pushary 1.9.134 → 1.9.136

package/dist/bin/pushary-daemon.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   inspectConfiguredManagedProviders
-} from "../chunk-PPUIIP3O.js";
+} from "../chunk-POV2TBFA.js";
 import {
   readHookWiring,
   readHookWiringSafely
-} from "../chunk-6JY44IZI.js";
-import "../chunk-FT5MTCKU.js";
-import "../chunk-PG23ENSN.js";
+} from "../chunk-MQ3I5OIC.js";
+import "../chunk-G73ACPR2.js";
+import "../chunk-ZWLSXECG.js";
 import {
   keepLinuxDaemonAfterLogout,
   lingerReportOf
@@ -15,26 +15,26 @@ import {
 import {
   HEARTBEAT_INTERVAL_MS,
   sendHeartbeat
-} from "../chunk-FJST6ZXC.js";
-import "../chunk-RLQDVWZ4.js";
+} from "../chunk-HKJLPVPZ.js";
+import "../chunk-6SWFS4GU.js";
 import {
   readSignedOutDiagnosis
-} from "../chunk-2YS7YEUW.js";
+} from "../chunk-U3OLXV5Z.js";
 import {
   HERMES_INSTALL_MARKER_FILE,
   defaultHermesHome,
   parseHermesInstallMarker
-} from "../chunk-7MIT5C7B.js";
+} from "../chunk-A7R43KOX.js";
 import {
   writeHuman
 } from "../chunk-QCGNGEGE.js";
-import "../chunk-IZJDVOJV.js";
-import "../chunk-3TKTZOKG.js";
-import "../chunk-PFHRW3LR.js";
-import "../chunk-NSBWFX7H.js";
+import "../chunk-2XDVEBHI.js";
+import "../chunk-54TZGPZP.js";
+import "../chunk-NZD6ISCL.js";
+import "../chunk-VBWJ756P.js";
 import {
   exitOnHelpFlag
-} from "../chunk-4EQOCSJW.js";
+} from "../chunk-K7YJBVR3.js";
 import {
   codexBinaryIsBroken,
   detectProviderLiveCapabilities,
@@ -43,8 +43,8 @@ import {
   launchableProviders,
   resolveControlPolicy,
   trackProviderInventory
-} from "../chunk-X23GSBOH.js";
-import "../chunk-UJZ5YHSR.js";
+} from "../chunk-DBIPNY7J.js";
+import "../chunk-EJHD44ZN.js";
 import {
   SESSION_REAP_SILENCE_MS,
   describeIdleWindow,
@@ -52,18 +52,18 @@ import {
   listProcessProofs,
   ownsLiveProcess,
   silentSpawnedProofs
-} from "../chunk-ZXJTTV7I.js";
+} from "../chunk-2MVKT7KH.js";
 import "../chunk-CYTPQDQY.js";
 import {
   readLocalAutoUpdateReport
-} from "../chunk-UZUDMZES.js";
-import "../chunk-EPPH5RMJ.js";
+} from "../chunk-ICCM3DLT.js";
+import "../chunk-NN43KGTN.js";
 import {
   startRegisteredTranscripts
-} from "../chunk-I6MI4NWX.js";
+} from "../chunk-L7Q57R4J.js";
 import "../chunk-VAE5JBR5.js";
 import "../chunk-G66WIAST.js";
-import "../chunk-RZBV5KTF.js";
+import "../chunk-43DT3QWZ.js";
 import {
   DAEMON_LEASE_RENEW_INTERVAL_MS,
   DAEMON_YIELD_CHECK_INTERVAL_MS,
@@ -81,49 +81,54 @@ import {
   requestDaemonHandoff,
   stopDaemonRunning,
   writeDaemonNeedsLogin
-} from "../chunk-3DCCMO23.js";
+} from "../chunk-FAF5RDWT.js";
 import {
   hookOwnerOf
-} from "../chunk-237FYIVC.js";
+} from "../chunk-TLK5YLIE.js";
 import {
+  markPendingCommandRefused,
   pendingCommandReceipts,
   removePendingCommand
-} from "../chunk-MRHGK3Q3.js";
-import "../chunk-JYCAAQUW.js";
-import "../chunk-XHC3UNOK.js";
-import "../chunk-MJVDFNP2.js";
+} from "../chunk-D7AAAD6W.js";
+import "../chunk-A2YJ2FBR.js";
+import "../chunk-5XDFQ6E3.js";
+import "../chunk-LAWI6NQK.js";
 import "../chunk-YPY4YCIZ.js";
-import "../chunk-KWICQAP7.js";
+import "../chunk-YOV3LHOL.js";
 import "../chunk-XMSDA5WA.js";
-import "../chunk-25UU4Q4V.js";
+import "../chunk-ZWURBNA3.js";
 import {
   spawnClaude
 } from "../chunk-H6CL3T2S.js";
-import "../chunk-RGVQOOGD.js";
-import "../chunk-J4UNR655.js";
+import "../chunk-IRIXOH4U.js";
+import "../chunk-L2GADKFL.js";
+import {
+  readCommandAck,
+  refusedReceiptMessage
+} from "../chunk-Y47BMZUR.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-2KN53MPE.js";
-import "../chunk-42PVKPHM.js";
-import "../chunk-LR3PIGRS.js";
-import "../chunk-V2T5ZDMP.js";
+import "../chunk-WXUEOHYY.js";
+import "../chunk-VVN3RPV6.js";
+import "../chunk-Q2VV77IY.js";
+import "../chunk-PHA6AFOR.js";
 import {
   getMachineId
-} from "../chunk-DS7XMYUB.js";
+} from "../chunk-WNT4JHK3.js";
 import {
   readControlMode
-} from "../chunk-CVBSETPW.js";
-import "../chunk-BKH4LQJC.js";
+} from "../chunk-PNVTPEO5.js";
+import "../chunk-LNF36PTF.js";
 import {
   claudeConfigDir,
   codexHome
-} from "../chunk-W4FJR57E.js";
+} from "../chunk-R7KC57PC.js";
 import {
   resolveBinary
-} from "../chunk-A44MRVWG.js";
+} from "../chunk-GS5FH3C2.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-T6HX6OTY.js";
+} from "../chunk-IKBTG3OT.js";
 import "../chunk-YU2EUD7O.js";
 import {
   writeJsonAtomicDurable
@@ -131,7 +136,7 @@ import {
 import {
   EXIT
 } from "../chunk-BG4HHB7E.js";
-import "../chunk-SZYKS433.js";
+import "../chunk-MQMVJDII.js";
 import "../chunk-WIIMW5YO.js";
 import {
   CLAUDE_INBOX,
@@ -161,7 +166,7 @@ import {
   parseHermesAdmission,
   parseHermesReplayCursor,
   qualifyHermesReceiptMode
-} from "../chunk-M65LPNIO.js";
+} from "../chunk-DL67HX3D.js";
 import "../chunk-MLKGABMK.js";
 
 // src/native-host-receiver.ts
@@ -810,23 +815,25 @@ var startNativeInputReceiver = (apiKey, machineId, options) => {
   const abort = new AbortController();
   const busy = /* @__PURE__ */ new Set();
   const settling = /* @__PURE__ */ new Set();
+  const refusalsReported = /* @__PURE__ */ new Set();
   const heartbeats = /* @__PURE__ */ new Map();
   const settlements = /* @__PURE__ */ new Map();
   let scanning = false;
   let cursor = 0;
+  const request = (path, body) => fetch(`${baseUrl}${path}`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${apiKey}`
+    },
+    body: JSON.stringify(body),
+    signal: AbortSignal.any([
+      abort.signal,
+      AbortSignal.timeout(CLAUDE_INBOX_RECEIVER.requestTimeoutMs)
+    ])
+  });
   const post = async (path, body) => {
-    const response = await fetch(`${baseUrl}${path}`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${apiKey}`
-      },
-      body: JSON.stringify(body),
-      signal: AbortSignal.any([
-        abort.signal,
-        AbortSignal.timeout(CLAUDE_INBOX_RECEIVER.requestTimeoutMs)
-      ])
-    });
+    const response = await request(path, body);
     if (!response.ok) throw new Error(`native inbox HTTP ${response.status}`);
     return response.json();
   };
@@ -835,17 +842,23 @@ var startNativeInputReceiver = (apiKey, machineId, options) => {
     if (!pending || settling.has(commandId) || settling.size >= CLAUDE_INBOX_RECEIVER.maxConcurrent) return false;
     settling.add(commandId);
     try {
-      const receipt = await post("/api/agent/command/ack", {
+      const response = await request("/api/agent/command/ack", {
         ...pending,
         commandId,
         machineId
       });
-      if (!isCommandAcknowledgementReceipt(receipt))
+      const ack = await readCommandAck(response);
+      if (ack.outcome === "retry") throw new Error(`native inbox HTTP ${response.status}`);
+      if (ack.outcome === "settled" && !isCommandAcknowledgementReceipt(await response.json()))
         throw new Error("native acknowledgement missing receipt");
       const current = settlements.get(commandId);
       if (current?.state !== pending.state || current.failureCode !== pending.failureCode || current.sessionId !== pending.sessionId) return false;
       if (pending.state === "delivered") client.confirmSettlement(pending.sessionId, commandId);
       settlements.delete(commandId);
+      if (ack.outcome === "refused" && !refusalsReported.has(commandId)) {
+        refusalsReported.add(commandId);
+        options.report?.(refusedReceiptMessage(commandId, ack.status));
+      }
       return true;
     } catch (error) {
       if (!abort.signal.aborted)
@@ -993,7 +1006,7 @@ var startNativeHostReceivers = (apiKey, machineId, report) => {
 };
 
 // src/hook-command-receipts.ts
-var reconcileCommandReceipts = async (apiKey, machineId, agentType, baseUrl, signal) => {
+var reconcileCommandReceipts = async (apiKey, machineId, agentType, baseUrl, signal, report) => {
   const namespace = `${apiKey}:${machineId}:${agentType}`;
   for (const { sessionId, command } of pendingCommandReceipts(namespace)) {
     signal?.throwIfAborted();
@@ -1016,7 +1029,12 @@ var reconcileCommandReceipts = async (apiKey, machineId, agentType, baseUrl, sig
         ...signal ? [signal] : []
       ])
     });
-    if (response.ok) removePendingCommand(sessionId, command.id, namespace);
+    const ack = await readCommandAck(response);
+    if (ack.outcome === "settled") removePendingCommand(sessionId, command.id, namespace);
+    if (ack.outcome === "refused") {
+      markPendingCommandRefused(sessionId, command.id, namespace);
+      report?.(refusedReceiptMessage(command.id, ack.status));
+    }
   }
 };
 
@@ -1417,7 +1435,8 @@ var startClaudeInboxReceiver = (apiKey, machineId, options = {}) => {
         machineId,
         "claude_code",
         baseUrl,
-        abort.signal
+        abort.signal,
+        options.report
       );
       const sessions = client.sessions().filter(options.ownsSession ?? ownsSession).slice(0, CLAUDE_INBOX_MAX_SESSIONS);
       if (!sessions.length) {

package/dist/bin/pushary-disconnect.js

@@ -2,18 +2,18 @@
 import {
   declinedAgentsFile,
   recordDeclinedAgent
-} from "../chunk-PG23ENSN.js";
+} from "../chunk-ZWLSXECG.js";
 import {
   isCursorPluginLeftover,
   isPusharyCursorPluginManifest,
   releaseSoleGate
-} from "../chunk-D2KJKAYM.js";
+} from "../chunk-ZWIJJYN3.js";
 import {
   planFxRemoval,
   removeClineServer
-} from "../chunk-IZJDVOJV.js";
-import "../chunk-3TKTZOKG.js";
-import "../chunk-PFHRW3LR.js";
+} from "../chunk-2XDVEBHI.js";
+import "../chunk-54TZGPZP.js";
+import "../chunk-NZD6ISCL.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -25,10 +25,10 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-NSBWFX7H.js";
+} from "../chunk-VBWJ756P.js";
 import {
   exitOnHelpFlag
-} from "../chunk-4EQOCSJW.js";
+} from "../chunk-K7YJBVR3.js";
 import {
   compatibleConfigFile,
   compatibleDocuments,
@@ -38,27 +38,28 @@ import {
   isEmptiedPusharyOwnedDocument,
   removeCompatibleHooks,
   removeCompatibleMcpServer
-} from "../chunk-RZBV5KTF.js";
+} from "../chunk-43DT3QWZ.js";
 import {
   removeGeminiSettings
-} from "../chunk-237FYIVC.js";
-import "../chunk-MRHGK3Q3.js";
-import "../chunk-JYCAAQUW.js";
-import "../chunk-XHC3UNOK.js";
-import "../chunk-MJVDFNP2.js";
+} from "../chunk-TLK5YLIE.js";
+import "../chunk-D7AAAD6W.js";
+import "../chunk-A2YJ2FBR.js";
+import "../chunk-5XDFQ6E3.js";
+import "../chunk-LAWI6NQK.js";
 import {
   parseFlags
 } from "../chunk-YPY4YCIZ.js";
-import "../chunk-RGVQOOGD.js";
-import "../chunk-J4UNR655.js";
+import "../chunk-IRIXOH4U.js";
+import "../chunk-L2GADKFL.js";
+import "../chunk-Y47BMZUR.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-2KN53MPE.js";
-import "../chunk-42PVKPHM.js";
-import "../chunk-LR3PIGRS.js";
-import "../chunk-V2T5ZDMP.js";
-import "../chunk-DS7XMYUB.js";
-import "../chunk-CVBSETPW.js";
-import "../chunk-BKH4LQJC.js";
+import "../chunk-WXUEOHYY.js";
+import "../chunk-VVN3RPV6.js";
+import "../chunk-Q2VV77IY.js";
+import "../chunk-PHA6AFOR.js";
+import "../chunk-WNT4JHK3.js";
+import "../chunk-PNVTPEO5.js";
+import "../chunk-LNF36PTF.js";
 import {
   claudeJson,
   claudeMcpReceipt,
@@ -88,9 +89,9 @@ import {
   removePusharySettings,
   removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-W4FJR57E.js";
-import "../chunk-A44MRVWG.js";
-import "../chunk-T6HX6OTY.js";
+} from "../chunk-R7KC57PC.js";
+import "../chunk-GS5FH3C2.js";
+import "../chunk-IKBTG3OT.js";
 import {
   UsageError
 } from "../chunk-YU2EUD7O.js";
@@ -102,14 +103,14 @@ import {
 } from "../chunk-BG4HHB7E.js";
 import {
   isInvocationOf
-} from "../chunk-SZYKS433.js";
+} from "../chunk-MQMVJDII.js";
 import "../chunk-WIIMW5YO.js";
 import {
   DISCONNECTABLE_AGENTS,
   DISCONNECT_AGENT_IDS,
   hookCompatibleProfileBySource,
   normalizeAgentId
-} from "../chunk-M65LPNIO.js";
+} from "../chunk-DL67HX3D.js";
 import "../chunk-MLKGABMK.js";
 
 // bin/pushary-disconnect.ts

package/dist/bin/pushary-display-hook.js

@@ -135,11 +135,21 @@ var init_native_input = __esm({
   }
 });
 
+// ../contracts/src/json-record.ts
+var isRecord;
+var init_json_record = __esm({
+  "../contracts/src/json-record.ts"() {
+    "use strict";
+    isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+  }
+});
+
 // ../contracts/src/command-delivery.ts
-var COMMAND_SETTLEMENT_STATES, COMMAND_RECOVERY, COMMAND_ACKNOWLEDGEMENT_STATES;
+var COMMAND_SETTLEMENT_STATES, COMMAND_RECOVERY, COMMAND_ACKNOWLEDGEMENT_STATES, COMMAND_ACK_ERRORS, COMMAND_ACK_ERROR_RESPONSES;
 var init_command_delivery = __esm({
   "../contracts/src/command-delivery.ts"() {
     "use strict";
+    init_json_record();
     COMMAND_SETTLEMENT_STATES = [
       "delivered",
       "failed",
@@ -156,6 +166,18 @@ var init_command_delivery = __esm({
       "dispatching",
       ...COMMAND_SETTLEMENT_STATES
     ];
+    COMMAND_ACK_ERRORS = {
+      unauthorized: { status: 401, error: "Unauthorized", final: false },
+      forbiddenKeyScope: { status: 403, error: "Forbidden key scope", final: true },
+      invalidAck: { status: 400, error: "invalid_ack", final: true },
+      invalidMachineId: { status: 400, error: "invalid_machine_id", final: true },
+      invalidDispatch: { status: 400, error: "invalid_dispatch", final: true },
+      machineRequired: { status: 400, error: "machine_required", final: true },
+      ackUnavailable: { status: 503, error: "ack_unavailable", final: false },
+      claimMismatch: { status: 409, error: "claim_mismatch", final: true },
+      staleCommand: { status: 409, error: "stale_command", final: true }
+    };
+    COMMAND_ACK_ERROR_RESPONSES = Object.values(COMMAND_ACK_ERRORS);
   }
 });
 
@@ -181,15 +203,6 @@ var init_claude_wake = __esm({
   }
 });
 
-// ../contracts/src/json-record.ts
-var isRecord;
-var init_json_record = __esm({
-  "../contracts/src/json-record.ts"() {
-    "use strict";
-    isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-  }
-});
-
 // ../contracts/src/agent-questions.ts
 var init_agent_questions = __esm({
   "../contracts/src/agent-questions.ts"() {
@@ -674,7 +687,9 @@ var init_agent_wiring = __esm({
       permissionRuleFile: null,
       configDirIsShared: false,
       soleGate: null,
-      taskControl: null
+      taskControl: null,
+      promptFollowsPreToolUseAllow: true,
+      permissionRequestPaths: "shell_escaped"
     };
     CODEBUDDY = {
       agentType: "codebuddy",
@@ -698,7 +713,9 @@ var init_agent_wiring = __esm({
       permissionRuleFile: homeJson(".codebuddy", "settings.json"),
       configDirIsShared: false,
       soleGate: null,
-      taskControl: null
+      taskControl: null,
+      promptFollowsPreToolUseAllow: false,
+      permissionRequestPaths: "as_pre_tool_use"
     };
     QODER = {
       agentType: "qoder",
@@ -722,7 +739,9 @@ var init_agent_wiring = __esm({
       permissionRuleFile: null,
       configDirIsShared: false,
       soleGate: null,
-      taskControl: null
+      taskControl: null,
+      promptFollowsPreToolUseAllow: false,
+      permissionRequestPaths: "as_pre_tool_use"
     };
     DROID = {
       agentType: "droid",
@@ -751,7 +770,9 @@ var init_agent_wiring = __esm({
       permissionRuleFile: null,
       configDirIsShared: false,
       soleGate: null,
-      taskControl: null
+      taskControl: null,
+      promptFollowsPreToolUseAllow: false,
+      permissionRequestPaths: "as_pre_tool_use"
     };
     DEVIN = {
       agentType: "devin",
@@ -785,7 +806,9 @@ var init_agent_wiring = __esm({
       permissionRuleFile: null,
       configDirIsShared: false,
       soleGate: null,
-      taskControl: null
+      taskControl: null,
+      promptFollowsPreToolUseAllow: false,
+      permissionRequestPaths: "as_pre_tool_use"
     };
     ANTIGRAVITY_TASK_CONTROL = {
       name: "manage_task",
@@ -836,7 +859,9 @@ var init_agent_wiring = __esm({
         receipt: [".pushary", "setup", "antigravity-tool-permission.json"],
         coveredTools: [ANTIGRAVITY_TASK_CONTROL.name]
       },
-      taskControl: ANTIGRAVITY_TASK_CONTROL
+      taskControl: ANTIGRAVITY_TASK_CONTROL,
+      promptFollowsPreToolUseAllow: false,
+      permissionRequestPaths: "as_pre_tool_use"
     };
     GROK = {
       agentType: "grok",
@@ -870,7 +895,9 @@ var init_agent_wiring = __esm({
       permissionRuleFile: null,
       configDirIsShared: false,
       soleGate: null,
-      taskControl: null
+      taskControl: null,
+      promptFollowsPreToolUseAllow: false,
+      permissionRequestPaths: "as_pre_tool_use"
     };
     HOOK_COMPATIBLE_PROFILES = Object.freeze([QWEN_CODE, CODEBUDDY, QODER, DROID, DEVIN, ANTIGRAVITY_CLI, GROK]);
   }