pushary 1.9.125 → 1.9.127

package/dist/bin/pushary-post-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   readHookInput
-} from "../chunk-6DG7PKY5.js";
+} from "../chunk-MBSM6GX5.js";
 import "../chunk-C2L477NM.js";
 import "../chunk-QPS5STKF.js";
 import "../chunk-HXBQTPKC.js";
@@ -11,13 +11,13 @@ import {
   activeIdentity,
   normalizeToolCall,
   profileFromArgv
-} from "../chunk-ZAYXOSEP.js";
+} from "../chunk-BLBK7VV7.js";
 import {
   emitHookOutput,
   handleCompaction,
   handlePostToolUse,
   isCompactionEvent
-} from "../chunk-WLC3AX6F.js";
+} from "../chunk-I365OPWV.js";
 import "../chunk-UXGGVCH5.js";
 import "../chunk-Q3KKA5IZ.js";
 import "../chunk-7OSBFMRV.js";

package/dist/bin/pushary-prompt-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   readHookInput
-} from "../chunk-6DG7PKY5.js";
+} from "../chunk-MBSM6GX5.js";
 import "../chunk-C2L477NM.js";
 import "../chunk-QPS5STKF.js";
 import "../chunk-HXBQTPKC.js";
@@ -9,11 +9,11 @@ import "../chunk-G66WIAST.js";
 import {
   activeHookSource,
   activeIdentity
-} from "../chunk-ZAYXOSEP.js";
+} from "../chunk-BLBK7VV7.js";
 import {
   emitHookOutput,
   handleUserPrompt
-} from "../chunk-WLC3AX6F.js";
+} from "../chunk-I365OPWV.js";
 import "../chunk-UXGGVCH5.js";
 import "../chunk-Q3KKA5IZ.js";
 import "../chunk-7OSBFMRV.js";

package/dist/bin/pushary-session-end-hook.js

@@ -5,7 +5,7 @@ import {
 import "../chunk-ROVLRXBI.js";
 import {
   readHookInput
-} from "../chunk-6DG7PKY5.js";
+} from "../chunk-MBSM6GX5.js";
 import "../chunk-C2L477NM.js";
 import "../chunk-QPS5STKF.js";
 import "../chunk-HXBQTPKC.js";
@@ -13,10 +13,10 @@ import "../chunk-G66WIAST.js";
 import {
   activeHookSource,
   activeIdentity
-} from "../chunk-ZAYXOSEP.js";
+} from "../chunk-BLBK7VV7.js";
 import {
   handleSessionEnd
-} from "../chunk-WLC3AX6F.js";
+} from "../chunk-I365OPWV.js";
 import "../chunk-UXGGVCH5.js";
 import "../chunk-Q3KKA5IZ.js";
 import "../chunk-7OSBFMRV.js";

package/dist/bin/pushary-session-start-hook.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   reapplyClaudeForVersion
-} from "../chunk-ZBKM5V6B.js";
+} from "../chunk-5WF4NBHQ.js";
 import "../chunk-27FILS44.js";
 import "../chunk-7LZQK7EB.js";
 import "../chunk-SNF3OTPB.js";
 import "../chunk-MKUFVNZL.js";
 import "../chunk-PO5Z73HT.js";
-import "../chunk-SBPVEVLZ.js";
+import "../chunk-YZ74AFIU.js";
 import "../chunk-P2WA3YY2.js";
 import "../chunk-ROVLRXBI.js";
 import {
@@ -15,7 +15,7 @@ import {
 } from "../chunk-STGEWWFW.js";
 import {
   readHookInput
-} from "../chunk-6DG7PKY5.js";
+} from "../chunk-MBSM6GX5.js";
 import "../chunk-C2L477NM.js";
 import "../chunk-QPS5STKF.js";
 import "../chunk-HXBQTPKC.js";
@@ -23,11 +23,11 @@ import "../chunk-G66WIAST.js";
 import {
   activeHookSource,
   activeIdentity
-} from "../chunk-ZAYXOSEP.js";
+} from "../chunk-BLBK7VV7.js";
 import {
   CLAUDE_CODE_AGENT,
   handleSessionStart
-} from "../chunk-WLC3AX6F.js";
+} from "../chunk-I365OPWV.js";
 import "../chunk-UXGGVCH5.js";
 import "../chunk-Q3KKA5IZ.js";
 import "../chunk-7OSBFMRV.js";

package/dist/bin/pushary-setup.js

@@ -44,7 +44,7 @@ import {
 import "../chunk-PUZZELE6.js";
 import {
   readCodexHooksOnDisk
-} from "../chunk-MIO2IWCZ.js";
+} from "../chunk-4HDFEBPU.js";
 import "../chunk-PO6ECYXG.js";
 import {
   clearDeclinedAgent,
@@ -115,7 +115,7 @@ import {
   soleGateFile,
   soleGateReceipt,
   soleGateReceiptFile
-} from "../chunk-AVSHVOFB.js";
+} from "../chunk-OPBPSPMU.js";
 import {
   describeDetection,
   detectAllAgents,
@@ -124,11 +124,11 @@ import {
   registerPluginLocation,
   shortenHome,
   vscodeSettingsTargets
-} from "../chunk-RKXSWF62.js";
+} from "../chunk-YT47T5TM.js";
 import {
   mcpServerBearer,
   readMacAppAgentKey
-} from "../chunk-NPAEVCTN.js";
+} from "../chunk-LAPXXS6K.js";
 import {
   keyScopeOf
 } from "../chunk-DK6R5IVR.js";
@@ -197,7 +197,7 @@ import {
   openCodePluginFile,
   openCodeWired,
   withOpenCodeAskRules
-} from "../chunk-SBPVEVLZ.js";
+} from "../chunk-YZ74AFIU.js";
 import {
   ansiPainter,
   createIo,
@@ -238,10 +238,10 @@ import {
   compatibleRecord,
   compatibleTargetPaths,
   hasCompatibleHooks
-} from "../chunk-ZAYXOSEP.js";
+} from "../chunk-BLBK7VV7.js";
 import {
   reportEvent
-} from "../chunk-WLC3AX6F.js";
+} from "../chunk-I365OPWV.js";
 import {
   DAEMON_COLD_START_TIMEOUT_MS,
   clearDaemonNeedsLogin,

package/dist/bin/pushary-status.js

@@ -24,10 +24,10 @@ import {
   CONNECTED_THROUGH_MAC_APP,
   keyWrittenByMacApp,
   readMacAppConnectionWhenKeyless
-} from "../chunk-NPAEVCTN.js";
+} from "../chunk-LAPXXS6K.js";
 import "../chunk-DK6R5IVR.js";
 import "../chunk-QCGNGEGE.js";
-import "../chunk-SBPVEVLZ.js";
+import "../chunk-YZ74AFIU.js";
 import {
   createIo
 } from "../chunk-FO3MDD26.js";
@@ -37,8 +37,8 @@ import {
 import "../chunk-MXUQJIQS.js";
 import "../chunk-P2WA3YY2.js";
 import "../chunk-ROVLRXBI.js";
-import "../chunk-ZAYXOSEP.js";
-import "../chunk-WLC3AX6F.js";
+import "../chunk-BLBK7VV7.js";
+import "../chunk-I365OPWV.js";
 import "../chunk-UXGGVCH5.js";
 import "../chunk-Q3KKA5IZ.js";
 import "../chunk-7OSBFMRV.js";

package/dist/bin/pushary-stop-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   readHookInput
-} from "../chunk-6DG7PKY5.js";
+} from "../chunk-MBSM6GX5.js";
 import "../chunk-C2L477NM.js";
 import "../chunk-QPS5STKF.js";
 import "../chunk-HXBQTPKC.js";
@@ -9,13 +9,13 @@ import "../chunk-G66WIAST.js";
 import {
   activeHookSource,
   activeIdentity
-} from "../chunk-ZAYXOSEP.js";
+} from "../chunk-BLBK7VV7.js";
 import {
   emitHookOutput,
   handleStop,
   handleSubagentStop,
   isSubagentStop
-} from "../chunk-WLC3AX6F.js";
+} from "../chunk-I365OPWV.js";
 import "../chunk-UXGGVCH5.js";
 import "../chunk-Q3KKA5IZ.js";
 import "../chunk-7OSBFMRV.js";

package/dist/bin/pushary-stopfailure-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   readHookInput
-} from "../chunk-6DG7PKY5.js";
+} from "../chunk-MBSM6GX5.js";
 import "../chunk-C2L477NM.js";
 import "../chunk-QPS5STKF.js";
 import "../chunk-HXBQTPKC.js";
@@ -9,10 +9,10 @@ import "../chunk-G66WIAST.js";
 import {
   activeHookSource,
   activeIdentity
-} from "../chunk-ZAYXOSEP.js";
+} from "../chunk-BLBK7VV7.js";
 import {
   handleStopFailure
-} from "../chunk-WLC3AX6F.js";
+} from "../chunk-I365OPWV.js";
 import "../chunk-UXGGVCH5.js";
 import "../chunk-Q3KKA5IZ.js";
 import "../chunk-7OSBFMRV.js";

package/dist/bin/pushary-upgrade.js

@@ -28,7 +28,7 @@ import {
 import {
   ensureCodexTrustAfterReapply,
   reapplyAllAgents
-} from "../chunk-ZBKM5V6B.js";
+} from "../chunk-5WF4NBHQ.js";
 import {
   HERMES_RESTART_COMMAND,
   describeCodexTrustConfirmation
@@ -40,7 +40,7 @@ import {
 import "../chunk-27FILS44.js";
 import {
   readMacAppAgentKey
-} from "../chunk-NPAEVCTN.js";
+} from "../chunk-LAPXXS6K.js";
 import "../chunk-DK6R5IVR.js";
 import "../chunk-7LZQK7EB.js";
 import {
@@ -55,7 +55,7 @@ import {
   retryAgentCommand
 } from "../chunk-MKUFVNZL.js";
 import "../chunk-PO5Z73HT.js";
-import "../chunk-SBPVEVLZ.js";
+import "../chunk-YZ74AFIU.js";
 import {
   exitOnHelpFlag
 } from "../chunk-IA3E675D.js";
@@ -77,8 +77,8 @@ import {
   readAutoUpdateState,
   updateAutoUpdateState
 } from "../chunk-STGEWWFW.js";
-import "../chunk-ZAYXOSEP.js";
-import "../chunk-WLC3AX6F.js";
+import "../chunk-BLBK7VV7.js";
+import "../chunk-I365OPWV.js";
 import {
   DAEMON_COLD_START_TIMEOUT_MS,
   daemonHasRemoteProof,

package/dist/{chunk-MIO2IWCZ.js → chunk-4HDFEBPU.js}

@@ -10,7 +10,7 @@ import {
   openCodeConfigDir,
   openCodePluginArgv,
   openCodePluginFile
-} from "./chunk-SBPVEVLZ.js";
+} from "./chunk-YZ74AFIU.js";
 import {
   liveCursorGateCoverage
 } from "./chunk-C2L477NM.js";
@@ -19,7 +19,7 @@ import {
   compatibleHookEvents,
   grokHome,
   parseConfigDocument
-} from "./chunk-ZAYXOSEP.js";
+} from "./chunk-BLBK7VV7.js";
 import {
   DEFAULT_HOOKS_KEY_PATH,
   GEMINI_HOOK_BINARY,

package/dist/{chunk-ZBKM5V6B.js → chunk-5WF4NBHQ.js}

@@ -28,7 +28,7 @@ import {
   openCodePluginDir,
   openCodeWired,
   withOpenCodeAskRules
-} from "./chunk-SBPVEVLZ.js";
+} from "./chunk-YZ74AFIU.js";
 import {
   detectClaudeVersion
 } from "./chunk-P2WA3YY2.js";
@@ -37,7 +37,7 @@ import {
   compatibleConfigFile,
   compatibleInstructionsFile,
   hasCompatibleHooks
-} from "./chunk-ZAYXOSEP.js";
+} from "./chunk-BLBK7VV7.js";
 import {
   GEMINI_HOOK_BINARY,
   addGeminiHooks,

package/dist/{chunk-GM26OJG6.js → chunk-6IL3DQY6.js}

@@ -7,10 +7,10 @@ import {
   defersToNativeMode,
   outcomeOfFailedAsk,
   storedWaitDeadline
-} from "./chunk-X6WYICTL.js";
+} from "./chunk-S7QATB3I.js";
 import {
   reportMachineDenial
-} from "./chunk-2WGP6QE7.js";
+} from "./chunk-6MFX5NIX.js";
 import {
   isGatingMoment,
   recordKeylessMoment
@@ -18,16 +18,16 @@ import {
 import {
   isAdmitted,
   readAdmissionRules
-} from "./chunk-6DG7PKY5.js";
+} from "./chunk-MBSM6GX5.js";
 import {
   isDeferAnswer,
   oncePerSession
-} from "./chunk-OJPHNITI.js";
+} from "./chunk-JW6JSBGS.js";
 import {
   activeHookSource,
   activeIdentity,
   namedSource
-} from "./chunk-ZAYXOSEP.js";
+} from "./chunk-BLBK7VV7.js";
 import {
   DEFAULT_SESSION,
   approvalAwaitingRetry,
@@ -48,7 +48,7 @@ import {
   settleQuestionsForToolUse,
   sweepFilesOlderThan,
   userScope
-} from "./chunk-WLC3AX6F.js";
+} from "./chunk-I365OPWV.js";
 import {
   UNNAMED_ACTION,
   deriveAction,

package/dist/{chunk-2WGP6QE7.js → chunk-6MFX5NIX.js}

@@ -4,7 +4,7 @@ import {
   claimThrottle,
   releaseThrottle,
   reportEvent
-} from "./chunk-WLC3AX6F.js";
+} from "./chunk-I365OPWV.js";
 import {
   deriveToolTarget,
   permissionDeniedAction

package/dist/{chunk-ZAYXOSEP.js → chunk-BLBK7VV7.js}

@@ -1,6 +1,6 @@
 import {
   CLAUDE_CODE_AGENT
-} from "./chunk-WLC3AX6F.js";
+} from "./chunk-I365OPWV.js";
 import {
   addGeminiMcpServer,
   removeGeminiMcpServer

package/dist/{chunk-44SXI642.js → chunk-FN77IVAI.js}

@@ -1,6 +1,6 @@
 import {
   readMacAppAgentKey
-} from "./chunk-NPAEVCTN.js";
+} from "./chunk-LAPXXS6K.js";
 import {
   API_KEYS_PATH
 } from "./chunk-DK6R5IVR.js";

package/dist/{chunk-WLC3AX6F.js → chunk-I365OPWV.js}

@@ -361,7 +361,7 @@ var emitHookOutput = async (render, write = writeOutput) => {
 
 // src/policy.ts
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync2, lstatSync as lstatSync2, readFileSync as readFileSync2, readdirSync as readdirSync2, unlinkSync as unlinkSync2, utimesSync, writeFileSync as writeFileSync2 } from "fs";
 import { join as join2 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 var CACHE_TTL_MS = 60 * 1e3;
@@ -371,10 +371,56 @@ var policyRequestFor = (agentType) => ({
   repoAware: REPO_AWARE_AGENTS.includes(agentType)
 });
 var POLICY_CACHE_FORMAT = "v3";
-var policyCacheFile = (apiKey, agent, repoAware = false) => {
-  const parts = [apiKey, agent, repoAware ? "repoAware" : void 0, "sessionToolAware"].filter(Boolean);
+var POLICY_CACHE_PREFIX = `pushary-policy-${POLICY_CACHE_FORMAT}-`;
+var policyCacheFile = (apiKey, agent, repoAware = false, sessionId) => {
+  const parts = [apiKey, agent, repoAware ? "repoAware" : void 0, "sessionToolAware", sessionId ? `session:${sessionId}` : void 0].filter(Boolean);
   const hash = createHash2("sha256").update(parts.join(":")).digest("hex").slice(0, 12);
-  return join2(tmpdir2(), `pushary-policy-${POLICY_CACHE_FORMAT}-${hash}.json`);
+  return join2(tmpdir2(), `${POLICY_CACHE_PREFIX}${hash}.json`);
+};
+var isAbsentOrNullableString = (value) => value === void 0 || value === null || typeof value === "string";
+var isCachedPolicyRead = (value) => isPolicyConfig(value) && isRecord(value) && (value._cachedAt === void 0 || typeof value._cachedAt === "number") && isAbsentOrNullableString(value._policyVersion) && isAbsentOrNullableString(value._sessionId);
+var isPolicyCacheName = (name) => name.startsWith(POLICY_CACHE_PREFIX) && name.endsWith(".json");
+var policyCachePruneStamp = () => join2(tmpdir2(), `pushary-policy-prune-${POLICY_CACHE_FORMAT}-${process.getuid?.() ?? "user"}.stamp`);
+var POLICY_CACHE_PRUNE_INTERVAL_MS = 60 * 60 * 1e3;
+var prunedWithinTheInterval = (stampedAtMs, now) => {
+  const elapsed = now - stampedAtMs;
+  return elapsed >= 0 && elapsed < POLICY_CACHE_PRUNE_INTERVAL_MS;
+};
+var claimPolicyCachePrune = (now) => {
+  const stamp = policyCachePruneStamp();
+  try {
+    const stamped = lstatSync2(stamp);
+    if (!stamped.isFile() || prunedWithinTheInterval(stamped.mtimeMs, now)) return false;
+    utimesSync(stamp, now / 1e3, now / 1e3);
+    return true;
+  } catch {
+    try {
+      writeFileSync2(stamp, "", { flag: "wx", mode: 384 });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+};
+var removePolicyCachesTooOldToServe = (now) => {
+  if (!claimPolicyCachePrune(now)) return;
+  try {
+    for (const name of readdirSync2(tmpdir2())) {
+      if (!isPolicyCacheName(name)) continue;
+      const path = join2(tmpdir2(), name);
+      try {
+        if (now - lstatSync2(path).mtimeMs >= STALE_CACHE_MAX_MS) unlinkSync2(path);
+      } catch {
+      }
+    }
+  } catch {
+  }
+};
+var writePolicyCache = (path, entry) => {
+  try {
+    writeFileSync2(path, JSON.stringify(entry), { encoding: "utf-8", mode: 384 });
+  } catch {
+  }
 };
 var POLICY_REQUEST_CAPABILITIES_VALUE = policyRequestCapabilitiesHeaderValue(CLI_POLICY_REQUEST_CAPABILITIES);
 var fetchPolicy = async (apiKey, agent, repoAware = false, sessionId, signal) => {
@@ -401,13 +447,15 @@ var fetchPolicy = async (apiKey, agent, repoAware = false, sessionId, signal) =>
   }, { maxAttempts: 2, shouldRetry: (error) => signal?.aborted !== true && isRetryable(error) });
 };
 var getPolicy = async (apiKey, expectedVersion, agent, repoAware = false, sessionId, signal) => {
-  const path = policyCacheFile(apiKey, agent, repoAware);
+  const path = policyCacheFile(apiKey, agent, repoAware, sessionId);
+  const sharedPath = policyCacheFile(apiKey, agent, repoAware);
+  const firstForThisSession = path !== sharedPath && !existsSync2(path);
+  const readPath = firstForThisSession ? sharedPath : path;
   let staleCache = null;
-  if (existsSync2(path)) {
+  if (existsSync2(readPath)) {
     try {
-      const stat = readFileSync2(path, "utf-8");
-      const cached = JSON.parse(stat);
-      if (!isPolicyConfig(cached)) throw new Error("Corrupted cache");
+      const cached = JSON.parse(readFileSync2(readPath, "utf-8"));
+      if (!isCachedPolicyRead(cached)) throw new Error("Corrupted cache");
       const versionStale = expectedVersion != null && (cached._policyVersion ?? null) !== expectedVersion;
       const sessionStale = (cached._sessionId ?? null) !== (sessionId ?? null);
       const age = cached._cachedAt ? Date.now() - cached._cachedAt : 0;
@@ -421,10 +469,11 @@ var getPolicy = async (apiKey, expectedVersion, agent, repoAware = false, sessio
   }
   try {
     const policy = await fetchPolicy(apiKey, agent, repoAware, sessionId, signal);
-    try {
-      writeFileSync2(path, JSON.stringify({ ...policy, _cachedAt: Date.now(), _policyVersion: expectedVersion ?? null, _sessionId: sessionId ?? null }), { encoding: "utf-8", mode: 384 });
-    } catch {
-    }
+    const cachedAt = Date.now();
+    const entry = { ...policy, _cachedAt: cachedAt, _policyVersion: expectedVersion ?? null, _sessionId: sessionId ?? null };
+    if (firstForThisSession) removePolicyCachesTooOldToServe(cachedAt);
+    writePolicyCache(path, entry);
+    if (path !== sharedPath) writePolicyCache(sharedPath, entry);
     return policy;
   } catch {
     if (staleCache) return staleCache;
@@ -434,10 +483,10 @@ var getPolicy = async (apiKey, expectedVersion, agent, repoAware = false, sessio
 var readFreshPolicyOfAnySession = (path, expectedVersion) => {
   try {
     const cached = JSON.parse(readFileSync2(path, "utf-8"));
-    if (!isRecord(cached) || typeof cached._cachedAt !== "number") return null;
+    if (!isCachedPolicyRead(cached) || cached._cachedAt === void 0) return null;
     if (Date.now() - cached._cachedAt >= CACHE_TTL_MS) return null;
     if (expectedVersion != null && (cached._policyVersion ?? null) !== expectedVersion) return null;
-    return isPolicyConfig(cached) ? cached : null;
+    return cached;
   } catch {
     return null;
   }
@@ -447,7 +496,7 @@ var readCachedPolicy = (apiKey, agent, repoAware = false) => {
   const path = policyCacheFile(apiKey, agent, repoAware);
   try {
     const cached = JSON.parse(readFileSync2(path, "utf-8"));
-    if (!isPolicyConfig(cached)) return null;
+    if (!isCachedPolicyRead(cached)) return null;
     const age = cached._cachedAt ? Date.now() - cached._cachedAt : STALE_CACHE_MAX_MS;
     return age < STALE_CACHE_MAX_MS ? cached : null;
   } catch {
@@ -741,7 +790,7 @@ var permissionTimeoutDecision = (timeoutAction, paused) => {
 
 // src/codex-call-decision.ts
 import { createHash as createHash4 } from "crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, readdirSync as readdirSync2, rmSync as rmSync2, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, readdirSync as readdirSync3, rmSync as rmSync2, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
 import { tmpdir as tmpdir4, userInfo } from "os";
 import { join as join4 } from "path";
 var CODEX_DECISION_TTL_MS = 60 * 1e3;
@@ -793,7 +842,7 @@ var parseDecision = (raw) => {
 };
 var sweepExpired = (dir, nowMs) => {
   try {
-    for (const name of readdirSync2(dir)) {
+    for (const name of readdirSync3(dir)) {
       const path = join4(dir, name);
       try {
         if (nowMs - statSync3(path).mtimeMs >= CODEX_DECISION_TTL_MS) rmSync2(path, { force: true });
@@ -862,7 +911,7 @@ var releaseThrottle = (key) => {
 
 // src/blocked-action-hint.ts
 import { createHash as createHash6 } from "crypto";
-import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync5, readdirSync as readdirSync3, rmSync as rmSync4, statSync as statSync5, utimesSync } from "fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync5, readdirSync as readdirSync4, rmSync as rmSync4, statSync as statSync5, utimesSync as utimesSync2 } from "fs";
 import { tmpdir as tmpdir6 } from "os";
 import { join as join6 } from "path";
 var BLOCKED_ACTION_HINT_TTL_MS = BLOCKED_ACTION_GRANT_TTL_SECONDS * 1e3;
@@ -886,7 +935,7 @@ var hintFile = (fingerprint) => join6(hintDir(), fingerprint);
 var isExpired = (mtimeMs, nowMs) => nowMs - mtimeMs >= BLOCKED_ACTION_HINT_TTL_MS;
 var sweepFilesOlderThan = (dir, ttlMs, nowMs) => {
   try {
-    for (const name of readdirSync3(dir)) {
+    for (const name of readdirSync4(dir)) {
       const path = join6(dir, name);
       try {
         if (nowMs - statSync5(path).mtimeMs >= ttlMs) rmSync4(path, { force: true });
@@ -934,7 +983,7 @@ var approvalIn = (fingerprint, sessionId) => {
 var approvalAwaitingRetry = (sessionId) => {
   if (!sessionId) return null;
   try {
-    for (const name of readdirSync3(hintDir())) {
+    for (const name of readdirSync4(hintDir())) {
       const approval = isFingerprint(name) ? approvalIn(name, sessionId) : null;
       if (approval) return approval;
     }
@@ -949,7 +998,7 @@ var markApprovalReminded = (approval) => {
     const { atime, mtime } = statSync5(path);
     const { fingerprint, sessionId, toolName } = approval;
     writeFileAtomic(path, JSON.stringify({ fingerprint, sessionId, toolName, reminded: true }), 384);
-    utimesSync(path, atime, mtime);
+    utimesSync2(path, atime, mtime);
   } catch {
     return;
   }
@@ -964,7 +1013,7 @@ var forgetBlockedActionHint = (fingerprint) => {
 };
 
 // src/claude-session-record.ts
-import { readFileSync as readFileSync6, readdirSync as readdirSync4, statSync as statSync6 } from "fs";
+import { readFileSync as readFileSync6, readdirSync as readdirSync5, statSync as statSync6 } from "fs";
 import { join as join7 } from "path";
 var UNREADABLE = { kind: "unreadable" };
 var OTHER_SESSION = { kind: "other_session" };
@@ -1000,7 +1049,7 @@ var readSessionFile = (path, sessionId) => {
 };
 var runningSessionFiles = (sessions) => {
   try {
-    return readdirSync4(sessions).filter((name) => name.endsWith(SESSION_FILE_SUFFIX)).map((name) => name.slice(0, -SESSION_FILE_SUFFIX.length)).filter((pid) => PROCESS_ID.test(pid) && isRunning(Number(pid))).map((pid) => join7(sessions, `${pid}${SESSION_FILE_SUFFIX}`));
+    return readdirSync5(sessions).filter((name) => name.endsWith(SESSION_FILE_SUFFIX)).map((name) => name.slice(0, -SESSION_FILE_SUFFIX.length)).filter((pid) => PROCESS_ID.test(pid) && isRunning(Number(pid))).map((pid) => join7(sessions, `${pid}${SESSION_FILE_SUFFIX}`));
   } catch {
     return [];
   }
@@ -1141,10 +1190,10 @@ var CLAUDE_CODE_AGENT = { type: "claude_code", label: "Claude Code" };
 var POLICY_CACHE_TTL_MS = 5 * 60 * 1e3;
 var readFreshCachedPolicy = (apiKey, agentType, sessionId) => {
   const request = policyRequestFor(agentType);
-  const path = policyCacheFile(apiKey, request.agent, request.repoAware);
+  const path = policyCacheFile(apiKey, request.agent, request.repoAware, sessionId);
   if (!existsSync6(path)) return null;
   const cached = JSON.parse(readFileSync7(path, "utf-8"));
-  if (!isPolicyConfig(cached)) return null;
+  if (!isCachedPolicyRead(cached)) return null;
   if ((cached._sessionId ?? null) !== (sessionId ?? null)) return null;
   if (!cached._cachedAt || Date.now() - cached._cachedAt >= POLICY_CACHE_TTL_MS) return null;
   return cached;

package/dist/{chunk-OJPHNITI.js → chunk-JW6JSBGS.js}

@@ -1,6 +1,6 @@
 import {
   DEFAULT_SESSION
-} from "./chunk-WLC3AX6F.js";
+} from "./chunk-I365OPWV.js";
 
 // src/answer.ts
 var isDeferAnswer = (value) => value === "defer";

package/dist/{chunk-NPAEVCTN.js → chunk-LAPXXS6K.js}

@@ -1,6 +1,6 @@
 import {
   macAppBridgeAvailable
-} from "./chunk-SBPVEVLZ.js";
+} from "./chunk-YZ74AFIU.js";
 import {
   keyPrefix
 } from "./chunk-SZV5SLSD.js";

package/dist/{chunk-6DG7PKY5.js → chunk-MBSM6GX5.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-QPS5STKF.js";
 import {
   namedEvent
-} from "./chunk-ZAYXOSEP.js";
+} from "./chunk-BLBK7VV7.js";
 import {
   writeDegraded
 } from "./chunk-7ZTVBYPE.js";

package/dist/{chunk-AVSHVOFB.js → chunk-OPBPSPMU.js}

@@ -1,7 +1,7 @@
 import {
   compatibleConfigFile,
   hasCompatibleHooks
-} from "./chunk-ZAYXOSEP.js";
+} from "./chunk-BLBK7VV7.js";
 import {
   pusharyHookExecutable
 } from "./chunk-Q3KKA5IZ.js";

package/dist/{chunk-X6WYICTL.js → chunk-S7QATB3I.js}

@@ -1,7 +1,7 @@
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "./chunk-OJPHNITI.js";
+} from "./chunk-JW6JSBGS.js";
 import {
   askUser,
   isDecisionStopped,

package/dist/{chunk-RKXSWF62.js → chunk-YT47T5TM.js}

@@ -1,12 +1,12 @@
 import {
   openCodeConfigDirFrom
-} from "./chunk-SBPVEVLZ.js";
+} from "./chunk-YZ74AFIU.js";
 import {
   nativeClaudeInstallPath
 } from "./chunk-ROVLRXBI.js";
 import {
   grokHome
-} from "./chunk-ZAYXOSEP.js";
+} from "./chunk-BLBK7VV7.js";
 import {
   claudeConfigDir,
   clineDataDirectory,

package/dist/{chunk-SBPVEVLZ.js → chunk-YZ74AFIU.js}

@@ -1,6 +1,6 @@
 import {
   compatibleConfigFile
-} from "./chunk-ZAYXOSEP.js";
+} from "./chunk-BLBK7VV7.js";
 import {
   hookOwnerOf,
   hookOwnerOfCommands