pushary 1.9.139 → 1.9.141

package/dist/{chunk-KQVURVAP.js → chunk-A6KNDKO5.js}

@@ -118,9 +118,9 @@ var isAgentQuestionSet = (value) => {
     const labels = /* @__PURE__ */ new Set();
     for (const option of question.options) {
       if (!option || typeof option !== "object" || Array.isArray(option)) return false;
-      const record4 = option;
-      const label = record4.label;
-      if (typeof label !== "string" || label.length === 0 || labels.has(label) || record4.description !== void 0 && typeof record4.description !== "string") return false;
+      const record5 = option;
+      const label = record5.label;
+      if (typeof label !== "string" || label.length === 0 || labels.has(label) || record5.description !== void 0 && typeof record5.description !== "string") return false;
       labels.add(label);
     }
     questions.add(question.question);
@@ -191,6 +191,42 @@ var codexQuestionAnswerReason = (answers) => {
   return `${CODEX_QUESTION_ANSWERED_IN_PUSHARY}. ${answered}. ${CODEX_QUESTION_CONTINUE}`;
 };
 
+// ../contracts/src/session-runtime.ts
+var SPAWN_CAPABILITY = "spawn";
+var CLAUDE_BRIDGE_CAPABILITY = "claude-bridge";
+var CLAUDE_RESUME_CAPABILITY = "claude-resume";
+var CODEX_BRIDGE_CAPABILITY = "codex-bridge";
+var CODEX_RESUME_CAPABILITY = "codex-resume";
+var GEMINI_BRIDGE_CAPABILITY = "gemini-bridge";
+var GEMINI_RESUME_CAPABILITY = "gemini-resume";
+var SESSION_RUNTIMES = {
+  claude: {
+    provider: "claude",
+    label: "Claude",
+    protocol: "claude-stream-json",
+    bridgeCapability: CLAUDE_BRIDGE_CAPABILITY,
+    resumeCapability: CLAUDE_RESUME_CAPABILITY,
+    phoneResume: false
+  },
+  codex: {
+    provider: "codex",
+    label: "Codex",
+    protocol: "codex-app-server",
+    bridgeCapability: CODEX_BRIDGE_CAPABILITY,
+    resumeCapability: CODEX_RESUME_CAPABILITY,
+    phoneResume: true
+  },
+  gemini: {
+    provider: "gemini",
+    label: "Gemini",
+    protocol: "gemini-stream-json",
+    bridgeCapability: GEMINI_BRIDGE_CAPABILITY,
+    resumeCapability: GEMINI_RESUME_CAPABILITY,
+    phoneResume: true
+  }
+};
+var sessionProvidersAdvertisedBy = (capabilities) => Object.values(SESSION_RUNTIMES).filter((runtime) => capabilities.includes(runtime.bridgeCapability)).map((runtime) => runtime.provider);
+
 // ../contracts/src/claude-connector.ts
 var CLAUDE_DIRECTORY_URL = "https://claude.ai/directory/pushary";
 var CLAUDE_CONNECTOR_URL = "https://pushary.com/api/mcp/mcp";
@@ -236,7 +272,7 @@ var defaults = {
   policyAgent: null,
   repoAware: false,
   disconnectable: false,
-  managedProvider: false,
+  sessionRuntime: null,
   bridged: false,
   enforcement: "cooperative",
   connectVia: "Plain MCP",
@@ -259,7 +295,7 @@ var AGENTS = {
     policyAgent: "claude_code",
     repoAware: true,
     disconnectable: true,
-    managedProvider: true,
+    sessionRuntime: SESSION_RUNTIMES.claude,
     enforcement: "enforced",
     connectVia: "Native hooks + MCP",
     setupCommand: PUSHARY_SETUP_COMMAND,
@@ -287,7 +323,7 @@ var AGENTS = {
     policyAgent: "codex",
     repoAware: true,
     disconnectable: true,
-    managedProvider: true,
+    sessionRuntime: SESSION_RUNTIMES.codex,
     enforcement: "enforced",
     connectVia: "Native hooks + MCP",
     setupCommand: PUSHARY_SETUP_COMMAND,
@@ -308,7 +344,7 @@ var AGENTS = {
     policyAgent: "gemini_cli",
     repoAware: true,
     disconnectable: true,
-    managedProvider: true,
+    sessionRuntime: SESSION_RUNTIMES.gemini,
     enforcement: "enforced",
     connectVia: "Native hooks + MCP",
     setupCommand: PUSHARY_SETUP_COMMAND,
@@ -524,7 +560,7 @@ var SESSION_HISTORY_AGENT_TYPES = Object.freeze(
 );
 var DISCONNECTABLE_AGENTS = Object.freeze(Object.values(AGENTS).flatMap((agent) => agent.disconnectable && agent.hookSource !== null ? [agent.hookSource] : []));
 var REPO_AWARE_AGENTS = Object.freeze(Object.values(AGENTS).flatMap((agent) => agent.repoAware ? [agent.policyAgent] : []));
-var MANAGED_PROVIDERS = Object.freeze(Object.values(AGENTS).flatMap((agent) => agent.managedProvider ? [agent.hookSource] : []));
+var MANAGED_PROVIDERS = Object.freeze(Object.values(AGENTS).flatMap((agent) => agent.sessionRuntime ? [agent.sessionRuntime.provider] : []));
 var BRIDGE_HOOK_SOURCES = Object.freeze(Object.values(AGENTS).flatMap((agent) => agent.bridged ? [agent.hookSource] : []));
 var isAgentId = (value) => Object.keys(AGENTS).includes(value);
 var isHooklessDisconnectableAgent = (value) => isAgentId(value) && AGENTS[value].disconnectable && AGENTS[value].hookSource === null;
@@ -616,18 +652,18 @@ var CANONICAL_COMMAND_KEYS = ["command"];
 var SHELL_TOOLS = /* @__PURE__ */ new Set([SHELL_TOOL, POWERSHELL_TOOL]);
 var PATH_TOOLS = /* @__PURE__ */ new Set(["Write", "Edit", "MultiEdit", "NotebookEdit", "Read"]);
 var PHONE_ANSWERED_TOOLS = /* @__PURE__ */ new Set(["AskUserQuestion", "ExitPlanMode"]);
-var firstString = (record4, keys2) => {
-  for (const key of keys2) {
-    const value = record4[key];
+var firstString = (record5, keys3) => {
+  for (const key of keys3) {
+    const value = record5[key];
     if (typeof value === "string" && value.length > 0) return value;
   }
   return void 0;
 };
-var pathsNamedIn = (record4, keys2) => keys2.flatMap((key) => {
-  const value = record4[key];
+var pathsNamedIn = (record5, keys3) => keys3.flatMap((key) => {
+  const value = record5[key];
   return typeof value === "string" && value.length > 0 ? [value] : [];
 });
-var namesOneFile = (paths, resolvePath) => new Set(paths.map(resolvePath)).size === 1;
+var namesOneFile = (paths2, resolvePath) => new Set(paths2.map(resolvePath)).size === 1;
 var filePathKeysOf = (profile) => [...profile.pathInputKeys, ...CANONICAL_PATH_KEYS];
 var namesAFilePath = (profile, toolInput) => pathsNamedIn(toolInput, filePathKeysOf(profile)).length > 0;
 var withCanonicalInputKeys = (profile, toolInput) => {
@@ -673,9 +709,9 @@ var toToolLookup = (profile, toolName, toolInput, resolvePath = (path) => path)
     return { tool, input: { command, ...context }, unreadable: false };
   }
   if (!PATH_TOOLS.has(tool)) return { tool, input: toolInput, unreadable: false };
-  const paths = pathsNamedIn(toolInput, filePathKeysOf(profile));
-  const [filePath] = paths;
-  if (!filePath || !namesOneFile(paths, resolvePath)) return { tool, input: toolInput, unreadable: true };
+  const paths2 = pathsNamedIn(toolInput, filePathKeysOf(profile));
+  const [filePath] = paths2;
+  if (!filePath || !namesOneFile(paths2, resolvePath)) return { tool, input: toolInput, unreadable: true };
   return { tool, input: { ...withCanonicalInputKeys(profile, toolInput), file_path: resolvePath(filePath) }, unreadable: false };
 };
 var NO_AGENT_PROMPT_REASON = "Pushary needs an answer from the phone before this can run, and this agent has no approval prompt of its own here, so nothing ran. Ask the user, then try again.";
@@ -1148,7 +1184,7 @@ var readNullableText = (value, field) => {
 var ASKED_TEXT_FIELDS = ["id", "siteId", "type", "content", "createdAt"];
 var ASKED_NULLABLE_FIELDS = ["questionType", "context", "contextPayloadSha256", "correlationId", "externalId", "sessionId", "agentType", "agentName", "machineId", "toolName", "toolTarget", "requestedByUserId"];
 var DECISION_NULLABLE_FIELDS = ["response", "responseSource", "note", "decisionOutcome", "decisionOrigin", "decidedByUserId", "decidedByActor", "riskClass", "answeredAt"];
-var isComplete = (record4, fields) => fields.every((field) => field in record4);
+var isComplete = (record5, fields) => fields.every((field) => field in record5);
 var readFields = (value, fields, read) => {
   const result = {};
   for (const field of fields) {
@@ -1160,7 +1196,7 @@ var readFields = (value, fields, read) => {
 };
 var ASKED_PAYLOAD_KEYS = /* @__PURE__ */ new Set(["event", ...ASKED_TEXT_FIELDS, ...ASKED_NULLABLE_FIELDS]);
 var DECISION_PAYLOAD_KEYS = /* @__PURE__ */ new Set(["event", "id", "autoResolved", "decisionLatencyMs", ...DECISION_NULLABLE_FIELDS]);
-var hasOnlyKeys = (value, keys2) => Object.keys(value).every((key) => keys2.has(key));
+var hasOnlyKeys = (value, keys3) => Object.keys(value).every((key) => keys3.has(key));
 var parseAskedPayload = (value) => {
   const text3 = readFields(value, ASKED_TEXT_FIELDS, readText);
   const nullable = readFields(value, ASKED_NULLABLE_FIELDS, readNullableText);
@@ -1205,7 +1241,7 @@ var parseAllOrNothing = (values, parse) => {
   }
   return parsed;
 };
-var entriesFitPage = (entries, beforeSeq) => beforeSeq === null || entries.every((entry) => entry.seq < beforeSeq);
+var entriesFitPage = (entries, beforeSeq) => beforeSeq === null || entries.every((entry2) => entry2.seq < beforeSeq);
 var parseSite = (value) => {
   if (!isPlainObject(value)) return null;
   const { siteId, siteName, beforeSeq, retentionFloor } = value;
@@ -1230,68 +1266,68 @@ var boundaryGapFindings = (entries, beforeSeq) => {
 };
 var linkFindings = (entries) => {
   const findings = [];
-  entries.forEach((entry, index) => {
+  entries.forEach((entry2, index) => {
     const previous = entries[index - 1];
     if (!previous) {
-      if (entry.seq === 1 && entry.prevHash !== AUDIT_CHAIN_GENESIS_HASH) findings.push({ kind: "genesis_mismatch", seq: entry.seq });
+      if (entry2.seq === 1 && entry2.prevHash !== AUDIT_CHAIN_GENESIS_HASH) findings.push({ kind: "genesis_mismatch", seq: entry2.seq });
       return;
     }
-    if (entry.seq !== previous.seq + 1) findings.push({ kind: "sequence_gap", afterSeq: previous.seq, seq: entry.seq });
-    if (entry.prevHash !== previous.entryHash) findings.push({ kind: "broken_link", seq: entry.seq });
+    if (entry2.seq !== previous.seq + 1) findings.push({ kind: "sequence_gap", afterSeq: previous.seq, seq: entry2.seq });
+    if (entry2.prevHash !== previous.entryHash) findings.push({ kind: "broken_link", seq: entry2.seq });
   });
   return findings;
 };
-var entryHashFindings = (entries, crypto) => entries.flatMap((entry) => crypto.sha256Hex(auditEntryMessage(entry)) === entry.entryHash ? [] : [{ kind: "entry_altered", seq: entry.seq }]);
-var payloadMatchesEntry = (payload, entry, siteId, crypto) => {
-  if (payload.id !== entry.interactionId || auditPayloadHash(payload, crypto.sha256Hex) !== entry.payloadHash) return false;
-  return payload.event === "asked" ? payload.siteId === siteId && payload.createdAt === entry.interactionCreatedAt : isFinalAuditDecision(payload) === entry.decisionFinal;
+var entryHashFindings = (entries, crypto) => entries.flatMap((entry2) => crypto.sha256Hex(auditEntryMessage(entry2)) === entry2.entryHash ? [] : [{ kind: "entry_altered", seq: entry2.seq }]);
+var payloadMatchesEntry = (payload, entry2, siteId, crypto) => {
+  if (payload.id !== entry2.interactionId || auditPayloadHash(payload, crypto.sha256Hex) !== entry2.payloadHash) return false;
+  return payload.event === "asked" ? payload.siteId === siteId && payload.createdAt === entry2.interactionCreatedAt : isFinalAuditDecision(payload) === entry2.decisionFinal;
 };
 var lastDecisionSeqByInteraction = (entries) => {
   const lastSeq = /* @__PURE__ */ new Map();
-  for (const entry of entries) {
-    if (entry.event === "decision") lastSeq.set(entry.interactionId, Math.max(entry.seq, lastSeq.get(entry.interactionId) ?? 0));
+  for (const entry2 of entries) {
+    if (entry2.event === "decision") lastSeq.set(entry2.interactionId, Math.max(entry2.seq, lastSeq.get(entry2.interactionId) ?? 0));
   }
   return lastSeq;
 };
-var goneBeforeRetentionEnded = (entry, retentionFloor) => retentionFloor === null || entry.interactionCreatedAt >= retentionFloor;
+var goneBeforeRetentionEnded = (entry2, retentionFloor) => retentionFloor === null || entry2.interactionCreatedAt >= retentionFloor;
 var payloadFindings = (site, entries, crypto) => {
   const lastDecisionSeq = lastDecisionSeqByInteraction(entries);
-  return entries.flatMap((entry) => {
-    const invalid = { kind: "invalid_status", seq: entry.seq, status: entry.payloadStatus };
-    const hasLaterDecision = entry.event === "decision" && (lastDecisionSeq.get(entry.interactionId) ?? 0) > entry.seq;
-    switch (entry.payloadStatus) {
+  return entries.flatMap((entry2) => {
+    const invalid = { kind: "invalid_status", seq: entry2.seq, status: entry2.payloadStatus };
+    const hasLaterDecision = entry2.event === "decision" && (lastDecisionSeq.get(entry2.interactionId) ?? 0) > entry2.seq;
+    switch (entry2.payloadStatus) {
       case "included":
         if (hasLaterDecision) return [invalid];
-        return entry.payload && payloadMatchesEntry(entry.payload, entry, site.siteId, crypto) ? [] : [{ kind: "entry_changed", seq: entry.seq }];
+        return entry2.payload && payloadMatchesEntry(entry2.payload, entry2, site.siteId, crypto) ? [] : [{ kind: "entry_changed", seq: entry2.seq }];
       case "changed_since_recorded":
-        if (entry.event === "asked" || hasLaterDecision) return [invalid];
-        return [{ kind: entry.decisionFinal ? "entry_changed" : "unrecorded_change", seq: entry.seq }];
+        if (entry2.event === "asked" || hasLaterDecision) return [invalid];
+        return [{ kind: entry2.decisionFinal ? "entry_changed" : "unrecorded_change", seq: entry2.seq }];
       case "superseded":
-        return entry.event === "asked" || entry.decisionFinal || !hasLaterDecision && site.beforeSeq === null ? [invalid] : [];
+        return entry2.event === "asked" || entry2.decisionFinal || !hasLaterDecision && site.beforeSeq === null ? [invalid] : [];
       case "aged_out":
-        return goneBeforeRetentionEnded(entry, site.retentionFloor) ? [{ kind: "row_missing", seq: entry.seq }] : [];
+        return goneBeforeRetentionEnded(entry2, site.retentionFloor) ? [{ kind: "row_missing", seq: entry2.seq }] : [];
     }
   });
 };
 var decisionSequenceFindings = (entries) => {
   const asked = /* @__PURE__ */ new Set();
   const decidedFinally = /* @__PURE__ */ new Set();
-  return entries.flatMap((entry) => {
-    if (entry.event === "asked") {
-      const repeated = asked.has(entry.interactionId);
-      asked.add(entry.interactionId);
-      return repeated ? [{ kind: "asked_twice", seq: entry.seq }] : [];
+  return entries.flatMap((entry2) => {
+    if (entry2.event === "asked") {
+      const repeated = asked.has(entry2.interactionId);
+      asked.add(entry2.interactionId);
+      return repeated ? [{ kind: "asked_twice", seq: entry2.seq }] : [];
     }
-    const afterFinal = decidedFinally.has(entry.interactionId);
-    if (entry.decisionFinal) decidedFinally.add(entry.interactionId);
-    return afterFinal ? [{ kind: "decision_rewritten", seq: entry.seq }] : [];
+    const afterFinal = decidedFinally.has(entry2.interactionId);
+    if (entry2.decisionFinal) decidedFinally.add(entry2.interactionId);
+    return afterFinal ? [{ kind: "decision_rewritten", seq: entry2.seq }] : [];
   });
 };
 var payloadCountsOf = (entries) => ({
-  included: entries.filter((entry) => entry.payloadStatus === "included").length,
-  aged_out: entries.filter((entry) => entry.payloadStatus === "aged_out").length,
-  superseded: entries.filter((entry) => entry.payloadStatus === "superseded").length,
-  changed_since_recorded: entries.filter((entry) => entry.payloadStatus === "changed_since_recorded").length
+  included: entries.filter((entry2) => entry2.payloadStatus === "included").length,
+  aged_out: entries.filter((entry2) => entry2.payloadStatus === "aged_out").length,
+  superseded: entries.filter((entry2) => entry2.payloadStatus === "superseded").length,
+  changed_since_recorded: entries.filter((entry2) => entry2.payloadStatus === "changed_since_recorded").length
 });
 var findingsForCheckpoint = (checkpoint, siteId, hashBySeq, crypto, pinnedKeyIds) => {
   const findings = [];
@@ -1338,7 +1374,7 @@ var knownHeadFindings = (site, hashBySeq, lastSeq, exportedAt, known) => {
 };
 var verifyAuditChainSite = (site, crypto, options) => {
   const entries = [...site.entries].sort((left, right) => left.seq - right.seq);
-  const hashBySeq = new Map(entries.map((entry) => [entry.seq, entry.entryHash]));
+  const hashBySeq = new Map(entries.map((entry2) => [entry2.seq, entry2.entryHash]));
   const firstSeq = entries[0]?.seq ?? null;
   const lastSeq = entries[entries.length - 1]?.seq ?? null;
   const checkpointResults = site.checkpoints.map((checkpoint) => ({
@@ -1889,9 +1925,9 @@ var scriptOfAnEvalEndingAt = (text3, end) => {
   return [(firstComment === -1 ? words : words.slice(0, firstComment)).map((word) => word.text).join(" ")];
 };
 var scriptsOfEvalsIn = (text3) => [...text3.matchAll(AN_EVAL_THAT_RUNS)].slice(0, MOST_SCRIPTS_READ_FROM_ONE_COMMAND + 1).flatMap((match) => scriptOfAnEvalEndingAt(text3, match.index + match[0].length));
-var scriptsDirectlyInside = (text3) => [...scriptsOfEvalsIn(text3), ...scriptsOfShellsIn(text3)];
+var scriptsWrittenForAShellOrAnEval = (text3) => [...scriptsOfEvalsIn(text3), ...scriptsOfShellsIn(text3)];
 var READING_OF_SCRIPTS_TOO_MANY_TO_READ = ": | sh";
-var readingsOfScriptsPassedToAShell = (text3) => {
+var readingsOfNestedShellScripts = (text3, scriptsDirectlyInside) => {
   const readings = [];
   let scriptsRead = 0;
   let level = [text3];
@@ -3860,16 +3896,345 @@ var scriptACodexShellCommandRuns = (command) => {
   return script.trim().length === 0 ? null : script;
 };
 
+// ../contracts/src/codex-permission-profile.ts
+var CODEX_PERMISSION_PROFILE_METHOD = "item/permissions/requestApproval";
+var CODEX_PERMISSION_PROFILE_CHOICES = { turn: "Allow this turn", session: "Allow this session", deny: "Deny" };
+var record2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var keys = (value, allowed) => Object.keys(value).every((key) => allowed.includes(key));
+var literalAbsolutePath = (value) => typeof value === "string" && value.length > 0 && value.length <= 4096 && /^(\/|[a-z]:[\\/])/i.test(value) && !/[\u0000-\u001f*?\[\]{}]/.test(value) && !value.split(/[\\/]/).some((part) => part === ".." || part === ".");
+var paths = (value) => value == null || Array.isArray(value) && value.length <= 32 && value.every(literalAbsolutePath);
+var entry = (value) => record2(value) && keys(value, ["path", "access"]) && (value.access === "read" || value.access === "write" || value.access === "deny") && record2(value.path) && keys(value.path, ["type", "path"]) && value.path.type === "path" && literalAbsolutePath(value.path.path);
+var isCodexPermissionProfile = (value) => {
+  if (!record2(value) || !keys(value, ["network", "fileSystem"])) return false;
+  const network = value.network;
+  if (network != null && (!record2(network) || !keys(network, ["enabled"]) || network.enabled != null && typeof network.enabled !== "boolean")) return false;
+  const files = value.fileSystem;
+  if (files == null) return true;
+  return record2(files) && keys(files, ["read", "write", "entries", "globScanMaxDepth"]) && paths(files.read) && paths(files.write) && (files.globScanMaxDepth == null || typeof files.globScanMaxDepth === "number" && Number.isSafeInteger(files.globScanMaxDepth) && files.globScanMaxDepth > 0) && (files.entries == null || Array.isArray(files.entries) && files.entries.length <= 32 && files.entries.every(entry));
+};
+var codexPermissionPaths = (profile, access) => [
+  ...profile.fileSystem?.[access] ?? [],
+  ...(profile.fileSystem?.entries ?? []).filter((entry2) => entry2.access === access).map((entry2) => entry2.path.path)
+];
+var CODEX_PERMISSION_QUESTION_MAX_UNITS = 180;
+var CODEX_PERMISSION_QUESTION_WITHOUT_A_GRANT = "Allow a Codex permission request that names no network access and no file paths?";
+var BROAD_ROOT_LABELS = {
+  computer: "the whole computer",
+  drive: "the whole drive",
+  volume: "a whole volume",
+  share: "a network share",
+  everyHome: "every home folder",
+  home: "a home folder",
+  topLevel: "a top-level folder"
+};
+var BROAD_ROOTS_IN_NAMING_ORDER = ["computer", "drive", "volume", "share", "everyHome", "home", "topLevel"];
+var RANK_IN_A_SENSITIVE_PLACE = BROAD_ROOTS_IN_NAMING_ORDER.length;
+var RANK_OUTSIDE_THE_WORKING_DIRECTORY = RANK_IN_A_SENSITIVE_PLACE + 1;
+var RANK_INSIDE_THE_WORKING_DIRECTORY = RANK_OUTSIDE_THE_WORKING_DIRECTORY + 1;
+var DRIVE_PREFIX = /^[a-z]:/i;
+var PATH_SEPARATOR = /[\\/]/;
+var TWO_SEPARATORS_THEN_A_NAME = /^[\\/]{2}[^\\/]/;
+var DOTS_AND_SPACES_WINDOWS_DROPS = /[. ]+$/;
+var PROCESS_WHOSE_ROOT_IS_LINKED = /^(?:self|thread-self|\d+)$/;
+var MACOS_DATA_VOLUME_FOLDERS = ["system", "volumes", "data"];
+var PROCESS_FOLDER = "proc";
+var PROCESS_ROOT_LINK = "root";
+var PROCESS_ROOT_FOLDERS = 3;
+var MOUNT_PARENT_FOLDERS = ["volumes", "mnt"];
+var MOUNT_FOLDERS = 2;
+var MACOS_PRIVATE_FOLDER = "private";
+var MACOS_PRIVATE_FOLDERS = 1;
+var FOLDERS_MACOS_KEEPS_UNDER_PRIVATE = ["etc", "var", "tmp"];
+var HOME_PARENT_FOLDERS = ["users", "home"];
+var FOLDERS_EVERY_HOME_SHARES = ["shared", "public"];
+var SUPERUSER_HOME_FOLDER = "root";
+var MACOS_SUPERUSER_HOME_PARENT = "var";
+var HIDDEN_ENTRY_PREFIX = ".";
+var HOME_APP_DATA_FOLDERS = ["library", "appdata"];
+var HOME_APP_DATA_FOLDERS_HOLDING_NOTHING_KEPT = ["caches", "logs"];
+var SYSTEM_FOLDERS_OF_A_COMPUTER = ["etc", "library", "system", "usr", "bin", "sbin", "dev", "boot", "lib", "lib64", "var", "applications", "opt", "proc", "sys"];
+var ENTRIES_OF_A_SYSTEM_FOLDER_HOLDING_NOTHING_KEPT = {
+  dev: ["null", "zero", "tty", "stdin", "stdout", "stderr", "fd", "random", "urandom"],
+  var: ["folders", "tmp", "log"]
+};
+var SYSTEM_FOLDERS_OF_A_DRIVE = ["windows", "program files", "program files (x86)", "programdata"];
+var SENSITIVE_PLACE_LABELS = {
+  hiddenInAHome: "hidden in a home folder",
+  appDataOfAHome: "app data in a home folder",
+  system: "a system folder"
+};
+var SEPARATOR_RUN = /[\\/]{2,}/g;
+var NETWORK_GRANT = "use the network";
+var WRITABLE_LEAD = "read and write ";
+var READ_ONLY_LEAD = "read ";
+var LIST_SEPARATOR = ", ";
+var QUOTE_UNITS = 2;
+var DETAILS_NOTE = " The details list every path.";
+var PERMISSIONS_HEADING = "Requested permissions:";
+var ELISION_MARK = "\u2026";
+var PATH_NO_REDACTION_SETTLES = "[redacted]";
+var SETTLING_PASSES = 4;
+var NAMED_PATH_FLOOR_UNITS = 32;
+var ONLY_NAMED_PATH_FLOOR_UNITS = 12;
+var NEVER_DRAWN_OR_BLANK = /^(?:[\p{C}\p{Zl}\p{Zp}\p{Default_Ignorable_Code_Point}\u2800]|(?! )\p{Zs})$/u;
+var COMBINING_MARK = /^\p{M}$/u;
+var LETTER_OR_DIGIT = /^[\p{L}\p{N}]$/u;
+var DISPLAY_UNIT = /\\ud[89ab][0-9a-f]{2}\\ud[c-f][0-9a-f]{2}|\\u[0-9a-f]{4}|\\["\\]|\[redacted(?: key)?\]|[\s\S]/gu;
+var PATH_IN_A_QUESTION = { backslashed: '"\\', reserved: ELISION_MARK };
+var PROSE_IN_QUOTES = { backslashed: '"\\', reserved: "" };
+var TEXT_ALREADY_ESCAPED = { backslashed: "", reserved: "" };
+var unitEscapes = (text3) => Array.from({ length: text3.length }, (_, index) => `\\u${text3.charCodeAt(index).toString(16).padStart(4, "0")}`).join("");
+var withCodePointVisible = (rules) => (shown, codePoint) => {
+  if (rules.backslashed.includes(codePoint)) return { text: `${shown.text}\\${codePoint}`, marksHaveABase: false };
+  if (rules.reserved.includes(codePoint) || NEVER_DRAWN_OR_BLANK.test(codePoint)) return { text: `${shown.text}${unitEscapes(codePoint)}`, marksHaveABase: false };
+  if (COMBINING_MARK.test(codePoint)) return { text: `${shown.text}${shown.marksHaveABase ? codePoint : unitEscapes(codePoint)}`, marksHaveABase: shown.marksHaveABase };
+  return { text: `${shown.text}${codePoint}`, marksHaveABase: LETTER_OR_DIGIT.test(codePoint) };
+};
+var visibleText = (text3, rules) => Array.from(text3).reduce(withCodePointVisible(rules), { text: "", marksHaveABase: false }).text;
+var inQuotes = (inside) => `"${inside}"`;
+var leadingUnitsWithin = (displayUnits, maxUnits) => {
+  const kept = [];
+  let units = 0;
+  for (const displayUnit of displayUnits) {
+    if (units + displayUnit.length > maxUnits) break;
+    kept.push(displayUnit);
+    units += displayUnit.length;
+  }
+  return kept;
+};
+var shortenedInTheMiddle = (text3, maxUnits) => {
+  if (text3.length <= maxUnits) return text3;
+  const displayUnits = text3.match(DISPLAY_UNIT) ?? [];
+  const keptUnits = maxUnits - ELISION_MARK.length;
+  const headUnits = Math.ceil(keptUnits / 2);
+  const head = leadingUnitsWithin(displayUnits, headUnits);
+  const tail = [...leadingUnitsWithin([...displayUnits].reverse(), keptUnits - headUnits)].reverse();
+  return `${head.join("")}${ELISION_MARK}${tail.join("")}`;
+};
+var isStillInQuotes = (text3) => text3.length >= QUOTE_UNITS && text3.startsWith('"') && text3.endsWith('"');
+var settledWithin = (inside, maxUnits, passesLeft = SETTLING_PASSES) => {
+  const shortened = shortenedInTheMiddle(inside, maxUnits);
+  const redacted = redactSecrets(inQuotes(shortened));
+  if (redacted === inQuotes(shortened)) return shortened;
+  if (passesLeft === 0 || !isStillInQuotes(redacted)) return PATH_NO_REDACTION_SETTLES;
+  return settledWithin(visibleText(redacted.slice(1, -1), TEXT_ALREADY_ESCAPED), maxUnits, passesLeft - 1);
+};
+var isNamedSegment = (segment) => segment.length > 0;
+var withoutWhatWindowsDrops = (segment) => segment.replace(DOTS_AND_SPACES_WINDOWS_DROPS, "");
+var pathShape = (path) => {
+  const drive = DRIVE_PREFIX.exec(path)?.[0].toLowerCase() ?? null;
+  const segments = path.slice(drive?.length ?? 0).split(PATH_SEPARATOR);
+  return {
+    drive,
+    doubleSlashed: drive === null && TWO_SEPARATORS_THEN_A_NAME.test(path),
+    segments: (drive === null ? segments : segments.map(withoutWhatWindowsDrops)).filter(isNamedSegment)
+  };
+};
+var spellingOf = ({ drive, doubleSlashed, segments }) => `${drive ?? ""}${doubleSlashed ? "//" : "/"}${segments.join("/")}`;
+var startsWithTheDataVolume = (folders) => MACOS_DATA_VOLUME_FOLDERS.every((folder, index) => folders[index] === folder);
+var startsWithAProcessRoot = ([first, second, third]) => first === PROCESS_FOLDER && second !== void 0 && PROCESS_WHOSE_ROOT_IS_LINKED.test(second) && third === PROCESS_ROOT_LINK;
+var startsWithAMount = ([first, second]) => first !== void 0 && second !== void 0 && MOUNT_PARENT_FOLDERS.includes(first);
+var startsWithAFolderMacosKeepsUnderPrivate = ([first, second]) => first === MACOS_PRIVATE_FOLDER && second !== void 0 && FOLDERS_MACOS_KEEPS_UNDER_PRIVATE.includes(second);
+var beyondRootAliases = ({ root, folders }) => {
+  if (startsWithTheDataVolume(folders)) return beyondRootAliases({ root: "volume", folders: folders.slice(MACOS_DATA_VOLUME_FOLDERS.length) });
+  if (startsWithAProcessRoot(folders)) return beyondRootAliases({ root: "computer", folders: folders.slice(PROCESS_ROOT_FOLDERS) });
+  if (startsWithAMount(folders)) return beyondRootAliases({ root: "volume", folders: folders.slice(MOUNT_FOLDERS) });
+  if (startsWithAFolderMacosKeepsUnderPrivate(folders)) return beyondRootAliases({ root, folders: folders.slice(MACOS_PRIVATE_FOLDERS) });
+  return { root, folders };
+};
+var placeOf = ({ drive, segments }) => {
+  const folders = segments.map((segment) => segment.toLowerCase());
+  return drive === null ? beyondRootAliases({ root: "computer", folders }) : { root: "drive", folders };
+};
+var namesAHome = (parent, folder) => HOME_PARENT_FOLDERS.includes(parent) && !FOLDERS_EVERY_HOME_SHARES.includes(folder) || parent === MACOS_SUPERUSER_HOME_PARENT && folder === SUPERUSER_HOME_FOLDER;
+var homeRelativePlace = ({ root, folders }) => {
+  const [first, second] = folders;
+  if (first === SUPERUSER_HOME_FOLDER) return { home: `${root}/${first}`, inside: folders.slice(1) };
+  if (first === void 0 || second === void 0 || !namesAHome(first, second)) return null;
+  return { home: `${root}/${first}/${second}`, inside: folders.slice(2) };
+};
+var sensitivePlaceInAHome = ({ home, inside }) => {
+  const [entry2, kept] = inside;
+  if (entry2 === void 0) return null;
+  if (entry2.startsWith(HIDDEN_ENTRY_PREFIX)) return { kind: "hiddenInAHome", folder: `${home}/${entry2}`, isTheFolderItself: kept === void 0 };
+  if (!HOME_APP_DATA_FOLDERS.includes(entry2) || kept !== void 0 && HOME_APP_DATA_FOLDERS_HOLDING_NOTHING_KEPT.includes(kept)) return null;
+  return { kind: "appDataOfAHome", folder: `${home}/${entry2}`, isTheFolderItself: kept === void 0 };
+};
+var holdsNothingKept = (systemFolder, entry2) => entry2 !== void 0 && (ENTRIES_OF_A_SYSTEM_FOLDER_HOLDING_NOTHING_KEPT[systemFolder] ?? []).includes(entry2);
+var systemFoldersOf = (root) => root === "drive" ? SYSTEM_FOLDERS_OF_A_DRIVE : SYSTEM_FOLDERS_OF_A_COMPUTER;
+var sensitivePlaceOf = (place) => {
+  const home = homeRelativePlace(place);
+  if (home !== null) return sensitivePlaceInAHome(home);
+  const [first, entry2] = place.folders;
+  if (first === void 0 || !systemFoldersOf(place.root).includes(first) || holdsNothingKept(first, entry2)) return null;
+  return { kind: "system", folder: `${place.root}/${first}`, isTheFolderItself: entry2 === void 0 };
+};
+var broadRootOf = (shape, place, sensitivePlace) => {
+  const [first, second] = place.folders;
+  if (first === void 0) return place.root;
+  if (homeRelativePlace(place)?.inside.length === 0) return "home";
+  if (second === void 0) return HOME_PARENT_FOLDERS.includes(first) ? "everyHome" : "topLevel";
+  return shape.doubleSlashed && shape.segments.length === 2 && sensitivePlace === null ? "share" : null;
+};
+var isInside = (path, folder) => folder.segments.length > 0 && path.drive === folder.drive && path.doubleSlashed === folder.doubleSlashed && folder.segments.every((segment, index) => path.segments[index] === segment);
+var FITTING_PLANS = [
+  { pointsToTheDetails: false, onlyWhenNothingIsLeftOut: true },
+  { pointsToTheDetails: true, onlyWhenNothingIsLeftOut: false },
+  { pointsToTheDetails: false, onlyWhenNothingIsLeftOut: false }
+];
+var workingDirectory = (cwd) => {
+  const shape = pathShape(cwd);
+  const placed = sensitivePlaceOf(placeOf(shape));
+  return { shape, sensitiveFolder: placed === null || placed.isTheFolderItself ? null : placed.folder };
+};
+var namingRank = (broadRoot, sensitivePlace, insideTheWorkingDirectory) => {
+  if (broadRoot !== null) return BROAD_ROOTS_IN_NAMING_ORDER.indexOf(broadRoot);
+  if (sensitivePlace !== null) return RANK_IN_A_SENSITIVE_PLACE;
+  return insideTheWorkingDirectory ? RANK_INSIDE_THE_WORKING_DIRECTORY : RANK_OUTSIDE_THE_WORKING_DIRECTORY;
+};
+var firstSeparatorOfARun = (run) => run.slice(0, 1);
+var withSeparatorRunsCollapsed = (path, { doubleSlashed }) => {
+  const collapsed = path.replace(SEPARATOR_RUN, firstSeparatorOfARun);
+  return doubleSlashed ? `${collapsed.slice(0, 1)}${collapsed}` : collapsed;
+};
+var isAWholeSystemFolder = (broadRoot, sensitivePlace) => broadRoot === "topLevel" && sensitivePlace?.kind === "system";
+var placeLabel = (broadRoot, sensitivePlace) => {
+  if (broadRoot !== null && !isAWholeSystemFolder(broadRoot, sensitivePlace)) return ` (${BROAD_ROOT_LABELS[broadRoot]})`;
+  return sensitivePlace === null ? "" : ` (${SENSITIVE_PLACE_LABELS[sensitivePlace.kind]})`;
+};
+var grantedPath = (path, cwd) => {
+  const shape = pathShape(path);
+  const place = placeOf(shape);
+  const placed = sensitivePlaceOf(place);
+  const insideTheWorkingDirectory = isInside(shape, cwd.shape);
+  const sensitivePlace = placed !== null && insideTheWorkingDirectory && placed.folder === cwd.sensitiveFolder ? null : placed;
+  const broadRoot = broadRootOf(shape, place, sensitivePlace);
+  return {
+    shown: settledWithin(visibleText(redactSecrets(withSeparatorRunsCollapsed(path, shape)), PATH_IN_A_QUESTION), Number.POSITIVE_INFINITY),
+    label: placeLabel(broadRoot, sensitivePlace),
+    sensitive: broadRoot !== null || sensitivePlace !== null,
+    rank: namingRank(broadRoot, sensitivePlace, insideTheWorkingDirectory)
+  };
+};
+var firstSpellings = (paths2) => {
+  const spelled = /* @__PURE__ */ new Map();
+  for (const path of paths2) {
+    const spelling = spellingOf(pathShape(path));
+    if (!spelled.has(spelling)) spelled.set(spelling, path);
+  }
+  return spelled;
+};
+var mostImportantFirst = (first, second) => first.rank - second.rank;
+var hasPaths = (list) => list.paths.length > 0;
+var permissionGrant = (profile, cwd) => {
+  const from = workingDirectory(cwd);
+  const writable = firstSpellings(codexPermissionPaths(profile, "write"));
+  const isNotAlsoWritable = ([spelling]) => !writable.has(spelling);
+  const readOnly = [...firstSpellings(codexPermissionPaths(profile, "read"))].filter(isNotAlsoWritable).map(([, path]) => path);
+  const listOf = (lead, listed) => ({ lead, paths: listed.map((path) => grantedPath(path, from)).sort(mostImportantFirst) });
+  return { network: profile.network?.enabled === true, lists: [listOf(WRITABLE_LEAD, [...writable.values()]), listOf(READ_ONLY_LEAD, readOnly)].filter(hasPaths) };
+};
+var isSensitive = (path) => path.sensitive;
+var sensitiveNote = (counted) => {
+  const sensitive = counted.filter(isSensitive).length;
+  if (sensitive === 0) return "";
+  return sensitive === counted.length ? ", all sensitive" : `, ${sensitive} of them sensitive`;
+};
+var restOf = (unnamed) => unnamed.length === 0 ? "" : ` and ${unnamed.length} more${sensitiveNote(unnamed)}`;
+var countedOnly = ({ lead, paths: paths2 }) => ({
+  text: `${lead}${paths2.length} ${paths2.length === 1 ? "path" : "paths"}${sensitiveNote(paths2)}`,
+  named: 0,
+  complete: false
+});
+var leastNamedUnits = ({ lead, paths: paths2 }) => {
+  const [first, ...rest] = paths2;
+  if (first === void 0) return 0;
+  return lead.length + QUOTE_UNITS + Math.min(first.shown.length, ONLY_NAMED_PATH_FLOOR_UNITS) + first.label.length + restOf(rest).length;
+};
+var fairShareOf = (lengths, units) => {
+  const shortestFirst = [...lengths].sort((first, second) => first - second);
+  let unitsLeft = units;
+  for (const [position, length] of shortestFirst.entries()) {
+    const share = Math.floor(unitsLeft / (shortestFirst.length - position));
+    if (length > share) return share;
+    unitsLeft -= length;
+  }
+  return Number.POSITIVE_INFINITY;
+};
+var namingTheFirst = ({ lead, paths: paths2 }, count, units) => {
+  const named = paths2.slice(0, count);
+  const rest = restOf(paths2.slice(count));
+  const lengths = named.map((path) => path.shown.length);
+  const floor = count === 1 ? ONLY_NAMED_PATH_FLOOR_UNITS : NAMED_PATH_FLOOR_UNITS;
+  const pathUnits = units - lead.length - rest.length - LIST_SEPARATOR.length * (count - 1) - named.reduce((sum, path) => sum + QUOTE_UNITS + path.label.length, 0);
+  if (pathUnits < lengths.reduce((sum, length) => sum + Math.min(length, floor), 0)) return null;
+  const share = fairShareOf(lengths, pathUnits);
+  const fitted = named.map((path) => ({ path, shown: settledWithin(path.shown, share) }));
+  return {
+    text: `${lead}${fitted.map(({ path, shown }) => `${inQuotes(shown)}${path.label}`).join(LIST_SEPARATOR)}${rest}`,
+    named: count,
+    complete: count === paths2.length && fitted.every(({ path, shown }) => shown === path.shown)
+  };
+};
+var namedWithin = (list, units) => {
+  for (let count = list.paths.length; count > 0; count -= 1) {
+    const fitted = namingTheFirst(list, count, units);
+    if (fitted !== null) return fitted;
+  }
+  return null;
+};
+var namesAsMany = (shared, unshared) => shared !== null && shared.named === unshared.named;
+var fittedAlone = (list, units) => {
+  const named = namedWithin(list, units);
+  return named === null ? null : [named];
+};
+var fittedLists = ([first, second], units) => {
+  if (first === void 0) return [];
+  if (second === void 0) return fittedAlone(first, units);
+  const counted = countedOnly(second);
+  const unshared = namedWithin(first, units - counted.text.length);
+  if (unshared === null) return null;
+  const shared = namedWithin(first, units - leastNamedUnits(second));
+  const leading = namesAsMany(shared, unshared) ? shared : unshared;
+  return [leading, namedWithin(second, units - leading.text.length) ?? counted];
+};
+var asAQuestion = (network, lists, pointsToTheDetails) => {
+  const grants = [...network ? [NETWORK_GRANT] : [], ...lists];
+  const inAList = grants.length < 2 ? grants.join("") : `${grants.slice(0, -1).join(", ")}, and ${grants.slice(-1).join("")}`;
+  return `Allow Codex to ${inAList}?${pointsToTheDetails ? DETAILS_NOTE : ""}`;
+};
+var questionUnder = ({ network, lists }, plan) => {
+  const frameUnits = asAQuestion(network, lists.map(() => ""), plan.pointsToTheDetails).length;
+  const fitted = fittedLists(lists, CODEX_PERMISSION_QUESTION_MAX_UNITS - frameUnits);
+  if (fitted === null) return null;
+  const nothingIsLeftOut = fitted.every((list) => list.complete);
+  if (plan.onlyWhenNothingIsLeftOut && !nothingIsLeftOut) return null;
+  return asAQuestion(network, fitted.map((list) => list.text), plan.pointsToTheDetails && !nothingIsLeftOut);
+};
+var isAskable = (question) => question !== null && question.length <= CODEX_PERMISSION_QUESTION_MAX_UNITS && redactSecrets(question) === question;
+var codexPermissionProfileQuestion = (profile, cwd) => {
+  const grant = permissionGrant(profile, cwd);
+  if (!grant.network && grant.lists.length === 0) return CODEX_PERMISSION_QUESTION_WITHOUT_A_GRANT;
+  return FITTING_PLANS.map((plan) => questionUnder(grant, plan)).find(isAskable) ?? asAQuestion(grant.network, grant.lists.map((list) => countedOnly(list).text), true);
+};
+var codexPermissionProfileDetail = (profile) => `${PERMISSIONS_HEADING}
+${JSON.stringify(profile, null, 2).split("\n").map((line) => visibleText(line, TEXT_ALREADY_ESCAPED)).join("\n")}`;
+var codexProseOnOneQuotedLine = (prose) => inQuotes(visibleText(prose, PROSE_IN_QUOTES));
+var codexPermissionProfileResponse = (permissions, answer) => ({
+  permissions: answer === CODEX_PERMISSION_PROFILE_CHOICES.turn || answer === CODEX_PERMISSION_PROFILE_CHOICES.session ? permissions : {},
+  scope: answer === CODEX_PERMISSION_PROFILE_CHOICES.session ? "session" : "turn"
+});
+
 // ../contracts/src/codex-native-approval.ts
 var CODEX_NATIVE_APPROVAL_CAPABILITY = "codex-native-approval-v1";
-var CODEX_NATIVE_APPROVAL_METHODS = ["item/commandExecution/requestApproval", "item/fileChange/requestApproval", "mcpServer/elicitation/request"];
+var CODEX_NATIVE_APPROVAL_METHODS = ["item/commandExecution/requestApproval", "item/fileChange/requestApproval", "mcpServer/elicitation/request", CODEX_PERMISSION_PROFILE_METHOD];
 var CODEX_NATIVE_APPROVAL_CHOICES = { once: "Allow once", session: "Allow this conversation", deny: "Deny" };
 var CODEX_NATIVE_APPROVAL_REPLIES = { ask: "ask", deny: "deny", native: "native", allow: "allow" };
-var record2 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+var record3 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 var identifier2 = (v) => typeof v === "string" && v.length > 0 && v.length <= 200;
 var text = (v) => typeof v === "string" && v.trim().length > 0 && v.length <= 16384;
 var optionalIdentifier = (v) => v == null || identifier2(v);
-var keys = (v, allowed) => Object.keys(v).every((key) => allowed.includes(key));
+var keys2 = (v, allowed) => Object.keys(v).every((key) => allowed.includes(key));
 var isMethod = (v) => typeof v === "string" && CODEX_NATIVE_APPROVAL_METHODS.some((method) => method === v);
 var boundedJson = (value) => {
   try {
@@ -3882,12 +4247,12 @@ var BASE_KEYS = ["threadId", "turnId", "itemId", "startedAtMs", "reason"];
 var MCP_META_KEYS = ["codex_approval_kind", "codex_requires_user_input", "codex_request_type", "codex_strict_auto_review", "codex_sensitive_action", "approvals_reviewer", "persist", "source", "connector_id", "connector_name", "connector_description", "tool_name", "tool_title", "tool_description", "tool_params", "tool_params_display"];
 var MCP_FLAGS_THAT_ASK_FOR_A_PERSON = ["codex_requires_user_input", "codex_strict_auto_review", "codex_sensitive_action"];
 var COMPUTER_USE_META_KEYS = [...MCP_META_KEYS, "riskLevel", "subtitle", "tool_call_id"];
-var computerUseDisplay = (value) => Array.isArray(value) && value.length <= 16 && value.every((item) => record2(item) && keys(item, ["name", "display_name", "value"]) && text(item.name) && text(item.display_name) && text(item.value));
+var computerUseDisplay = (value) => Array.isArray(value) && value.length <= 16 && value.every((item) => record3(item) && keys2(item, ["name", "display_name", "value"]) && text(item.name) && text(item.display_name) && text(item.value));
 var isExecpolicyAmendment = (value) => Array.isArray(value) && value.length > 0 && value.length <= 128 && value.every((token) => typeof token === "string" && token.length <= 16384);
 var isCommandDecision = (value) => {
   if (typeof value === "string") return ["accept", "acceptForSession", "decline", "cancel"].includes(value);
-  if (!record2(value) || !keys(value, ["acceptWithExecpolicyAmendment"]) || !record2(value.acceptWithExecpolicyAmendment)) return false;
-  return keys(value.acceptWithExecpolicyAmendment, ["execpolicy_amendment"]) && isExecpolicyAmendment(value.acceptWithExecpolicyAmendment.execpolicy_amendment);
+  if (!record3(value) || !keys2(value, ["acceptWithExecpolicyAmendment"]) || !record3(value.acceptWithExecpolicyAmendment)) return false;
+  return keys2(value.acceptWithExecpolicyAmendment, ["execpolicy_amendment"]) && isExecpolicyAmendment(value.acceptWithExecpolicyAmendment.execpolicy_amendment);
 };
 var FILE_CHANGE_KINDS = ["add", "delete", "update"];
 var FILE_CHANGE_VERB = { add: "adding", delete: "deleting", update: "editing" };
@@ -3903,11 +4268,11 @@ var fileChangeQuestion = (changes) => {
   return `Allow these ${changes.length} file changes once? ${named}${unnamed > 0 ? ` and ${unnamed} more` : ""}`;
 };
 var codexElicitationToolName = (serverName, toolName) => `mcp__${serverName}__${toolName}`;
-var withCodexReason = (detail, reason) => text(reason) ? `${detail}
-
-Codex's reason: ${redactSecrets(reason)}` : detail;
+var CODEX_REASON_LEAD = "\n\nCodex's reason: ";
+var withCodexReason = (detail, reason) => text(reason) ? `${detail}${CODEX_REASON_LEAD}${redactSecrets(reason)}` : detail;
+var withCodexReasonOnOneQuotedLine = (detail, reason) => text(reason) ? `${detail}${CODEX_REASON_LEAD}${codexProseOnOneQuotedLine(redactSecrets(reason))}` : detail;
 var parseCodexNativeApproval = (value) => {
-  if (!record2(value) || !keys(value, ["method", "params", "changes"]) || !isMethod(value.method) || !record2(value.params) || !boundedJson(value)) return null;
+  if (!record3(value) || !keys2(value, ["method", "params", "changes"]) || !isMethod(value.method) || !record3(value.params) || !boundedJson(value)) return null;
   const p = value.params;
   if (!identifier2(p.threadId) || !optionalIdentifier(p.turnId) || !optionalIdentifier(p.itemId)) return null;
   const request = { method: value.method, params: p, ...Array.isArray(value.changes) ? { changes: value.changes } : {} };
@@ -3922,9 +4287,9 @@ var parseCodexNativeApproval = (value) => {
   };
   if (value.method === "mcpServer/elicitation/request") {
     const meta = p._meta;
-    const computerUse = record2(meta) && meta.connector_id === "computer-use";
-    if (value.changes !== void 0 || !keys(p, ["threadId", "turnId", "serverName", "mode", "message", "requestedSchema", "_meta"]) || !(p.mode === "form" || computerUse && (p.mode === "openai/form" || p.mode === "openaiForm")) || !identifier2(p.serverName) || !text(p.message) || p.message.length > 500 || !record2(p.requestedSchema) || !keys(p.requestedSchema, ["type", "properties", "required", "$schema"]) || p.requestedSchema.type !== "object" || !record2(p.requestedSchema.properties) || Object.keys(p.requestedSchema.properties).length !== 0 || p.requestedSchema.required != null && (!Array.isArray(p.requestedSchema.required) || p.requestedSchema.required.length !== 0)) return null;
-    if (!record2(meta) || !keys(meta, computerUse ? COMPUTER_USE_META_KEYS : MCP_META_KEYS) || meta.codex_approval_kind !== "mcp_tool_call" || !identifier2(meta.tool_name) || !record2(meta.tool_params) || meta.tool_params_display != null && !(computerUse ? computerUseDisplay(meta.tool_params_display) : record2(meta.tool_params_display))) return null;
+    const computerUse = record3(meta) && meta.connector_id === "computer-use";
+    if (value.changes !== void 0 || !keys2(p, ["threadId", "turnId", "serverName", "mode", "message", "requestedSchema", "_meta"]) || !(p.mode === "form" || computerUse && (p.mode === "openai/form" || p.mode === "openaiForm")) || !identifier2(p.serverName) || !text(p.message) || p.message.length > 500 || !record3(p.requestedSchema) || !keys2(p.requestedSchema, ["type", "properties", "required", "$schema"]) || p.requestedSchema.type !== "object" || !record3(p.requestedSchema.properties) || Object.keys(p.requestedSchema.properties).length !== 0 || p.requestedSchema.required != null && (!Array.isArray(p.requestedSchema.required) || p.requestedSchema.required.length !== 0)) return null;
+    if (!record3(meta) || !keys2(meta, computerUse ? COMPUTER_USE_META_KEYS : MCP_META_KEYS) || meta.codex_approval_kind !== "mcp_tool_call" || !identifier2(meta.tool_name) || !record3(meta.tool_params) || meta.tool_params_display != null && !(computerUse ? computerUseDisplay(meta.tool_params_display) : record3(meta.tool_params_display))) return null;
     if (computerUse && (meta.riskLevel !== "low" && meta.riskLevel !== "high" || meta.subtitle != null && !text(meta.subtitle) || !optionalIdentifier(meta.tool_call_id))) return null;
     if (MCP_FLAGS_THAT_ASK_FOR_A_PERSON.some((key) => meta[key] != null && typeof meta[key] !== "boolean")) return null;
     if (meta.approvals_reviewer != null && meta.approvals_reviewer !== "user") return null;
@@ -3956,8 +4321,23 @@ var parseCodexNativeApproval = (value) => {
     };
   }
   if (!identifier2(p.turnId) || !identifier2(p.itemId) || !Number.isSafeInteger(p.startedAtMs) || p.reason != null && !text(p.reason)) return null;
+  if (value.method === CODEX_PERMISSION_PROFILE_METHOD) {
+    if (value.changes !== void 0 || !keys2(p, [...BASE_KEYS, "cwd", "environmentId", "permissions"]) || !text(p.cwd) || p.environmentId != null && p.environmentId !== "local" || !isCodexPermissionProfile(p.permissions)) return null;
+    return {
+      ...base,
+      permissionProfile: p.permissions,
+      codexAsksForAPerson: true,
+      cwd: p.cwd,
+      toolName: "request_permissions",
+      toolInputs: [{ permissions: p.permissions }],
+      scopePaths: [...codexPermissionPaths(p.permissions, "read"), ...codexPermissionPaths(p.permissions, "write")],
+      question: codexPermissionProfileQuestion(p.permissions, p.cwd),
+      detail: withCodexReasonOnOneQuotedLine(codexPermissionProfileDetail(p.permissions), p.reason),
+      options: [CODEX_PERMISSION_PROFILE_CHOICES.turn, CODEX_PERMISSION_PROFILE_CHOICES.session, CODEX_PERMISSION_PROFILE_CHOICES.deny]
+    };
+  }
   if (value.method === "item/commandExecution/requestApproval") {
-    if (value.changes !== void 0 || !keys(p, [...BASE_KEYS, "approvalId", "kind", "environmentId", "command", "cwd", "commandActions", "networkApprovalContext", "proposedExecpolicyAmendment", "proposedNetworkPolicyAmendments", "availableDecisions"]) || !optionalIdentifier(p.approvalId) || p.kind != null && p.kind !== "command" || p.environmentId != null && p.environmentId !== "local" || p.networkApprovalContext != null || p.proposedNetworkPolicyAmendments != null || p.proposedExecpolicyAmendment != null && !isExecpolicyAmendment(p.proposedExecpolicyAmendment) || !text(p.command) || !text(p.cwd)) return null;
+    if (value.changes !== void 0 || !keys2(p, [...BASE_KEYS, "approvalId", "kind", "environmentId", "command", "cwd", "commandActions", "networkApprovalContext", "proposedExecpolicyAmendment", "proposedNetworkPolicyAmendments", "availableDecisions"]) || !optionalIdentifier(p.approvalId) || p.kind != null && p.kind !== "command" || p.environmentId != null && p.environmentId !== "local" || p.networkApprovalContext != null || p.proposedNetworkPolicyAmendments != null || p.proposedExecpolicyAmendment != null && !isExecpolicyAmendment(p.proposedExecpolicyAmendment) || !text(p.command) || !text(p.cwd)) return null;
     const decisions = p.availableDecisions ?? ["accept", "decline", "cancel"];
     if (!Array.isArray(decisions) || !decisions.includes("accept") || !decisions.some((v) => v === "decline" || v === "cancel") || !decisions.every(isCommandDecision)) return null;
     const command = scriptACodexShellCommandRuns(p.command) ?? p.command;
@@ -3973,24 +4353,25 @@ Directory: ${redactSecrets(p.cwd)}`, p.reason),
       negativeDecision: decisions.includes("decline") ? "decline" : "cancel"
     };
   }
-  if (!keys(p, [...BASE_KEYS, "grantRoot"]) || p.grantRoot != null || !Array.isArray(value.changes) || value.changes.length === 0 || value.changes.length > 32) return null;
+  if (!keys2(p, [...BASE_KEYS, "grantRoot"]) || p.grantRoot != null || !Array.isArray(value.changes) || value.changes.length === 0 || value.changes.length > 32) return null;
   const changes = [];
   for (const change of value.changes) {
-    if (!record2(change) || !keys(change, ["path", "kind", "diff"]) || !text(change.path) || typeof change.diff !== "string" || !record2(change.kind) || !keys(change.kind, ["type", "move_path"]) || !isFileChangeKind(change.kind.type) || change.kind.move_path != null) return null;
+    if (!record3(change) || !keys2(change, ["path", "kind", "diff"]) || !text(change.path) || typeof change.diff !== "string" || !record3(change.kind) || !keys2(change.kind, ["type", "move_path"]) || !isFileChangeKind(change.kind.type) || change.kind.move_path != null) return null;
     changes.push({ kind: change.kind.type, path: change.path, diff: change.diff });
   }
-  const paths = changes.map((change) => change.path);
+  const paths2 = changes.map((change) => change.path);
   return {
     ...base,
     toolName: "Edit",
-    toolInputs: paths.map((file_path) => ({ file_path })),
-    scopePaths: paths,
+    toolInputs: paths2.map((file_path) => ({ file_path })),
+    scopePaths: paths2,
     question: fileChangeQuestion(changes),
     detail: withCodexReason(changes.map((change) => `${redactSecrets(labelledFileChange(change))}
 ${redactSecretsDeep(change.diff)}`).join("\n\n"), p.reason)
   };
 };
 var codexNativeApprovalResponse = (approval, answer) => {
+  if (approval.permissionProfile) return codexPermissionProfileResponse(approval.permissionProfile, answer);
   const accepted = approval.options.includes(answer) && (answer === CODEX_NATIVE_APPROVAL_CHOICES.once || answer === CODEX_NATIVE_APPROVAL_CHOICES.session);
   if (approval.request.method === "mcpServer/elicitation/request") return {
     action: accepted ? "accept" : "decline",
@@ -4014,10 +4395,22 @@ var compressTranscriptRecord = (raw, deflateRaw) => {
   if (raw.length > TRANSCRIPT_RECORD_MAX_INFLATED_BYTES) return raw;
   const deflated = deflateRaw(raw);
   if (!compressionShrinks(raw, deflated)) return raw;
-  const record4 = new Uint8Array(deflated.length + 1);
-  record4[0] = COMPRESSED_TRANSCRIPT_RECORD_MARKER;
-  record4.set(deflated, 1);
-  return record4;
+  const record5 = new Uint8Array(deflated.length + 1);
+  record5[0] = COMPRESSED_TRANSCRIPT_RECORD_MARKER;
+  record5.set(deflated, 1);
+  return record5;
+};
+
+// ../contracts/src/spawn-delivery.ts
+var SPAWN_RECOVERY = {
+  receiptRetentionMs: 7 * 24 * 60 * 60 * 1e3,
+  retrySendWindowMs: 60 * 60 * 1e3
+};
+var SPAWN_LAUNCH_FAILED_CODE = "launch_failed";
+var SPAWN_UNCONFIRMED_ATTEMPT_FAILURE = {
+  code: SPAWN_LAUNCH_FAILED_CODE,
+  message: "The previous launch could not be confirmed. Check your sessions before starting another.",
+  retryable: true
 };
 
 // ../contracts/src/claude-inbox.ts
@@ -4034,11 +4427,11 @@ var CLAUDE_INBOX = {
   sender: "pushary",
   carrier: "native"
 };
-var record3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var record4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var text2 = (value) => typeof value === "string" && value.length > 0;
 var sessionIdPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var parseClaudeInboxSession = (value, platform = "darwin") => {
-  if (!record3(value) || !Number.isSafeInteger(value.pid) || typeof value.pid !== "number" || value.pid <= 0 || !text2(value.sessionId) || !sessionIdPattern.test(value.sessionId) || !text2(value.cwd) || !text2(value.procStart) || platform === "linux" && !text2(value.pidDomain) || !text2(value.messagingSocketPath) || value.peerProtocol !== CLAUDE_INBOX.protocol || !text2(value.version) || !supportsClaudeInbox(value.version, platform))
+  if (!record4(value) || !Number.isSafeInteger(value.pid) || typeof value.pid !== "number" || value.pid <= 0 || !text2(value.sessionId) || !sessionIdPattern.test(value.sessionId) || !text2(value.cwd) || !text2(value.procStart) || platform === "linux" && !text2(value.pidDomain) || !text2(value.messagingSocketPath) || value.peerProtocol !== CLAUDE_INBOX.protocol || !text2(value.version) || !supportsClaudeInbox(value.version, platform))
     return null;
   return {
     pid: value.pid,
@@ -4059,19 +4452,19 @@ var claudeInboxAction = (progress) => {
   }
   return progress.attempted ? "observe" /* observe */ : "submit" /* submit */;
 };
-var isClaudeInboxReceipt = (value, sessionId, commandId) => record3(value) && value.type === "user" && value.sessionId === sessionId && value.uuid === commandId && record3(value.origin) && value.origin.kind === "peer" && value.origin.msg_id === commandId;
+var isClaudeInboxReceipt = (value, sessionId, commandId) => record4(value) && value.type === "user" && value.sessionId === sessionId && value.uuid === commandId && record4(value.origin) && value.origin.kind === "peer" && value.origin.msg_id === commandId;
 var CLAUDE_INBOX_MAX_SESSIONS = 128;
 var parseClaudeInboxCommand = (value) => {
-  if (!record3(value) || !text2(value.id) || !sessionIdPattern.test(value.id) || !text2(value.text) || typeof value.expiresAtMs !== "number" || !Number.isSafeInteger(value.expiresAtMs))
+  if (!record4(value) || !text2(value.id) || !sessionIdPattern.test(value.id) || !text2(value.text) || typeof value.expiresAtMs !== "number" || !Number.isSafeInteger(value.expiresAtMs))
     return null;
   return { id: value.id, text: value.text, expiresAtMs: value.expiresAtMs };
 };
 var parseClaudeInboxPoll = (value) => {
-  if (!record3(value) || value.protocol !== CLAUDE_INBOX.protocol || !Array.isArray(value.sessionIds) || value.sessionIds.length > CLAUDE_INBOX_MAX_SESSIONS || !value.sessionIds.every((id) => nativeIdentifier(id)))
+  if (!record4(value) || value.protocol !== CLAUDE_INBOX.protocol || !Array.isArray(value.sessionIds) || value.sessionIds.length > CLAUDE_INBOX_MAX_SESSIONS || !value.sessionIds.every((id) => nativeIdentifier(id)))
     return null;
   return value.sessionIds;
 };
-var parseClaudeInboxClaim = (value) => record3(value) && value.protocol === CLAUDE_INBOX.protocol ? parseClaudeInboxCommand(value.command) : null;
+var parseClaudeInboxClaim = (value) => record4(value) && value.protocol === CLAUDE_INBOX.protocol ? parseClaudeInboxCommand(value.command) : null;
 var CLAUDE_INBOX_RECEIVER = {
   pollMs: 3e3,
   heartbeatMs: 6e4,
@@ -6903,9 +7296,38 @@ var substitutionFedTo = (pieces, index) => {
   const next = pieces[index + 1];
   return next !== void 0 && SUBSTITUTION_OPENERS.has(next.before) ? next.text : null;
 };
+var REDIRECTION_REMOVED = " ";
+var arrowReadingInForce = null;
+var anArrowWasReadAsText = false;
+var underEachArrowReading = (judge) => {
+  if (arrowReadingInForce !== null) return [judge()];
+  try {
+    anArrowWasReadAsText = false;
+    arrowReadingInForce = "arrows_the_shell_sees";
+    const withArrowsTheShellSees = judge();
+    if (!anArrowWasReadAsText) return [withArrowsTheShellSees];
+    arrowReadingInForce = "every_arrow";
+    return [withArrowsTheShellSees, judge()];
+  } finally {
+    arrowReadingInForce = null;
+  }
+};
+var isTrue = (answer) => answer;
+var underEitherArrowReading = (judge) => underEachArrowReading(judge).some(isTrue);
+var withoutOutputRedirectionTargets = (text3) => {
+  if (arrowReadingInForce === "every_arrow") return text3.replace(OUTPUT_REDIRECTION, REDIRECTION_REMOVED);
+  const visible = shellVisibleText(text3);
+  const removeVisibleRedirection = (match, _target, offset) => {
+    const operator = offset + match.search(REDIRECTION_OPERATOR_CHARACTER);
+    if (visible === null || REDIRECTION_OPERATOR_CHARACTER.test(visible.charAt(operator))) return REDIRECTION_REMOVED;
+    anArrowWasReadAsText = true;
+    return match;
+  };
+  return text3.replace(OUTPUT_REDIRECTION, removeVisibleRedirection);
+};
 var roughSegmentsOf = (command) => {
   const { text: text3, bodies } = withHeredocBodiesSetAside(commandForReading(command));
-  const pieces = roughPiecesOf(text3.replace(INPUT_REDIRECTION, ` ${REDIRECTED_INPUT_MARK} `).replace(OUTPUT_REDIRECTION, " "));
+  const pieces = roughPiecesOf(withoutOutputRedirectionTargets(text3.replace(INPUT_REDIRECTION, ` ${REDIRECTED_INPUT_MARK} `)));
   let heredocsSeen = 0;
   return pieces.map((piece, index) => {
     const heredocCount = occurrencesOf(piece.text, HEREDOC_MARK);
@@ -7477,6 +7899,20 @@ var runnerReadingOf = (innermost) => {
   const commands = [.../* @__PURE__ */ new Set([...fromScript, ...named.map(verbatimInvocationText), ...afterEndOfOptions.map(verbatimInvocationText)])];
   return commands.length === 0 ? NO_INLINE_SCRIPT : { kind: "readable", scripts: commands };
 };
+var scriptsOfExecutablePiece = (piece) => {
+  const invocation = innermostInvocation(invocationOfRoughPiece(piece.text));
+  const scripts = inlineScriptsOf(invocation, []);
+  const runner = runnerReadingOf(invocation);
+  return [
+    ...scripts.kind === "readable" ? scripts.scripts : [],
+    ...runner.kind === "readable" ? runner.scripts : []
+  ];
+};
+var scriptsExecutedBy = (command) => {
+  const readable = readingWithoutCommentsOrAnsiEscapes(command) ?? command;
+  return roughPiecesOf(withoutOutputRedirectionTargets(readable)).flatMap(scriptsOfExecutablePiece);
+};
+var readingsOfScriptsPassedToAShell = (command) => readingsOfNestedShellScripts(command, scriptsExecutedBy);
 var MAX_SPELLED_FORMS = 4096;
 var markTruncated = (accumulator) => {
   accumulator.hidesWhatItRuns = true;
@@ -8520,7 +8956,7 @@ var isScopeContract = (value) => {
   if (c.promises !== void 0 && !strings(c.promises)) return false;
   return strings(c.allowedPaths) && strings(c.offLimitsPaths) && typeof c.doneWhen === "string";
 };
-var findBestRoute = (routes, toolName, args, repoKey) => {
+var routeMatchingBestUnderOneArrowReading = (routes, toolName, args, repoKey) => {
   let best;
   let bestWeight = 0;
   let bestScoped = -1;
@@ -8541,7 +8977,13 @@ var findBestRoute = (routes, toolName, args, repoKey) => {
       bestLength = length;
     }
   }
-  return best ?? routes.find((r) => r.toolPattern === "*");
+  return best;
+};
+var isAMatchedRoute = (route) => route !== void 0;
+var routeWaitsForSomeoneElse = (route) => route.answeredBySomeoneElse === true;
+var findBestRoute = (routes, toolName, args, repoKey) => {
+  const matched = underEachArrowReading(() => routeMatchingBestUnderOneArrowReading(routes, toolName, args, repoKey)).filter(isAMatchedRoute);
+  return matched.find(routeWaitsForSomeoneElse) ?? matched[0] ?? routes.find((r) => r.toolPattern === "*");
 };
 var autoApprove = (tool) => ({
   tool,
@@ -8656,11 +9098,13 @@ var resolvePolicyReading = (reach, config, toolName, modeOverride, toolInput, cw
   }
   return base;
 };
-var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
+var policyUnderOneArrowReading = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
   const withoutRunners = resolvePolicyReading(SPELLS_WITHOUT_COMMAND_RUNNERS, config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId);
   const withRunners = resolvePolicyReading(SPELLS_COMMAND_RUNNERS_TOO, config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId);
   return strictestReadingOf(withRunners, withoutRunners);
 };
+var keepingTheStrictestReading = (strictest, reading) => strictestReadingOf(reading, strictest);
+var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => underEachArrowReading(() => policyUnderOneArrowReading(config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId)).reduce(keepingTheStrictestReading);
 var VERDICT_RESTRAINT = { allow: 0, requires_human: 1, deny: 2 };
 var verdictRestraint = (policy) => VERDICT_RESTRAINT[verdictForPolicy(policy)];
 var asksAtLeastAsHard = (policy, than) => restraintRank(policy) >= restraintRank(than) && TIMEOUT_ACTION_STRICTNESS[policy.timeoutAction] >= TIMEOUT_ACTION_STRICTNESS[than.timeoutAction] && policy.timeoutSeconds >= than.timeoutSeconds && policy.pushFirstSeconds <= than.pushFirstSeconds;
@@ -8713,10 +9157,10 @@ var namesOneToolAfterPrefix = (toolName, prefix) => {
   return tool.length > 0 && !tool.includes(SERVER_AND_TOOL_SEPARATOR);
 };
 var isPusharyConnectorTool = (toolName) => PUSHARY_CONNECTOR_TOOL_PREFIXES.some((prefix) => namesOneToolAfterPrefix(toolName, prefix));
-var strictestScopeVerdict = (scope, paths) => {
-  if (paths.length === 0) return evaluateScope(scope, void 0);
+var strictestScopeVerdict = (scope, paths2) => {
+  if (paths2.length === 0) return evaluateScope(scope, void 0);
   let worst = { outcome: "in_scope" };
-  for (const path of paths) {
+  for (const path of paths2) {
     const verdict = evaluateScope(scope, path);
     if (verdict.outcome === "off_limits") return verdict;
     if (verdict.outcome === "out_of_scope") worst = verdict;
@@ -8795,8 +9239,8 @@ var isBlockedActionRequest = (request) => isBlockedActionEvent(request) && block
 var canonicalJsonText = (value) => {
   if (Array.isArray(value)) return `[${value.map(canonicalJsonText).join(",")}]`;
   if (value !== null && typeof value === "object") {
-    const record4 = value;
-    return `{${Object.keys(record4).filter((key) => record4[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJsonText(record4[key])}`).join(",")}}`;
+    const record5 = value;
+    return `{${Object.keys(record5).filter((key) => record5[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJsonText(record5[key])}`).join(",")}}`;
   }
   return JSON.stringify(value) ?? "null";
 };
@@ -8885,15 +9329,18 @@ var policyForScopeQuestion = (policy) => policy.timeoutAction === "approve" ? {
   pushFirstSeconds: policy.pushFirstSeconds > 0 ? policy.pushFirstSeconds : SCOPE_QUESTION_FIRST_WAIT_SECONDS
 } : policy;
 var isAReading = (reading) => reading !== null && reading.trim() !== "";
+var readingsOfScriptsWrittenForAShell = (command) => readingsOfNestedShellScripts(command, scriptsWrittenForAShellOrAnEval);
 var extraReadingsOf = (toolInput) => {
   const { command } = toolInput;
   if (typeof command !== "string" || command.length > LONGEST_COMMAND_READ_FOR_A_PUSH) return [];
   const commentFree = readingWithoutCommentsOrAnsiEscapes(command);
   const spelledOut = [command, commentFree].filter(isAReading).map(readingWithShellFormsSpelledOut);
+  const scanned = [command, commentFree, ...spelledOut].filter(isAReading);
   const readings = [
     commentFree,
     ...spelledOut,
-    ...[command, commentFree, ...spelledOut].filter(isAReading).flatMap(readingsOfScriptsPassedToAShell)
+    ...scanned.flatMap(readingsOfScriptsPassedToAShell),
+    ...scanned.flatMap(readingsOfScriptsWrittenForAShell)
   ];
   return readings.filter(isAReading).map((reading) => ({ ...toolInput, command: reading }));
 };
@@ -8906,7 +9353,16 @@ var readingsNotYetJudged = (toolInputs) => {
   });
 };
 var withExtraReadings = (input) => shellDialectOf(input.toolName) !== void 0 ? { ...input, toolInputs: [...input.toolInputs, ...readingsNotYetJudged(input.toolInputs)] } : input;
-var resolveGate = (rawInput) => {
+var GATE_VERDICT_RESTRAINT = { allow: 0, defer: 1, gate: 2, deny: 3, kill: 4 };
+var strictestGateVerdictOf = (strictest, verdict) => {
+  const restraint = GATE_VERDICT_RESTRAINT[verdict.kind] - GATE_VERDICT_RESTRAINT[strictest.kind];
+  if (restraint !== 0) return restraint > 0 ? verdict : strictest;
+  return strictest.kind === "gate" && verdict.kind === "gate" ? { ...strictest, policy: strictestReadingOf(verdict.policy, strictest.policy) } : strictest;
+};
+var policyOfReadings = (readings) => readings.policy;
+var toolInputsOfReadings = (readings) => readings.toolInputs;
+var readingsAreAllowed = (readings) => verdictForPolicy(readings.policy) === "allow";
+var gateVerdictUnderOneArrowReading = (rawInput) => {
   const input = withExtraReadings(rawInput);
   const { modeState, config, toolName, toolInputs, cwd, sessionId } = input;
   const repoKey = input.sharedRepoKey ?? input.repoKey;
@@ -8922,16 +9378,23 @@ var resolveGate = (rawInput) => {
     const legacyPolicy = (toolInputs.length ? toolInputs : [void 0]).map((toolInput) => resolvePolicy(config, toolName, modeState.mode, toolInput, cwd, input.repoKey, sessionId)).find((policy2) => policy2.repoKey === input.repoKey && verdictForPolicy(policy2) === "deny");
     if (legacyPolicy) return { kind: "deny", policy: legacyPolicy, reason: `Denied by policy for ${legacyPolicy.tool}` };
   }
-  const policy = toolInputs.slice(rawInput.toolInputs.length).map((reading) => resolvePolicy(config, toolName, modeState.mode, reading, cwd, repoKey, sessionId)).reduce(
-    (strictest, reading) => strictestReadingOf(reading, strictest),
-    resolvePolicyAcross(config, toolName, modeState.mode, rawInput.toolInputs, cwd, repoKey, sessionId)
-  );
+  const written = {
+    toolInputs: rawInput.toolInputs,
+    policy: resolvePolicyAcross(config, toolName, modeState.mode, rawInput.toolInputs, cwd, repoKey, sessionId)
+  };
+  const extra = toolInputs.slice(rawInput.toolInputs.length).map((reading) => ({
+    toolInputs: [reading],
+    policy: resolvePolicy(config, toolName, modeState.mode, reading, cwd, repoKey, sessionId)
+  }));
+  const policy = extra.map(policyOfReadings).reduce(keepingTheStrictestReading, written.policy);
   const verdict = verdictForPolicy(policy);
   const autoDenies = verdict === "deny";
   const allowedByBypassMode = !autoDenies && verdict !== "allow" && bypassModeAllows(input);
-  const askBesideARoutedPush = verdict === "allow" ? askAtTheRouteOfAPush(input, repoKey, policy) : void 0;
+  const allowed = [written, ...extra].filter(readingsAreAllowed);
+  const allowedBy = allowed[0]?.policy;
+  const askBesideARoutedPush = autoDenies || allowedBy === void 0 ? void 0 : askAtTheRouteOfAPush({ ...input, toolInputs: allowed.flatMap(toolInputsOfReadings) }, repoKey, allowedBy);
   const autoApproves = (verdict === "allow" || allowedByBypassMode) && askBesideARoutedPush === void 0;
-  const askedPolicy = askBesideARoutedPush ?? policy;
+  const askedPolicy = askBesideARoutedPush === void 0 ? policy : strictestReadingOf(policy, askBesideARoutedPush);
   if (autoDenies) return { kind: "deny", policy, reason: `Denied by policy for ${policy.tool}` };
   if (isAskedInEveryMode(toolName)) return { kind: "gate", policy };
   if (isModeStateDegraded(modeState)) {
@@ -8961,6 +9424,7 @@ var resolveGate = (rawInput) => {
     scopePath: scopeReason && "path" in scopeVerdict ? widenablePath(scopeVerdict.path) : void 0
   };
 };
+var resolveGate = (rawInput) => underEachArrowReading(() => gateVerdictUnderOneArrowReading(rawInput)).reduce(strictestGateVerdictOf);
 var noModeOverrideIsActive = (input) => (input.modeState.mode ?? input.config.modeOverride ?? null) === null;
 var editAsksAtTheAgentsPrompt = (input, verdict) => verdict.kind === "gate" && !verdict.scopeReason && noModeOverrideIsActive(input) && !aChosenRuleGoverns(input) && verdict.policy.mode === "push_first" && FILE_EDIT_TOOLS.has(input.toolName);
 var claudePromptsBeforeAnEdit = (permissionMode) => permissionMode === "default";
@@ -8995,10 +9459,11 @@ var codexDeferredPreToolUse = () => ({ kind: "deny", reason: CODEX_PRE_TOOL_USE_
 var isScopeReason = (scopeReason) => typeof scopeReason === "string" && scopeReason.length > 0;
 var scopeBreachReasonOf = (verdict) => verdict.kind === "gate" && isScopeReason(verdict.scopeReason) ? verdict.scopeReason : void 0;
 var onlyCodexPreToolUseCanAsk = (verdict, permissionMode) => verdict.kind === "gate" && (scopeBreachReasonOf(verdict) !== void 0 || !codexRaisesItsOwnPrompts(permissionMode));
-var runsACommandThatNeedsAPerson = ({ toolName, toolInputs }) => SHELL_DIALECT_BY_TOOL.has(toolName) && toolInputs.some((toolInput) => {
+var runsACommandThatNeedsAPersonUnderOneArrowReading = ({ toolName, toolInputs }) => SHELL_DIALECT_BY_TOOL.has(toolName) && toolInputs.some((toolInput) => {
   const command = extractPolicyArg(toolName, toolInput);
   return command !== void 0 && (commandNeedsAPerson(toolName, command) || commandWritesThroughARemoteApi(command));
 });
+var runsACommandThatNeedsAPerson = (input) => underEitherArrowReading(() => runsACommandThatNeedsAPersonUnderOneArrowReading(input));
 var namesASecretOrWorkflowFile = (path) => {
   const written = withoutDotSegments(normalizeSeparators(path));
   return SECRET_FILE_NAME.test(basenameOf(written)) || CI_WORKFLOW_FILE.test(written);
@@ -9009,10 +9474,11 @@ var editsAFileThatNeedsAPerson = ({ toolName, toolInputs }) => toolInputs.some((
   const path = extractPolicyArg(toolName, toolInput);
   return path !== void 0 && fileEditNeedsAPerson(toolName, path);
 });
-var runsADestructiveCommand = ({ toolName, toolInputs }) => SHELL_DIALECT_BY_TOOL.has(toolName) && toolInputs.some((toolInput) => {
+var runsADestructiveCommandUnderOneArrowReading = ({ toolName, toolInputs }) => SHELL_DIALECT_BY_TOOL.has(toolName) && toolInputs.some((toolInput) => {
   const command = extractPolicyArg(toolName, toolInput);
   return command !== void 0 && commandIsDestructive(toolName, command);
 });
+var runsADestructiveCommand = (input) => underEitherArrowReading(() => runsADestructiveCommandUnderOneArrowReading(input));
 var codexCallIsDestructive = (input, call) => call.deletesFiles || runsADestructiveCommand(input);
 var connectorCallOnlyReads = ({ toolName, toolInputs }) => isCodexConnectorTool(toolName) && mcpToolOnlyReads(toolName) && !mcpToolAppNamesADatabase(toolName) && toolInputs.length > 0 && toolInputs.every((toolInput) => mcpToolInputOnlyReads(toolName, toolInput));
 var fullAccessRunsThisConnectorReadUnasked = (input, verdict, call) => !codexRaisesItsOwnPrompts(call.permissionMode) && scopeBreachReasonOf(verdict) === void 0 && noModeOverrideIsActive(input) && connectorCallOnlyReads(input);
@@ -9190,7 +9656,7 @@ var pushSpellingsBeyondTheWrittenOnesIn = (input, toolInput) => [...pushesOfTheC
 var writtenRouteArgumentsOf = (input, toolInput) => [...policyArgForms(input.toolName, toolInput, input.cwd), ...pushesOfTheCurrentBranchIn(input, toolInput)];
 var routeArgumentsOf = (input, toolInput) => [...writtenRouteArgumentsOf(input, toolInput), ...pushSpellingsBeyondTheWrittenOnesIn(input, toolInput)];
 var everyRule = () => true;
-var aChosenRuleGoverns = (input, counts = everyRule) => {
+var aChosenRuleGovernsUnderOneArrowReading = (input, counts) => {
   const chosen = input.config.policies.filter((policy) => !isDefaultRule(policy));
   const routes = approvalRoutesOf(input.config);
   if (routes === null) return true;
@@ -9201,8 +9667,8 @@ var aChosenRuleGoverns = (input, counts = everyRule) => {
     return governing !== void 0 && counts(governing.policy) || findBestRoute(routes, input.toolName, routeArgumentsOf(input, toolInput), input.repoKey) !== void 0;
   });
 };
+var aChosenRuleGoverns = (input, counts = everyRule) => underEitherArrowReading(() => aChosenRuleGovernsUnderOneArrowReading(input, counts));
 var AUTO_PERMISSION_MODE = "auto";
-var routeWaitsForSomeoneElse = (route) => route.answeredBySomeoneElse === true;
 var routeDeliveredFor = (input, routes, toolInput) => {
   const repoKey = input.sharedRepoKey ?? input.repoKey;
   const written = writtenRouteArgumentsOf(input, toolInput);
@@ -9214,12 +9680,13 @@ var routeDeliveredFor = (input, routes, toolInput) => {
   if (heldSpelledRoute !== void 0 && heldSpelledRoute.toolPattern.length > (writtenRoute?.toolPattern.length ?? -1)) return heldSpelledRoute;
   return writtenRoute ?? findBestRoute(routes, input.toolName, spelled, repoKey);
 };
-var callWaitsForSomeoneElse = (input) => {
+var callWaitsForSomeoneElseUnderOneArrowReading = (input) => {
   const routes = approvalRoutesOf(input.config);
   if (routes === null) return false;
   return withExtraReadings(input).toolInputs.some((toolInput) => routeDeliveredFor(input, routes, toolInput)?.answeredBySomeoneElse === true);
 };
-var namedRouteWaitsForSomeoneElse = (input) => {
+var callWaitsForSomeoneElse = (input) => underEitherArrowReading(() => callWaitsForSomeoneElseUnderOneArrowReading(input));
+var namedRouteWaitsForSomeoneElseUnderOneArrowReading = (input) => {
   const routes = approvalRoutesOf(input.config);
   if (routes === null) return false;
   return withExtraReadings(input).toolInputs.some((toolInput) => {
@@ -9227,11 +9694,15 @@ var namedRouteWaitsForSomeoneElse = (input) => {
     return route?.answeredBySomeoneElse === true && patternToolName(route.toolPattern) === input.toolName;
   });
 };
-var matchedRouteOf = (input) => {
+var namedRouteWaitsForSomeoneElse = (input) => underEitherArrowReading(() => namedRouteWaitsForSomeoneElseUnderOneArrowReading(input));
+var firstRouteHeldForSomeoneElseOrFirstOf = (matched) => matched.find(routeWaitsForSomeoneElse) ?? matched[0];
+var routesMatchedUnderOneArrowReading = (input) => {
   const routes = approvalRoutesOf(input.config);
-  if (routes === null) return void 0;
-  const matched = withExtraReadings(input).toolInputs.flatMap((toolInput) => routeDeliveredFor(input, routes, toolInput) ?? []);
-  const route = matched.find((candidate) => candidate.answeredBySomeoneElse === true) ?? matched[0];
+  if (routes === null) return [];
+  return withExtraReadings(input).toolInputs.flatMap((toolInput) => routeDeliveredFor(input, routes, toolInput) ?? []);
+};
+var matchedRouteOf = (input) => {
+  const route = firstRouteHeldForSomeoneElseOrFirstOf(underEachArrowReading(() => routesMatchedUnderOneArrowReading(input)).flat());
   if (route === void 0) return void 0;
   return route.repoKey ? { toolPattern: route.toolPattern, repoKey: route.repoKey } : { toolPattern: route.toolPattern };
 };
@@ -9448,11 +9919,11 @@ var elicitationEnum = (property) => {
   return members.length === property.enum.length && members.length >= ELICITATION_MIN_OPTIONS ? members : null;
 };
 var readElicitationFields = (schema) => {
-  const record4 = elicitationRecord(schema);
-  const properties = elicitationRecord(record4?.properties);
-  if (!properties || record4?.type !== "object") return null;
-  if (Object.keys(record4).some((key) => !["type", "properties", "required", "$schema"].includes(key))) return null;
-  if (record4.required !== void 0 && (!Array.isArray(record4.required) || !record4.required.every((name) => typeof name === "string" && Object.hasOwn(properties, name)))) return null;
+  const record5 = elicitationRecord(schema);
+  const properties = elicitationRecord(record5?.properties);
+  if (!properties || record5?.type !== "object") return null;
+  if (Object.keys(record5).some((key) => !["type", "properties", "required", "$schema"].includes(key))) return null;
+  if (record5.required !== void 0 && (!Array.isArray(record5.required) || !record5.required.every((name) => typeof name === "string" && Object.hasOwn(properties, name)))) return null;
   const entries = Object.entries(properties);
   if (entries.length === 0) return null;
   const fields = [];
@@ -9622,6 +10093,14 @@ export {
   isCodexQuestionTool,
   parseCodexQuestions,
   codexQuestionAnswerReason,
+  SPAWN_CAPABILITY,
+  CLAUDE_BRIDGE_CAPABILITY,
+  CLAUDE_RESUME_CAPABILITY,
+  CODEX_BRIDGE_CAPABILITY,
+  CODEX_RESUME_CAPABILITY,
+  GEMINI_BRIDGE_CAPABILITY,
+  GEMINI_RESUME_CAPABILITY,
+  sessionProvidersAdvertisedBy,
   CLAUDE_CONNECTOR_URL,
   CLAUDE_CONNECTOR_GUIDE,
   COWORK_CONNECTOR_LIMIT,
@@ -9718,6 +10197,8 @@ export {
   codexNativeApprovalResponse,
   transcriptRecordPlaintext,
   compressTranscriptRecord,
+  SPAWN_LAUNCH_FAILED_CODE,
+  SPAWN_UNCONFIRMED_ATTEMPT_FAILURE,
   CLAUDE_INBOX,
   parseClaudeInboxSession,
   claudeInboxAction,