pushary 1.9.130 → 1.9.133

package/dist/{chunk-6NG7NVTL.js → chunk-D2KJKAYM.js}

@@ -1,14 +1,14 @@
 import {
   compatibleConfigFile,
   hasCompatibleHooks
-} from "./chunk-3R2GILXH.js";
+} from "./chunk-RZBV5KTF.js";
 import {
   pusharyHookExecutable
-} from "./chunk-ZABDTVGQ.js";
+} from "./chunk-237FYIVC.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-SWWM3LRZ.js";
+} from "./chunk-W4FJR57E.js";
 import {
   isRecord
 } from "./chunk-M65LPNIO.js";

package/dist/{chunk-ZCMVIRD3.js → chunk-DS7XMYUB.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-SWWM3LRZ.js";
+} from "./chunk-W4FJR57E.js";
 import {
   writeFileAtomic
 } from "./chunk-TODDEIYG.js";

package/dist/{chunk-NUOZ46B2.js → chunk-EA5EASYT.js}

@@ -1,6 +1,6 @@
 import {
   DEFAULT_SESSION
-} from "./chunk-TJ2R3V5A.js";
+} from "./chunk-MRHGK3Q3.js";
 
 // src/answer.ts
 var isDeferAnswer = (value) => value === "defer";

package/dist/{chunk-HFIIF32E.js → chunk-EPPH5RMJ.js}

@@ -1,17 +1,17 @@
 import {
   pusharyHookExecutable
-} from "./chunk-ZABDTVGQ.js";
+} from "./chunk-237FYIVC.js";
 import {
   bridgeResolvesToApp,
   cursorUserHooks,
   executableFileName,
   isBridgeLocator,
   liveBridgeProbe
-} from "./chunk-SWWM3LRZ.js";
+} from "./chunk-W4FJR57E.js";
 import {
   atLeast,
   parseVersion
-} from "./chunk-HMHZ4QF3.js";
+} from "./chunk-A44MRVWG.js";
 import {
   CURSOR_GATE_COVERAGE,
   CURSOR_GATE_SCRIPT,

package/dist/{chunk-JGUKBFGP.js → chunk-FJST6ZXC.js}

@@ -3,17 +3,17 @@ import {
   expectedLaunchCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "./chunk-WDA26JR4.js";
+} from "./chunk-X23GSBOH.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   hasDaemonServiceDefinition,
   readDaemonNeedsLogin,
   readDaemonStatus
-} from "./chunk-G3IEREIQ.js";
+} from "./chunk-3DCCMO23.js";
 import {
   getMachineId
-} from "./chunk-ZCMVIRD3.js";
+} from "./chunk-DS7XMYUB.js";
 import {
   readControlMode,
   readKeySource

package/dist/{chunk-AAMWERYZ.js → chunk-FT5MTCKU.js}

@@ -1,6 +1,6 @@
 import {
   claudeConfigDir
-} from "./chunk-SWWM3LRZ.js";
+} from "./chunk-W4FJR57E.js";
 import {
   claudePermissionRulesFromSettings
 } from "./chunk-M65LPNIO.js";

package/dist/{chunk-XQHXVBC2.js → chunk-FTH4TSJ2.js}

@@ -1,12 +1,12 @@
 import {
   macAppBridgeAvailable
-} from "./chunk-56DO6XGT.js";
+} from "./chunk-NSBWFX7H.js";
 import {
   keyPrefix
 } from "./chunk-CVBSETPW.js";
 import {
   bridgeAgentKey
-} from "./chunk-SWWM3LRZ.js";
+} from "./chunk-W4FJR57E.js";
 import {
   readJsonSafe
 } from "./chunk-TODDEIYG.js";

package/dist/{chunk-7COOVVQJ.js → chunk-GKZMBU6T.js}

@@ -1,6 +1,6 @@
 import {
   absoluteUrl
-} from "./chunk-QIHYQHCC.js";
+} from "./chunk-LR3PIGRS.js";
 import {
   KEY_SCOPE
 } from "./chunk-M65LPNIO.js";

package/dist/{chunk-DIUFYQ7F.js → chunk-HOPJEPL4.js}

@@ -1,13 +1,13 @@
 import {
   notificationAnswerStep
-} from "./chunk-B3X4SME2.js";
+} from "./chunk-L5RSLIBQ.js";
 import {
   canChangeApprovalSettings
-} from "./chunk-7COOVVQJ.js";
+} from "./chunk-GKZMBU6T.js";
 import {
   matchMacAccountStep,
   retryAgentCommand
-} from "./chunk-2VNYP35D.js";
+} from "./chunk-3TKTZOKG.js";
 import {
   EXIT
 } from "./chunk-BG4HHB7E.js";

package/dist/{chunk-W3WJUR4P.js → chunk-HW63OEVM.js}

@@ -4,7 +4,7 @@ import {
   claimThrottle,
   releaseThrottle,
   reportEvent
-} from "./chunk-TJ2R3V5A.js";
+} from "./chunk-MRHGK3Q3.js";
 import {
   deriveToolTarget,
   permissionDeniedAction

package/dist/{chunk-BBYFAY3S.js → chunk-I6MI4NWX.js}

@@ -1,16 +1,17 @@
 import {
+  ownedOnlyByThisUser,
   readOwnerOnlyJson,
   savedTranscriptReadPositions
-} from "./chunk-GVSIVBVT.js";
+} from "./chunk-VAE5JBR5.js";
 import {
   SESSION_HISTORY_RETENTION_DAYS
 } from "./chunk-G66WIAST.js";
 import {
   ensureDaemonRunning
-} from "./chunk-G3IEREIQ.js";
+} from "./chunk-3DCCMO23.js";
 import {
   hookOwnerOf
-} from "./chunk-ZABDTVGQ.js";
+} from "./chunk-237FYIVC.js";
 import {
   hookMeaning
 } from "./chunk-JYCAAQUW.js";
@@ -42,7 +43,7 @@ import {
   claudeConfigDir,
   codexHome,
   pusharyDir
-} from "./chunk-SWWM3LRZ.js";
+} from "./chunk-W4FJR57E.js";
 import {
   getApiKey,
   getBaseUrl
@@ -238,7 +239,7 @@ var readState = (sessionId, runtime) => {
   try {
     const path = fileFor(sessionId, runtime.directory);
     const info = lstatSync(path);
-    if (!info.isFile() || info.nlink !== 1 || info.size > MAX_TAIL || (info.mode & 511) !== 384) return null;
+    if (!info.isFile() || info.nlink !== 1 || info.size > MAX_TAIL || !ownedOnlyByThisUser(info)) return null;
     const envelope = external_exports.object({ content: external_exports.string() }).parse(JSON.parse(readFileSync(path, "utf8")));
     const plain = decryptRecord(envelope.content, runtime.sessionKey);
     if (!plain) return null;

package/dist/{chunk-QBWCBTDH.js → chunk-IZJDVOJV.js}

@@ -4,10 +4,10 @@ import {
   configFailureKind,
   retryAgentCommand,
   writeSetupConfigFile
-} from "./chunk-2VNYP35D.js";
+} from "./chunk-3TKTZOKG.js";
 import {
   MCP_BRIDGE_BINARY
-} from "./chunk-RQMUNSKU.js";
+} from "./chunk-PFHRW3LR.js";
 import {
   KEY_FILE_MODE
 } from "./chunk-CVBSETPW.js";
@@ -32,10 +32,10 @@ import {
   withClinePusharyServer,
   withRefreshedClineKey,
   withoutClinePusharyServer
-} from "./chunk-SWWM3LRZ.js";
+} from "./chunk-W4FJR57E.js";
 import {
   resolveGlobalBinary
-} from "./chunk-HMHZ4QF3.js";
+} from "./chunk-A44MRVWG.js";
 import {
   readJsonSafe,
   writeFileAtomic,

package/dist/{chunk-66HILP6Q.js → chunk-J4UNR655.js}

@@ -6,17 +6,17 @@ import {
   McpToolError,
   SubscriptionRequiredError,
   callMcpTool
-} from "./chunk-QQEU4LN2.js";
+} from "./chunk-2KN53MPE.js";
 import {
   fetchAsCredential
 } from "./chunk-42PVKPHM.js";
 import {
   installNetworkDefaults,
   isNetworkFailure
-} from "./chunk-5AVCVA3Z.js";
+} from "./chunk-V2T5ZDMP.js";
 import {
   clientReportClaims
-} from "./chunk-SWWM3LRZ.js";
+} from "./chunk-W4FJR57E.js";
 import {
   getApiKey,
   getBaseUrl

package/dist/{chunk-PBXXI75U.js → chunk-KIWFCW7M.js}

@@ -1,11 +1,11 @@
 import {
   autoUpdateLock
-} from "./chunk-SWWM3LRZ.js";
+} from "./chunk-W4FJR57E.js";
 import {
   installPackageGlobally,
   npmErrorMessage,
   npmExitedOnPermissionDenied
-} from "./chunk-HMHZ4QF3.js";
+} from "./chunk-A44MRVWG.js";
 import {
   writeJsonAtomic
 } from "./chunk-TODDEIYG.js";
@@ -140,11 +140,13 @@ var forkFinishWithUpgradeLock = (request) => new Promise((resolve, reject) => {
   const path = canonicalLockPath(request.lockPath ?? autoUpdateLock());
   const server = heldLocks.get(path);
   if (!server) return reject(new Error("Cannot finish an upgrade without its lock"));
-  const child = fork(request.entry, [...request.args], {
+  const options = {
     execArgv: [],
     stdio: request.stdio ?? ["inherit", "inherit", "inherit", "ipc"],
-    env: { ...process.env, ...request.env, [INHERITED_LOCK_ENV]: path }
-  });
+    env: { ...process.env, ...request.env, [INHERITED_LOCK_ENV]: path },
+    windowsHide: true
+  };
+  const child = fork(request.entry, [...request.args], options);
   const timer = setTimeout(() => child.kill("SIGKILL"), FINISH_TIMEOUT_MS);
   child.on("message", (message) => {
     if (message === LOCK_READY) child.send(LOCK_HANDLE, server, (error) => {

package/dist/{chunk-B3X4SME2.js → chunk-L5RSLIBQ.js}

@@ -1,13 +1,13 @@
 import {
   APPROVAL_RULES_PATH,
   canChangeApprovalSettings
-} from "./chunk-7COOVVQJ.js";
+} from "./chunk-GKZMBU6T.js";
 import {
   callMcpTool
-} from "./chunk-QQEU4LN2.js";
+} from "./chunk-2KN53MPE.js";
 import {
   absoluteUrl
-} from "./chunk-QIHYQHCC.js";
+} from "./chunk-LR3PIGRS.js";
 import {
   getBaseUrl
 } from "./chunk-T6HX6OTY.js";

package/dist/{chunk-PEYTSAGK.js → chunk-LBMCQWRX.js}

@@ -12,7 +12,7 @@ import {
   reachVerdict,
   reachesYou,
   verifyDelivery
-} from "./chunk-B3X4SME2.js";
+} from "./chunk-L5RSLIBQ.js";
 import {
   humanIsTty,
   writeHuman

package/dist/{chunk-QIHYQHCC.js → chunk-LR3PIGRS.js}

@@ -1,6 +1,6 @@
 import {
   pusharyFetch
-} from "./chunk-5AVCVA3Z.js";
+} from "./chunk-V2T5ZDMP.js";
 import {
   getBaseUrl
 } from "./chunk-T6HX6OTY.js";

package/dist/{chunk-C2TRPHGA.js → chunk-MF5ZQX7C.js}

@@ -1,17 +1,17 @@
 import {
   openCodeConfigDirFrom
-} from "./chunk-56DO6XGT.js";
+} from "./chunk-NSBWFX7H.js";
 import {
   nativeClaudeInstallPath
 } from "./chunk-CYTPQDQY.js";
 import {
   grokHome
-} from "./chunk-3R2GILXH.js";
+} from "./chunk-RZBV5KTF.js";
 import {
   claudeConfigDir,
   clineDataDirectory,
   codexHomeFrom
-} from "./chunk-SWWM3LRZ.js";
+} from "./chunk-W4FJR57E.js";
 import {
   HOOK_COMPATIBLE_PROFILES
 } from "./chunk-M65LPNIO.js";

package/dist/{chunk-SZSIZCAU.js → chunk-MJVDFNP2.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-SWWM3LRZ.js";
+} from "./chunk-W4FJR57E.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-TJ2R3V5A.js → chunk-MRHGK3Q3.js}

@@ -39,17 +39,17 @@ import {
   reportClientError,
   sendNotification,
   waitForAnswer
-} from "./chunk-66HILP6Q.js";
+} from "./chunk-J4UNR655.js";
 import {
   isRetryable,
   withRetry
-} from "./chunk-QQEU4LN2.js";
+} from "./chunk-2KN53MPE.js";
 import {
   fetchAsCredential
 } from "./chunk-42PVKPHM.js";
 import {
   getMachineId
-} from "./chunk-ZCMVIRD3.js";
+} from "./chunk-DS7XMYUB.js";
 import {
   reportedInstallSource
 } from "./chunk-BKH4LQJC.js";
@@ -59,11 +59,11 @@ import {
   POSTTOOLUSE_MIRROR_ONLY_TOOLS,
   canonicalJson,
   claudeConfigDir
-} from "./chunk-SWWM3LRZ.js";
+} from "./chunk-W4FJR57E.js";
 import {
   compareVersion,
   parseVersion
-} from "./chunk-HMHZ4QF3.js";
+} from "./chunk-A44MRVWG.js";
 import {
   getApiKey,
   getBaseUrl

package/dist/{chunk-56DO6XGT.js → chunk-NSBWFX7H.js}

@@ -1,10 +1,10 @@
 import {
   compatibleConfigFile
-} from "./chunk-3R2GILXH.js";
+} from "./chunk-RZBV5KTF.js";
 import {
   hookOwnerOf,
   hookOwnerOfCommands
-} from "./chunk-ZABDTVGQ.js";
+} from "./chunk-237FYIVC.js";
 import {
   AGENT_CHOICES
 } from "./chunk-XHC3UNOK.js";
@@ -19,7 +19,7 @@ import {
   resolveBridgeStub,
   vscodePluginDir,
   windowsNodeLauncherFor
-} from "./chunk-SWWM3LRZ.js";
+} from "./chunk-W4FJR57E.js";
 import {
   readJsonSafe
 } from "./chunk-TODDEIYG.js";

package/dist/{chunk-RQMUNSKU.js → chunk-PFHRW3LR.js}

@@ -1,6 +1,6 @@
 import {
   parseSseMessages
-} from "./chunk-QQEU4LN2.js";
+} from "./chunk-2KN53MPE.js";
 import {
   fetchAsCredential
 } from "./chunk-42PVKPHM.js";

package/dist/{chunk-CRVPT3HO.js → chunk-PG23ENSN.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-SWWM3LRZ.js";
+} from "./chunk-W4FJR57E.js";
 import {
   readRegularJsonFile,
   writeFileAtomic

package/dist/{chunk-BZOTJ2CO.js → chunk-PHKCTMAV.js}

@@ -9,13 +9,13 @@ import {
   installedCodexApp,
   readCodexAppRuntime,
   shellQuoted
-} from "./chunk-NFK2RHD3.js";
+} from "./chunk-VME5NXCM.js";
 import {
   writeHuman
 } from "./chunk-QCGNGEGE.js";
 import {
   xml
-} from "./chunk-G3IEREIQ.js";
+} from "./chunk-3DCCMO23.js";
 import {
   writeFileAtomic
 } from "./chunk-TODDEIYG.js";

package/dist/{chunk-47IBUIDJ.js → chunk-PPUIIP3O.js}

@@ -1,13 +1,13 @@
 import {
   ensureCodexTrustsPusharyHooks
-} from "./chunk-YC6R5CXH.js";
+} from "./chunk-RLQDVWZ4.js";
 import {
   hermesReceiptPaths,
   hermesSetupPredatesThePluginFolder,
   installHermesPlugin,
   refreshHermesPluginFiles,
   shippedHermesPlugin
-} from "./chunk-CPSGGBEN.js";
+} from "./chunk-7MIT5C7B.js";
 import {
   fxIgnoresInstructionsFile,
   fxInstructionsBody,
@@ -16,7 +16,7 @@ import {
   macAppFxBridge,
   refreshClineKey,
   switchFxHttpEntryToBridge
-} from "./chunk-QBWCBTDH.js";
+} from "./chunk-IZJDVOJV.js";
 import {
   OPENCODE_HOOK_BINARY,
   agentHookOwner,
@@ -28,16 +28,16 @@ import {
   openCodePluginDir,
   openCodeWired,
   withOpenCodeAskRules
-} from "./chunk-56DO6XGT.js";
+} from "./chunk-NSBWFX7H.js";
 import {
   detectClaudeVersion
-} from "./chunk-QEEXR6CD.js";
+} from "./chunk-UJZ5YHSR.js";
 import {
   addCompatibleHooks,
   compatibleConfigFile,
   compatibleInstructionsFile,
   hasCompatibleHooks
-} from "./chunk-3R2GILXH.js";
+} from "./chunk-RZBV5KTF.js";
 import {
   GEMINI_HOOK_BINARY,
   addGeminiHooks,
@@ -49,7 +49,7 @@ import {
   geminiWired,
   hasGeminiHooks,
   planHooks
-} from "./chunk-ZABDTVGQ.js";
+} from "./chunk-237FYIVC.js";
 import {
   KEY_FILE_MODE
 } from "./chunk-CVBSETPW.js";
@@ -99,13 +99,13 @@ import {
   renderAgentInstructions,
   supportedClaudeEvents,
   vscodePluginMcp
-} from "./chunk-SWWM3LRZ.js";
+} from "./chunk-W4FJR57E.js";
 import {
   formatVersion,
   hookCommandsUseBareNames,
   resolveGlobalBinDir,
   resolveGlobalBinary
-} from "./chunk-HMHZ4QF3.js";
+} from "./chunk-A44MRVWG.js";
 import {
   readJsonSafe,
   writeFileAtomic,

package/dist/{chunk-ND35WKWA.js → chunk-QVIDOVT6.js}

@@ -1,16 +1,16 @@
 import {
   claudeSettingsLocationFor,
   readClaudePermissionRules
-} from "./chunk-AAMWERYZ.js";
+} from "./chunk-FT5MTCKU.js";
 import {
   askAgentQuestions,
   defersToNativeMode,
   outcomeOfFailedAsk,
   storedWaitDeadline
-} from "./chunk-FZWWCDYA.js";
+} from "./chunk-XWUPOTJV.js";
 import {
   reportMachineDenial
-} from "./chunk-W3WJUR4P.js";
+} from "./chunk-HW63OEVM.js";
 import {
   isGatingMoment,
   recordKeylessMoment
@@ -18,16 +18,16 @@ import {
 import {
   isAdmitted,
   readAdmissionRules
-} from "./chunk-3SDMCBT7.js";
+} from "./chunk-UDAXXR43.js";
 import {
   isDeferAnswer,
   oncePerSession
-} from "./chunk-NUOZ46B2.js";
+} from "./chunk-EA5EASYT.js";
 import {
   activeHookSource,
   activeIdentity,
   namedSource
-} from "./chunk-3R2GILXH.js";
+} from "./chunk-RZBV5KTF.js";
 import {
   DEFAULT_SESSION,
   approvalAwaitingRetry,
@@ -48,7 +48,7 @@ import {
   settleQuestionsForToolUse,
   sweepFilesOlderThan,
   userScope
-} from "./chunk-TJ2R3V5A.js";
+} from "./chunk-MRHGK3Q3.js";
 import {
   UNNAMED_ACTION,
   deriveAction,
@@ -81,10 +81,10 @@ import {
   waitForQuestion,
   waitsForThePhone,
   withdrawQuestion
-} from "./chunk-66HILP6Q.js";
+} from "./chunk-J4UNR655.js";
 import {
   getMachineId
-} from "./chunk-ZCMVIRD3.js";
+} from "./chunk-DS7XMYUB.js";
 import {
   getApiKey,
   getBaseUrl

package/dist/{chunk-YC6R5CXH.js → chunk-RLQDVWZ4.js}

@@ -7,10 +7,10 @@ import {
   codexHome,
   codexHooksJsonIn,
   isPusharyCodexCommand
-} from "./chunk-SWWM3LRZ.js";
+} from "./chunk-W4FJR57E.js";
 import {
   resolvePathBinary
-} from "./chunk-HMHZ4QF3.js";
+} from "./chunk-A44MRVWG.js";
 import {
   getPackageVersion
 } from "./chunk-WIIMW5YO.js";

package/dist/{chunk-7A745YEM.js → chunk-RVGYXUOC.js}

@@ -1,9 +1,9 @@
 import {
   CODEX_HOOK_STATUS
-} from "./chunk-YC6R5CXH.js";
+} from "./chunk-RLQDVWZ4.js";
 import {
   retryAgentCommand
-} from "./chunk-2VNYP35D.js";
+} from "./chunk-3TKTZOKG.js";
 import {
   NPX_LATEST_COMMAND
 } from "./chunk-SZYKS433.js";

package/dist/{chunk-3R2GILXH.js → chunk-RZBV5KTF.js}

@@ -1,10 +1,10 @@
 import {
   addGeminiMcpServer,
   removeGeminiMcpServer
-} from "./chunk-ZABDTVGQ.js";
+} from "./chunk-237FYIVC.js";
 import {
   CLAUDE_CODE_AGENT
-} from "./chunk-TJ2R3V5A.js";
+} from "./chunk-MRHGK3Q3.js";
 import {
   compatibleToolLookup
 } from "./chunk-JYCAAQUW.js";
@@ -19,7 +19,7 @@ import {
   isPusharyHook,
   registerHookEntry,
   removeClaudeMcpServers
-} from "./chunk-SWWM3LRZ.js";
+} from "./chunk-W4FJR57E.js";
 import {
   HOOK_COMPATIBLE_PROFILES,
   PHONE_ANSWERED_TOOLS,

package/dist/{chunk-OUN5T5VX.js → chunk-S4HS6VTI.js}

@@ -1,7 +1,7 @@
 import {
   readOwnerOnlyJson,
   transcriptReadPositionSchema
-} from "./chunk-GVSIVBVT.js";
+} from "./chunk-VAE5JBR5.js";
 import {
   external_exports
 } from "./chunk-XMSDA5WA.js";

package/dist/{chunk-3SDMCBT7.js → chunk-UDAXXR43.js}

@@ -1,16 +1,16 @@
 import {
   cursorGateOwnsClaudeCall,
   readCursorGateRegistration
-} from "./chunk-HFIIF32E.js";
+} from "./chunk-EPPH5RMJ.js";
 import {
   registerTranscript
-} from "./chunk-BBYFAY3S.js";
+} from "./chunk-I6MI4NWX.js";
 import {
   namedEvent
-} from "./chunk-3R2GILXH.js";
+} from "./chunk-RZBV5KTF.js";
 import {
   writeDegraded
-} from "./chunk-66HILP6Q.js";
+} from "./chunk-J4UNR655.js";
 import {
   claudeShapedHookInput,
   hookCompatibleProfileBySource,

package/dist/{chunk-QEEXR6CD.js → chunk-UJZ5YHSR.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-CYTPQDQY.js";
 import {
   parseVersion
-} from "./chunk-HMHZ4QF3.js";
+} from "./chunk-A44MRVWG.js";
 import {
   isRecord
 } from "./chunk-M65LPNIO.js";

package/dist/{chunk-Q4WPTLEX.js → chunk-UZUDMZES.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-POFBE6ZY.js";
 import {
   autoUpdateState
-} from "./chunk-SWWM3LRZ.js";
+} from "./chunk-W4FJR57E.js";
 import {
   readJsonSafe,
   writeJsonAtomic
@@ -172,7 +172,7 @@ var updateAutoUpdateState = (statePath, patch) => {
 };
 var ignoreSpawnFailure = () => void 0;
 var spawnDetached = (command, args, cwd) => {
-  const child = spawn(command, [...args], { cwd, detached: true, stdio: "ignore" });
+  const child = spawn(command, [...args], { cwd, detached: true, stdio: "ignore", windowsHide: true });
   child.on("error", ignoreSpawnFailure);
   child.unref();
 };