from "../chunk-VKRRUT45.js";
-import "../chunk-L37Q4BR6.js";
-import "../chunk-A5YOWKPR.js";
+} from "../chunk-FEJP2I44.js";
+import "../chunk-WJUFRGJS.js";
+import "../chunk-NDOT226I.js";
 import "../chunk-HXBQTPKC.js";
 import "../chunk-G66WIAST.js";
-import "../chunk-HHZSB6KL.js";
-import "../chunk-XOPOX5QY.js";
-import "../chunk-WFHUECGB.js";
-import "../chunk-3GFJ7CXQ.js";
-import "../chunk-HVGN7TRN.js";
-import "../chunk-SUI5JE6T.js";
-import "../chunk-EG2E2562.js";
+import "../chunk-6RME4X3J.js";
+import "../chunk-X4CDZLUK.js";
+import "../chunk-SFMJMQJC.js";
+import "../chunk-XOYPF2BI.js";
+import "../chunk-7OSBFMRV.js";
+import "../chunk-LS3CQ536.js";
+import "../chunk-IZ7MIGO7.js";
 import "../chunk-YPY4YCIZ.js";
-import "../chunk-4DSJF5JD.js";
+import "../chunk-5MITA7MU.js";
 import "../chunk-XMSDA5WA.js";
-import "../chunk-XSSG5JLJ.js";
-import "../chunk-363YZ5WJ.js";
-import "../chunk-KG7UZSCD.js";
+import "../chunk-AH4NLZTT.js";
+import "../chunk-2QWQCU7L.js";
+import "../chunk-QK4I4CHR.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-UZL3VQCE.js";
-import "../chunk-ZV7G73KH.js";
-import "../chunk-XRRY45XB.js";
+import "../chunk-SQPAX33Q.js";
+import "../chunk-HINZZUOB.js";
+import "../chunk-UIHY3ANL.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-47HCNA5U.js";
-import "../chunk-6FR5ZYMS.js";
-import "../chunk-CPBS6LS3.js";
-import "../chunk-B4M2XZNQ.js";
-import "../chunk-ZRTUS6WD.js";
-import "../chunk-ODXZPMKN.js";
-import "../chunk-MZX35RFX.js";
+import "../chunk-E5LU5MJ2.js";
+import "../chunk-4LR27PGD.js";
+import "../chunk-SZV5SLSD.js";
+import "../chunk-NCHNITQW.js";
+import "../chunk-GZ3D46PV.js";
+import "../chunk-IGMI36FA.js";
+import "../chunk-2M7FELUY.js";
 import "../chunk-YU2EUD7O.js";
 import "../chunk-T5I4PKOQ.js";
 import "../chunk-BG4HHB7E.js";
-import "../chunk-7VRL6XYM.js";
+import "../chunk-5S32WI3B.js";
 import "../chunk-ZVU6WMMU.js";
-import "../chunk-W744DTUT.js";
+import "../chunk-HI5YJFKW.js";
 import "../chunk-MLKGABMK.js";
 
 // bin/pushary-bell-hook.ts

package/dist/bin/pushary-bell.js

@@ -5,28 +5,28 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-IYUAMUO6.js";
+} from "../chunk-BVI2N7QA.js";
 import {
   createIo
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-YZORQXN7.js";
+} from "../chunk-IA3E675D.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-EG2E2562.js";
+} from "../chunk-IZ7MIGO7.js";
 import {
   parseFlags
 } from "../chunk-YPY4YCIZ.js";
-import "../chunk-CPBS6LS3.js";
-import "../chunk-B4M2XZNQ.js";
+import "../chunk-SZV5SLSD.js";
+import "../chunk-NCHNITQW.js";
 import {
   claudeSettings
-} from "../chunk-ZRTUS6WD.js";
-import "../chunk-ODXZPMKN.js";
-import "../chunk-MZX35RFX.js";
+} from "../chunk-GZ3D46PV.js";
+import "../chunk-IGMI36FA.js";
+import "../chunk-2M7FELUY.js";
 import "../chunk-YU2EUD7O.js";
 import {
   readJsonSafe,
@@ -35,11 +35,11 @@ import {
 import {
   EXIT
 } from "../chunk-BG4HHB7E.js";
-import "../chunk-7VRL6XYM.js";
+import "../chunk-5S32WI3B.js";
 import "../chunk-ZVU6WMMU.js";
 import {
   isRecord
-} from "../chunk-W744DTUT.js";
+} from "../chunk-HI5YJFKW.js";
 import "../chunk-MLKGABMK.js";
 
 // bin/pushary-bell.ts

package/dist/bin/pushary-claude.js

@@ -12,19 +12,19 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-HSFTTGOB.js";
+} from "../chunk-FG67GH5B.js";
 import "../chunk-ROVLRXBI.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-K4RIBZ32.js";
+} from "../chunk-7FDDOT2A.js";
 import {
   claudeTranscriptPath,
   redactDraft,
   registerTranscript,
   registeredTranscriptEnabled,
   startDraftPublisher
-} from "../chunk-A5YOWKPR.js";
+} from "../chunk-NDOT226I.js";
 import "../chunk-HXBQTPKC.js";
 import "../chunk-G66WIAST.js";
 import {
@@ -40,32 +40,32 @@ import {
   removePendingCommand,
   reportEvent,
   savePendingCommand
-} from "../chunk-XOPOX5QY.js";
+} from "../chunk-X4CDZLUK.js";
 import {
   ensureDaemonRunning
-} from "../chunk-WFHUECGB.js";
-import "../chunk-3GFJ7CXQ.js";
+} from "../chunk-SFMJMQJC.js";
+import "../chunk-XOYPF2BI.js";
 import {
   UNNAMED_ACTION,
   deriveToolTarget,
   describeStopFailure,
   describeToolCall,
   scopePathFor
-} from "../chunk-HVGN7TRN.js";
-import "../chunk-SUI5JE6T.js";
-import "../chunk-EG2E2562.js";
+} from "../chunk-7OSBFMRV.js";
+import "../chunk-LS3CQ536.js";
+import "../chunk-IZ7MIGO7.js";
 import "../chunk-YPY4YCIZ.js";
-import "../chunk-4DSJF5JD.js";
+import "../chunk-5MITA7MU.js";
 import {
   external_exports
 } from "../chunk-XMSDA5WA.js";
 import {
   transcriptsEnabled
-} from "../chunk-XSSG5JLJ.js";
+} from "../chunk-AH4NLZTT.js";
 import {
   repoKeyFor,
   repositoryScopeFor
-} from "../chunk-363YZ5WJ.js";
+} from "../chunk-2QWQCU7L.js";
 import {
   askUser,
   cancelQuestion,
@@ -77,37 +77,37 @@ import {
   waitForAnswer,
   waitsForThePhone,
   withdrawQuestion
-} from "../chunk-KG7UZSCD.js";
+} from "../chunk-QK4I4CHR.js";
 import "../chunk-POFBE6ZY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-UZL3VQCE.js";
-import "../chunk-ZV7G73KH.js";
-import "../chunk-XRRY45XB.js";
+} from "../chunk-SQPAX33Q.js";
+import "../chunk-HINZZUOB.js";
+import "../chunk-UIHY3ANL.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
-import "../chunk-47HCNA5U.js";
+import "../chunk-E5LU5MJ2.js";
 import {
   getMachineId
-} from "../chunk-6FR5ZYMS.js";
-import "../chunk-CPBS6LS3.js";
-import "../chunk-B4M2XZNQ.js";
+} from "../chunk-4LR27PGD.js";
+import "../chunk-SZV5SLSD.js";
+import "../chunk-NCHNITQW.js";
 import {
   claudeConfigDir
-} from "../chunk-ZRTUS6WD.js";
-import "../chunk-ODXZPMKN.js";
+} from "../chunk-GZ3D46PV.js";
+import "../chunk-IGMI36FA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-MZX35RFX.js";
+} from "../chunk-2M7FELUY.js";
 import "../chunk-YU2EUD7O.js";
 import "../chunk-T5I4PKOQ.js";
 import "../chunk-BG4HHB7E.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-7VRL6XYM.js";
+} from "../chunk-5S32WI3B.js";
 import "../chunk-ZVU6WMMU.js";
 import {
   DECISION_STOP_REASON,
@@ -120,7 +120,7 @@ import {
   refusesWhenUnanswered,
   resolveGate,
   timeoutActionWithoutLocalPrompt
-} from "../chunk-W744DTUT.js";
+} from "../chunk-HI5YJFKW.js";
 import "../chunk-MLKGABMK.js";
 
 // src/wrapper/localPassthrough.ts

package/dist/bin/pushary-clean.js

@@ -15,30 +15,30 @@ import {
   storedMacAppState,
   storedPusharyKeychainServices,
   waitForMacAppExit
-} from "../chunk-TAHUCUY3.js";
+} from "../chunk-B3KFHR43.js";
 import {
   PUSHARY_SKILL_NAME,
   PUSHARY_SKILL_SOURCE,
   createGuards
 } from "../chunk-J42EAEX3.js";
-import "../chunk-5KCUQ3B7.js";
+import "../chunk-HLZWEGW3.js";
 import "../chunk-XCEN33UP.js";
 import {
   describeCliKeyRevocation,
   planCliKeyRevocations,
   readCliHeldKeys,
   revokeCliKeys
-} from "../chunk-6CJ7D6EQ.js";
+} from "../chunk-RK7QHQTY.js";
 import {
   isCursorPluginLeftover,
   releaseSoleGate,
   withoutPusharyCursorHooks
-} from "../chunk-33NEYAK2.js";
+} from "../chunk-2A4X4ETF.js";
 import {
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-NVOQBKIL.js";
+} from "../chunk-DLXYQE5G.js";
 import {
   configFileHoldsMacAppKey,
   macAppKeepsMcpEntry,
@@ -46,22 +46,22 @@ import {
   pusharyKey,
   readMacAppAgentKey,
   setupReceiptKey
-} from "../chunk-PTONPJWL.js";
-import "../chunk-KESS6HAK.js";
+} from "../chunk-J7WPO2M2.js";
+import "../chunk-JK7GROFO.js";
 import {
   HERMES_CONFIG_FILE,
   defaultHermesHome,
   hermesReceiptPaths,
   removeHermesWiring
-} from "../chunk-ZWUVJ3DV.js";
+} from "../chunk-F4K2A7DJ.js";
 import "../chunk-QCGNGEGE.js";
 import {
   planClineRemoval,
   planFxRemoval,
   removeClineServer
-} from "../chunk-5NHWNILG.js";
-import "../chunk-EDNCFLR7.js";
-import "../chunk-NXWQZBOK.js";
+} from "../chunk-F5FMUDD7.js";
+import "../chunk-5UT5EFMH.js";
+import "../chunk-EVWF3A5D.js";
 import {
   OPENCODE_ASKED_PERMISSIONS,
   OPENCODE_PLUGIN_SIBLING,
@@ -75,14 +75,14 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-INKDRMSK.js";
+} from "../chunk-O7VVRTOR.js";
 import {
   ansiPainter,
   useColor
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-YZORQXN7.js";
+} from "../chunk-IA3E675D.js";
 import "../chunk-ROVLRXBI.js";
 import {
   compatibleConfigFile,
@@ -95,40 +95,40 @@ import {
   removeCompatibleHooks,
   removeCompatibleMcpServer,
   serializeConfigDocument
-} from "../chunk-HHZSB6KL.js";
-import "../chunk-XOPOX5QY.js";
+} from "../chunk-6RME4X3J.js";
+import "../chunk-X4CDZLUK.js";
 import {
   disableDaemonService
-} from "../chunk-WFHUECGB.js";
+} from "../chunk-SFMJMQJC.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
   removeGeminiSettings,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-3GFJ7CXQ.js";
-import "../chunk-HVGN7TRN.js";
-import "../chunk-SUI5JE6T.js";
-import "../chunk-EG2E2562.js";
+} from "../chunk-XOYPF2BI.js";
+import "../chunk-7OSBFMRV.js";
+import "../chunk-LS3CQ536.js";
+import "../chunk-IZ7MIGO7.js";
 import {
   parseFlags
 } from "../chunk-YPY4YCIZ.js";
-import "../chunk-363YZ5WJ.js";
-import "../chunk-KG7UZSCD.js";
+import "../chunk-2QWQCU7L.js";
+import "../chunk-QK4I4CHR.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-UZL3VQCE.js";
-import "../chunk-ZV7G73KH.js";
-import "../chunk-XRRY45XB.js";
+import "../chunk-SQPAX33Q.js";
+import "../chunk-HINZZUOB.js";
+import "../chunk-UIHY3ANL.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-47HCNA5U.js";
-import "../chunk-6FR5ZYMS.js";
+import "../chunk-E5LU5MJ2.js";
+import "../chunk-4LR27PGD.js";
 import {
   CANDIDATE_RCS,
   isDisabledExport,
   removeClaudeAlias,
   shellProfileCandidates
-} from "../chunk-CPBS6LS3.js";
-import "../chunk-B4M2XZNQ.js";
+} from "../chunk-SZV5SLSD.js";
+import "../chunk-NCHNITQW.js";
 import {
   claudeConfigDir,
   claudeJson,
@@ -173,17 +173,17 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-ZRTUS6WD.js";
+} from "../chunk-GZ3D46PV.js";
 import {
   cleanNpmEnv,
   globalPackageState,
   npmIsOnPath,
   readGlobalFolder,
   readGlobalPrefix
-} from "../chunk-ODXZPMKN.js";
+} from "../chunk-IGMI36FA.js";
 import {
   getBaseUrl
-} from "../chunk-MZX35RFX.js";
+} from "../chunk-2M7FELUY.js";
 import "../chunk-YU2EUD7O.js";
 import "../chunk-T5I4PKOQ.js";
 import {
@@ -191,7 +191,7 @@ import {
 } from "../chunk-BG4HHB7E.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-7VRL6XYM.js";
+} from "../chunk-5S32WI3B.js";
 import {
   CLI_PACKAGE_NAMES,
   globalPackageFolder,
@@ -205,7 +205,7 @@ import {
   SUPPORT_EMAIL,
   isValidApiKey,
   redactSecrets
-} from "../chunk-W744DTUT.js";
+} from "../chunk-HI5YJFKW.js";
 import "../chunk-E46NE7FB.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/bin/pushary-codex-bridge.js

@@ -1,47 +1,47 @@
 #!/usr/bin/env node
 import {
   runCodexBridge
-} from "../chunk-H4LCCX7W.js";
-import "../chunk-BYP2R2PF.js";
+} from "../chunk-RI5APNBY.js";
+import "../chunk-LIIIC27B.js";
 import {
   resolveProviderBinary
-} from "../chunk-W4MZBZU3.js";
-import "../chunk-YQGPBLIT.js";
+} from "../chunk-S6TMCUU7.js";
+import "../chunk-KRKH26TX.js";
 import "../chunk-N5P2FLOJ.js";
 import {
   withSpawnProcessOwnership
-} from "../chunk-HSFTTGOB.js";
+} from "../chunk-FG67GH5B.js";
 import "../chunk-ROVLRXBI.js";
-import "../chunk-4DSJF5JD.js";
+import "../chunk-5MITA7MU.js";
 import "../chunk-XMSDA5WA.js";
 import {
   transcriptsEnabled
-} from "../chunk-XSSG5JLJ.js";
-import "../chunk-363YZ5WJ.js";
-import "../chunk-KG7UZSCD.js";
+} from "../chunk-AH4NLZTT.js";
+import "../chunk-2QWQCU7L.js";
+import "../chunk-QK4I4CHR.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-UZL3VQCE.js";
-import "../chunk-ZV7G73KH.js";
-import "../chunk-XRRY45XB.js";
+import "../chunk-SQPAX33Q.js";
+import "../chunk-HINZZUOB.js";
+import "../chunk-UIHY3ANL.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-47HCNA5U.js";
+import "../chunk-E5LU5MJ2.js";
 import {
   getMachineId
-} from "../chunk-6FR5ZYMS.js";
-import "../chunk-CPBS6LS3.js";
-import "../chunk-B4M2XZNQ.js";
-import "../chunk-ZRTUS6WD.js";
-import "../chunk-ODXZPMKN.js";
+} from "../chunk-4LR27PGD.js";
+import "../chunk-SZV5SLSD.js";
+import "../chunk-NCHNITQW.js";
+import "../chunk-GZ3D46PV.js";
+import "../chunk-IGMI36FA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-MZX35RFX.js";
+} from "../chunk-2M7FELUY.js";
 import "../chunk-YU2EUD7O.js";
 import "../chunk-T5I4PKOQ.js";
 import "../chunk-BG4HHB7E.js";
-import "../chunk-7VRL6XYM.js";
+import "../chunk-5S32WI3B.js";
 import "../chunk-ZVU6WMMU.js";
-import "../chunk-W744DTUT.js";
+import "../chunk-HI5YJFKW.js";
 import "../chunk-MLKGABMK.js";
 
 // bin/pushary-codex-bridge.ts