pushary 1.9.138 → 1.9.139

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (132) hide show
  1. package/CHANGELOG.md +4 -0
  2. package/dist/{api-J4XJ7XWW.js → api-JY6EQT7A.js} +11 -11
  3. package/dist/bin/pushary-audit.js +3 -3
  4. package/dist/bin/pushary-bell-hook.js +28 -28
  5. package/dist/bin/pushary-bell.js +10 -10
  6. package/dist/bin/pushary-claude.js +27 -27
  7. package/dist/bin/pushary-clean.js +35 -35
  8. package/dist/bin/pushary-codex-bridge.js +23 -23
  9. package/dist/bin/pushary-codex-hook.js +35 -35
  10. package/dist/bin/pushary-codex-session.js +8 -8
  11. package/dist/bin/pushary-codex.js +16 -16
  12. package/dist/bin/pushary-connect.js +29 -29
  13. package/dist/bin/pushary-cowork.js +5 -5
  14. package/dist/bin/pushary-daemon.js +43 -43
  15. package/dist/bin/pushary-disconnect.js +28 -28
  16. package/dist/bin/pushary-doctor.js +43 -43
  17. package/dist/bin/pushary-elicitation-hook.js +28 -28
  18. package/dist/bin/pushary-gemini-bridge.js +17 -17
  19. package/dist/bin/pushary-gemini-hook.js +32 -32
  20. package/dist/bin/pushary-hook.js +35 -35
  21. package/dist/bin/pushary-login.js +21 -21
  22. package/dist/bin/pushary-logout.js +27 -27
  23. package/dist/bin/pushary-mcp.js +12 -12
  24. package/dist/bin/pushary-mode.js +15 -15
  25. package/dist/bin/pushary-notification-hook.js +27 -27
  26. package/dist/bin/pushary-opencode-hook.js +31 -31
  27. package/dist/bin/pushary-permission-denied-hook.js +35 -35
  28. package/dist/bin/pushary-permission-hook.js +35 -35
  29. package/dist/bin/pushary-post-hook.js +28 -28
  30. package/dist/bin/pushary-prompt-hook.js +27 -27
  31. package/dist/bin/pushary-session-end-hook.js +27 -27
  32. package/dist/bin/pushary-session-start-hook.js +36 -36
  33. package/dist/bin/pushary-setup.js +50 -50
  34. package/dist/bin/pushary-stats.js +5 -5
  35. package/dist/bin/pushary-status.js +33 -33
  36. package/dist/bin/pushary-stop-hook.js +27 -27
  37. package/dist/bin/pushary-stopfailure-hook.js +27 -27
  38. package/dist/bin/pushary-suggestions.js +15 -15
  39. package/dist/bin/pushary-transcript-register.js +17 -17
  40. package/dist/bin/pushary-transcripts.js +25 -25
  41. package/dist/bin/pushary-upgrade.js +41 -41
  42. package/dist/bin/pushary-wait.js +15 -15
  43. package/dist/bin/pushary.js +7 -7
  44. package/dist/{chunk-MENTZJHA.js → chunk-2MJMKM6D.js} +1 -1
  45. package/dist/{chunk-VF4N6NHG.js → chunk-2X2JHX77.js} +4 -4
  46. package/dist/{chunk-LF3ZRLUQ.js → chunk-2YMVIBFT.js} +12 -12
  47. package/dist/{chunk-K7YJBVR3.js → chunk-3FNBN4JQ.js} +1 -1
  48. package/dist/{chunk-Y47BMZUR.js → chunk-3PQEUSPK.js} +1 -1
  49. package/dist/{chunk-B4UIRMOE.js → chunk-422KDIO5.js} +2 -2
  50. package/dist/{chunk-P7YVVWTW.js → chunk-4NLZUCPG.js} +2 -2
  51. package/dist/{chunk-52B2TQJM.js → chunk-4RKB6X4S.js} +2 -2
  52. package/dist/{chunk-IRIXOH4U.js → chunk-6A6OSNC2.js} +1 -1
  53. package/dist/{chunk-O26H5X5M.js → chunk-6RAHONLG.js} +2 -2
  54. package/dist/{chunk-NNDUDXOJ.js → chunk-7MPKMLE3.js} +8 -8
  55. package/dist/{chunk-LIZEMDE4.js → chunk-7Q6YKZY2.js} +3 -3
  56. package/dist/{chunk-6TK3DWSF.js → chunk-AEC72YC3.js} +6 -6
  57. package/dist/{chunk-LIUWN23V.js → chunk-AOAIYHAP.js} +5 -5
  58. package/dist/{chunk-WHOFZB5W.js → chunk-BRXKVYTV.js} +1 -1
  59. package/dist/{chunk-S47AAQFT.js → chunk-BURSH6SW.js} +4 -4
  60. package/dist/{chunk-NIBF37NU.js → chunk-C4F5RUJL.js} +6 -6
  61. package/dist/{chunk-FYLYAVQG.js → chunk-CQLQFN6B.js} +3 -3
  62. package/dist/{chunk-TN5PGMH5.js → chunk-CZH3JDVB.js} +2 -2
  63. package/dist/{chunk-HVRXBHX2.js → chunk-DF2CUKN4.js} +2 -2
  64. package/dist/{chunk-EJSU5YWO.js → chunk-DTJZK3MN.js} +6 -6
  65. package/dist/{chunk-APTNHX63.js → chunk-FIQ7ND7P.js} +5 -5
  66. package/dist/{chunk-TJCUGBCZ.js → chunk-FMQBG2TD.js} +6 -6
  67. package/dist/{chunk-R7CQF2P3.js → chunk-FSTSLVZJ.js} +1 -1
  68. package/dist/{chunk-KN4YJ4QS.js → chunk-GCOOOIBX.js} +3 -3
  69. package/dist/{chunk-FQ3ASV5L.js → chunk-GGTLV67J.js} +4 -4
  70. package/dist/{chunk-LNF36PTF.js → chunk-GVJWHTN2.js} +2 -2
  71. package/dist/{chunk-IDGWQY3J.js → chunk-H4O4IPWY.js} +5 -5
  72. package/dist/{chunk-VVN3RPV6.js → chunk-IAWFSD4Q.js} +1 -1
  73. package/dist/{chunk-N3VCBXI6.js → chunk-IDXCVT6W.js} +3 -3
  74. package/dist/{chunk-IKBTG3OT.js → chunk-IEHI64ZN.js} +1 -1
  75. package/dist/{chunk-YQQGIDBC.js → chunk-IHUXZGHB.js} +1 -1
  76. package/dist/{chunk-YOV3LHOL.js → chunk-INGRSQVC.js} +3 -3
  77. package/dist/{chunk-5XDFQ6E3.js → chunk-IOWB43KY.js} +1 -1
  78. package/dist/{chunk-KYD3LHFB.js → chunk-ISDMTGZ3.js} +1 -1
  79. package/dist/{chunk-CBTXOWB3.js → chunk-J5SMCRIT.js} +5 -5
  80. package/dist/{chunk-EHQCMJHI.js → chunk-J6CNQ5UK.js} +1 -1
  81. package/dist/{chunk-TXPXK5Q6.js → chunk-KDQSPNPH.js} +16 -16
  82. package/dist/{chunk-DL67HX3D.js → chunk-KQVURVAP.js} +118 -24
  83. package/dist/{chunk-AGVE7MXF.js → chunk-KXHGEJVW.js} +2 -2
  84. package/dist/{chunk-SNMTACCY.js → chunk-KYWH4XUR.js} +3 -3
  85. package/dist/{chunk-P6HLLS5J.js → chunk-LGIB72D7.js} +2 -2
  86. package/dist/{chunk-KXKE3SW3.js → chunk-LHUA6ADC.js} +3 -3
  87. package/dist/{chunk-33E75LIY.js → chunk-LHYBHWCK.js} +2 -2
  88. package/dist/{chunk-RRUP72V6.js → chunk-LKSFQTGQ.js} +1 -1
  89. package/dist/{chunk-H5XLVJI7.js → chunk-LSABM2ES.js} +2 -2
  90. package/dist/{chunk-FJ7OESWX.js → chunk-LVL7XAXK.js} +5 -5
  91. package/dist/{chunk-LPXHKIJC.js → chunk-LYLADUYE.js} +2 -2
  92. package/dist/{chunk-NUG2A73X.js → chunk-M4G4VWW6.js} +1 -1
  93. package/dist/{chunk-L3UV4LLL.js → chunk-M6TJWXST.js} +8 -8
  94. package/dist/{chunk-NLJ2ILA7.js → chunk-MAPC5KKZ.js} +2 -2
  95. package/dist/{chunk-DMZMPYLB.js → chunk-MNVBO6UO.js} +4 -4
  96. package/dist/{chunk-PNDL3OMR.js → chunk-OBKHLKKB.js} +4 -4
  97. package/dist/{chunk-VQMGR32B.js → chunk-OBPBT6RG.js} +3 -3
  98. package/dist/{chunk-7WR3FDDX.js → chunk-OLJTUTD2.js} +3 -3
  99. package/dist/{chunk-B3AZPYRU.js → chunk-P3UCAWUP.js} +6 -6
  100. package/dist/{chunk-FO5MHOBI.js → chunk-P6S4CALA.js} +5 -5
  101. package/dist/{chunk-CULDO4UA.js → chunk-Q5H5AFS7.js} +3 -3
  102. package/dist/{chunk-DES272QQ.js → chunk-QG5MJ6NW.js} +4 -4
  103. package/dist/{chunk-WM7OY63L.js → chunk-QMKI5RGT.js} +1 -1
  104. package/dist/{chunk-A2YJ2FBR.js → chunk-QTR6KQEU.js} +1 -1
  105. package/dist/{chunk-ICQU3SNR.js → chunk-RBPAUX6C.js} +5 -5
  106. package/dist/{chunk-42BVIKPZ.js → chunk-S63DCSH4.js} +4 -4
  107. package/dist/{chunk-JFGM6VSU.js → chunk-SKVPWXNK.js} +10 -10
  108. package/dist/{chunk-QXATIKHQ.js → chunk-SVKZKLEP.js} +1 -1
  109. package/dist/{chunk-PPCZSOCL.js → chunk-T5FPA2JO.js} +3 -3
  110. package/dist/{chunk-OXPYENHL.js → chunk-U7Z53YWH.js} +4 -4
  111. package/dist/{chunk-5ZK4RHYR.js → chunk-UTUR6WEA.js} +3 -3
  112. package/dist/{chunk-DK6CMXYI.js → chunk-UZZRSCFR.js} +5 -5
  113. package/dist/{chunk-KTVMIG32.js → chunk-WES6E62H.js} +4 -4
  114. package/dist/{chunk-PNVTPEO5.js → chunk-XKXOT2ZU.js} +3 -3
  115. package/dist/{chunk-ZWURBNA3.js → chunk-XQYBTRVW.js} +1 -1
  116. package/dist/{chunk-OAGYR5LI.js → chunk-ZAZQHOBS.js} +11 -11
  117. package/dist/{chunk-U3OLXV5Z.js → chunk-ZNMLL2WN.js} +2 -2
  118. package/dist/{chunk-MQMVJDII.js → chunk-ZYLZCNOJ.js} +1 -1
  119. package/dist/{codex-app-cards-switch-R3MIDYFA.js → codex-app-cards-switch-TOHSGS5T.js} +11 -11
  120. package/dist/{codex-card-routing-LQJEJNTS.js → codex-card-routing-BPCOKSBO.js} +2 -2
  121. package/dist/{codex-desktop-launch-2YRIBVDK.js → codex-desktop-launch-6LD5GETH.js} +1 -1
  122. package/dist/{codex-session-launch-CTMTMGHU.js → codex-session-launch-ZVFPD4ON.js} +20 -20
  123. package/dist/{config-34VUNHK6.js → config-3AFJSGM2.js} +3 -3
  124. package/dist/{global-upgrade-NMTIVAJ3.js → global-upgrade-6SWFRW5G.js} +9 -9
  125. package/dist/{identity-3XKATUN2.js → identity-K2VBL5PB.js} +4 -4
  126. package/dist/{live-capabilities-MR35FXPF.js → live-capabilities-VQEG7TCE.js} +4 -4
  127. package/dist/{paths-YA5ROXGC.js → paths-ZAVMBGAQ.js} +3 -3
  128. package/dist/{reapply-LIBOIVBT.js → reapply-BXMMOQXK.js} +29 -29
  129. package/dist/src/index.js +34 -34
  130. package/dist/{upgrade-lock-LK4XD3HR.js → upgrade-lock-UZN332AO.js} +4 -4
  131. package/dist/{usage-ZSV4LFDL.js → usage-EDDIN5YZ.js} +3 -3
  132. package/package.json +1 -1
@@ -4388,13 +4388,7 @@ var patternToolName = (pattern) => {
4388
4388
  const open = argumentOpenIndex(pattern);
4389
4389
  return open === -1 ? pattern : pattern.slice(0, open);
4390
4390
  };
4391
- var matchToolPattern = (pattern, toolName, arg, intent = PATTERN_INTENT.grant) => {
4392
- const open = argumentOpenIndex(pattern);
4393
- if (open === -1) {
4394
- return pattern === toolName ? "tool" : "none";
4395
- }
4396
- if (patternToolName(pattern) !== toolName || arg === void 0) return "none";
4397
- const inner = pattern.slice(open + 1, -1);
4391
+ var rankOfArgument = (toolName, inner, arg, intent) => {
4398
4392
  if (inner.endsWith(":*")) {
4399
4393
  const prefix = inner.slice(0, -2);
4400
4394
  return rankWholeOrSegments(toolName, arg, intent, (segment) => segment.startsWith(prefix));
@@ -4407,6 +4401,17 @@ var matchToolPattern = (pattern, toolName, arg, intent = PATTERN_INTENT.grant) =
4407
4401
  }
4408
4402
  return arg === inner ? "exact" : "none";
4409
4403
  };
4404
+ var bestRankOf = (ranks) => ranks.reduce((best, rank) => matchRankWeight(rank) > matchRankWeight(best) ? rank : best, "none");
4405
+ var argumentSpellingsFor = (toolName, arg, intent) => toolName in POLICY_PATH_KEYS ? pathSpellingsFor(arg, intent) : [arg];
4406
+ var matchToolPattern = (pattern, toolName, arg, intent = PATTERN_INTENT.grant) => {
4407
+ const open = argumentOpenIndex(pattern);
4408
+ if (open === -1) {
4409
+ return pattern === toolName ? "tool" : "none";
4410
+ }
4411
+ if (patternToolName(pattern) !== toolName || arg === void 0) return "none";
4412
+ const inner = pattern.slice(open + 1, -1);
4413
+ return bestRankOf(argumentSpellingsFor(toolName, arg, intent).map((spelling) => rankOfArgument(toolName, inner, spelling, intent)));
4414
+ };
4410
4415
  var POLICY_PATH_KEYS = {
4411
4416
  Read: "file_path",
4412
4417
  Edit: "file_path",
@@ -4426,7 +4431,8 @@ var extractPolicyArg = (toolName, toolInput) => {
4426
4431
  return typeof value === "string" ? value : void 0;
4427
4432
  };
4428
4433
  var normalizeSeparators = (value) => value.replace(/\\/g, "/");
4429
- var isAbsolutePath = (value) => value.startsWith("/") || /^[A-Za-z]:\//.test(value);
4434
+ var DRIVE_ROOT = /^[A-Za-z]:\//;
4435
+ var isAbsolutePath = (value) => value.startsWith("/") || DRIVE_ROOT.test(value);
4430
4436
  var relativeToCwd = (path, cwd) => {
4431
4437
  const base = normalizeSeparators(cwd).replace(/\/+$/, "");
4432
4438
  if (!base) return void 0;
@@ -4435,10 +4441,86 @@ var relativeToCwd = (path, cwd) => {
4435
4441
  const rest = path.slice(prefix.length);
4436
4442
  return rest.length > 0 ? rest : void 0;
4437
4443
  };
4438
- var policyArgForms = (toolName, toolInput, cwd) => {
4439
- const raw = extractPolicyArg(toolName, toolInput);
4440
- if (raw === void 0) return [];
4441
- if (!(toolName in POLICY_PATH_KEYS)) return [raw];
4444
+ var CURRENT_SEGMENT = ".";
4445
+ var PARENT_SEGMENT = "..";
4446
+ var BACKSLASH2 = "\\";
4447
+ var NETWORK_SHARE_PREFIX = "//";
4448
+ var DOT_SEGMENT = /(?:^|[\\/])\.{1,2}(?=[\\/]|$)/;
4449
+ var WINDOWS_PATH = /^(?:[A-Za-z]:[\\/]|\\\\)/;
4450
+ var FIRST_SEGMENT_WITH_AN_UNKNOWN_BASE = /^(?:~|\$|%|[A-Za-z]:)/;
4451
+ var hasDotSegment = (path) => DOT_SEGMENT.test(path);
4452
+ var PATH_SPELLINGS_CACHE_MAX = 64;
4453
+ var anchorOf = (path) => {
4454
+ const drive = DRIVE_ROOT.exec(path)?.[0];
4455
+ if (drive !== void 0) return { base: "root", prefix: drive, segments: path.slice(drive.length).split("/") };
4456
+ if (path.startsWith("/")) return { base: "root", prefix: "/", segments: path.slice(1).split("/") };
4457
+ const [first = "", ...rest] = path.split("/");
4458
+ return FIRST_SEGMENT_WITH_AN_UNKNOWN_BASE.test(first) ? { base: "unknown", prefix: `${first}/`, segments: rest } : { base: "relative", prefix: "", segments: path.split("/") };
4459
+ };
4460
+ var joinedToDirectory = (directory, path) => directory.endsWith("/") ? `${directory}${path}` : `${directory}/${path}`;
4461
+ var standingOf = (base, climbs) => {
4462
+ if (climbs === 0) return "placed";
4463
+ return base === "relative" ? "above_its_start" : "unplaceable";
4464
+ };
4465
+ var readingOf = (path, directory) => {
4466
+ if (path.startsWith(NETWORK_SHARE_PREFIX)) return { spelling: path, standing: "unplaceable" };
4467
+ const anchor = anchorOf(path);
4468
+ if (anchor.base === "relative" && directory !== void 0) return readingOf(joinedToDirectory(directory, path), void 0);
4469
+ const kept = [];
4470
+ let climbs = 0;
4471
+ for (const segment of anchor.segments) {
4472
+ if (segment === "" || segment === CURRENT_SEGMENT) continue;
4473
+ if (segment !== PARENT_SEGMENT) kept.push(segment);
4474
+ else if (kept.length > 0) kept.pop();
4475
+ else if (anchor.base !== "root") climbs += 1;
4476
+ }
4477
+ const spelling = `${anchor.prefix}${[...Array(climbs).fill(PARENT_SEGMENT), ...kept].join("/")}`;
4478
+ return { spelling: spelling.length > 0 ? spelling : CURRENT_SEGMENT, standing: standingOf(anchor.base, climbs) };
4479
+ };
4480
+ var hasOneSeparatorReading = (path, directory) => !path.includes(BACKSLASH2) || WINDOWS_PATH.test(path) || directory !== void 0 && DRIVE_ROOT.test(directory);
4481
+ var separatorReadingsOf = (path, directory) => hasOneSeparatorReading(path, directory) ? [normalizeSeparators(path)] : [path, normalizeSeparators(path)];
4482
+ var spellingsOfReadings = (readings) => [...new Set(readings.map((reading) => reading.spelling))];
4483
+ var isPlaced = (reading) => reading.standing === "placed";
4484
+ var isUnplaceable = (reading) => reading.standing === "unplaceable";
4485
+ var locatePath = (path, directory) => {
4486
+ const readings = separatorReadingsOf(path, directory).map((reading) => readingOf(reading, directory));
4487
+ const [only, ...others] = spellingsOfReadings(readings);
4488
+ return only !== void 0 && others.length === 0 && readings.every(isPlaced) ? { kind: "located", path: only } : { kind: "unlocated", readings };
4489
+ };
4490
+ var isTooLongToMatch = (path) => path.length > GLOB_MAX_ARG_LENGTH;
4491
+ var locatedDirectoryOf = (cwd) => {
4492
+ if (!cwd) return void 0;
4493
+ const location = locatePath(cwd);
4494
+ return location.kind === "located" && isAbsolutePath(location.path) ? location.path : void 0;
4495
+ };
4496
+ var unlocatedPathSpellings = (path, readings) => [.../* @__PURE__ */ new Set([path, normalizeSeparators(path), ...spellingsOfReadings(readings)])];
4497
+ var matchSpellingsOf = (path) => {
4498
+ const location = locatePath(path);
4499
+ return location.kind === "located" ? { grant: [location.path], restrict: [location.path] } : { grant: [], restrict: unlocatedPathSpellings(path, location.readings) };
4500
+ };
4501
+ var pathSpellingsCache = /* @__PURE__ */ new Map();
4502
+ var cachedMatchSpellingsOf = (path) => {
4503
+ const cached = pathSpellingsCache.get(path);
4504
+ if (cached !== void 0) return cached;
4505
+ const spellings = matchSpellingsOf(path);
4506
+ if (pathSpellingsCache.size >= PATH_SPELLINGS_CACHE_MAX) pathSpellingsCache.clear();
4507
+ pathSpellingsCache.set(path, spellings);
4508
+ return spellings;
4509
+ };
4510
+ var pathSpellingsFor = (path, intent) => {
4511
+ if (isTooLongToMatch(path)) return intent === PATTERN_INTENT.restrict ? [path] : [];
4512
+ if (!hasDotSegment(path)) return [path];
4513
+ const spellings = cachedMatchSpellingsOf(path);
4514
+ return intent === PATTERN_INTENT.restrict ? spellings.restrict : spellings.grant;
4515
+ };
4516
+ var scopeSpellingsOf = (path) => {
4517
+ if (!hasDotSegment(path)) return [path];
4518
+ if (isTooLongToMatch(path)) return void 0;
4519
+ const location = locatePath(path);
4520
+ if (location.kind === "located") return [location.path];
4521
+ return location.readings.some(isUnplaceable) ? void 0 : spellingsOfReadings(location.readings);
4522
+ };
4523
+ var writtenPathForms = (raw, cwd) => {
4442
4524
  const forms = [raw];
4443
4525
  const normalized = normalizeSeparators(raw);
4444
4526
  if (normalized !== raw) forms.push(normalized);
@@ -4448,14 +4530,24 @@ var policyArgForms = (toolName, toolInput, cwd) => {
4448
4530
  }
4449
4531
  return forms;
4450
4532
  };
4533
+ var locatedPathForms = (path, directory) => {
4534
+ const relative = directory !== void 0 && isAbsolutePath(path) ? relativeToCwd(path, directory) : void 0;
4535
+ return relative === void 0 ? [path] : [path, relative];
4536
+ };
4537
+ var resolvedPathForms = (raw, cwd) => {
4538
+ const directory = locatedDirectoryOf(cwd);
4539
+ const location = locatePath(raw, directory);
4540
+ return location.kind === "located" ? locatedPathForms(location.path, directory) : [raw];
4541
+ };
4542
+ var policyArgForms = (toolName, toolInput, cwd) => {
4543
+ const raw = extractPolicyArg(toolName, toolInput);
4544
+ if (raw === void 0) return [];
4545
+ if (!(toolName in POLICY_PATH_KEYS)) return [raw];
4546
+ return !isTooLongToMatch(raw) && hasDotSegment(raw) ? resolvedPathForms(raw, cwd) : writtenPathForms(raw, cwd);
4547
+ };
4451
4548
  var matchToolPatternAny = (pattern, toolName, args, intent = PATTERN_INTENT.grant) => {
4452
4549
  if (args.length === 0) return matchToolPattern(pattern, toolName);
4453
- let best = "none";
4454
- for (const arg of args) {
4455
- const rank = matchToolPattern(pattern, toolName, arg, intent);
4456
- if (matchRankWeight(rank) > matchRankWeight(best)) best = rank;
4457
- }
4458
- return best;
4550
+ return bestRankOf(args.map((arg) => matchToolPattern(pattern, toolName, arg, intent)));
4459
4551
  };
4460
4552
  var SAFE_SHELL_COMMANDS = /* @__PURE__ */ new Set([
4461
4553
  "ls",
@@ -8399,17 +8491,16 @@ var matchesGlobPath = (glob, path) => {
8399
8491
  return compiled ? matchGlobTokens(compiled, path) : false;
8400
8492
  };
8401
8493
  var SCOPE_PATH_MAX_LENGTH = 200;
8494
+ var allowedPathsCover = (allowedPaths, path) => scopeSpellingsOf(path)?.every((spelling) => allowedPaths.some((rule) => matchesGlobPath(rule, spelling))) ?? false;
8402
8495
  var evaluateScope = (contract, path) => {
8403
8496
  if (!contract) return { outcome: "no_contract" };
8404
8497
  if (typeof path !== "string" || path.length === 0) return { outcome: "in_scope" };
8498
+ const offLimitsSpellings = pathSpellingsFor(path, PATTERN_INTENT.restrict);
8405
8499
  for (const rule of contract.offLimitsPaths) {
8406
- if (matchesGlobPath(rule, path)) return { outcome: "off_limits", path, rule };
8500
+ if (offLimitsSpellings.some((spelling) => matchesGlobPath(rule, spelling))) return { outcome: "off_limits", path, rule };
8407
8501
  }
8408
8502
  if (contract.allowedPaths.length === 0) return { outcome: "in_scope" };
8409
- for (const rule of contract.allowedPaths) {
8410
- if (matchesGlobPath(rule, path)) return { outcome: "in_scope" };
8411
- }
8412
- return { outcome: "out_of_scope", path };
8503
+ return allowedPathsCover(contract.allowedPaths, path) ? { outcome: "in_scope" } : { outcome: "out_of_scope", path };
8413
8504
  };
8414
8505
  var scopeRequiresHuman = (verdict) => verdict.outcome === "out_of_scope" || verdict.outcome === "off_limits";
8415
8506
  var widenablePath = (path) => path.length > 0 && path.length <= SCOPE_PATH_MAX_LENGTH ? path : void 0;
@@ -8908,7 +8999,10 @@ var runsACommandThatNeedsAPerson = ({ toolName, toolInputs }) => SHELL_DIALECT_B
8908
8999
  const command = extractPolicyArg(toolName, toolInput);
8909
9000
  return command !== void 0 && (commandNeedsAPerson(toolName, command) || commandWritesThroughARemoteApi(command));
8910
9001
  });
8911
- var namesASecretOrWorkflowFile = (path) => SECRET_FILE_NAME.test(basenameOf(path)) || CI_WORKFLOW_FILE.test(normalizeSeparators(path));
9002
+ var namesASecretOrWorkflowFile = (path) => {
9003
+ const written = withoutDotSegments(normalizeSeparators(path));
9004
+ return SECRET_FILE_NAME.test(basenameOf(written)) || CI_WORKFLOW_FILE.test(written);
9005
+ };
8912
9006
  var fileEditNeedsAPerson = (toolName, path) => FILE_EDIT_TOOLS.has(toolName) && namesASecretOrWorkflowFile(path);
8913
9007
  var fileEditNeedsAPersonWithPermissionsOff = (toolName, path) => FILE_EDIT_TOOLS.has(toolName) && pathNeedsAPersonToChange(path);
8914
9008
  var editsAFileThatNeedsAPerson = ({ toolName, toolInputs }) => toolInputs.some((toolInput) => {
@@ -7,10 +7,10 @@ import {
7
7
  codexHome,
8
8
  codexHooksJsonIn,
9
9
  isPusharyCodexCommand
10
- } from "./chunk-TN5PGMH5.js";
10
+ } from "./chunk-CZH3JDVB.js";
11
11
  import {
12
12
  resolvePathBinary
13
- } from "./chunk-FYLYAVQG.js";
13
+ } from "./chunk-CQLQFN6B.js";
14
14
  import {
15
15
  getPackageVersion
16
16
  } from "./chunk-WIIMW5YO.js";
@@ -1,19 +1,19 @@
1
1
  import {
2
2
  readExistingMachineId
3
- } from "./chunk-EHQCMJHI.js";
3
+ } from "./chunk-J6CNQ5UK.js";
4
4
  import {
5
5
  NetworkError
6
6
  } from "./chunk-YU2EUD7O.js";
7
7
  import {
8
8
  getBaseUrl
9
- } from "./chunk-IKBTG3OT.js";
9
+ } from "./chunk-IEHI64ZN.js";
10
10
  import {
11
11
  getPackageVersion
12
12
  } from "./chunk-WIIMW5YO.js";
13
13
  import {
14
14
  clientContextHeaders,
15
15
  redactSecretsFromContent
16
- } from "./chunk-DL67HX3D.js";
16
+ } from "./chunk-KQVURVAP.js";
17
17
 
18
18
  // src/cli/net.ts
19
19
  import { createRequire } from "module";
@@ -9,13 +9,13 @@ import {
9
9
  installedCodexApp,
10
10
  readCodexAppRuntime,
11
11
  shellQuoted
12
- } from "./chunk-KN4YJ4QS.js";
12
+ } from "./chunk-GCOOOIBX.js";
13
13
  import {
14
14
  writeHuman
15
15
  } from "./chunk-QCGNGEGE.js";
16
16
  import {
17
17
  xml
18
- } from "./chunk-6TK3DWSF.js";
18
+ } from "./chunk-AEC72YC3.js";
19
19
  import {
20
20
  writeFileAtomic
21
21
  } from "./chunk-TODDEIYG.js";
@@ -1,19 +1,19 @@
1
1
  import {
2
2
  pusharyFetch
3
- } from "./chunk-SNMTACCY.js";
3
+ } from "./chunk-KYWH4XUR.js";
4
4
  import {
5
5
  NetworkError
6
6
  } from "./chunk-YU2EUD7O.js";
7
7
  import {
8
8
  getBaseUrl
9
- } from "./chunk-IKBTG3OT.js";
9
+ } from "./chunk-IEHI64ZN.js";
10
10
  import {
11
11
  EXIT
12
12
  } from "./chunk-BG4HHB7E.js";
13
13
  import {
14
14
  isValidApiKey,
15
15
  normalizeKeyScope
16
- } from "./chunk-DL67HX3D.js";
16
+ } from "./chunk-KQVURVAP.js";
17
17
 
18
18
  // src/session.ts
19
19
  var samePusharyAccount = (left, right) => left.kind === "ok" && right.kind === "ok" && left.identity.workspaceId !== "" && left.identity.workspaceId === right.identity.workspaceId && left.identity.siteId === right.identity.siteId;
@@ -3,7 +3,7 @@ import {
3
3
  } from "./chunk-POFBE6ZY.js";
4
4
  import {
5
5
  autoUpdateState
6
- } from "./chunk-TN5PGMH5.js";
6
+ } from "./chunk-CZH3JDVB.js";
7
7
  import {
8
8
  readJsonSafe,
9
9
  writeJsonAtomic
@@ -17,7 +17,7 @@ import {
17
17
  } from "./chunk-WIIMW5YO.js";
18
18
  import {
19
19
  isAutoUpdateResult
20
- } from "./chunk-DL67HX3D.js";
20
+ } from "./chunk-KQVURVAP.js";
21
21
 
22
22
  // src/auto-update.ts
23
23
  import { spawn } from "child_process";
@@ -7,7 +7,7 @@ import {
7
7
  } from "./chunk-BG4HHB7E.js";
8
8
  import {
9
9
  redactSecretsFromContent
10
- } from "./chunk-DL67HX3D.js";
10
+ } from "./chunk-KQVURVAP.js";
11
11
 
12
12
  // src/cli/json.ts
13
13
  var writeStdoutFully = (text) => new Promise((resolve, reject) => {
@@ -1,12 +1,12 @@
1
1
  import {
2
2
  pusharyDir
3
- } from "./chunk-TN5PGMH5.js";
3
+ } from "./chunk-CZH3JDVB.js";
4
4
  import {
5
5
  readJsonSafe
6
6
  } from "./chunk-TODDEIYG.js";
7
7
  import {
8
8
  isRecord
9
- } from "./chunk-DL67HX3D.js";
9
+ } from "./chunk-KQVURVAP.js";
10
10
 
11
11
  // src/process-ownership.ts
12
12
  import { createHash, randomUUID } from "crypto";
@@ -3,24 +3,24 @@ import {
3
3
  expectedLaunchCapabilities,
4
4
  hasSpawnProvider,
5
5
  resolveControlPolicy
6
- } from "./chunk-7WR3FDDX.js";
6
+ } from "./chunk-OLJTUTD2.js";
7
7
  import {
8
8
  daemonHasRemoteProof,
9
9
  daemonServiceManagerAvailable,
10
10
  hasDaemonServiceDefinition,
11
11
  readDaemonNeedsLogin,
12
12
  readDaemonStatus
13
- } from "./chunk-6TK3DWSF.js";
13
+ } from "./chunk-AEC72YC3.js";
14
14
  import {
15
15
  getMachineId
16
- } from "./chunk-EHQCMJHI.js";
16
+ } from "./chunk-J6CNQ5UK.js";
17
17
  import {
18
18
  readControlMode,
19
19
  readKeySource
20
- } from "./chunk-PNVTPEO5.js";
20
+ } from "./chunk-XKXOT2ZU.js";
21
21
  import {
22
22
  getBaseUrl
23
- } from "./chunk-IKBTG3OT.js";
23
+ } from "./chunk-IEHI64ZN.js";
24
24
  import {
25
25
  getPackageVersion
26
26
  } from "./chunk-WIIMW5YO.js";
@@ -1,9 +1,9 @@
1
1
  import {
2
2
  claudeConfigDir
3
- } from "./chunk-TN5PGMH5.js";
3
+ } from "./chunk-CZH3JDVB.js";
4
4
  import {
5
5
  claudePermissionRulesFromSettings
6
- } from "./chunk-DL67HX3D.js";
6
+ } from "./chunk-KQVURVAP.js";
7
7
 
8
8
  // src/claude-permission-rules.ts
9
9
  import { readFileSync, statSync } from "fs";
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  DEFAULT_SESSION
3
- } from "./chunk-LF3ZRLUQ.js";
3
+ } from "./chunk-2YMVIBFT.js";
4
4
 
5
5
  // src/answer.ts
6
6
  var isDeferAnswer = (value) => value === "defer";
@@ -1,31 +1,31 @@
1
1
  import {
2
2
  MANAGED_CLAUDE_SETTINGS_BY_PLATFORM
3
- } from "./chunk-LPXHKIJC.js";
3
+ } from "./chunk-LYLADUYE.js";
4
4
  import {
5
5
  declinedAgentsFile,
6
6
  readDeclinedAgents
7
- } from "./chunk-P7YVVWTW.js";
7
+ } from "./chunk-4NLZUCPG.js";
8
8
  import {
9
9
  OPENCODE_HOOK_BINARY,
10
10
  openCodeConfigDir,
11
11
  openCodePluginArgv,
12
12
  openCodePluginFile
13
- } from "./chunk-ICQU3SNR.js";
13
+ } from "./chunk-RBPAUX6C.js";
14
14
  import {
15
15
  liveCursorGateCoverage
16
- } from "./chunk-FQ3ASV5L.js";
16
+ } from "./chunk-GGTLV67J.js";
17
17
  import {
18
18
  compatibleConfigFile,
19
19
  compatibleHookEvents,
20
20
  grokHome,
21
21
  parseConfigDocument
22
- } from "./chunk-APTNHX63.js";
22
+ } from "./chunk-FIQ7ND7P.js";
23
23
  import {
24
24
  DEFAULT_HOOKS_KEY_PATH,
25
25
  GEMINI_HOOK_BINARY,
26
26
  GEMINI_HOOK_EVENTS,
27
27
  hooksAt
28
- } from "./chunk-PNDL3OMR.js";
28
+ } from "./chunk-OBKHLKKB.js";
29
29
  import {
30
30
  CODEX_EARLIER_APPROVAL_MATCHERS,
31
31
  CODEX_HOOK_BINARY,
@@ -53,7 +53,7 @@ import {
53
53
  parseHookArgv,
54
54
  parseHookCommand,
55
55
  supportedClaudeEvents
56
- } from "./chunk-TN5PGMH5.js";
56
+ } from "./chunk-CZH3JDVB.js";
57
57
  import {
58
58
  readRegularJsonFile,
59
59
  readRegularTextFile
@@ -67,7 +67,7 @@ import {
67
67
  OPENCODE_APPROVAL_EVENT,
68
68
  isRecord,
69
69
  matcherMatchesEveryCall
70
- } from "./chunk-DL67HX3D.js";
70
+ } from "./chunk-KQVURVAP.js";
71
71
 
72
72
  // src/hook-wiring.ts
73
73
  import { createHash } from "crypto";
@@ -3,10 +3,10 @@ import {
3
3
  } from "./chunk-CYTPQDQY.js";
4
4
  import {
5
5
  parseVersion
6
- } from "./chunk-FYLYAVQG.js";
6
+ } from "./chunk-CQLQFN6B.js";
7
7
  import {
8
8
  isRecord
9
- } from "./chunk-DL67HX3D.js";
9
+ } from "./chunk-KQVURVAP.js";
10
10
 
11
11
  // src/setup/agent-probe.ts
12
12
  import { execSync } from "child_process";
@@ -1,21 +1,21 @@
1
1
  import {
2
2
  UNNAMED_ACTION
3
- } from "./chunk-A2YJ2FBR.js";
3
+ } from "./chunk-QTR6KQEU.js";
4
4
  import {
5
5
  askUser,
6
6
  isAwayPaused,
7
7
  isLocalQuestionHandoff,
8
8
  unavailableQuestionUnlessRefused,
9
9
  waitForQuestion
10
- } from "./chunk-B3AZPYRU.js";
10
+ } from "./chunk-P3UCAWUP.js";
11
11
  import {
12
12
  getMachineId
13
- } from "./chunk-EHQCMJHI.js";
13
+ } from "./chunk-J6CNQ5UK.js";
14
14
  import {
15
15
  hookWaitClamped,
16
16
  hookWaitDeadline,
17
17
  scopeBreachReasonOf
18
- } from "./chunk-DL67HX3D.js";
18
+ } from "./chunk-KQVURVAP.js";
19
19
 
20
20
  // src/pushed-question.ts
21
21
  var scopeQuestionOf = (verdict) => {
@@ -1,9 +1,9 @@
1
1
  import {
2
2
  AGENT_CHOICES
3
- } from "./chunk-5XDFQ6E3.js";
3
+ } from "./chunk-IOWB43KY.js";
4
4
  import {
5
5
  BELL_HOOK_BINARY
6
- } from "./chunk-WHOFZB5W.js";
6
+ } from "./chunk-BRXKVYTV.js";
7
7
  import {
8
8
  CLAUDE_HOOK_EVENTS,
9
9
  CODEX_HOOK_EVENTS,
@@ -16,13 +16,13 @@ import {
16
16
  isBridgeLocator,
17
17
  isProtectedByScope,
18
18
  registerHookEntry
19
- } from "./chunk-TN5PGMH5.js";
19
+ } from "./chunk-CZH3JDVB.js";
20
20
  import {
21
21
  CURSOR_GATE_EVENTS,
22
22
  HOOK_BUDGETS,
23
23
  HOOK_LOCATOR_BINARY,
24
24
  hookCommandHoldBudget
25
- } from "./chunk-DL67HX3D.js";
25
+ } from "./chunk-KQVURVAP.js";
26
26
 
27
27
  // src/gemini-config.ts
28
28
  var GEMINI_HOOK_BINARY = "pushary-gemini-hook";
@@ -4,15 +4,15 @@ import {
4
4
  claimThrottle,
5
5
  releaseThrottle,
6
6
  reportEvent
7
- } from "./chunk-LF3ZRLUQ.js";
7
+ } from "./chunk-2YMVIBFT.js";
8
8
  import {
9
9
  deriveToolTarget,
10
10
  permissionDeniedAction
11
- } from "./chunk-A2YJ2FBR.js";
11
+ } from "./chunk-QTR6KQEU.js";
12
12
  import {
13
13
  machineDecisionFor,
14
14
  wireVerdictFor
15
- } from "./chunk-DL67HX3D.js";
15
+ } from "./chunk-KQVURVAP.js";
16
16
 
17
17
  // src/machine-decision-audit.ts
18
18
  import { basename } from "path";
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  realpath
3
- } from "./chunk-NLJ2ILA7.js";
3
+ } from "./chunk-MAPC5KKZ.js";
4
4
  import {
5
5
  findNativeClaudeInstall
6
6
  } from "./chunk-CYTPQDQY.js";
@@ -13,10 +13,10 @@ import {
13
13
  resolvePackageVersionFromBinary,
14
14
  resolvePathBinary,
15
15
  resolvePathBinaryAsync
16
- } from "./chunk-FYLYAVQG.js";
16
+ } from "./chunk-CQLQFN6B.js";
17
17
  import {
18
18
  MANAGED_PROVIDERS
19
- } from "./chunk-DL67HX3D.js";
19
+ } from "./chunk-KQVURVAP.js";
20
20
 
21
21
  // src/live-capabilities.ts
22
22
  import { homedir } from "os";
@@ -6,21 +6,21 @@ import {
6
6
  McpToolError,
7
7
  SubscriptionRequiredError,
8
8
  callMcpTool
9
- } from "./chunk-DK6CMXYI.js";
9
+ } from "./chunk-UZZRSCFR.js";
10
10
  import {
11
11
  installNetworkDefaults,
12
12
  isNetworkFailure
13
- } from "./chunk-SNMTACCY.js";
13
+ } from "./chunk-KYWH4XUR.js";
14
14
  import {
15
15
  fetchAsCredential
16
- } from "./chunk-VVN3RPV6.js";
16
+ } from "./chunk-IAWFSD4Q.js";
17
17
  import {
18
18
  clientReportClaims
19
- } from "./chunk-TN5PGMH5.js";
19
+ } from "./chunk-CZH3JDVB.js";
20
20
  import {
21
21
  getApiKey,
22
22
  getBaseUrl
23
- } from "./chunk-IKBTG3OT.js";
23
+ } from "./chunk-IEHI64ZN.js";
24
24
  import {
25
25
  ASK_AGENT_NAME_MAX,
26
26
  CLIENT_REPORT_PATH,
@@ -29,7 +29,7 @@ import {
29
29
  TOOL_FAILURE_CODES,
30
30
  degradedLine,
31
31
  truncateLine
32
- } from "./chunk-DL67HX3D.js";
32
+ } from "./chunk-KQVURVAP.js";
33
33
 
34
34
  // src/api.ts
35
35
  import { randomUUID } from "crypto";
@@ -1,19 +1,19 @@
1
1
  import {
2
2
  announceSubscriptionRequired,
3
3
  isDeferAnswer
4
- } from "./chunk-NUG2A73X.js";
4
+ } from "./chunk-M4G4VWW6.js";
5
5
  import {
6
6
  askUser,
7
7
  isDecisionStopped,
8
8
  isQuestionLimitRefusal,
9
9
  waitForQuestion
10
- } from "./chunk-B3AZPYRU.js";
10
+ } from "./chunk-P3UCAWUP.js";
11
11
  import {
12
12
  SubscriptionRequiredError
13
- } from "./chunk-DK6CMXYI.js";
13
+ } from "./chunk-UZZRSCFR.js";
14
14
  import {
15
15
  getMachineId
16
- } from "./chunk-EHQCMJHI.js";
16
+ } from "./chunk-J6CNQ5UK.js";
17
17
  import {
18
18
  ASK_CONTEXT_MAX,
19
19
  agentQuestionContext,
@@ -23,7 +23,7 @@ import {
23
23
  plainAskOf,
24
24
  questionsShownAsASet,
25
25
  shouldDeferToNativeMode
26
- } from "./chunk-DL67HX3D.js";
26
+ } from "./chunk-KQVURVAP.js";
27
27
 
28
28
  // src/native-defer.ts
29
29
  var nativeDeferOptions = () => {
@@ -5,10 +5,10 @@ import {
5
5
  hermesAppWiringRecord,
6
6
  hermesConfigReceipt,
7
7
  hermesSetupReceipt
8
- } from "./chunk-TN5PGMH5.js";
8
+ } from "./chunk-CZH3JDVB.js";
9
9
  import {
10
10
  resolvePathBinary
11
- } from "./chunk-FYLYAVQG.js";
11
+ } from "./chunk-CQLQFN6B.js";
12
12
  import {
13
13
  readJsonSafe,
14
14
  writeJsonAtomic
@@ -19,7 +19,7 @@ import {
19
19
  } from "./chunk-WIIMW5YO.js";
20
20
  import {
21
21
  isRecord
22
- } from "./chunk-DL67HX3D.js";
22
+ } from "./chunk-KQVURVAP.js";
23
23
 
24
24
  // src/hermes/plugin-payload.ts
25
25
  import { createHash } from "crypto";
@@ -1,19 +1,19 @@
1
1
  import {
2
2
  notificationAnswerStep
3
- } from "./chunk-EJSU5YWO.js";
3
+ } from "./chunk-DTJZK3MN.js";
4
4
  import {
5
5
  canChangeApprovalSettings
6
- } from "./chunk-52B2TQJM.js";
6
+ } from "./chunk-4RKB6X4S.js";
7
7
  import {
8
8
  matchMacAccountStep,
9
9
  retryAgentCommand
10
- } from "./chunk-LIZEMDE4.js";
10
+ } from "./chunk-7Q6YKZY2.js";
11
11
  import {
12
12
  EXIT
13
13
  } from "./chunk-BG4HHB7E.js";
14
14
  import {
15
15
  NPX_LATEST_COMMAND
16
- } from "./chunk-MQMVJDII.js";
16
+ } from "./chunk-ZYLZCNOJ.js";
17
17
 
18
18
  // src/setup/closing.ts
19
19
  var ACTIVITY_URL = "pushary.com/dashboard/agent/activity";