pushary 1.9.134 → 1.9.135

package/dist/bin/pushary-codex-hook.js

@@ -1,40 +1,40 @@
 #!/usr/bin/env node
 import {
   takeHookHoldBudget
-} from "../chunk-NYFUU23B.js";
+} from "../chunk-GRCX2FGD.js";
 import {
   parseCodexHookInput,
   pushQuestionAndWait,
   scopeQuestionOf
-} from "../chunk-C4UH6YPD.js";
+} from "../chunk-NWNUS2ET.js";
 import {
   askAgentQuestions,
   defersToNativeMode
-} from "../chunk-XWUPOTJV.js";
+} from "../chunk-7JXYR4TC.js";
 import {
   reportMachineDenial
-} from "../chunk-HW63OEVM.js";
+} from "../chunk-7DWERNHQ.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-2U4MCUVZ.js";
+} from "../chunk-7KWOR2T2.js";
 import {
   triggerAutoUpdate
-} from "../chunk-UZUDMZES.js";
+} from "../chunk-UDSJKRRI.js";
 import {
   readHookInput
-} from "../chunk-UDAXXR43.js";
-import "../chunk-EPPH5RMJ.js";
+} from "../chunk-7GEMAKQL.js";
+import "../chunk-EWJXECUK.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-EA5EASYT.js";
-import "../chunk-I6MI4NWX.js";
+} from "../chunk-64QLX4ZC.js";
+import "../chunk-65ZWYA5L.js";
 import "../chunk-VAE5JBR5.js";
 import "../chunk-G66WIAST.js";
-import "../chunk-RZBV5KTF.js";
-import "../chunk-3DCCMO23.js";
-import "../chunk-237FYIVC.js";
+import "../chunk-7ASHS5VR.js";
+import "../chunk-RCZ5ZER4.js";
+import "../chunk-ORZ7H3AQ.js";
 import {
   CODEX_AGENT,
   DEFAULT_SESSION,
@@ -66,7 +66,7 @@ import {
   toPolicyLookup,
   toPolicyLookups,
   userScope
-} from "../chunk-MRHGK3Q3.js";
+} from "../chunk-RGRPDJG3.js";
 import {
   codexReviewerDenialsSince,
   deriveActionBody,
@@ -79,18 +79,18 @@ import {
   scanCodexGuardianReviews,
   scopePathFor,
   sessionIdentityOf
-} from "../chunk-JYCAAQUW.js";
-import "../chunk-XHC3UNOK.js";
-import "../chunk-MJVDFNP2.js";
+} from "../chunk-UXPRMNH2.js";
+import "../chunk-WVOMK2HW.js";
+import "../chunk-IOUCIJ56.js";
 import "../chunk-YPY4YCIZ.js";
-import "../chunk-KWICQAP7.js";
+import "../chunk-4PPSXQQ6.js";
 import "../chunk-XMSDA5WA.js";
-import "../chunk-25UU4Q4V.js";
+import "../chunk-UQCVVN7K.js";
 import "../chunk-H6CL3T2S.js";
 import {
   repoKeyFor,
   repositoryScopeFor
-} from "../chunk-RGVQOOGD.js";
+} from "../chunk-DMK3U7GG.js";
 import {
   cancelQuestion,
   claimBlockedAction,
@@ -100,26 +100,27 @@ import {
   pollForAnswer,
   requestGate,
   sendNotification
-} from "../chunk-J4UNR655.js";
+} from "../chunk-XRO6NRBO.js";
+import "../chunk-XB75IJ3G.js";
 import "../chunk-POFBE6ZY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-2KN53MPE.js";
-import "../chunk-42PVKPHM.js";
-import "../chunk-LR3PIGRS.js";
-import "../chunk-V2T5ZDMP.js";
+} from "../chunk-ZNST34QH.js";
+import "../chunk-2K7MZRPH.js";
+import "../chunk-SFN72Q7W.js";
+import "../chunk-6UARD3WA.js";
 import {
   getMachineId
-} from "../chunk-DS7XMYUB.js";
-import "../chunk-CVBSETPW.js";
-import "../chunk-BKH4LQJC.js";
+} from "../chunk-RLNJNRYP.js";
+import "../chunk-LTY5DSWT.js";
+import "../chunk-IABPEGAA.js";
 import {
   canonicalJson
-} from "../chunk-W4FJR57E.js";
-import "../chunk-A44MRVWG.js";
+} from "../chunk-ZJKWDM3S.js";
+import "../chunk-ACI4PZ5N.js";
 import {
   getApiKey
-} from "../chunk-T6HX6OTY.js";
+} from "../chunk-FP6ZVMF2.js";
 import "../chunk-YU2EUD7O.js";
 import {
   writeFileAtomic
@@ -127,7 +128,7 @@ import {
 import {
   EXIT
 } from "../chunk-BG4HHB7E.js";
-import "../chunk-SZYKS433.js";
+import "../chunk-BGXXWLS5.js";
 import "../chunk-WIIMW5YO.js";
 import {
   CODEX_RESCUE_STOP_RESERVE_SECONDS,
@@ -156,7 +157,7 @@ import {
   refusesWhenUnanswered,
   resolveGate,
   unapprovedScopeReason
-} from "../chunk-M65LPNIO.js";
+} from "../chunk-H4226UC7.js";
 import "../chunk-MLKGABMK.js";
 
 // bin/pushary-codex-hook.ts
@@ -806,7 +807,7 @@ var decidePreToolUse = async (input) => {
 };
 var repairCodexHoldsQuietly = async () => {
   try {
-    const { repairCodexHolds } = await import("../reapply-LNVBPUWL.js");
+    const { repairCodexHolds } = await import("../reapply-MVZKPXIQ.js");
     repairCodexHolds();
   } catch {
     return;

package/dist/bin/pushary-codex-session.js

@@ -8,8 +8,8 @@ import "../chunk-MLKGABMK.js";
 var args = process.argv.slice(2);
 if (args[0] === "codex") args.shift();
 var appBehindTheProxy = args[0] === "--desktop-proxy" && args[2] === "--" ? args[1] : void 0;
-if (args[0] !== "--desktop-proxy") (await import("../usage-XLJK7OTL.js")).exitOnHelpFlag("codex");
-var loadWhatReadsTheAccount = () => Promise.all([import("../config-5SNDVPS2.js"), import("../identity-DCRNA3J3.js")]);
+if (args[0] !== "--desktop-proxy") (await import("../usage-R6PZTIEH.js")).exitOnHelpFlag("codex");
+var loadWhatReadsTheAccount = () => Promise.all([import("../config-BV5FQ536.js"), import("../identity-G6FQTONT.js")]);
 var loadedWhenThePassThroughStarted = appBehindTheProxy === void 0 ? null : loadWhatReadsTheAccount().catch(() => null);
 var desktopAccount = async () => {
   try {
@@ -19,7 +19,7 @@ var desktopAccount = async () => {
     return null;
   }
 };
-var desktopLaunch = await import("../codex-desktop-launch-CFKIJZVB.js").catch(() => null);
+var desktopLaunch = await import("../codex-desktop-launch-DIUFMA45.js").catch(() => null);
 if (desktopLaunch === null && appBehindTheProxy !== void 0) {
   process.exitCode = await letCodexRunWithoutPushary(appBehindTheProxy, args.slice(3));
 } else {
@@ -27,15 +27,15 @@ if (desktopLaunch === null && appBehindTheProxy !== void 0) {
   const stop = () => abort.abort();
   if (!args[0]?.startsWith("--desktop")) for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) process.on(signal, stop);
   try {
-    const { codexDesktopCommand } = desktopLaunch ?? await import("../codex-desktop-launch-CFKIJZVB.js");
+    const { codexDesktopCommand } = desktopLaunch ?? await import("../codex-desktop-launch-DIUFMA45.js");
     const desktop = await codexDesktopCommand(args, [process.execPath, ...process.execArgv, process.argv[1], "codex"], desktopAccount);
     if (desktop !== null) process.exitCode = desktop;
     else {
       const [{ getApiKey, getBaseUrl }, { getMachineId }, { resolveProviderBinary }, { codexSessionDirectory, launchCodexSession }] = await Promise.all([
-        import("../config-5SNDVPS2.js"),
-        import("../identity-DCRNA3J3.js"),
-        import("../live-capabilities-H7J5ANZ3.js"),
-        import("../codex-session-launch-YGH5UUAH.js")
+        import("../config-BV5FQ536.js"),
+        import("../identity-G6FQTONT.js"),
+        import("../live-capabilities-YHMOXY5E.js"),
+        import("../codex-session-launch-S4WTGKRY.js")
       ]);
       const binary = resolveProviderBinary("codex");
       if (!binary) throw new Error("Install Codex first, then run pushary codex");

package/dist/bin/pushary-codex.js

@@ -1,36 +1,37 @@
 #!/usr/bin/env node
 import {
   reportEvent
-} from "../chunk-MRHGK3Q3.js";
-import "../chunk-JYCAAQUW.js";
-import "../chunk-RGVQOOGD.js";
+} from "../chunk-RGRPDJG3.js";
+import "../chunk-UXPRMNH2.js";
+import "../chunk-DMK3U7GG.js";
 import {
   askUser,
   isDecisionStopped,
   waitForAnswer
-} from "../chunk-J4UNR655.js";
+} from "../chunk-XRO6NRBO.js";
+import "../chunk-XB75IJ3G.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-2KN53MPE.js";
-import "../chunk-42PVKPHM.js";
-import "../chunk-LR3PIGRS.js";
-import "../chunk-V2T5ZDMP.js";
+import "../chunk-ZNST34QH.js";
+import "../chunk-2K7MZRPH.js";
+import "../chunk-SFN72Q7W.js";
+import "../chunk-6UARD3WA.js";
 import {
   getMachineId
-} from "../chunk-DS7XMYUB.js";
-import "../chunk-BKH4LQJC.js";
-import "../chunk-W4FJR57E.js";
-import "../chunk-A44MRVWG.js";
+} from "../chunk-RLNJNRYP.js";
+import "../chunk-IABPEGAA.js";
+import "../chunk-ZJKWDM3S.js";
+import "../chunk-ACI4PZ5N.js";
 import {
   getApiKey
-} from "../chunk-T6HX6OTY.js";
+} from "../chunk-FP6ZVMF2.js";
 import "../chunk-YU2EUD7O.js";
 import "../chunk-TODDEIYG.js";
 import "../chunk-BG4HHB7E.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-SZYKS433.js";
+} from "../chunk-BGXXWLS5.js";
 import "../chunk-WIIMW5YO.js";
-import "../chunk-M65LPNIO.js";
+import "../chunk-H4226UC7.js";
 import "../chunk-MLKGABMK.js";
 
 // bin/pushary-codex.ts

package/dist/bin/pushary-connect.js

@@ -1,55 +1,56 @@
 #!/usr/bin/env node
 import {
   printKeyCheck
-} from "../chunk-ZJPBTJED.js";
+} from "../chunk-LIXCHEDJ.js";
 import {
   connectDevice,
   connectExistingApp,
   printConnectInstructions
-} from "../chunk-LBMCQWRX.js";
+} from "../chunk-AEOITMCS.js";
 import "../chunk-3EGEA4KH.js";
-import "../chunk-L5RSLIBQ.js";
-import "../chunk-2YS7YEUW.js";
+import "../chunk-X3NYMHLG.js";
+import "../chunk-NBMK6T6R.js";
 import {
   CONNECTED_THROUGH_MAC_APP,
   PAIR_FROM_MAC_APP,
   readMacAppConnection
-} from "../chunk-FTH4TSJ2.js";
-import "../chunk-GKZMBU6T.js";
+} from "../chunk-GLAGHQPB.js";
+import "../chunk-VND6LN6X.js";
 import "../chunk-QCGNGEGE.js";
-import "../chunk-NSBWFX7H.js";
+import "../chunk-CGROOSWT.js";
 import {
   createIo
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-4EQOCSJW.js";
-import "../chunk-RZBV5KTF.js";
-import "../chunk-237FYIVC.js";
-import "../chunk-MRHGK3Q3.js";
-import "../chunk-JYCAAQUW.js";
-import "../chunk-XHC3UNOK.js";
-import "../chunk-MJVDFNP2.js";
+} from "../chunk-4VVDRMVE.js";
+import "../chunk-7ASHS5VR.js";
+import "../chunk-ORZ7H3AQ.js";
+import "../chunk-RGRPDJG3.js";
+import "../chunk-UXPRMNH2.js";
+import "../chunk-WVOMK2HW.js";
+import "../chunk-IOUCIJ56.js";
 import {
   parseFlags
 } from "../chunk-YPY4YCIZ.js";
-import "../chunk-RGVQOOGD.js";
-import "../chunk-J4UNR655.js";
+import "../chunk-DMK3U7GG.js";
+import "../chunk-XRO6NRBO.js";
+import "../chunk-XB75IJ3G.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-2KN53MPE.js";
-import "../chunk-42PVKPHM.js";
+import "../chunk-ZNST34QH.js";
+import "../chunk-2K7MZRPH.js";
 import {
   checkApiKey
-} from "../chunk-LR3PIGRS.js";
-import "../chunk-V2T5ZDMP.js";
-import "../chunk-DS7XMYUB.js";
+} from "../chunk-SFN72Q7W.js";
+import "../chunk-6UARD3WA.js";
+import "../chunk-RLNJNRYP.js";
 import {
   readKeySource
-} from "../chunk-CVBSETPW.js";
-import "../chunk-BKH4LQJC.js";
-import "../chunk-W4FJR57E.js";
-import "../chunk-A44MRVWG.js";
-import "../chunk-T6HX6OTY.js";
+} from "../chunk-LTY5DSWT.js";
+import "../chunk-IABPEGAA.js";
+import "../chunk-ZJKWDM3S.js";
+import "../chunk-ACI4PZ5N.js";
+import "../chunk-FP6ZVMF2.js";
 import {
   UsageError
 } from "../chunk-YU2EUD7O.js";
@@ -59,9 +60,9 @@ import {
 } from "../chunk-BG4HHB7E.js";
 import {
   isInvocationOf
-} from "../chunk-SZYKS433.js";
+} from "../chunk-BGXXWLS5.js";
 import "../chunk-WIIMW5YO.js";
-import "../chunk-M65LPNIO.js";
+import "../chunk-H4226UC7.js";
 import "../chunk-MLKGABMK.js";
 
 // bin/pushary-connect.ts

package/dist/bin/pushary-cowork.js

@@ -2,15 +2,15 @@
 import {
   coworkOutput,
   parseCoworkOptions
-} from "../chunk-75FJZR2M.js";
+} from "../chunk-WTLQMJZ3.js";
 import {
   canOpenBrowser,
   openInBrowser
 } from "../chunk-PUZZELE6.js";
 import {
   exitOnHelpFlag
-} from "../chunk-4EQOCSJW.js";
-import "../chunk-XHC3UNOK.js";
+} from "../chunk-4VVDRMVE.js";
+import "../chunk-WVOMK2HW.js";
 import "../chunk-YPY4YCIZ.js";
 import {
   UsageError
@@ -18,11 +18,11 @@ import {
 import {
   EXIT
 } from "../chunk-BG4HHB7E.js";
-import "../chunk-SZYKS433.js";
+import "../chunk-BGXXWLS5.js";
 import "../chunk-WIIMW5YO.js";
 import {
   CLAUDE_CONNECTOR_GUIDE
-} from "../chunk-M65LPNIO.js";
+} from "../chunk-H4226UC7.js";
 import "../chunk-MLKGABMK.js";
 
 // bin/pushary-cowork.ts

package/dist/bin/pushary-daemon.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   inspectConfiguredManagedProviders
-} from "../chunk-PPUIIP3O.js";
+} from "../chunk-G3YIGTFS.js";
 import {
   readHookWiring,
   readHookWiringSafely
-} from "../chunk-6JY44IZI.js";
-import "../chunk-FT5MTCKU.js";
-import "../chunk-PG23ENSN.js";
+} from "../chunk-TKOALSA5.js";
+import "../chunk-OUMH4UTT.js";
+import "../chunk-UCDPJHZT.js";
 import {
   keepLinuxDaemonAfterLogout,
   lingerReportOf
@@ -15,26 +15,26 @@ import {
 import {
   HEARTBEAT_INTERVAL_MS,
   sendHeartbeat
-} from "../chunk-FJST6ZXC.js";
-import "../chunk-RLQDVWZ4.js";
+} from "../chunk-KUAS2DGZ.js";
+import "../chunk-VCMJLNEP.js";
 import {
   readSignedOutDiagnosis
-} from "../chunk-2YS7YEUW.js";
+} from "../chunk-NBMK6T6R.js";
 import {
   HERMES_INSTALL_MARKER_FILE,
   defaultHermesHome,
   parseHermesInstallMarker
-} from "../chunk-7MIT5C7B.js";
+} from "../chunk-MGTMXF3T.js";
 import {
   writeHuman
 } from "../chunk-QCGNGEGE.js";
-import "../chunk-IZJDVOJV.js";
-import "../chunk-3TKTZOKG.js";
-import "../chunk-PFHRW3LR.js";
-import "../chunk-NSBWFX7H.js";
+import "../chunk-WPPTHRBO.js";
+import "../chunk-V7KBG7XH.js";
+import "../chunk-WNPZGHHU.js";
+import "../chunk-CGROOSWT.js";
 import {
   exitOnHelpFlag
-} from "../chunk-4EQOCSJW.js";
+} from "../chunk-4VVDRMVE.js";
 import {
   codexBinaryIsBroken,
   detectProviderLiveCapabilities,
@@ -43,8 +43,8 @@ import {
   launchableProviders,
   resolveControlPolicy,
   trackProviderInventory
-} from "../chunk-X23GSBOH.js";
-import "../chunk-UJZ5YHSR.js";
+} from "../chunk-6RSAOA2P.js";
+import "../chunk-SULQKUPJ.js";
 import {
   SESSION_REAP_SILENCE_MS,
   describeIdleWindow,
@@ -52,18 +52,18 @@ import {
   listProcessProofs,
   ownsLiveProcess,
   silentSpawnedProofs
-} from "../chunk-ZXJTTV7I.js";
+} from "../chunk-4YBDKFU2.js";
 import "../chunk-CYTPQDQY.js";
 import {
   readLocalAutoUpdateReport
-} from "../chunk-UZUDMZES.js";
-import "../chunk-EPPH5RMJ.js";
+} from "../chunk-UDSJKRRI.js";
+import "../chunk-EWJXECUK.js";
 import {
   startRegisteredTranscripts
-} from "../chunk-I6MI4NWX.js";
+} from "../chunk-65ZWYA5L.js";
 import "../chunk-VAE5JBR5.js";
 import "../chunk-G66WIAST.js";
-import "../chunk-RZBV5KTF.js";
+import "../chunk-7ASHS5VR.js";
 import {
   DAEMON_LEASE_RENEW_INTERVAL_MS,
   DAEMON_YIELD_CHECK_INTERVAL_MS,
@@ -81,49 +81,54 @@ import {
   requestDaemonHandoff,
   stopDaemonRunning,
   writeDaemonNeedsLogin
-} from "../chunk-3DCCMO23.js";
+} from "../chunk-RCZ5ZER4.js";
 import {
   hookOwnerOf
-} from "../chunk-237FYIVC.js";
+} from "../chunk-ORZ7H3AQ.js";
 import {
+  markPendingCommandRefused,
   pendingCommandReceipts,
   removePendingCommand
-} from "../chunk-MRHGK3Q3.js";
-import "../chunk-JYCAAQUW.js";
-import "../chunk-XHC3UNOK.js";
-import "../chunk-MJVDFNP2.js";
+} from "../chunk-RGRPDJG3.js";
+import "../chunk-UXPRMNH2.js";
+import "../chunk-WVOMK2HW.js";
+import "../chunk-IOUCIJ56.js";
 import "../chunk-YPY4YCIZ.js";
-import "../chunk-KWICQAP7.js";
+import "../chunk-4PPSXQQ6.js";
 import "../chunk-XMSDA5WA.js";
-import "../chunk-25UU4Q4V.js";
+import "../chunk-UQCVVN7K.js";
 import {
   spawnClaude
 } from "../chunk-H6CL3T2S.js";
-import "../chunk-RGVQOOGD.js";
-import "../chunk-J4UNR655.js";
+import "../chunk-DMK3U7GG.js";
+import "../chunk-XRO6NRBO.js";
+import {
+  readCommandAck,
+  refusedReceiptMessage
+} from "../chunk-XB75IJ3G.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-2KN53MPE.js";
-import "../chunk-42PVKPHM.js";
-import "../chunk-LR3PIGRS.js";
-import "../chunk-V2T5ZDMP.js";
+import "../chunk-ZNST34QH.js";
+import "../chunk-2K7MZRPH.js";
+import "../chunk-SFN72Q7W.js";
+import "../chunk-6UARD3WA.js";
 import {
   getMachineId
-} from "../chunk-DS7XMYUB.js";
+} from "../chunk-RLNJNRYP.js";
 import {
   readControlMode
-} from "../chunk-CVBSETPW.js";
-import "../chunk-BKH4LQJC.js";
+} from "../chunk-LTY5DSWT.js";
+import "../chunk-IABPEGAA.js";
 import {
   claudeConfigDir,
   codexHome
-} from "../chunk-W4FJR57E.js";
+} from "../chunk-ZJKWDM3S.js";
 import {
   resolveBinary
-} from "../chunk-A44MRVWG.js";
+} from "../chunk-ACI4PZ5N.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-T6HX6OTY.js";
+} from "../chunk-FP6ZVMF2.js";
 import "../chunk-YU2EUD7O.js";
 import {
   writeJsonAtomicDurable
@@ -131,7 +136,7 @@ import {
 import {
   EXIT
 } from "../chunk-BG4HHB7E.js";
-import "../chunk-SZYKS433.js";
+import "../chunk-BGXXWLS5.js";
 import "../chunk-WIIMW5YO.js";
 import {
   CLAUDE_INBOX,
@@ -161,7 +166,7 @@ import {
   parseHermesAdmission,
   parseHermesReplayCursor,
   qualifyHermesReceiptMode
-} from "../chunk-M65LPNIO.js";
+} from "../chunk-H4226UC7.js";
 import "../chunk-MLKGABMK.js";
 
 // src/native-host-receiver.ts
@@ -810,23 +815,25 @@ var startNativeInputReceiver = (apiKey, machineId, options) => {
   const abort = new AbortController();
   const busy = /* @__PURE__ */ new Set();
   const settling = /* @__PURE__ */ new Set();
+  const refusalsReported = /* @__PURE__ */ new Set();
   const heartbeats = /* @__PURE__ */ new Map();
   const settlements = /* @__PURE__ */ new Map();
   let scanning = false;
   let cursor = 0;
+  const request = (path, body) => fetch(`${baseUrl}${path}`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${apiKey}`
+    },
+    body: JSON.stringify(body),
+    signal: AbortSignal.any([
+      abort.signal,
+      AbortSignal.timeout(CLAUDE_INBOX_RECEIVER.requestTimeoutMs)
+    ])
+  });
   const post = async (path, body) => {
-    const response = await fetch(`${baseUrl}${path}`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${apiKey}`
-      },
-      body: JSON.stringify(body),
-      signal: AbortSignal.any([
-        abort.signal,
-        AbortSignal.timeout(CLAUDE_INBOX_RECEIVER.requestTimeoutMs)
-      ])
-    });
+    const response = await request(path, body);
     if (!response.ok) throw new Error(`native inbox HTTP ${response.status}`);
     return response.json();
   };
@@ -835,17 +842,23 @@ var startNativeInputReceiver = (apiKey, machineId, options) => {
     if (!pending || settling.has(commandId) || settling.size >= CLAUDE_INBOX_RECEIVER.maxConcurrent) return false;
     settling.add(commandId);
     try {
-      const receipt = await post("/api/agent/command/ack", {
+      const response = await request("/api/agent/command/ack", {
         ...pending,
         commandId,
         machineId
       });
-      if (!isCommandAcknowledgementReceipt(receipt))
+      const ack = await readCommandAck(response);
+      if (ack.outcome === "retry") throw new Error(`native inbox HTTP ${response.status}`);
+      if (ack.outcome === "settled" && !isCommandAcknowledgementReceipt(await response.json()))
         throw new Error("native acknowledgement missing receipt");
       const current = settlements.get(commandId);
       if (current?.state !== pending.state || current.failureCode !== pending.failureCode || current.sessionId !== pending.sessionId) return false;
       if (pending.state === "delivered") client.confirmSettlement(pending.sessionId, commandId);
       settlements.delete(commandId);
+      if (ack.outcome === "refused" && !refusalsReported.has(commandId)) {
+        refusalsReported.add(commandId);
+        options.report?.(refusedReceiptMessage(commandId, ack.status));
+      }
       return true;
     } catch (error) {
       if (!abort.signal.aborted)
@@ -993,7 +1006,7 @@ var startNativeHostReceivers = (apiKey, machineId, report) => {
 };
 
 // src/hook-command-receipts.ts
-var reconcileCommandReceipts = async (apiKey, machineId, agentType, baseUrl, signal) => {
+var reconcileCommandReceipts = async (apiKey, machineId, agentType, baseUrl, signal, report) => {
   const namespace = `${apiKey}:${machineId}:${agentType}`;
   for (const { sessionId, command } of pendingCommandReceipts(namespace)) {
     signal?.throwIfAborted();
@@ -1016,7 +1029,12 @@ var reconcileCommandReceipts = async (apiKey, machineId, agentType, baseUrl, sig
         ...signal ? [signal] : []
       ])
     });
-    if (response.ok) removePendingCommand(sessionId, command.id, namespace);
+    const ack = await readCommandAck(response);
+    if (ack.outcome === "settled") removePendingCommand(sessionId, command.id, namespace);
+    if (ack.outcome === "refused") {
+      markPendingCommandRefused(sessionId, command.id, namespace);
+      report?.(refusedReceiptMessage(command.id, ack.status));
+    }
   }
 };
 
@@ -1417,7 +1435,8 @@ var startClaudeInboxReceiver = (apiKey, machineId, options = {}) => {
         machineId,
         "claude_code",
         baseUrl,
-        abort.signal
+        abort.signal,
+        options.report
       );
       const sessions = client.sessions().filter(options.ownsSession ?? ownsSession).slice(0, CLAUDE_INBOX_MAX_SESSIONS);
       if (!sessions.length) {