pushary 1.9.144 → 1.9.145

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (134) hide show
  1. package/CHANGELOG.md +7 -0
  2. package/dist/{api-ZV7TT25P.js → api-KWJQMO6G.js} +11 -11
  3. package/dist/bin/pushary-audit.js +3 -3
  4. package/dist/bin/pushary-bell-hook.js +28 -28
  5. package/dist/bin/pushary-bell.js +10 -10
  6. package/dist/bin/pushary-claude.js +27 -27
  7. package/dist/bin/pushary-clean.js +35 -35
  8. package/dist/bin/pushary-codex-bridge.js +23 -23
  9. package/dist/bin/pushary-codex-hook.js +35 -35
  10. package/dist/bin/pushary-codex-session.js +8 -8
  11. package/dist/bin/pushary-codex.js +16 -16
  12. package/dist/bin/pushary-connect.js +29 -29
  13. package/dist/bin/pushary-cowork.js +5 -5
  14. package/dist/bin/pushary-daemon.js +43 -43
  15. package/dist/bin/pushary-disconnect.js +28 -28
  16. package/dist/bin/pushary-display-hook.js +7 -0
  17. package/dist/bin/pushary-doctor.js +58 -43
  18. package/dist/bin/pushary-elicitation-hook.js +28 -28
  19. package/dist/bin/pushary-gemini-bridge.js +17 -17
  20. package/dist/bin/pushary-gemini-hook.js +32 -32
  21. package/dist/bin/pushary-hook.js +35 -35
  22. package/dist/bin/pushary-login.js +21 -21
  23. package/dist/bin/pushary-logout.js +27 -27
  24. package/dist/bin/pushary-mcp.js +12 -12
  25. package/dist/bin/pushary-mode.js +15 -15
  26. package/dist/bin/pushary-notification-hook.js +27 -27
  27. package/dist/bin/pushary-opencode-hook.js +31 -31
  28. package/dist/bin/pushary-permission-denied-hook.js +35 -35
  29. package/dist/bin/pushary-permission-hook.js +35 -35
  30. package/dist/bin/pushary-post-hook.js +28 -28
  31. package/dist/bin/pushary-prompt-hook.js +27 -27
  32. package/dist/bin/pushary-session-end-hook.js +27 -27
  33. package/dist/bin/pushary-session-start-hook.js +36 -36
  34. package/dist/bin/pushary-setup.js +119 -52
  35. package/dist/bin/pushary-stats.js +5 -5
  36. package/dist/bin/pushary-status.js +33 -33
  37. package/dist/bin/pushary-stop-hook.js +27 -27
  38. package/dist/bin/pushary-stopfailure-hook.js +27 -27
  39. package/dist/bin/pushary-suggestions.js +15 -15
  40. package/dist/bin/pushary-transcript-register.js +17 -17
  41. package/dist/bin/pushary-transcripts.js +25 -25
  42. package/dist/bin/pushary-upgrade.js +41 -41
  43. package/dist/bin/pushary-wait.js +15 -15
  44. package/dist/bin/pushary.js +7 -7
  45. package/dist/{chunk-MCI6KYN7.js → chunk-2ELNRGNX.js} +3 -3
  46. package/dist/{chunk-OZG6CGYW.js → chunk-2LGDEPVL.js} +6 -6
  47. package/dist/{chunk-5TZYAMGW.js → chunk-33BYPZ52.js} +1 -1
  48. package/dist/{chunk-LUVSHGLH.js → chunk-4KDRT3OA.js} +1 -1
  49. package/dist/{chunk-B4VIT5N3.js → chunk-4L5WPDTB.js} +1 -1
  50. package/dist/{chunk-BHNX7XNO.js → chunk-52UXNCZG.js} +3 -3
  51. package/dist/{chunk-56HFENZK.js → chunk-5TWW7ZUL.js} +5 -5
  52. package/dist/{chunk-CWWO3JTD.js → chunk-63WX5KZN.js} +3 -3
  53. package/dist/{chunk-Z2WQD2W6.js → chunk-6IWOMXUF.js} +4 -4
  54. package/dist/{chunk-R7FSMUHG.js → chunk-6LZ7MXHD.js} +2 -1
  55. package/dist/{chunk-EMODTMHE.js → chunk-6UK4K5RS.js} +1 -1
  56. package/dist/{chunk-RPXSGCRG.js → chunk-72LP4RPC.js} +2 -2
  57. package/dist/{chunk-WC25Z4XS.js → chunk-7LTP2GHO.js} +2 -2
  58. package/dist/{chunk-QESEICW4.js → chunk-A2H256WR.js} +1 -1
  59. package/dist/{chunk-23CGCD5L.js → chunk-B4JQIH5M.js} +6 -6
  60. package/dist/{chunk-4EBJ4PTZ.js → chunk-BWREST4F.js} +1 -1
  61. package/dist/{chunk-ZVJIJPQY.js → chunk-BYKRAYGD.js} +1 -1
  62. package/dist/{chunk-KEBI7NYU.js → chunk-CUR2DCZN.js} +4 -4
  63. package/dist/chunk-D3UFDCTQ.js +87 -0
  64. package/dist/{chunk-BE5LO5VW.js → chunk-DZIZ3XFL.js} +2 -2
  65. package/dist/{chunk-WTULK73V.js → chunk-EPWOARGR.js} +2 -2
  66. package/dist/{chunk-GV3FDGQH.js → chunk-FCSPMSDC.js} +4 -4
  67. package/dist/{chunk-ZGYGKKXF.js → chunk-FNAH3YJC.js} +16 -16
  68. package/dist/{chunk-ZKKZEVNI.js → chunk-G3VSMI7K.js} +2 -2
  69. package/dist/{chunk-LVOHE66T.js → chunk-GK5X2ZTN.js} +5 -5
  70. package/dist/{chunk-UK5DKLZY.js → chunk-GURIOZE7.js} +8 -8
  71. package/dist/{chunk-7VMVMC4H.js → chunk-HOQH5CLZ.js} +1 -1
  72. package/dist/{chunk-LS6BU5RM.js → chunk-IDLOJIIS.js} +1 -1
  73. package/dist/{chunk-P5QXH5QI.js → chunk-IIN26HL7.js} +1 -1
  74. package/dist/{chunk-22CXL7YI.js → chunk-IRPIMQ7U.js} +3 -3
  75. package/dist/{chunk-4JTZZXB3.js → chunk-JKWUF776.js} +3 -3
  76. package/dist/{chunk-7QWH257P.js → chunk-JZT2LPRM.js} +1 -1
  77. package/dist/{chunk-EY5CVFDL.js → chunk-K2SKUBYY.js} +12 -12
  78. package/dist/{chunk-EOKUIOMT.js → chunk-KFALRZIN.js} +4 -4
  79. package/dist/{chunk-AJQ4TTPJ.js → chunk-KGFB2LEB.js} +3 -3
  80. package/dist/{chunk-XLMJEEW3.js → chunk-KKPT7ROP.js} +2 -2
  81. package/dist/{chunk-5BTAIFVV.js → chunk-KS3PNTRT.js} +1 -1
  82. package/dist/{chunk-S7WVJ6AR.js → chunk-L4OGTRVW.js} +4 -4
  83. package/dist/{chunk-QLGLUUOP.js → chunk-LD4R2P6N.js} +1 -1
  84. package/dist/{chunk-YESBU4VQ.js → chunk-LJRPWUST.js} +3 -3
  85. package/dist/{chunk-DDJHPMBJ.js → chunk-LMU6NG2G.js} +1 -1
  86. package/dist/{chunk-C5LIS3XM.js → chunk-LQXUWXQP.js} +7 -0
  87. package/dist/{chunk-4524ZR2U.js → chunk-MKHVLDMN.js} +2 -2
  88. package/dist/{chunk-C6SKS6IU.js → chunk-MNU5N3CQ.js} +11 -11
  89. package/dist/{chunk-BHKODM4L.js → chunk-MOC2DN42.js} +2 -2
  90. package/dist/{chunk-44BLJJPH.js → chunk-NTMKJRQ3.js} +2 -2
  91. package/dist/{chunk-FC2ENROR.js → chunk-OONMKLUF.js} +4 -4
  92. package/dist/{chunk-5AXDNDUJ.js → chunk-PXZTCR4M.js} +2 -2
  93. package/dist/{chunk-EC7VHNHE.js → chunk-PY6CM4NK.js} +6 -6
  94. package/dist/{chunk-HNFYZPNJ.js → chunk-Q6P7G4NY.js} +4 -4
  95. package/dist/{chunk-3KRGT5AZ.js → chunk-QKTF7WS6.js} +67 -4
  96. package/dist/{chunk-WGOTBZ23.js → chunk-R34RWVN2.js} +6 -5
  97. package/dist/{chunk-HGIW56MU.js → chunk-RO6EVL5C.js} +2 -2
  98. package/dist/{chunk-JK7DTAQH.js → chunk-RWLNTZK5.js} +5 -5
  99. package/dist/{chunk-PYT4WXXR.js → chunk-S3A4PCRR.js} +10 -10
  100. package/dist/{chunk-YCU7Y77H.js → chunk-S7HGPKCL.js} +1 -1
  101. package/dist/{chunk-F37YD4YE.js → chunk-SQL5YXUH.js} +1 -1
  102. package/dist/{chunk-WTBFPSTR.js → chunk-TJXJGMSP.js} +4 -4
  103. package/dist/{chunk-44WPMZGQ.js → chunk-TRV3ETGY.js} +5 -5
  104. package/dist/{chunk-WWCM6UL7.js → chunk-USFZJAB4.js} +1 -1
  105. package/dist/{chunk-5I3UQEAX.js → chunk-VTJ4WZOC.js} +3 -3
  106. package/dist/{chunk-VP4T5352.js → chunk-WH4ODOCE.js} +6 -6
  107. package/dist/{chunk-YY5YVMBA.js → chunk-WMBWKPKJ.js} +5 -5
  108. package/dist/{chunk-HIIXYZYV.js → chunk-WOSO4YFQ.js} +3 -3
  109. package/dist/{chunk-WGT5LCIB.js → chunk-WPBWJMBZ.js} +5 -5
  110. package/dist/{chunk-CZOMD2IW.js → chunk-WUT3PO33.js} +8 -8
  111. package/dist/{chunk-AGUL2JDK.js → chunk-Y7INHH5G.js} +3 -3
  112. package/dist/{chunk-YD376BLV.js → chunk-YNCVSKUW.js} +5 -5
  113. package/dist/{chunk-E32SRYTE.js → chunk-YRJZF5RG.js} +3 -3
  114. package/dist/{chunk-74QCFZKV.js → chunk-YU5XE6VC.js} +6 -6
  115. package/dist/{chunk-YFK3MJGZ.js → chunk-YZA3YBHX.js} +2 -2
  116. package/dist/{chunk-53KLGXFL.js → chunk-ZBMVOMFG.js} +4 -3
  117. package/dist/{chunk-H33CFJOF.js → chunk-ZJZNT2G5.js} +4 -4
  118. package/dist/{chunk-6LALK6GI.js → chunk-ZORBUQFG.js} +2 -2
  119. package/dist/{chunk-CV4EIXPV.js → chunk-ZSOCJHL7.js} +188 -13
  120. package/dist/{codex-app-cards-switch-5PWB62W3.js → codex-app-cards-switch-F7WQ7Y3I.js} +11 -11
  121. package/dist/{codex-card-routing-I6YOJBTT.js → codex-card-routing-EVL5L36G.js} +2 -2
  122. package/dist/{codex-desktop-launch-BCPUKOCV.js → codex-desktop-launch-PL6Z2ELZ.js} +1 -1
  123. package/dist/{codex-session-launch-4ZUBROFZ.js → codex-session-launch-7NQEAUDU.js} +20 -20
  124. package/dist/{config-2CHOLFNB.js → config-KFFD4VWH.js} +3 -3
  125. package/dist/{global-upgrade-4IKWJHLE.js → global-upgrade-L3CY6EFF.js} +9 -9
  126. package/dist/{identity-I2VWLZAQ.js → identity-DPYYIMHL.js} +4 -4
  127. package/dist/{live-capabilities-4CLCROSP.js → live-capabilities-QJEXK6GH.js} +4 -4
  128. package/dist/{paths-YMHQKLFX.js → paths-PEF6C64P.js} +3 -3
  129. package/dist/{reapply-FBQ7VR6L.js → reapply-7APCQRRK.js} +29 -29
  130. package/dist/src/index.js +34 -34
  131. package/dist/{upgrade-lock-7ONNXM6V.js → upgrade-lock-A7OKXMRW.js} +4 -4
  132. package/dist/{usage-GWUTCS5A.js → usage-HSS33762.js} +3 -3
  133. package/package.json +1 -1
  134. package/dist/chunk-I6HXZIER.js +0 -31
@@ -1,12 +1,12 @@
1
1
  import {
2
2
  parseSseMessages
3
- } from "./chunk-WGT5LCIB.js";
3
+ } from "./chunk-WPBWJMBZ.js";
4
4
  import {
5
5
  fetchAsCredential
6
- } from "./chunk-YCU7Y77H.js";
6
+ } from "./chunk-S7HGPKCL.js";
7
7
  import {
8
8
  NPX_LATEST_COMMAND
9
- } from "./chunk-R7FSMUHG.js";
9
+ } from "./chunk-6LZ7MXHD.js";
10
10
 
11
11
  // src/mcp-stdio-bridge.ts
12
12
  var MCP_BRIDGE_BINARY = "pushary-mcp";
@@ -1,22 +1,22 @@
1
1
  import {
2
2
  cursorGateOwnsClaudeCall,
3
3
  readCursorGateRegistration
4
- } from "./chunk-S7WVJ6AR.js";
4
+ } from "./chunk-L4OGTRVW.js";
5
5
  import {
6
6
  registerTranscript
7
- } from "./chunk-PYT4WXXR.js";
7
+ } from "./chunk-S3A4PCRR.js";
8
8
  import {
9
9
  namedEvent
10
- } from "./chunk-WGOTBZ23.js";
10
+ } from "./chunk-R34RWVN2.js";
11
11
  import {
12
12
  writeDegraded
13
- } from "./chunk-74QCFZKV.js";
13
+ } from "./chunk-YU5XE6VC.js";
14
14
  import {
15
15
  claudeShapedHookInput,
16
16
  hookCompatibleProfileBySource,
17
17
  isGrokHookPayload,
18
18
  isGrokSessionEndStop
19
- } from "./chunk-C5LIS3XM.js";
19
+ } from "./chunk-LQXUWXQP.js";
20
20
 
21
21
  // src/tool-hook-input.ts
22
22
  var OPTIONAL_TEXT_FIELDS = ["hook_event_name", "session_id", "cwd", "transcript_path", "tool_use_id", "permission_mode", "cursor_version"];
@@ -4,15 +4,15 @@ import {
4
4
  claimThrottle,
5
5
  releaseThrottle,
6
6
  reportEvent
7
- } from "./chunk-EY5CVFDL.js";
7
+ } from "./chunk-K2SKUBYY.js";
8
8
  import {
9
9
  deriveToolTarget,
10
10
  permissionDeniedAction
11
- } from "./chunk-7QWH257P.js";
11
+ } from "./chunk-JZT2LPRM.js";
12
12
  import {
13
13
  machineDecisionFor,
14
14
  wireVerdictFor
15
- } from "./chunk-C5LIS3XM.js";
15
+ } from "./chunk-LQXUWXQP.js";
16
16
 
17
17
  // src/machine-decision-audit.ts
18
18
  import { basename } from "path";
@@ -1,17 +1,17 @@
1
1
  import {
2
2
  compatibleConfigFile,
3
3
  hasCompatibleHooks
4
- } from "./chunk-WGOTBZ23.js";
4
+ } from "./chunk-R34RWVN2.js";
5
5
  import {
6
6
  pusharyHookExecutable
7
- } from "./chunk-KEBI7NYU.js";
7
+ } from "./chunk-CUR2DCZN.js";
8
8
  import {
9
9
  isProtectedByScope,
10
10
  registerHookEntry
11
- } from "./chunk-RPXSGCRG.js";
11
+ } from "./chunk-72LP4RPC.js";
12
12
  import {
13
13
  isRecord
14
- } from "./chunk-C5LIS3XM.js";
14
+ } from "./chunk-LQXUWXQP.js";
15
15
 
16
16
  // src/cursor-config.ts
17
17
  var hookCommandOf = (entry) => {
@@ -2,7 +2,7 @@ import {
2
2
  DISCONNECT_AGENT_IDS,
3
3
  SETUP_AGENT_CHOICES,
4
4
  isApprovalMode
5
- } from "./chunk-C5LIS3XM.js";
5
+ } from "./chunk-LQXUWXQP.js";
6
6
 
7
7
  // src/cli/mode-request.ts
8
8
  var parseDuration = (value) => {
@@ -241,6 +241,7 @@ var SETUP_OPTIONS = [
241
241
  ["--transcripts on|off", "Enable or disable encrypted transcript sync on this machine"],
242
242
  ["--skip-phone", "Skip pairing a phone"],
243
243
  ["--take-over-hooks", "Replace hooks the Pushary Mac app owns with the CLI's. Without it the app's wiring is kept"],
244
+ ["--hermes-gate-terminal", "Add Hermes's terminal tool to PUSHARY_GATE_TOOLS when Hermes skips its own approvals on a container backend"],
244
245
  ["--verify roundtrip", "Send a real question and wait for you to answer it (default when a human is present)"],
245
246
  ["--verify push", "Only prove a notification was delivered. Automatic when nobody is at the terminal"],
246
247
  ["--verify none", "Skip the final check entirely"],
@@ -2,7 +2,7 @@ import {
2
2
  localRepoKey,
3
3
  normalizeRepoRemote,
4
4
  parseGitBranch
5
- } from "./chunk-C5LIS3XM.js";
5
+ } from "./chunk-LQXUWXQP.js";
6
6
 
7
7
  // src/repo.ts
8
8
  import { existsSync, readFileSync, statSync } from "fs";
@@ -3,7 +3,7 @@ import {
3
3
  formatVersion,
4
4
  quoteIfNeeded,
5
5
  shellDoubleQuoted
6
- } from "./chunk-5I3UQEAX.js";
6
+ } from "./chunk-VTJ4WZOC.js";
7
7
  import {
8
8
  writeFileAtomic
9
9
  } from "./chunk-TODDEIYG.js";
@@ -20,7 +20,7 @@ import {
20
20
  PRETOOLUSE_GATED_TOOLS,
21
21
  PUSHARY_TOOL_PREFIX,
22
22
  withHookHoldBudget
23
- } from "./chunk-C5LIS3XM.js";
23
+ } from "./chunk-LQXUWXQP.js";
24
24
 
25
25
  // src/setup/paths.ts
26
26
  import { createHash as createHash2 } from "crypto";
@@ -1,10 +1,10 @@
1
1
  import {
2
2
  callDecisionStore,
3
3
  identifyingToolInput
4
- } from "./chunk-EY5CVFDL.js";
4
+ } from "./chunk-K2SKUBYY.js";
5
5
  import {
6
6
  canonicalJson
7
- } from "./chunk-RPXSGCRG.js";
7
+ } from "./chunk-72LP4RPC.js";
8
8
 
9
9
  // src/phone-approval.ts
10
10
  import { createHash } from "crypto";
@@ -3,7 +3,7 @@ import {
3
3
  } from "./chunk-BG4HHB7E.js";
4
4
  import {
5
5
  renderCommandHelp
6
- } from "./chunk-R7FSMUHG.js";
6
+ } from "./chunk-6LZ7MXHD.js";
7
7
  import {
8
8
  getPackageVersion
9
9
  } from "./chunk-WIIMW5YO.js";
@@ -2,10 +2,10 @@ import {
2
2
  SIGNED_OUT_ON_MAC_MESSAGE,
3
3
  describeSignedOutKey,
4
4
  readSignedOutDiagnosis
5
- } from "./chunk-ZKKZEVNI.js";
5
+ } from "./chunk-G3VSMI7K.js";
6
6
  import {
7
7
  APPROVAL_RULES_PATH
8
- } from "./chunk-YFK3MJGZ.js";
8
+ } from "./chunk-YZA3YBHX.js";
9
9
  import {
10
10
  createIo
11
11
  } from "./chunk-FO3MDD26.js";
@@ -14,19 +14,19 @@ import {
14
14
  checkApiKey,
15
15
  describeKeyCheck,
16
16
  keyCheckFromResponse
17
- } from "./chunk-E32SRYTE.js";
17
+ } from "./chunk-YRJZF5RG.js";
18
18
  import {
19
19
  readKeySource
20
- } from "./chunk-HIIXYZYV.js";
20
+ } from "./chunk-WOSO4YFQ.js";
21
21
  import {
22
22
  getBaseUrl
23
- } from "./chunk-4EBJ4PTZ.js";
23
+ } from "./chunk-BWREST4F.js";
24
24
  import {
25
25
  EXIT
26
26
  } from "./chunk-BG4HHB7E.js";
27
27
  import {
28
28
  KEY_SCOPE
29
- } from "./chunk-C5LIS3XM.js";
29
+ } from "./chunk-LQXUWXQP.js";
30
30
 
31
31
  // src/cli/report-key.ts
32
32
  var { dim, yellow } = createIo();
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  NPX_LATEST_COMMAND
3
- } from "./chunk-R7FSMUHG.js";
3
+ } from "./chunk-6LZ7MXHD.js";
4
4
 
5
5
  // src/config.ts
6
6
  import { readFileSync } from "fs";
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  isFinalCommandAckRefusal
3
- } from "./chunk-C5LIS3XM.js";
3
+ } from "./chunk-LQXUWXQP.js";
4
4
 
5
5
  // src/command-ack-outcome.ts
6
6
  var SETTLED_ACK = { outcome: "settled" };
@@ -1,9 +1,9 @@
1
1
  import {
2
2
  AGENT_CHOICES
3
- } from "./chunk-53KLGXFL.js";
3
+ } from "./chunk-ZBMVOMFG.js";
4
4
  import {
5
5
  BELL_HOOK_BINARY
6
- } from "./chunk-F37YD4YE.js";
6
+ } from "./chunk-SQL5YXUH.js";
7
7
  import {
8
8
  CLAUDE_HOOK_EVENTS,
9
9
  CODEX_HOOK_EVENTS,
@@ -16,13 +16,13 @@ import {
16
16
  isBridgeLocator,
17
17
  isProtectedByScope,
18
18
  registerHookEntry
19
- } from "./chunk-RPXSGCRG.js";
19
+ } from "./chunk-72LP4RPC.js";
20
20
  import {
21
21
  CURSOR_GATE_EVENTS,
22
22
  HOOK_BUDGETS,
23
23
  HOOK_LOCATOR_BINARY,
24
24
  hookCommandHoldBudget
25
- } from "./chunk-C5LIS3XM.js";
25
+ } from "./chunk-LQXUWXQP.js";
26
26
 
27
27
  // src/gemini-config.ts
28
28
  var GEMINI_HOOK_BINARY = "pushary-gemini-hook";
@@ -0,0 +1,87 @@
1
+ import {
2
+ HERMES_APPROVAL_TRANSPORT_KEY,
3
+ HERMES_COMMAND_ALLOWLIST_KEY,
4
+ HERMES_DOCKER_MOUNT_CWD_KEY,
5
+ HERMES_DOCKER_VOLUMES_KEY,
6
+ HERMES_GATE_TOOLS_KEY,
7
+ HERMES_TERMINAL_ENV_KEY,
8
+ HERMES_TERMINAL_SECTION,
9
+ gateToolsWithShell,
10
+ gatesHermesShell,
11
+ hermesAlwaysAllowsShell,
12
+ hermesApprovalCoverage,
13
+ hermesGateToolsFrom,
14
+ hermesShellGateState,
15
+ readHermesSetting,
16
+ readSetupReceipt,
17
+ receiptWithSnapshot,
18
+ settingSnapshot,
19
+ writeHermesSetting,
20
+ writeSetupReceipt
21
+ } from "./chunk-ZSOCJHL7.js";
22
+ import {
23
+ configFilePath
24
+ } from "./chunk-BWREST4F.js";
25
+ import {
26
+ readJsonSafe,
27
+ writeJsonAtomic
28
+ } from "./chunk-TODDEIYG.js";
29
+ import {
30
+ readSetupOutcomeProperties
31
+ } from "./chunk-LQXUWXQP.js";
32
+
33
+ // src/hermes/shell-gate.ts
34
+ var readHermesShellGate = async (launcher) => {
35
+ const [terminal, terminalEnv, dockerVolumes, dockerMountCwd, gateReading, allowlist, transport] = await Promise.all([
36
+ readHermesSetting(launcher, HERMES_TERMINAL_SECTION),
37
+ readHermesSetting(launcher, HERMES_TERMINAL_ENV_KEY),
38
+ readHermesSetting(launcher, HERMES_DOCKER_VOLUMES_KEY),
39
+ readHermesSetting(launcher, HERMES_DOCKER_MOUNT_CWD_KEY),
40
+ readHermesSetting(launcher, HERMES_GATE_TOOLS_KEY),
41
+ readHermesSetting(launcher, HERMES_COMMAND_ALLOWLIST_KEY),
42
+ readHermesSetting(launcher, HERMES_APPROVAL_TRANSPORT_KEY)
43
+ ]);
44
+ return hermesShellGateState({
45
+ coverage: hermesApprovalCoverage({ terminal, terminalEnv, dockerVolumes, dockerMountCwd }),
46
+ gate: hermesGateToolsFrom(gateReading),
47
+ alwaysAllowed: hermesAlwaysAllowsShell({ allowlist, transport })
48
+ });
49
+ };
50
+ var RECEIPT_FAILURES = {
51
+ missing: "receipt_missing",
52
+ invalid: "receipt_invalid"
53
+ };
54
+ var gateHermesShell = async (request) => {
55
+ const stored = readSetupReceipt(request.receipts);
56
+ if (stored.kind !== "ok") return { kind: "failed", reason: RECEIPT_FAILURES[stored.kind] };
57
+ const reading = await readHermesSetting(request.launcher, HERMES_GATE_TOOLS_KEY);
58
+ const gate = hermesGateToolsFrom(reading);
59
+ if (gatesHermesShell(gate)) return { kind: "already_gated" };
60
+ const value = gateToolsWithShell(gate);
61
+ if (reading === null || value === null) return { kind: "failed", reason: "setting_unreadable" };
62
+ writeSetupReceipt(request.receipts, receiptWithSnapshot(stored.receipt, settingSnapshot(HERMES_GATE_TOOLS_KEY, reading)));
63
+ return await writeHermesSetting(request.launcher, HERMES_GATE_TOOLS_KEY, value) ? { kind: "gated", value } : { kind: "failed", reason: "setting_refused" };
64
+ };
65
+
66
+ // src/setup/failure-record.ts
67
+ import { dirname, join } from "path";
68
+ var failurePath = () => join(dirname(configFilePath()), "last-setup-failure.json");
69
+ var saveSetupFailure = (body, path = failurePath()) => {
70
+ const properties = readSetupOutcomeProperties(body);
71
+ if (properties.exitCode === null || properties.exitCode === 0) return;
72
+ writeJsonAtomic(path, { ...properties, recordedAt: (/* @__PURE__ */ new Date()).toISOString() }, 384);
73
+ };
74
+ var readSetupFailure = (path = failurePath()) => {
75
+ const result = readJsonSafe(path);
76
+ if (result.kind !== "ok" || typeof result.value !== "object" || result.value === null || Array.isArray(result.value)) return null;
77
+ const body = result.value;
78
+ if (!("recordedAt" in body) || typeof body.recordedAt !== "string" || body.recordedAt.length > 30 || !Number.isFinite(Date.parse(body.recordedAt))) return null;
79
+ return { ...readSetupOutcomeProperties({ ...body }), recordedAt: body.recordedAt };
80
+ };
81
+
82
+ export {
83
+ readHermesShellGate,
84
+ gateHermesShell,
85
+ saveSetupFailure,
86
+ readSetupFailure
87
+ };
@@ -3,10 +3,10 @@ import {
3
3
  } from "./chunk-CYTPQDQY.js";
4
4
  import {
5
5
  parseVersion
6
- } from "./chunk-5I3UQEAX.js";
6
+ } from "./chunk-VTJ4WZOC.js";
7
7
  import {
8
8
  isRecord
9
- } from "./chunk-C5LIS3XM.js";
9
+ } from "./chunk-LQXUWXQP.js";
10
10
 
11
11
  // src/setup/agent-probe.ts
12
12
  import { execSync } from "child_process";
@@ -1,11 +1,11 @@
1
1
  import {
2
2
  autoUpdateLock
3
- } from "./chunk-RPXSGCRG.js";
3
+ } from "./chunk-72LP4RPC.js";
4
4
  import {
5
5
  installPackageGlobally,
6
6
  npmErrorMessage,
7
7
  npmExitedOnPermissionDenied
8
- } from "./chunk-5I3UQEAX.js";
8
+ } from "./chunk-VTJ4WZOC.js";
9
9
  import {
10
10
  writeJsonAtomic
11
11
  } from "./chunk-TODDEIYG.js";
@@ -12,7 +12,7 @@ import {
12
12
  reachVerdict,
13
13
  reachesYou,
14
14
  verifyDelivery
15
- } from "./chunk-EC7VHNHE.js";
15
+ } from "./chunk-PY6CM4NK.js";
16
16
  import {
17
17
  humanIsTty,
18
18
  writeHuman
@@ -24,14 +24,14 @@ import {
24
24
  } from "./chunk-FO3MDD26.js";
25
25
  import {
26
26
  reportedInstallSource
27
- } from "./chunk-BHKODM4L.js";
27
+ } from "./chunk-MOC2DN42.js";
28
28
  import {
29
29
  NPX_LATEST_COMMAND
30
- } from "./chunk-R7FSMUHG.js";
30
+ } from "./chunk-6LZ7MXHD.js";
31
31
  import {
32
32
  NO_PAIRING_COMPUTER,
33
33
  PAIR_TTL_SECONDS
34
- } from "./chunk-C5LIS3XM.js";
34
+ } from "./chunk-LQXUWXQP.js";
35
35
 
36
36
  // src/onboarding.ts
37
37
  import qrcodeTerminal from "qrcode-terminal";
@@ -2,37 +2,37 @@ import {
2
2
  forgetPhoneApproval,
3
3
  rememberPhoneApproval,
4
4
  takePhoneApproval
5
- } from "./chunk-WC25Z4XS.js";
5
+ } from "./chunk-7LTP2GHO.js";
6
6
  import {
7
7
  claudeSettingsLocationFor,
8
8
  readClaudePermissionRules
9
- } from "./chunk-44BLJJPH.js";
9
+ } from "./chunk-NTMKJRQ3.js";
10
10
  import {
11
11
  askAgentQuestions,
12
12
  defersToNativeMode,
13
13
  outcomeOfFailedAsk,
14
14
  storedWaitDeadline
15
- } from "./chunk-44WPMZGQ.js";
15
+ } from "./chunk-TRV3ETGY.js";
16
16
  import {
17
17
  reportMachineDenial
18
- } from "./chunk-CWWO3JTD.js";
18
+ } from "./chunk-63WX5KZN.js";
19
19
  import {
20
20
  isGatingMoment,
21
21
  recordKeylessMoment
22
- } from "./chunk-5TZYAMGW.js";
22
+ } from "./chunk-33BYPZ52.js";
23
23
  import {
24
24
  isAdmitted,
25
25
  readAdmissionRules
26
- } from "./chunk-56HFENZK.js";
26
+ } from "./chunk-5TWW7ZUL.js";
27
27
  import {
28
28
  isDeferAnswer,
29
29
  oncePerSession
30
- } from "./chunk-WWCM6UL7.js";
30
+ } from "./chunk-USFZJAB4.js";
31
31
  import {
32
32
  activeHookSource,
33
33
  activeIdentity,
34
34
  namedSource
35
- } from "./chunk-WGOTBZ23.js";
35
+ } from "./chunk-R34RWVN2.js";
36
36
  import {
37
37
  DEFAULT_SESSION,
38
38
  approvalAwaitingRetry,
@@ -53,7 +53,7 @@ import {
53
53
  settleQuestionsForToolUse,
54
54
  sweepFilesOlderThan,
55
55
  userScope
56
- } from "./chunk-EY5CVFDL.js";
56
+ } from "./chunk-K2SKUBYY.js";
57
57
  import {
58
58
  UNNAMED_ACTION,
59
59
  deriveAction,
@@ -64,12 +64,12 @@ import {
64
64
  patchDeletesFiles,
65
65
  permissionDeniedAction,
66
66
  scopePathFor
67
- } from "./chunk-7QWH257P.js";
67
+ } from "./chunk-JZT2LPRM.js";
68
68
  import {
69
69
  branchFor,
70
70
  repoKeyFor,
71
71
  repositoryScopeFor
72
- } from "./chunk-EMODTMHE.js";
72
+ } from "./chunk-6UK4K5RS.js";
73
73
  import {
74
74
  askUser,
75
75
  cancelQuestion,
@@ -86,20 +86,20 @@ import {
86
86
  waitForQuestion,
87
87
  waitsForThePhone,
88
88
  withdrawQuestion
89
- } from "./chunk-74QCFZKV.js";
89
+ } from "./chunk-YU5XE6VC.js";
90
90
  import {
91
91
  getMachineId
92
- } from "./chunk-5BTAIFVV.js";
92
+ } from "./chunk-KS3PNTRT.js";
93
93
  import {
94
94
  getApiKey,
95
95
  getBaseUrl
96
- } from "./chunk-4EBJ4PTZ.js";
96
+ } from "./chunk-BWREST4F.js";
97
97
  import {
98
98
  writeFileAtomic
99
99
  } from "./chunk-TODDEIYG.js";
100
100
  import {
101
101
  NPX_LATEST_COMMAND
102
- } from "./chunk-R7FSMUHG.js";
102
+ } from "./chunk-6LZ7MXHD.js";
103
103
  import {
104
104
  AGENT_QUESTION_STRATEGY,
105
105
  AGENT_QUESTION_TOOL,
@@ -168,7 +168,7 @@ import {
168
168
  timeoutActionWithoutLocalPrompt,
169
169
  unansweredRefusalReason,
170
170
  unapprovedScopeReason
171
- } from "./chunk-C5LIS3XM.js";
171
+ } from "./chunk-LQXUWXQP.js";
172
172
 
173
173
  // src/terminal-answer-watch.ts
174
174
  import { closeSync, openSync, readSync, statSync } from "fs";
@@ -4,10 +4,10 @@ import {
4
4
  keyPrefix,
5
5
  readConfigFileKey,
6
6
  readMacAppKeyPrefix
7
- } from "./chunk-HIIXYZYV.js";
7
+ } from "./chunk-WOSO4YFQ.js";
8
8
  import {
9
9
  NPX_LATEST_COMMAND
10
- } from "./chunk-R7FSMUHG.js";
10
+ } from "./chunk-6LZ7MXHD.js";
11
11
 
12
12
  // src/key-signed-out.ts
13
13
  var VERDICT_BY_CHECK = {
@@ -1,13 +1,13 @@
1
1
  import {
2
2
  compatibleConfigFile
3
- } from "./chunk-WGOTBZ23.js";
3
+ } from "./chunk-R34RWVN2.js";
4
4
  import {
5
5
  hookOwnerOf,
6
6
  hookOwnerOfCommands
7
- } from "./chunk-KEBI7NYU.js";
7
+ } from "./chunk-CUR2DCZN.js";
8
8
  import {
9
9
  AGENT_CHOICES
10
- } from "./chunk-53KLGXFL.js";
10
+ } from "./chunk-ZBMVOMFG.js";
11
11
  import {
12
12
  bridgeStub,
13
13
  claudeSettings,
@@ -19,7 +19,7 @@ import {
19
19
  resolveBridgeStub,
20
20
  vscodePluginDir,
21
21
  windowsNodeLauncherFor
22
- } from "./chunk-RPXSGCRG.js";
22
+ } from "./chunk-72LP4RPC.js";
23
23
  import {
24
24
  readJsonSafe
25
25
  } from "./chunk-TODDEIYG.js";
@@ -29,7 +29,7 @@ import {
29
29
  OPENCODE_APPROVAL_EVENT,
30
30
  hookCompatibleProfile,
31
31
  isRecord
32
- } from "./chunk-C5LIS3XM.js";
32
+ } from "./chunk-LQXUWXQP.js";
33
33
 
34
34
  // src/opencode-plugin.ts
35
35
  var OPENCODE_PLUGIN_MARKER = "pushary-opencode-plugin w1";
@@ -1,31 +1,31 @@
1
1
  import {
2
2
  MANAGED_CLAUDE_SETTINGS_BY_PLATFORM
3
- } from "./chunk-44BLJJPH.js";
3
+ } from "./chunk-NTMKJRQ3.js";
4
4
  import {
5
5
  declinedAgentsFile,
6
6
  readDeclinedAgents
7
- } from "./chunk-XLMJEEW3.js";
7
+ } from "./chunk-KKPT7ROP.js";
8
8
  import {
9
9
  OPENCODE_HOOK_BINARY,
10
10
  openCodeConfigDir,
11
11
  openCodePluginArgv,
12
12
  openCodePluginFile
13
- } from "./chunk-LVOHE66T.js";
13
+ } from "./chunk-GK5X2ZTN.js";
14
14
  import {
15
15
  liveCursorGateCoverage
16
- } from "./chunk-S7WVJ6AR.js";
16
+ } from "./chunk-L4OGTRVW.js";
17
17
  import {
18
18
  compatibleConfigFile,
19
19
  compatibleHookEvents,
20
20
  grokHome,
21
21
  parseConfigDocument
22
- } from "./chunk-WGOTBZ23.js";
22
+ } from "./chunk-R34RWVN2.js";
23
23
  import {
24
24
  DEFAULT_HOOKS_KEY_PATH,
25
25
  GEMINI_HOOK_BINARY,
26
26
  GEMINI_HOOK_EVENTS,
27
27
  hooksAt
28
- } from "./chunk-KEBI7NYU.js";
28
+ } from "./chunk-CUR2DCZN.js";
29
29
  import {
30
30
  CODEX_EARLIER_APPROVAL_MATCHERS,
31
31
  CODEX_HOOK_BINARY,
@@ -53,7 +53,7 @@ import {
53
53
  parseHookArgv,
54
54
  parseHookCommand,
55
55
  supportedClaudeEvents
56
- } from "./chunk-RPXSGCRG.js";
56
+ } from "./chunk-72LP4RPC.js";
57
57
  import {
58
58
  readRegularJsonFile,
59
59
  readRegularTextFile
@@ -67,7 +67,7 @@ import {
67
67
  OPENCODE_APPROVAL_EVENT,
68
68
  isRecord,
69
69
  matcherMatchesEveryCall
70
- } from "./chunk-C5LIS3XM.js";
70
+ } from "./chunk-LQXUWXQP.js";
71
71
 
72
72
  // src/hook-wiring.ts
73
73
  import { createHash } from "crypto";
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  readTranscriptPreference
3
- } from "./chunk-HIIXYZYV.js";
3
+ } from "./chunk-WOSO4YFQ.js";
4
4
 
5
5
  // src/transcript-setting.ts
6
6
  var transcriptEnvironmentPreference = () => {
@@ -2,7 +2,7 @@ import {
2
2
  isApprovalMode,
3
3
  isRecord,
4
4
  isTimeoutAction
5
- } from "./chunk-C5LIS3XM.js";
5
+ } from "./chunk-LQXUWXQP.js";
6
6
 
7
7
  // src/cli/settings-response.ts
8
8
  var isFiniteNumber = (value) => typeof value === "number" && Number.isFinite(value);
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  readConfigFileKey
3
- } from "./chunk-HIIXYZYV.js";
3
+ } from "./chunk-WOSO4YFQ.js";
4
4
 
5
5
  // src/bell/fleet.ts
6
6
  import { closeSync, constants, futimesSync, lstatSync, mkdirSync, openSync, readdirSync, unlinkSync } from "fs";
@@ -3,15 +3,15 @@ import {
3
3
  } from "./chunk-XMSDA5WA.js";
4
4
  import {
5
5
  fetchAsCredential
6
- } from "./chunk-YCU7Y77H.js";
6
+ } from "./chunk-S7HGPKCL.js";
7
7
  import {
8
8
  getBaseUrl
9
- } from "./chunk-4EBJ4PTZ.js";
9
+ } from "./chunk-BWREST4F.js";
10
10
  import {
11
11
  compressTranscriptRecord,
12
12
  redactSecretsFromContent,
13
13
  transcriptRecordPlaintext
14
- } from "./chunk-C5LIS3XM.js";
14
+ } from "./chunk-LQXUWXQP.js";
15
15
 
16
16
  // src/transcript-api.ts
17
17
  var providerRecipientSchema = external_exports.object({
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  SETUP_FLAGS
3
- } from "./chunk-53KLGXFL.js";
3
+ } from "./chunk-ZBMVOMFG.js";
4
4
  import {
5
5
  parseFlags
6
6
  } from "./chunk-YPY4YCIZ.js";
@@ -9,7 +9,7 @@ import {
9
9
  } from "./chunk-YU2EUD7O.js";
10
10
  import {
11
11
  NPX_LATEST_COMMAND
12
- } from "./chunk-R7FSMUHG.js";
12
+ } from "./chunk-6LZ7MXHD.js";
13
13
  import {
14
14
  CLAUDE_CONNECTOR_GUIDE,
15
15
  CLAUDE_CONNECTOR_STEPS,
@@ -17,7 +17,7 @@ import {
17
17
  CLAUDE_CONNECTOR_URL,
18
18
  COWORK_CONNECTOR_LIMIT,
19
19
  COWORK_STANDING_INSTRUCTIONS
20
- } from "./chunk-C5LIS3XM.js";
20
+ } from "./chunk-LQXUWXQP.js";
21
21
 
22
22
  // src/cli/cowork.ts
23
23
  import { readFileSync } from "fs";