pushary 1.9.143 → 1.9.145

package/dist/{chunk-KP6FVUCC.js → chunk-ZSOCJHL7.js}

@@ -5,10 +5,10 @@ import {
   hermesAppWiringRecord,
   hermesConfigReceipt,
   hermesSetupReceipt
-} from "./chunk-IG7NGXBS.js";
+} from "./chunk-72LP4RPC.js";
 import {
   resolvePathBinary
-} from "./chunk-QFZNPZRO.js";
+} from "./chunk-VTJ4WZOC.js";
 import {
   readJsonSafe,
   writeJsonAtomic
@@ -19,7 +19,7 @@ import {
 } from "./chunk-WIIMW5YO.js";
 import {
   isRecord
-} from "./chunk-C5LIS3XM.js";
+} from "./chunk-LQXUWXQP.js";
 
 // src/hermes/plugin-payload.ts
 import { createHash } from "crypto";
@@ -32,7 +32,7 @@ import os
 import threading
 from pathlib import Path
 
-from . import api, approval, history, host, identity, installation, schemas, tools
+from . import api, approval, approval_coverage, history, host, identity, installation, schemas, tools
 
 logger = logging.getLogger(__name__)
 
@@ -125,6 +125,7 @@ def register(ctx):
                 ctx.register_skill(child.name, skill_md)
 
     installation.record_plugin_load(transport)
+    _warn_when_hermes_skips_the_shell()
 
     logger.info(
         "[pushary] Plugin registered: %d tools, %d hooks, approval transport %s",
@@ -157,8 +158,14 @@ def _register_system_prompt_section(ctx):
 
 
 def _gated_tools():
-    raw = os.environ.get("PUSHARY_GATE_TOOLS", "")
-    return {name.strip().lower() for name in raw.split(",") if name.strip()}
+    raw = os.environ.get(approval_coverage.GATE_TOOLS_ENV, "")
+    return {name.strip().lower() for name in raw.split(approval_coverage.GATE_TOOLS_SEPARATOR) if name.strip()}
+
+
+def _warn_when_hermes_skips_the_shell():
+    warning = approval_coverage.shell_gate_warning(os.environ, host.terminal_config(), _gated_tools())
+    if warning:
+        logger.warning(warning)
 
 
 def _egress_redactor():
@@ -949,6 +956,7 @@ def get_end_user_decision(decision_id, wait_seconds=45):
     seg = urllib.parse.quote(str(decision_id), safe="")
     return _rest_call("GET", f"/decisions/{seg}", params={"wait": wait_seconds})
 ` },
+  { path: "approval_coverage.py", contents: 'import json\nimport re\nfrom typing import AbstractSet, Any, List, Mapping, Optional\n\nHERMES_SHELL_TOOL = "terminal"\nGATE_TOOLS_ENV = "PUSHARY_GATE_TOOLS"\nTERMINAL_BACKEND_ENV = "TERMINAL_ENV"\nDOCKER_MOUNT_CWD_ENV = "TERMINAL_DOCKER_MOUNT_CWD_TO_WORKSPACE"\nDOCKER_VOLUMES_ENV = "TERMINAL_DOCKER_VOLUMES"\n\nDEFAULT_BACKEND = "local"\nDOCKER_BACKEND = "docker"\nBACKENDS_THAT_SKIP_APPROVALS = frozenset({"modal", "daytona", "vercel_sandbox"})\n\nBACKEND_NAME = re.compile(r"^[a-z0-9_]+$")\nTRUE_WORDS = frozenset({"true", "1", "yes"})\nHOST_PATH_PREFIXES = ("/", "~", "./", "../")\nWINDOWS_DRIVE_SEPARATORS = ("/", "\\\\")\nGATE_TOOLS_SEPARATOR = ","\n\n\ndef _is_blank(value: Any) -> bool:\n    return value is None or (isinstance(value, str) and not value.strip())\n\n\ndef _backend_name(value: Any) -> Optional[str]:\n    if not isinstance(value, str):\n        return None\n    name = value.strip()\n    return name if BACKEND_NAME.match(name) else None\n\n\ndef terminal_backend(environ: Mapping[str, str], terminal_config: Mapping[str, Any]) -> Optional[str]:\n    for value in (environ.get(TERMINAL_BACKEND_ENV), terminal_config.get("backend")):\n        if not _is_blank(value):\n            return _backend_name(value)\n    return DEFAULT_BACKEND\n\n\ndef _is_true(value: Any) -> bool:\n    if isinstance(value, bool):\n        return value\n    if isinstance(value, int):\n        return value == 1\n    return isinstance(value, str) and value.strip().lower() in TRUE_WORDS\n\n\ndef volume_binds_host_path(spec: Any) -> bool:\n    if not isinstance(spec, str):\n        return False\n    volume = spec.strip()\n    if not volume:\n        return False\n    if volume.startswith(HOST_PATH_PREFIXES):\n        return True\n    return len(volume) >= 3 and volume[1] == ":" and volume[2] in WINDOWS_DRIVE_SEPARATORS\n\n\ndef _docker_volumes(environ: Mapping[str, str], terminal_config: Mapping[str, Any]) -> List[Any]:\n    raw = environ.get(DOCKER_VOLUMES_ENV)\n    volumes: Any = terminal_config.get("docker_volumes")\n    if raw is not None:\n        try:\n            volumes = json.loads(raw)\n        except ValueError:\n            return []\n    return volumes if isinstance(volumes, list) else []\n\n\ndef _docker_may_reach_host(environ: Mapping[str, str], terminal_config: Mapping[str, Any]) -> bool:\n    mount = environ.get(DOCKER_MOUNT_CWD_ENV, terminal_config.get("docker_mount_cwd_to_workspace"))\n    return _is_true(mount) or any(volume_binds_host_path(volume) for volume in _docker_volumes(environ, terminal_config))\n\n\ndef skips_dangerous_command_approvals(environ: Mapping[str, str], terminal_config: Mapping[str, Any]) -> bool:\n    backend = terminal_backend(environ, terminal_config)\n    if backend == DOCKER_BACKEND:\n        return not _docker_may_reach_host(environ, terminal_config)\n    return backend in BACKENDS_THAT_SKIP_APPROVALS\n\n\ndef _gate_tools_with_shell(environ: Mapping[str, str]) -> str:\n    listed = [entry.strip() for entry in environ.get(GATE_TOOLS_ENV, "").split(GATE_TOOLS_SEPARATOR) if entry.strip()]\n    return GATE_TOOLS_SEPARATOR.join([*listed, HERMES_SHELL_TOOL])\n\n\ndef shell_gate_warning(\n    environ: Mapping[str, str],\n    terminal_config: Mapping[str, Any],\n    gated_tools: AbstractSet[str],\n) -> Optional[str]:\n    if HERMES_SHELL_TOOL in gated_tools or not skips_dangerous_command_approvals(environ, terminal_config):\n        return None\n    backend = terminal_backend(environ, terminal_config)\n    return (\n        f"[pushary] Hermes skips its dangerous-command approvals on the {backend} terminal backend, "\n        f"because it treats the container as the boundary. Pushary only gates the tools listed in "\n        f"{GATE_TOOLS_ENV}, and {HERMES_SHELL_TOOL} is not one of them, so no shell command reaches "\n        f"your phone. To gate them, run: hermes config set {GATE_TOOLS_ENV} {_gate_tools_with_shell(environ)} "\n        f"and restart Hermes."\n    )\n' },
   { path: "approval_ledger.py", contents: 'from __future__ import annotations\n\nimport json\nimport os\nimport re\nimport secrets\nfrom dataclasses import dataclass\nfrom pathlib import Path\nfrom typing import TYPE_CHECKING, Callable, Dict, Iterable, List, Literal, Mapping, Optional, Set, Tuple, Union\n\nif TYPE_CHECKING:\n    from typing_extensions import TypeGuard\n\nApprovalChoice = Literal["once", "session", "always", "deny"]\nRecordState = Literal["waiting", "settled"]\nClaimState = Literal["claiming", "won", "lost"]\nHandedBack = Literal["handed_to_hermes"]\nEnded = Literal["ended"]\nSettledOutcome = Union[ApprovalChoice, HandedBack]\nRecentOutcome = Union[SettledOutcome, Ended]\nDecider = Literal["hermes_desktop", "pushary_transport"]\nRefusedClaim = Literal["not_found", "not_waiting", "not_answerable_here", "not_offered", "already_claimed"]\nClaimResult = Union[Literal["claimed"], RefusedClaim]\nProcessIsRunning = Callable[[int], bool]\n\nAPPROVAL_CHOICES: Tuple[ApprovalChoice, ...] = ("once", "session", "always", "deny")\nWAITING: RecordState = "waiting"\nSETTLED: RecordState = "settled"\nCLAIMING: ClaimState = "claiming"\nWON: ClaimState = "won"\nLOST: ClaimState = "lost"\nCLAIM_STATES: Tuple[ClaimState, ...] = (CLAIMING, WON, LOST)\nHANDED_TO_HERMES: HandedBack = "handed_to_hermes"\nENDED: Ended = "ended"\nSETTLED_OUTCOMES: Tuple[SettledOutcome, ...] = (*APPROVAL_CHOICES, HANDED_TO_HERMES)\nRECENT_OUTCOMES: Tuple[RecentOutcome, ...] = (*SETTLED_OUTCOMES, ENDED)\nDECIDED_BY_DESKTOP: Decider = "hermes_desktop"\nDECIDED_BY_TRANSPORT: Decider = "pushary_transport"\n\nCLAIMED: Literal["claimed"] = "claimed"\nNOT_FOUND: RefusedClaim = "not_found"\nNOT_WAITING: RefusedClaim = "not_waiting"\nNOT_ANSWERABLE_HERE: RefusedClaim = "not_answerable_here"\nNOT_OFFERED: RefusedClaim = "not_offered"\nALREADY_CLAIMED: RefusedClaim = "already_claimed"\nREFUSED_CLAIMS: Tuple[RefusedClaim, ...] = (NOT_FOUND, NOT_WAITING, NOT_ANSWERABLE_HERE, NOT_OFFERED, ALREADY_CLAIMED)\n\nDESKTOP_ANSWER_SOURCE = "hermes_desktop"\nUNNAMED_ANSWER_SOURCE = "pushary"\n\nLEDGER_PATH = ("plugin-data", "pushary", "approvals")\nRECORD_SUFFIX = ".json"\nHOST_OUTCOME_PREFIX = "host-"\nTEMPORARY_PREFIX = "."\n\nCORRELATION_ID_PATTERN = re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$")\nREQUEST_ID_PATTERN = re.compile(r"^[A-Za-z0-9_-]{1,64}$")\nTOKEN_PATTERN = re.compile(r"^[a-z][a-z0-9_]{0,63}$")\n\nRETENTION_SECONDS = 24 * 60 * 60\nRECENT_LIMIT = 6\nSUBJECT_MAX = 200\nLABEL_MAX = 80\n\n\n@dataclass(frozen=True)\nclass OfferedChoice:\n    choice: ApprovalChoice\n    label: str\n\n\n@dataclass(frozen=True)\nclass OpenedApproval:\n    correlation_id: str\n    request_id: Optional[str]\n    subject: str\n    choices: Tuple[OfferedChoice, ...]\n    pid: int\n    opened_at_ms: int\n    deadline_at_ms: int\n\n\n@dataclass(frozen=True)\nclass WaitingRecord:\n    opened: OpenedApproval\n\n\n@dataclass(frozen=True)\nclass SettledRecord:\n    opened: OpenedApproval\n    outcome: SettledOutcome\n    answer_source: Optional[str]\n    settled_at_ms: int\n\n\nApprovalRecord = Union[WaitingRecord, SettledRecord]\n\n\n@dataclass(frozen=True)\nclass HostOutcome:\n    request_id: str\n    choice: str\n    at_ms: int\n\n\n@dataclass(frozen=True)\nclass WaitingApproval:\n    correlation_id: str\n    subject: str\n    choices: Tuple[OfferedChoice, ...]\n    opened_at_ms: int\n    deadline_at_ms: int\n    answerable_here: bool\n    routed_to: Optional[str]\n    claim: Optional[ClaimState]\n\n\n@dataclass(frozen=True)\nclass RecentApproval:\n    correlation_id: str\n    subject: str\n    opened_at_ms: int\n    settled_at_ms: int\n    outcome: RecentOutcome\n    answer_source: Optional[str]\n    host_outcome: Optional[str]\n\n\n@dataclass(frozen=True)\nclass ApprovalsView:\n    waiting: Tuple[WaitingApproval, ...]\n    recent: Tuple[RecentApproval, ...]\n\n\ndef is_correlation_id(value: object) -> TypeGuard[str]:\n    return isinstance(value, str) and CORRELATION_ID_PATTERN.fullmatch(value) is not None\n\n\ndef is_request_id(value: object) -> TypeGuard[str]:\n    return isinstance(value, str) and REQUEST_ID_PATTERN.fullmatch(value) is not None\n\n\ndef is_token(value: object) -> TypeGuard[str]:\n    return isinstance(value, str) and TOKEN_PATTERN.fullmatch(value) is not None\n\n\ndef approval_choice(value: object) -> Optional[ApprovalChoice]:\n    for choice in APPROVAL_CHOICES:\n        if value == choice:\n            return choice\n    return None\n\n\ndef _record_state(value: object) -> Optional[RecordState]:\n    for state in (WAITING, SETTLED):\n        if value == state:\n            return state\n    return None\n\n\ndef _settled_outcome(value: object) -> Optional[SettledOutcome]:\n    for outcome in SETTLED_OUTCOMES:\n        if value == outcome:\n            return outcome\n    return None\n\n\ndef _instant(value: object) -> Optional[int]:\n    return value if isinstance(value, int) and not isinstance(value, bool) and value >= 0 else None\n\n\ndef _bounded_text(value: object, limit: int) -> Optional[str]:\n    return value if isinstance(value, str) and len(value) <= limit else None\n\n\ndef _fields(value: object) -> Optional[Mapping[object, object]]:\n    return value if isinstance(value, dict) else None\n\n\ndef offered_choices(pairs: Iterable[Tuple[str, str]]) -> Tuple[OfferedChoice, ...]:\n    offered = []\n    for raw_choice, raw_label in pairs:\n        choice = approval_choice(raw_choice)\n        if choice is not None:\n            offered.append(OfferedChoice(choice, str(raw_label)[:LABEL_MAX]))\n    return tuple(offered)\n\n\ndef _parse_offered(value: object) -> Optional[OfferedChoice]:\n    fields = _fields(value)\n    if fields is None:\n        return None\n    choice = approval_choice(fields.get("choice"))\n    label = _bounded_text(fields.get("label"), LABEL_MAX)\n    return OfferedChoice(choice, label) if choice is not None and label is not None else None\n\n\ndef _parse_choices(value: object) -> Optional[Tuple[OfferedChoice, ...]]:\n    if not isinstance(value, list):\n        return None\n    parsed: List[OfferedChoice] = []\n    for item in value:\n        offered = _parse_offered(item)\n        if offered is None:\n            return None\n        parsed.append(offered)\n    return tuple(parsed)\n\n\ndef _parse_opened(fields: Mapping[object, object]) -> Optional[OpenedApproval]:\n    correlation_id = fields.get("correlationId")\n    request_id = fields.get("requestId")\n    subject = _bounded_text(fields.get("subject"), SUBJECT_MAX)\n    choices = _parse_choices(fields.get("choices"))\n    pid = fields.get("pid")\n    opened_at_ms = _instant(fields.get("openedAtMs"))\n    deadline_at_ms = _instant(fields.get("deadlineAtMs"))\n    if not is_correlation_id(correlation_id):\n        return None\n    if request_id is not None and not is_request_id(request_id):\n        return None\n    if (\n        subject is None\n        or not choices\n        or not isinstance(pid, int) or isinstance(pid, bool) or pid <= 0\n        or opened_at_ms is None\n        or deadline_at_ms is None\n    ):\n        return None\n    return OpenedApproval(\n        correlation_id=correlation_id,\n        request_id=request_id,\n        subject=subject,\n        choices=choices,\n        pid=pid,\n        opened_at_ms=opened_at_ms,\n        deadline_at_ms=deadline_at_ms,\n    )\n\n\ndef parse_record(value: object) -> Optional[ApprovalRecord]:\n    fields = _fields(value)\n    if fields is None:\n        return None\n    opened = _parse_opened(fields)\n    state = _record_state(fields.get("state"))\n    if opened is None or state is None:\n        return None\n    if state == WAITING:\n        return WaitingRecord(opened)\n    outcome = _settled_outcome(fields.get("outcome"))\n    settled_at_ms = _instant(fields.get("settledAtMs"))\n    answer_source = fields.get("answerSource")\n    if outcome is None or settled_at_ms is None:\n        return None\n    if answer_source is not None and not is_token(answer_source):\n        return None\n    return SettledRecord(opened, outcome, answer_source, settled_at_ms)\n\n\ndef parse_host_outcome(value: object) -> Optional[HostOutcome]:\n    fields = _fields(value)\n    if fields is None:\n        return None\n    request_id = fields.get("requestId")\n    choice = fields.get("choice")\n    at_ms = _instant(fields.get("atMs"))\n    if not is_request_id(request_id) or not is_token(choice) or at_ms is None:\n        return None\n    return HostOutcome(request_id, choice, at_ms)\n\n\ndef _offered_json(choice: OfferedChoice) -> Dict[str, object]:\n    return {"choice": choice.choice, "label": choice.label}\n\n\ndef _opened_json(opened: OpenedApproval) -> Dict[str, object]:\n    return {\n        "correlationId": opened.correlation_id,\n        "requestId": opened.request_id,\n        "subject": opened.subject,\n        "choices": [_offered_json(choice) for choice in opened.choices],\n        "pid": opened.pid,\n        "openedAtMs": opened.opened_at_ms,\n        "deadlineAtMs": opened.deadline_at_ms,\n    }\n\n\ndef _record_json(record: ApprovalRecord) -> Dict[str, object]:\n    stored = _opened_json(record.opened)\n    if isinstance(record, WaitingRecord):\n        stored["state"] = WAITING\n        return stored\n    stored.update(state=SETTLED, outcome=record.outcome, answerSource=record.answer_source,\n                  settledAtMs=record.settled_at_ms)\n    return stored\n\n\ndef _host_outcome_json(outcome: HostOutcome) -> Dict[str, object]:\n    return {"requestId": outcome.request_id, "choice": outcome.choice, "atMs": outcome.at_ms}\n\n\ndef ledger_directory(home: Path) -> Path:\n    return Path(home).joinpath(*LEDGER_PATH)\n\n\ndef _record_path(home: Path, correlation_id: str) -> Path:\n    return ledger_directory(home) / f"{correlation_id}{RECORD_SUFFIX}"\n\n\ndef _host_outcome_path(home: Path, request_id: str) -> Path:\n    return ledger_directory(home) / f"{HOST_OUTCOME_PREFIX}{request_id}{RECORD_SUFFIX}"\n\n\ndef _ensure_parent(path: Path) -> None:\n    path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)\n\n\ndef _staged_json(path: Path, value: Dict[str, object]) -> Path:\n    _ensure_parent(path)\n    staged = path.with_name(f"{TEMPORARY_PREFIX}{path.name}.{secrets.token_hex(8)}.tmp")\n    try:\n        with open(os.open(staged, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), "w", encoding="utf-8") as handle:\n            json.dump(value, handle)\n    except BaseException:\n        staged.unlink(missing_ok=True)\n        raise\n    return staged\n\n\ndef _replace_json(path: Path, value: Dict[str, object]) -> None:\n    staged = _staged_json(path, value)\n    try:\n        os.replace(staged, path)\n    finally:\n        staged.unlink(missing_ok=True)\n\n\ndef _read_json(path: Path) -> object:\n    try:\n        return json.loads(path.read_text(encoding="utf-8"))\n    except (OSError, ValueError):\n        return None\n\n\ndef read_record(home: Path, correlation_id: str) -> Optional[ApprovalRecord]:\n    if not is_correlation_id(correlation_id):\n        return None\n    record = parse_record(_read_json(_record_path(home, correlation_id)))\n    return record if record is not None and record.opened.correlation_id == correlation_id else None\n\n\ndef read_host_outcome(home: Path, request_id: Optional[str]) -> Optional[HostOutcome]:\n    if not is_request_id(request_id):\n        return None\n    outcome = parse_host_outcome(_read_json(_host_outcome_path(home, request_id)))\n    return outcome if outcome is not None and outcome.request_id == request_id else None\n\n\ndef open_approval(\n    home: Path,\n    *,\n    correlation_id: str,\n    request_id: Optional[str],\n    subject: str,\n    choices: Tuple[OfferedChoice, ...],\n    pid: int,\n    opened_at_ms: int,\n    deadline_at_ms: int,\n) -> bool:\n    if not is_correlation_id(correlation_id) or pid <= 0 or not choices:\n        return False\n    opened = OpenedApproval(\n        correlation_id=correlation_id,\n        request_id=request_id if is_request_id(request_id) else None,\n        subject=subject[:SUBJECT_MAX],\n        choices=choices,\n        pid=pid,\n        opened_at_ms=opened_at_ms,\n        deadline_at_ms=deadline_at_ms,\n    )\n    _replace_json(_record_path(home, correlation_id), _record_json(WaitingRecord(opened)))\n    return True\n\n\ndef settle_approval(\n    home: Path,\n    correlation_id: str,\n    *,\n    outcome: SettledOutcome,\n    answer_source: Optional[str],\n    settled_at_ms: int,\n) -> bool:\n    record = read_record(home, correlation_id)\n    if not isinstance(record, WaitingRecord):\n        return False\n    source = answer_source if is_token(answer_source) else None\n    _replace_json(_record_path(home, correlation_id), _record_json(SettledRecord(record.opened, outcome, source,\n                                                                                 settled_at_ms)))\n    return True\n\n\ndef record_host_outcome(home: Path, request_id: str, choice: str, at_ms: int) -> bool:\n    if not is_request_id(request_id) or not is_token(choice):\n        return False\n    _replace_json(_host_outcome_path(home, request_id), _host_outcome_json(HostOutcome(request_id, choice, at_ms)))\n    return True\n\n\ndef host_has_finished(home: Path, request_id: Optional[str]) -> bool:\n    return read_host_outcome(home, request_id) is not None\n\n\ndef _owner_is_running(opened: OpenedApproval, process_is_running: ProcessIsRunning) -> bool:\n    return opened.pid > 0 and process_is_running(opened.pid)\n\n\ndef _is_live(record: ApprovalRecord, host_outcome: Optional[HostOutcome], now_ms: int,\n             process_is_running: ProcessIsRunning) -> bool:\n    return (\n        isinstance(record, WaitingRecord)\n        and host_outcome is None\n        and now_ms < record.opened.deadline_at_ms\n        and _owner_is_running(record.opened, process_is_running)\n    )\n\n\ndef _waiting_elsewhere(record: WaitingRecord) -> WaitingApproval:\n    opened = record.opened\n    return WaitingApproval(\n        correlation_id=opened.correlation_id,\n        subject=opened.subject,\n        choices=opened.choices,\n        opened_at_ms=opened.opened_at_ms,\n        deadline_at_ms=opened.deadline_at_ms,\n        answerable_here=False,\n        routed_to=None,\n        claim=None,\n    )\n\n\ndef _recent(record: ApprovalRecord, host_outcome: Optional[HostOutcome]) -> RecentApproval:\n    opened = record.opened\n    if isinstance(record, SettledRecord):\n        outcome: RecentOutcome = record.outcome\n        settled_at_ms = record.settled_at_ms\n        answer_source = record.answer_source\n    else:\n        outcome = ENDED\n        settled_at_ms = host_outcome.at_ms if host_outcome else opened.deadline_at_ms\n        answer_source = None\n    return RecentApproval(\n        correlation_id=opened.correlation_id,\n        subject=opened.subject,\n        opened_at_ms=opened.opened_at_ms,\n        settled_at_ms=settled_at_ms,\n        outcome=outcome,\n        answer_source=answer_source,\n        host_outcome=host_outcome.choice if host_outcome else None,\n    )\n\n\ndef approvals_view(\n    records: Iterable[ApprovalRecord],\n    host_outcomes: Mapping[str, HostOutcome],\n    now_ms: int,\n    process_is_running: ProcessIsRunning,\n) -> ApprovalsView:\n    waiting = []\n    recent = []\n    for record in records:\n        request_id = record.opened.request_id\n        host_outcome = host_outcomes.get(request_id) if request_id else None\n        if isinstance(record, WaitingRecord) and _is_live(record, host_outcome, now_ms, process_is_running):\n            waiting.append(_waiting_elsewhere(record))\n        else:\n            recent.append(_recent(record, host_outcome))\n    waiting.sort(key=lambda item: item.opened_at_ms)\n    recent.sort(key=lambda item: item.settled_at_ms, reverse=True)\n    return ApprovalsView(waiting=tuple(waiting), recent=tuple(recent[:RECENT_LIMIT]))\n\n\ndef _ledger_files(home: Path) -> List[Path]:\n    try:\n        return [path for path in ledger_directory(home).iterdir() if path.is_file()]\n    except OSError:\n        return []\n\n\ndef _correlation_id_of(name: str) -> Optional[str]:\n    candidate = name[: -len(RECORD_SUFFIX)] if name.endswith(RECORD_SUFFIX) else None\n    return candidate if is_correlation_id(candidate) else None\n\n\ndef _ledger_entries(home: Path) -> List[Tuple[Path, object]]:\n    return [(path, _read_json(path)) for path in _ledger_files(home) if not path.name.startswith(TEMPORARY_PREFIX)]\n\n\ndef read_approvals(home: Path, now_ms: int, process_is_running: ProcessIsRunning) -> ApprovalsView:\n    records: List[ApprovalRecord] = []\n    host_outcomes: Dict[str, HostOutcome] = {}\n    for path, value in _ledger_entries(home):\n        name = path.name\n        if name.startswith(HOST_OUTCOME_PREFIX):\n            host_outcome = parse_host_outcome(value)\n            if host_outcome is not None:\n                host_outcomes[host_outcome.request_id] = host_outcome\n        else:\n            record = parse_record(value)\n            if record is not None and name == f"{record.opened.correlation_id}{RECORD_SUFFIX}":\n                records.append(record)\n    return approvals_view(records, host_outcomes, now_ms, process_is_running)\n\n\ndef _unexpired_waiting(home: Path, now_ms: int) -> Set[str]:\n    kept: Set[str] = set()\n    for path, value in _ledger_entries(home):\n        if path.name.startswith(HOST_OUTCOME_PREFIX) or not path.name.endswith(RECORD_SUFFIX):\n            continue\n        record = parse_record(value)\n        if isinstance(record, WaitingRecord) and record.opened.deadline_at_ms > now_ms:\n            kept.add(record.opened.correlation_id)\n    return kept\n\n\ndef prune(home: Path, now_seconds: float) -> None:\n    kept = _unexpired_waiting(home, int(now_seconds * 1000))\n    for path in _ledger_files(home):\n        if _correlation_id_of(path.name) in kept:\n            continue\n        try:\n            if now_seconds - path.stat().st_mtime > RETENTION_SECONDS:\n                path.unlink(missing_ok=True)\n        except OSError:\n            continue\n' },
   { path: "approval.py", contents: `import logging
 import os
@@ -957,10 +965,10 @@ import time
 from typing import Literal, Optional, Tuple
 
 from . import api, approval_ledger, cancellation, desktop_answers, desktop_contract, identity, installation
+from .approval_coverage import HERMES_SHELL_TOOL
 
 logger = logging.getLogger(__name__)
 
-HERMES_SHELL_TOOL = "terminal"
 DECISION_LINE_MAX = 500
 ACTION_BODY_MAX = 4000
 
@@ -1313,7 +1321,7 @@ def _await_decision(request, created, correlation_id: str, offered, uses_select:
     return _decided(request, correlation_id, "deny", None)
 ` },
   { path: "cancellation.py", contents: 'from __future__ import annotations\n\nfrom typing import Literal, Mapping, Tuple\n\nCancellation = Literal[\n    "withdrawn_by_this_call",\n    "cancelled_unproven",\n    "already_cancelled",\n    "not_pending",\n    "unreachable",\n]\n\nWITHDRAWN_BY_THIS_CALL: Cancellation = "withdrawn_by_this_call"\nCANCELLED_UNPROVEN: Cancellation = "cancelled_unproven"\nALREADY_CANCELLED: Cancellation = "already_cancelled"\nNOT_PENDING: Cancellation = "not_pending"\nUNREACHABLE: Cancellation = "unreachable"\nCANCELLATIONS: Tuple[Cancellation, ...] = (\n    WITHDRAWN_BY_THIS_CALL,\n    CANCELLED_UNPROVEN,\n    ALREADY_CANCELLED,\n    NOT_PENDING,\n    UNREACHABLE,\n)\n\nUNAVAILABLE_STATUS = "unavailable"\nSTOP_HANDOFF = "stop"\n\n\ndef classify_cancellation(response: object) -> Cancellation:\n    if not isinstance(response, Mapping):\n        return UNREACHABLE\n    fields: Mapping[object, object] = response\n    cancelled = fields.get("cancelled")\n    by_this_call = fields.get("cancelledByThisCall")\n    if (\n        not isinstance(cancelled, bool)\n        or fields.get("status") == UNAVAILABLE_STATUS\n        or fields.get("handoffAction") == STOP_HANDOFF\n        or (by_this_call is not None and not isinstance(by_this_call, bool))\n        or (by_this_call is True and not cancelled)\n    ):\n        return UNREACHABLE\n    if not cancelled:\n        return NOT_PENDING\n    if by_this_call is None:\n        return CANCELLED_UNPROVEN\n    return WITHDRAWN_BY_THIS_CALL if by_this_call else ALREADY_CANCELLED\n' },
-  { path: "dashboard/manifest.json", contents: '{\n  "name": "pushary",\n  "label": "Pushary",\n  "description": "Approvals Pushary is carrying to your phone, answerable from Hermes Desktop",\n  "version": "1.0.1",\n  "tab": { "hidden": true },\n  "entry": "web.js",\n  "api": "plugin_api.py"\n}\n' },
+  { path: "dashboard/manifest.json", contents: '{\n  "name": "pushary",\n  "label": "Pushary",\n  "description": "Approvals Pushary is carrying to your phone, answerable from Hermes Desktop",\n  "version": "1.0.2",\n  "tab": { "hidden": true },\n  "entry": "web.js",\n  "api": "plugin_api.py"\n}\n' },
   { path: "dashboard/plugin_api.py", contents: `import importlib
 import sys
 import time
@@ -1967,7 +1975,7 @@ def stop_history(session_id: str) -> None:
         if thread.is_alive():
             logger.warning("[pushary] Hermes final history export is still pending")
 ` },
-  { path: "host.py", contents: 'import os\n\nTRANSPORT_NAME = "pushary"\n\nHOOK_TIMEOUT_DEFAULT_SECONDS = 30.0\nHOOK_TIMEOUT_MAX_SECONDS = 600.0\n\nGATE_HEADROOM_SECONDS = 5.0\nGATE_MIN_SECONDS = 5.0\nGATE_MAX_SECONDS = 55.0\n\n# The last Hermes that runs a pre_tool_call callback to completion. Anything\n# after this abandons one that outlives plugins.hook_callback_timeout.\nUNBOUNDED_THROUGH_VERSION = (0, 20, 5)\n\n\ndef _config():\n    try:\n        from hermes_cli.config import load_config_readonly\n\n        loaded = load_config_readonly()\n    except Exception:\n        return {}\n    return loaded if isinstance(loaded, dict) else {}\n\n\ndef _section(node, *path):\n    for key in path:\n        node = node.get(key) if isinstance(node, dict) else None\n        if node is None:\n            return {}\n    return node if isinstance(node, dict) else {}\n\n\ndef profile_secret(name):\n    try:\n        from agent.secret_scope import get_secret\n    except Exception:\n        return os.environ.get(name) or None\n    try:\n        return get_secret(name) or None\n    except Exception:\n        return None\n\n\ndef hermes_version_label():\n    try:\n        from importlib.metadata import version\n\n        return version("hermes-cli")\n    except Exception:\n        try:\n            import hermes_cli\n\n            label = getattr(hermes_cli, "__version__", None)\n        except Exception:\n            return None\n    return str(label) if label else None\n\n\ndef _hermes_version():\n    """This Hermes as a comparable tuple, or None when it will not say."""\n    raw = hermes_version_label()\n    if not raw:\n        return None\n    parts = []\n    for piece in str(raw).split(".")[:3]:\n        digits = ""\n        for char in piece:\n            if not char.isdigit():\n                break\n            digits += char\n        if not digits:\n            return None\n        parts.append(int(digits))\n    while len(parts) < 3:\n        parts.append(0)\n    return tuple(parts)\n\n\ndef bounds_pre_tool_call():\n    """Whether this Hermes abandons a slow pre_tool_call callback.\n\n    The timeout was added after 0.20.5, which runs plugin hooks to completion.\n    Clamping the wait on a host that would never have cut it off just shortens\n    the window the user has to answer, for nothing.\n\n    Unreadable means assume bounded. A wait that is shorter than it had to be\n    costs the user seconds; a wait longer than the host allows costs them the\n    answer they already gave.\n\n    That rule is why the private symbol is not asked on its own. `hasattr` on\n    `_HOOK_TIMEOUT_FAIL_CLOSED_HOOKS` cannot tell "this host runs hooks to\n    completion" apart from "the private name moved", and those two answers want\n    opposite behaviour: the first earns the full window, the second spends 55\n    seconds against a budget of 30 and loses an answer the user already gave.\n    A rename is the likelier of the two, because a private name is the one thing\n    a host is free to change. So the symbol is taken as proof of bounded, and\n    only a version this side of the timeout landing is taken as proof of the\n    other. Anything unreadable falls to bounded.\n    """\n    try:\n        from hermes_cli import plugins\n    except Exception:\n        return True\n    if hasattr(plugins, "_HOOK_TIMEOUT_FAIL_CLOSED_HOOKS"):\n        return True\n    version = _hermes_version()\n    if version is None:\n        return True\n    return version > UNBOUNDED_THROUGH_VERSION\n\n\ndef hook_callback_timeout_seconds():\n    raw = _section(_config(), "plugins").get("hook_callback_timeout")\n    if raw is None:\n        return HOOK_TIMEOUT_DEFAULT_SECONDS\n    try:\n        timeout = float(raw)\n    except (TypeError, ValueError):\n        return HOOK_TIMEOUT_DEFAULT_SECONDS\n    if timeout < 0:\n        return HOOK_TIMEOUT_DEFAULT_SECONDS\n    return min(timeout, HOOK_TIMEOUT_MAX_SECONDS)\n\n\ndef gate_budget_seconds(requested_seconds):\n    if not bounds_pre_tool_call():\n        return max(1.0, min(float(requested_seconds), GATE_MAX_SECONDS))\n    timeout = hook_callback_timeout_seconds()\n    ceiling = (\n        GATE_MAX_SECONDS\n        if timeout <= 0\n        else max(GATE_MIN_SECONDS, timeout - GATE_HEADROOM_SECONDS)\n    )\n    return max(1.0, min(float(requested_seconds), ceiling, GATE_MAX_SECONDS))\n\n\ndef pushary_is_selected_transport():\n    selected = _section(_config(), "security", "approval").get("transport")\n    return str(selected or "").strip().lower() == TRANSPORT_NAME\n' },
+  { path: "host.py", contents: 'import os\n\nTRANSPORT_NAME = "pushary"\n\nHOOK_TIMEOUT_DEFAULT_SECONDS = 30.0\nHOOK_TIMEOUT_MAX_SECONDS = 600.0\n\nGATE_HEADROOM_SECONDS = 5.0\nGATE_MIN_SECONDS = 5.0\nGATE_MAX_SECONDS = 55.0\n\n# The last Hermes that runs a pre_tool_call callback to completion. Anything\n# after this abandons one that outlives plugins.hook_callback_timeout.\nUNBOUNDED_THROUGH_VERSION = (0, 20, 5)\n\n\ndef _config():\n    try:\n        from hermes_cli.config import load_config_readonly\n\n        loaded = load_config_readonly()\n    except Exception:\n        return {}\n    return loaded if isinstance(loaded, dict) else {}\n\n\ndef _section(node, *path):\n    for key in path:\n        node = node.get(key) if isinstance(node, dict) else None\n        if node is None:\n            return {}\n    return node if isinstance(node, dict) else {}\n\n\ndef profile_secret(name):\n    try:\n        from agent.secret_scope import get_secret\n    except Exception:\n        return os.environ.get(name) or None\n    try:\n        return get_secret(name) or None\n    except Exception:\n        return None\n\n\ndef hermes_version_label():\n    try:\n        from importlib.metadata import version\n\n        return version("hermes-cli")\n    except Exception:\n        try:\n            import hermes_cli\n\n            label = getattr(hermes_cli, "__version__", None)\n        except Exception:\n            return None\n    return str(label) if label else None\n\n\ndef _hermes_version():\n    """This Hermes as a comparable tuple, or None when it will not say."""\n    raw = hermes_version_label()\n    if not raw:\n        return None\n    parts = []\n    for piece in str(raw).split(".")[:3]:\n        digits = ""\n        for char in piece:\n            if not char.isdigit():\n                break\n            digits += char\n        if not digits:\n            return None\n        parts.append(int(digits))\n    while len(parts) < 3:\n        parts.append(0)\n    return tuple(parts)\n\n\ndef bounds_pre_tool_call():\n    """Whether this Hermes abandons a slow pre_tool_call callback.\n\n    The timeout was added after 0.20.5, which runs plugin hooks to completion.\n    Clamping the wait on a host that would never have cut it off just shortens\n    the window the user has to answer, for nothing.\n\n    Unreadable means assume bounded. A wait that is shorter than it had to be\n    costs the user seconds; a wait longer than the host allows costs them the\n    answer they already gave.\n\n    That rule is why the private symbol is not asked on its own. `hasattr` on\n    `_HOOK_TIMEOUT_FAIL_CLOSED_HOOKS` cannot tell "this host runs hooks to\n    completion" apart from "the private name moved", and those two answers want\n    opposite behaviour: the first earns the full window, the second spends 55\n    seconds against a budget of 30 and loses an answer the user already gave.\n    A rename is the likelier of the two, because a private name is the one thing\n    a host is free to change. So the symbol is taken as proof of bounded, and\n    only a version this side of the timeout landing is taken as proof of the\n    other. Anything unreadable falls to bounded.\n    """\n    try:\n        from hermes_cli import plugins\n    except Exception:\n        return True\n    if hasattr(plugins, "_HOOK_TIMEOUT_FAIL_CLOSED_HOOKS"):\n        return True\n    version = _hermes_version()\n    if version is None:\n        return True\n    return version > UNBOUNDED_THROUGH_VERSION\n\n\ndef hook_callback_timeout_seconds():\n    raw = _section(_config(), "plugins").get("hook_callback_timeout")\n    if raw is None:\n        return HOOK_TIMEOUT_DEFAULT_SECONDS\n    try:\n        timeout = float(raw)\n    except (TypeError, ValueError):\n        return HOOK_TIMEOUT_DEFAULT_SECONDS\n    if timeout < 0:\n        return HOOK_TIMEOUT_DEFAULT_SECONDS\n    return min(timeout, HOOK_TIMEOUT_MAX_SECONDS)\n\n\ndef gate_budget_seconds(requested_seconds):\n    if not bounds_pre_tool_call():\n        return max(1.0, min(float(requested_seconds), GATE_MAX_SECONDS))\n    timeout = hook_callback_timeout_seconds()\n    ceiling = (\n        GATE_MAX_SECONDS\n        if timeout <= 0\n        else max(GATE_MIN_SECONDS, timeout - GATE_HEADROOM_SECONDS)\n    )\n    return max(1.0, min(float(requested_seconds), ceiling, GATE_MAX_SECONDS))\n\n\ndef terminal_config():\n    return _section(_config(), "terminal")\n\n\ndef pushary_is_selected_transport():\n    selected = _section(_config(), "security", "approval").get("transport")\n    return str(selected or "").strip().lower() == TRANSPORT_NAME\n' },
   { path: "identity.py", contents: 'import hashlib\nimport os\nimport re\nimport socket\nfrom pathlib import Path\n\nDEFAULT_AGENT_NAME = "Hermes"\nMAX_ID_LENGTH = 128\nSHARED_MACHINE_ID_FILE = Path.home() / ".pushary" / "machine-id"\nSHARED_MACHINE_ID_PATTERN = re.compile(r"^[A-Za-z0-9-]{1,128}$")\n\n_session_id = None\n\n\ndef agent_name():\n    return os.environ.get("PUSHARY_AGENT_NAME", DEFAULT_AGENT_NAME)\n\n\ndef labelled_agent_name(requested):\n    project = str(requested or "").partition(" - ")[2].strip()\n    return f"{agent_name()} - {project}" if project else agent_name()\n\n\ndef shared_machine_id(path=None):\n    try:\n        value = (path or SHARED_MACHINE_ID_FILE).read_text(encoding="utf-8").strip()\n    except OSError:\n        return None\n    return value if SHARED_MACHINE_ID_PATTERN.match(value) else None\n\n\ndef hostname_machine_id():\n    try:\n        host = socket.gethostname()\n    except Exception:\n        return None\n    if not host:\n        return None\n    return hashlib.sha256(host.encode("utf-8")).hexdigest()[:8]\n\n\ndef machine_id():\n    return shared_machine_id() or hostname_machine_id()\n\n\ndef remember_session(value):\n    global _session_id\n    if value:\n        _session_id = str(value)[:MAX_ID_LENGTH]\n\n\ndef forget_session():\n    global _session_id\n    _session_id = None\n\n\ndef session_id():\n    return _session_id\n' },
   { path: "installation.py", contents: `import json
 import logging
@@ -2098,7 +2106,7 @@ def record_plugin_load(approval_transport_registered, home=None, pid=None, now=N
         logger.debug("[pushary] could not record the plugin load: %s", exc)
         return None
 ` },
-  { path: "plugin.yaml", contents: 'name: pushary\nversion: 1.0.1\ndescription: Push notifications and human-in-the-loop for Hermes Agent via Pushary\nauthor: RalphNex OU\nrequires_env:\n  - name: PUSHARY_API_KEY\n    description: Your Pushary API key\n    url: https://pushary.com/sign-up?from=hermes\n    secret: true\nconfig_schema:\n  api_key:\n    type: secret\n    env: PUSHARY_API_KEY\n    label: Pushary API key\n    description: "Get one at pushary.com/sign-up?from=hermes"\n    required: true\nprovides_tools:\n  - pushary_remind\n  - pushary_notify\n  - pushary_ask\n  - pushary_wait\n  - pushary_cancel\n  - pushary_propose_scope\n  - pushary_enroll\n  - pushary_ask_end_user\nprovides_hooks:\n  - pre_llm_call\n  - pre_tool_call\n  - post_tool_call\n  - on_session_start\n  - on_session_end\n  - on_session_finalize\n  - post_approval_response\nprovides_approval_transports:\n  - pushary\n' },
+  { path: "plugin.yaml", contents: 'name: pushary\nversion: 1.0.2\ndescription: Push notifications and human-in-the-loop for Hermes Agent via Pushary\nauthor: RalphNex OU\nrequires_env:\n  - name: PUSHARY_API_KEY\n    description: Your Pushary API key\n    url: https://pushary.com/sign-up?from=hermes\n    secret: true\nconfig_schema:\n  api_key:\n    type: secret\n    env: PUSHARY_API_KEY\n    label: Pushary API key\n    description: "Get one at pushary.com/sign-up?from=hermes"\n    required: true\nprovides_tools:\n  - pushary_remind\n  - pushary_notify\n  - pushary_ask\n  - pushary_wait\n  - pushary_cancel\n  - pushary_propose_scope\n  - pushary_enroll\n  - pushary_ask_end_user\nprovides_hooks:\n  - pre_llm_call\n  - pre_tool_call\n  - post_tool_call\n  - on_session_start\n  - on_session_end\n  - on_session_finalize\n  - post_approval_response\nprovides_approval_transports:\n  - pushary\n' },
   { path: "schemas.py", contents: `PUSHARY_REMIND = {
     "name": "pushary_remind",
     "description": "Schedule a one-time personal reminder on Pushary, even after Hermes exits. Use body plus in_minutes or at (ISO timestamp with explicit UTC offset, within 30 days). Never guess the user's timezone. Confirm the returned time. No arguments lists pending reminders; cancel_reminder_id cancels a scheduled one. Use Hermes cron for agent work; use this for reminding the operator.",
@@ -2743,6 +2751,135 @@ var shippedHermesPlugin = (files = HERMES_PLUGIN_FILES) => {
   return { files, version, digest: hermesPluginDigest(files) };
 };
 
+// src/hermes/approval-coverage.ts
+var HERMES_TERMINAL_SECTION = "terminal";
+var HERMES_TERMINAL_ENV_KEY = "TERMINAL_ENV";
+var HERMES_GATE_TOOLS_KEY = "PUSHARY_GATE_TOOLS";
+var HERMES_SHELL_TOOL = "terminal";
+var HERMES_DOCKER_VOLUMES_KEY = "TERMINAL_DOCKER_VOLUMES";
+var HERMES_DOCKER_MOUNT_CWD_KEY = "TERMINAL_DOCKER_MOUNT_CWD_TO_WORKSPACE";
+var HERMES_COMMAND_ALLOWLIST_KEY = "command_allowlist";
+var HERMES_ALWAYS_ALLOWED_SHELL_RULE = `plugin_rule:${HERMES_SHELL_TOOL}`;
+var HERMES_DEFAULT_BACKEND = "local";
+var HERMES_DOCKER_BACKEND = "docker";
+var BACKENDS_WHERE_HERMES_ASKS = /* @__PURE__ */ new Set(["local", "ssh"]);
+var BACKENDS_WHERE_HERMES_SKIPS = /* @__PURE__ */ new Set(["modal", "daytona", "vercel_sandbox"]);
+var BACKEND_NAME = /^[a-z0-9_]+$/;
+var TRUE_WORDS = /* @__PURE__ */ new Set(["true", "1", "yes"]);
+var HOST_PATH_PREFIXES = ["/", "~", "./", "../"];
+var WINDOWS_DRIVE_PATH = /^.:[/\\]/;
+var GATE_TOOLS_SEPARATOR = ",";
+var ABSENT = { kind: "absent" };
+var MALFORMED = { kind: "malformed" };
+var backendNameOf = (value) => {
+  if (value === void 0 || value === null) return ABSENT;
+  if (typeof value !== "string") return MALFORMED;
+  const name = value.trim();
+  if (name === "") return ABSENT;
+  return BACKEND_NAME.test(name) ? { kind: "named", name } : MALFORMED;
+};
+var terminalSectionOf = (reading) => {
+  if (reading.kind === "unset") return { kind: "read", section: {} };
+  return isRecord(reading.value) ? { kind: "read", section: reading.value } : { kind: "malformed" };
+};
+var environmentBackendOf = (reading) => reading.kind === "unset" ? ABSENT : backendNameOf(reading.value);
+var effectiveBackend = (configured, environment) => {
+  if (configured.kind === "malformed") return MALFORMED;
+  if (configured.kind === "named" && configured.name !== HERMES_DEFAULT_BACKEND) return configured;
+  if (environment.kind !== "absent") return environment;
+  return { kind: "named", name: HERMES_DEFAULT_BACKEND };
+};
+var isTrueSetting = (value) => value === true || value === 1 || typeof value === "string" && TRUE_WORDS.has(value.trim().toLowerCase());
+var bindsHostPath = (volume) => {
+  if (typeof volume !== "string") return false;
+  const spec = volume.trim();
+  return spec !== "" && (HOST_PATH_PREFIXES.some((prefix) => spec.startsWith(prefix)) || WINDOWS_DRIVE_PATH.test(spec));
+};
+var effectiveValue = (reading, configured) => reading.kind === "set" ? reading.value : configured;
+var volumeListOf = (value) => {
+  if (typeof value !== "string") return value;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return null;
+  }
+};
+var mountsHostVolume = (access) => {
+  const volumes = volumeListOf(access.volumes);
+  return Array.isArray(volumes) && volumes.some(bindsHostPath);
+};
+var dockerCoverage = (access) => {
+  const backend = HERMES_DOCKER_BACKEND;
+  if (mountsHostVolume(access)) return { kind: "hermes_asks", backend };
+  if (isTrueSetting(access.mountCwd)) return { kind: "hermes_may_skip", backend, doubt: "docker_start_folder" };
+  return { kind: "hermes_skips", backend };
+};
+var dockerCoverageFrom = (section, readings) => {
+  if (readings.dockerVolumes === null || readings.dockerMountCwd === null) return { kind: "unreadable" };
+  return dockerCoverage({
+    volumes: effectiveValue(readings.dockerVolumes, section.docker_volumes),
+    mountCwd: effectiveValue(readings.dockerMountCwd, section.docker_mount_cwd_to_workspace)
+  });
+};
+var coverageOn = (backend, section, readings) => {
+  if (backend === HERMES_DOCKER_BACKEND) return dockerCoverageFrom(section, readings);
+  if (BACKENDS_WHERE_HERMES_ASKS.has(backend)) return { kind: "hermes_asks", backend };
+  if (BACKENDS_WHERE_HERMES_SKIPS.has(backend)) return { kind: "hermes_skips", backend };
+  return { kind: "hermes_may_skip", backend, doubt: "plugin_backend" };
+};
+var hermesApprovalCoverage = (readings) => {
+  if (readings.terminal === null || readings.terminalEnv === null) return { kind: "unreadable" };
+  const terminal = terminalSectionOf(readings.terminal);
+  if (terminal.kind === "malformed") return { kind: "unreadable" };
+  const backend = effectiveBackend(backendNameOf(terminal.section.backend), environmentBackendOf(readings.terminalEnv));
+  return backend.kind === "named" ? coverageOn(backend.name, terminal.section, readings) : { kind: "unreadable" };
+};
+var listedEntries = (raw) => raw.split(GATE_TOOLS_SEPARATOR).map((entry) => entry.trim()).filter((entry) => entry !== "");
+var hermesGateToolsFrom = (reading) => {
+  if (reading === null) return { kind: "unreadable" };
+  if (reading.kind === "unset") return { kind: "unset" };
+  if (typeof reading.value !== "string") return { kind: "unreadable" };
+  const entries = listedEntries(reading.value);
+  return { kind: "listed", entries, tools: entries.map((entry) => entry.toLowerCase()) };
+};
+var gatesHermesShell = (gate) => gate.kind === "listed" && gate.tools.includes(HERMES_SHELL_TOOL);
+var gateToolsWithShell = (gate) => {
+  if (gate.kind === "unreadable" || gatesHermesShell(gate)) return null;
+  const entries = gate.kind === "listed" ? gate.entries : [];
+  return [...entries, HERMES_SHELL_TOOL].join(GATE_TOOLS_SEPARATOR);
+};
+var LEGACY_FLOW_LIST = /^\[(.*)\]$/s;
+var LEGACY_LIST_SEPARATOR = ",";
+var QUOTED_ENTRY = /^(['"])(.*)\1$/s;
+var unquotedEntry = (entry) => {
+  const trimmed = entry.trim();
+  return QUOTED_ENTRY.exec(trimmed)?.[2] ?? trimmed;
+};
+var legacyListEntries = (raw) => {
+  const list = LEGACY_FLOW_LIST.exec(raw.trim());
+  return list ? list[1].split(LEGACY_LIST_SEPARATOR).map(unquotedEntry) : [];
+};
+var allowlistEntries = (allowlist) => {
+  if (allowlist?.kind !== "set") return [];
+  if (Array.isArray(allowlist.value)) return allowlist.value;
+  return typeof allowlist.value === "string" ? legacyListEntries(allowlist.value) : [];
+};
+var escalatesToHermesApprovals = (transport) => transport?.kind === "set" && transport.value === HERMES_PUSHARY_TRANSPORT;
+var hermesAlwaysAllowsShell = ({ allowlist, transport }) => escalatesToHermesApprovals(transport) && allowlistEntries(allowlist).includes(HERMES_ALWAYS_ALLOWED_SHELL_RULE);
+var skipOf = (coverage) => coverage.kind === "hermes_skips" ? { kind: "skips" } : { kind: "may_skip", doubt: coverage.doubt };
+var hermesShellGateState = ({ coverage, gate, alwaysAllowed }) => {
+  if (coverage.kind === "unreadable") return { kind: "unreadable" };
+  if (coverage.kind === "hermes_asks") return { kind: "hermes_asks", backend: coverage.backend };
+  const skip = skipOf(coverage);
+  const backend = coverage.backend;
+  if (!gatesHermesShell(gate)) return { kind: "ungated", backend, skip };
+  return alwaysAllowed ? { kind: "always_allowed", backend, skip } : { kind: "pushary_gates", backend, skip };
+};
+var hermesShellGateChoice = (input) => {
+  if (input.requested) return "apply";
+  return input.canAsk ? "ask" : "report";
+};
+
 // src/hermes/runtime.ts
 import { execFile } from "child_process";
 import { accessSync, closeSync, constants, existsSync, mkdirSync, openSync, readFileSync, readSync, renameSync, rmSync, statSync, writeFileSync } from "fs";
@@ -2793,9 +2930,18 @@ var PUSHARY_VALUES = {
   [HERMES_APPROVAL_TRANSPORT_KEY]: HERMES_PUSHARY_TRANSPORT,
   [HERMES_APPROVAL_FALLBACK_KEY]: HERMES_PUSHARY_FALLBACK
 };
+var readingBefore = (snapshot) => snapshot.wasSet ? { kind: "set", value: snapshot.before } : { kind: "unset" };
+var valueSetupWrote = (snapshot) => {
+  if (snapshot.key === HERMES_GATE_TOOLS_KEY) return gateToolsWithShell(hermesGateToolsFrom(readingBefore(snapshot)));
+  return Object.hasOwn(PUSHARY_VALUES, snapshot.key) ? PUSHARY_VALUES[snapshot.key] : null;
+};
+var receiptWithSnapshot = (receipt, snapshot) => ({
+  ...receipt,
+  settings: [...receipt.settings.filter((setting) => setting.key !== snapshot.key), snapshot]
+});
 var hermesSettingRestore = (snapshot, current) => {
-  const ours = PUSHARY_VALUES[snapshot.key];
-  const stillOurs = current.kind === "set" && current.value === ours;
+  const ours = valueSetupWrote(snapshot);
+  const stillOurs = ours !== null && current.kind === "set" && current.value === ours;
   const oursBeforeSetup = snapshot.wasSet && snapshot.before === ours;
   return stillOurs && !oursBeforeSetup ? { kind: "restore", key: snapshot.key, snapshot } : { kind: "leave", key: snapshot.key };
 };
@@ -2880,13 +3026,20 @@ var commandOutput = (error) => {
 };
 var stoppedAtTimeout = (error) => isRecord(error) && error.killed === true;
 var runFileAsync = promisify(execFile);
+var SETTINGS_A_SERVICE_GATEWAY_NEVER_INHERITS = [
+  HERMES_GATE_TOOLS_KEY,
+  HERMES_TERMINAL_ENV_KEY,
+  HERMES_DOCKER_VOLUMES_KEY,
+  HERMES_DOCKER_MOUNT_CWD_KEY
+];
+var environmentAsTheGatewaySeesIt = (environment) => Object.fromEntries(Object.entries(environment).filter(([name]) => !SETTINGS_A_SERVICE_GATEWAY_NEVER_INHERITS.includes(name)));
 var runHermesCommand = async (launcher, args, timeoutMs = HERMES_COMMAND_TIMEOUT_MS) => {
   const shell = needsShell(launcher.path);
   try {
     const running = runFileAsync(
       shell ? quotedForWindowsShell(launcher.path) : launcher.path,
       shell ? args.map(quotedForWindowsShell) : [...args],
-      { encoding: "utf-8", timeout: timeoutMs, maxBuffer: HERMES_OUTPUT_LIMIT_BYTES, shell }
+      { encoding: "utf-8", timeout: timeoutMs, maxBuffer: HERMES_OUTPUT_LIMIT_BYTES, shell, env: environmentAsTheGatewaySeesIt(process.env) }
     );
     running.child.stdin?.end();
     const { stdout } = await running;
@@ -3362,8 +3515,28 @@ var removeHermesWiring = async (request) => {
 
 export {
   HERMES_INSTALL_MARKER_FILE,
+  HERMES_APPROVAL_TRANSPORT_KEY,
   shippedHermesPlugin,
+  HERMES_TERMINAL_SECTION,
+  HERMES_TERMINAL_ENV_KEY,
+  HERMES_GATE_TOOLS_KEY,
+  HERMES_SHELL_TOOL,
+  HERMES_DOCKER_VOLUMES_KEY,
+  HERMES_DOCKER_MOUNT_CWD_KEY,
+  HERMES_COMMAND_ALLOWLIST_KEY,
+  HERMES_ALWAYS_ALLOWED_SHELL_RULE,
+  hermesApprovalCoverage,
+  hermesGateToolsFrom,
+  gatesHermesShell,
+  gateToolsWithShell,
+  hermesAlwaysAllowsShell,
+  hermesShellGateState,
+  hermesShellGateChoice,
+  settingSnapshot,
+  receiptWithSnapshot,
   findHermesLauncher,
+  readHermesSetting,
+  writeHermesSetting,
   hermesPluginDirectory,
   HERMES_CONFIG_FILE,
   defaultHermesHome,
@@ -3378,6 +3551,8 @@ export {
   hermesReceiptPaths,
   hermesSetupWasRecorded,
   hermesSetupPredatesThePluginFolder,
+  readSetupReceipt,
+  writeSetupReceipt,
   installHermesPlugin,
   refreshHermesPluginFiles,
   removeHermesWiring

package/dist/{codex-app-cards-switch-EGUHSLTG.js → codex-app-cards-switch-F7WQ7Y3I.js}

@@ -22,22 +22,22 @@ import {
   turnCodexAppCardsOff,
   turnCodexAppCardsOn,
   whyLaunchctlFailed
-} from "./chunk-FYB6HBHQ.js";
-import "./chunk-44Z6MQZ2.js";
+} from "./chunk-RO6EVL5C.js";
+import "./chunk-KGFB2LEB.js";
 import "./chunk-XCEN33UP.js";
 import "./chunk-QCGNGEGE.js";
-import "./chunk-ZF4CPOO7.js";
+import "./chunk-WH4ODOCE.js";
 import "./chunk-H6CL3T2S.js";
-import "./chunk-4Z7YVVKQ.js";
-import "./chunk-HIIXYZYV.js";
-import "./chunk-BHKODM4L.js";
-import "./chunk-IG7NGXBS.js";
-import "./chunk-QFZNPZRO.js";
-import "./chunk-4EBJ4PTZ.js";
+import "./chunk-KS3PNTRT.js";
+import "./chunk-WOSO4YFQ.js";
+import "./chunk-MOC2DN42.js";
+import "./chunk-72LP4RPC.js";
+import "./chunk-VTJ4WZOC.js";
+import "./chunk-BWREST4F.js";
 import "./chunk-TODDEIYG.js";
-import "./chunk-R7FSMUHG.js";
+import "./chunk-6LZ7MXHD.js";
 import "./chunk-WIIMW5YO.js";
-import "./chunk-C5LIS3XM.js";
+import "./chunk-LQXUWXQP.js";
 import "./chunk-U4P4NDVB.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{codex-card-routing-I6YOJBTT.js → codex-card-routing-EVL5L36G.js}

@@ -1,10 +1,10 @@
 import {
   deriveToolTarget
-} from "./chunk-7QWH257P.js";
+} from "./chunk-JZT2LPRM.js";
 import {
   TOOL_NAME_MAX_LENGTH,
   codexElicitationToolName
-} from "./chunk-C5LIS3XM.js";
+} from "./chunk-LQXUWXQP.js";
 import "./chunk-MLKGABMK.js";
 
 // src/codex-card-routing.ts

package/dist/{codex-desktop-launch-6UN5CWCX.js → codex-desktop-launch-PL6Z2ELZ.js}

@@ -11,7 +11,7 @@ import {
   installedCodexApp,
   shellQuoted,
   writeDesktopProxy
-} from "./chunk-44Z6MQZ2.js";
+} from "./chunk-KGFB2LEB.js";
 import "./chunk-XCEN33UP.js";
 import {
   CODEX_APP_LAUNCH_VARIABLE

package/dist/{codex-session-launch-7R3HNIDJ.js → codex-session-launch-7NQEAUDU.js}

@@ -11,38 +11,38 @@ import {
   isCodexQuestionLeftWithTheLocalClient,
   planCodexElicitation,
   reportOwnedQuestion
-} from "./chunk-USNGPJXF.js";
-import "./chunk-B4VIT5N3.js";
-import "./chunk-R27HXRSK.js";
-import "./chunk-UIZE4YMU.js";
-import "./chunk-DDJHPMBJ.js";
-import "./chunk-NQF652IG.js";
+} from "./chunk-WUT3PO33.js";
+import "./chunk-4L5WPDTB.js";
+import "./chunk-Y7INHH5G.js";
+import "./chunk-DZIZ3XFL.js";
+import "./chunk-LMU6NG2G.js";
+import "./chunk-PXZTCR4M.js";
 import "./chunk-CYTPQDQY.js";
-import "./chunk-22CXL7YI.js";
+import "./chunk-IRPIMQ7U.js";
 import "./chunk-XMSDA5WA.js";
-import "./chunk-EMODTMHE.js";
+import "./chunk-6UK4K5RS.js";
 import {
   writeDegraded
-} from "./chunk-CNURORKI.js";
+} from "./chunk-YU5XE6VC.js";
 import "./chunk-POFBE6ZY.js";
-import "./chunk-V53QYJNY.js";
-import "./chunk-DZLLKJJT.js";
-import "./chunk-4OX4SJGA.js";
+import "./chunk-WPBWJMBZ.js";
+import "./chunk-YRJZF5RG.js";
+import "./chunk-LJRPWUST.js";
 import "./chunk-H6CL3T2S.js";
-import "./chunk-ZVJIJPQY.js";
-import "./chunk-YCU7Y77H.js";
-import "./chunk-4Z7YVVKQ.js";
+import "./chunk-BYKRAYGD.js";
+import "./chunk-S7HGPKCL.js";
+import "./chunk-KS3PNTRT.js";
 import "./chunk-YU2EUD7O.js";
-import "./chunk-IG7NGXBS.js";
-import "./chunk-QFZNPZRO.js";
-import "./chunk-4EBJ4PTZ.js";
+import "./chunk-72LP4RPC.js";
+import "./chunk-VTJ4WZOC.js";
+import "./chunk-BWREST4F.js";
 import "./chunk-BG4HHB7E.js";
 import "./chunk-TODDEIYG.js";
-import "./chunk-R7FSMUHG.js";
+import "./chunk-6LZ7MXHD.js";
 import "./chunk-WIIMW5YO.js";
 import {
   canonicalJsonText
-} from "./chunk-C5LIS3XM.js";
+} from "./chunk-LQXUWXQP.js";
 import "./chunk-MLKGABMK.js";
 
 // src/codex-session-launch.ts

package/dist/{config-2CHOLFNB.js → config-KFFD4VWH.js}

@@ -3,9 +3,9 @@ import {
   getApiKey,
   getBaseUrl,
   resetKeyDriftWarning
-} from "./chunk-4EBJ4PTZ.js";
-import "./chunk-R7FSMUHG.js";
-import "./chunk-C5LIS3XM.js";
+} from "./chunk-BWREST4F.js";
+import "./chunk-6LZ7MXHD.js";
+import "./chunk-LQXUWXQP.js";
 import "./chunk-MLKGABMK.js";
 export {
   configFilePath,

package/dist/{global-upgrade-CCVIYELF.js → global-upgrade-L3CY6EFF.js}

@@ -7,20 +7,20 @@ import {
   recordUnfinishedUpgrade,
   upgradeInstalledPackage,
   withUpgradeLock
-} from "./chunk-PYSDCPZ3.js";
-import "./chunk-QQHUUPPW.js";
-import "./chunk-R27HXRSK.js";
-import "./chunk-UIZE4YMU.js";
+} from "./chunk-2LGDEPVL.js";
+import "./chunk-EPWOARGR.js";
+import "./chunk-Y7INHH5G.js";
+import "./chunk-DZIZ3XFL.js";
 import "./chunk-CYTPQDQY.js";
-import "./chunk-MOYEHNFP.js";
+import "./chunk-MKHVLDMN.js";
 import "./chunk-POFBE6ZY.js";
-import "./chunk-IG7NGXBS.js";
-import "./chunk-QFZNPZRO.js";
+import "./chunk-72LP4RPC.js";
+import "./chunk-VTJ4WZOC.js";
 import "./chunk-BG4HHB7E.js";
 import "./chunk-TODDEIYG.js";
-import "./chunk-R7FSMUHG.js";
+import "./chunk-6LZ7MXHD.js";
 import "./chunk-WIIMW5YO.js";
-import "./chunk-C5LIS3XM.js";
+import "./chunk-LQXUWXQP.js";
 import "./chunk-MLKGABMK.js";
 export {
   finishGlobalUpgrade,

package/dist/{identity-7QA3EDOM.js → identity-DPYYIMHL.js}

@@ -2,12 +2,12 @@ import {
   getMachineId,
   getOrCreateMachineId,
   readExistingMachineId
-} from "./chunk-4Z7YVVKQ.js";
-import "./chunk-IG7NGXBS.js";
-import "./chunk-QFZNPZRO.js";
+} from "./chunk-KS3PNTRT.js";
+import "./chunk-72LP4RPC.js";
+import "./chunk-VTJ4WZOC.js";
 import "./chunk-TODDEIYG.js";
 import "./chunk-WIIMW5YO.js";
-import "./chunk-C5LIS3XM.js";
+import "./chunk-LQXUWXQP.js";
 import "./chunk-MLKGABMK.js";
 export {
   getMachineId,

package/dist/{live-capabilities-SDMX6CPZ.js → live-capabilities-QJEXK6GH.js}

@@ -16,10 +16,10 @@ import {
   resolveControlPolicy,
   resolveProviderBinary,
   trackProviderInventory
-} from "./chunk-R27HXRSK.js";
-import "./chunk-UIZE4YMU.js";
+} from "./chunk-Y7INHH5G.js";
+import "./chunk-DZIZ3XFL.js";
 import "./chunk-CYTPQDQY.js";
-import "./chunk-QFZNPZRO.js";
+import "./chunk-VTJ4WZOC.js";
 import "./chunk-TODDEIYG.js";
 import "./chunk-WIIMW5YO.js";
 import {
@@ -30,7 +30,7 @@ import {
   GEMINI_BRIDGE_CAPABILITY,
   GEMINI_RESUME_CAPABILITY,
   SPAWN_CAPABILITY
-} from "./chunk-C5LIS3XM.js";
+} from "./chunk-LQXUWXQP.js";
 import "./chunk-MLKGABMK.js";
 export {
   CLAUDE_BRIDGE_CAPABILITY,

package/dist/{paths-ZC6XY73Q.js → paths-PEF6C64P.js}

@@ -39,11 +39,11 @@ import {
   serviceOwedBackMark,
   vscodePluginDir,
   vscodePluginMcp
-} from "./chunk-IG7NGXBS.js";
-import "./chunk-QFZNPZRO.js";
+} from "./chunk-72LP4RPC.js";
+import "./chunk-VTJ4WZOC.js";
 import "./chunk-TODDEIYG.js";
 import "./chunk-WIIMW5YO.js";
-import "./chunk-C5LIS3XM.js";
+import "./chunk-LQXUWXQP.js";
 import "./chunk-MLKGABMK.js";
 export {
   autoUpdateLock,