pushary 1.9.19 → 1.9.21

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 1.9.21
+
+- `pushary setup` records a key as the one Pushary for Mac is signed in with only when Pushary for Mac holds that same key. It used to record any key it reused from your agent settings that way, including one left behind by an earlier CLI sign-in. `pushary clean` never revokes the Mac app's key, so it skipped that leftover key and left it working. Now it revokes it, and still leaves the Mac app's own key alone.
+- For the same reason, a leftover CLI key is no longer reported as "signed out on this Mac" when it stops working.
+- A key recorded by an earlier version stays recorded until setup saves a different key.
+
+## 1.9.20
+
+- `pushary setup` calls a key found in your agent settings the Pushary for Mac key only when Pushary for Mac holds that same key. A key left behind by an earlier CLI sign-in is called a key found in your agent settings, also when Pushary for Mac is installed.
+- On Windows, when npm cannot replace a file during the global install (EPERM), setup says to close other terminals or editors that use Node, then run setup again. It used to suggest an npm prefix change, which does not help when another program has the file open. EACCES, and EPERM on macOS and Linux, keep the npm prefix advice.
+- The pairing screen prints the fingerprint directly under the QR code, above the waiting line, so the QR code, the fingerprint and the waiting line all fit an 80x24 terminal. The fingerprint used to sit above the QR code and scroll off.
+- `Wrong account? Run npx pushary@latest setup --connect app` is printed only where that command can pair: not in CI, and not with `--skip-phone` or `--connect none`. On an inactive plan it is printed once, next to the account with no plan, instead of twice.
+
 ## 1.9.19
 
 - When nobody has answered the last 3 approvals in one agent session, Pushary stops sending that session's approvals to your phone. Each further call ends at once, exactly as it would have if nobody had answered it for the whole wait: under When I'm out Claude Code asks in its own prompt, a rule that refuses on timeout refuses it, a rule that approves on timeout runs it at once with nobody asked, and Codex set to never ask for approval refuses it. Nothing is sent, and the paused approval does not appear on your phone or in the Mac app. A command that deletes, rewrites history or reaches the network, such as `git push`, `rm` or `dropdb`, and any call Pushary flags as destructive, is still sent to your phone.

package/dist/bin/pushary-bell-hook.js

@@ -1,41 +1,41 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-MGW26CW7.js";
+} from "../chunk-ESHO7OC3.js";
 import {
   readHookInput
-} from "../chunk-T27NT7LJ.js";
-import "../chunk-XUUE6MYM.js";
-import "../chunk-6WEC3KZP.js";
-import "../chunk-6GQDOO5P.js";
-import "../chunk-XGHXQUDG.js";
-import "../chunk-ATDOYZXC.js";
-import "../chunk-2V2CCTGQ.js";
+} from "../chunk-II6OFDB3.js";
+import "../chunk-TJ4KMPYO.js";
+import "../chunk-VTR4VRL2.js";
+import "../chunk-L5NPRGVE.js";
+import "../chunk-6WINXCXY.js";
+import "../chunk-IM7EGZVH.js";
+import "../chunk-6WBIQQHO.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-E2RXTRM2.js";
-import "../chunk-SEZUF33H.js";
-import "../chunk-YAU4JCYI.js";
-import "../chunk-YONHM5BQ.js";
-import "../chunk-7TSL3JCX.js";
+import "../chunk-BDL6GJOQ.js";
+import "../chunk-PYWZYM74.js";
+import "../chunk-YLLGKY7K.js";
+import "../chunk-247PAUW6.js";
+import "../chunk-AXBFNQG6.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-4ABHSCFJ.js";
-import "../chunk-NILVJ7HV.js";
-import "../chunk-CRW4P7JU.js";
-import "../chunk-DVLQ4TVD.js";
+import "../chunk-FH4O3QGQ.js";
+import "../chunk-YCL2V5FD.js";
+import "../chunk-JHAPJRAN.js";
+import "../chunk-Y2BOLNJV.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-SXVXANPI.js";
-import "../chunk-UAA4BEYM.js";
-import "../chunk-B4OS2OVD.js";
-import "../chunk-KRDQQL2X.js";
+import "../chunk-ZNAGS7O7.js";
+import "../chunk-UZ2YEGIT.js";
+import "../chunk-TBCXMW2C.js";
+import "../chunk-NBGJ3EOE.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-MID7BURF.js";
-import "../chunk-FEKP3NJR.js";
-import "../chunk-FT7UNIS3.js";
-import "../chunk-XQ4HTTBB.js";
-import "../chunk-LHGB64O2.js";
-import "../chunk-6HMCOGKJ.js";
+import "../chunk-NVXC6ZBR.js";
+import "../chunk-CEF4UQ3X.js";
+import "../chunk-AQFEP65J.js";
+import "../chunk-4WHNRAOK.js";
+import "../chunk-B6KZME5D.js";
+import "../chunk-VBPASZU7.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,37 +5,39 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-MGW26CW7.js";
+} from "../chunk-ESHO7OC3.js";
 import {
   createIo
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-LXYNKZFP.js";
+} from "../chunk-BV5JPACQ.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-7TSL3JCX.js";
+} from "../chunk-AXBFNQG6.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-4ABHSCFJ.js";
+import "../chunk-FH4O3QGQ.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-MID7BURF.js";
+import "../chunk-NVXC6ZBR.js";
 import {
   claudeSettings
-} from "../chunk-FEKP3NJR.js";
+} from "../chunk-CEF4UQ3X.js";
 import {
   readJsonSafe,
   writeJsonAtomic
-} from "../chunk-FT7UNIS3.js";
-import "../chunk-XQ4HTTBB.js";
-import "../chunk-LHGB64O2.js";
-import "../chunk-6HMCOGKJ.js";
+} from "../chunk-AQFEP65J.js";
+import "../chunk-4WHNRAOK.js";
+import "../chunk-B6KZME5D.js";
+import {
+  isRecord
+} from "../chunk-VBPASZU7.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");
@@ -48,8 +50,8 @@ var readStdin = async () => {
 var settingsPath = () => claudeSettings();
 var loadSettings = (path) => {
   const existing = readJsonSafe(path);
-  if (existing.kind === "ok") return existing.value;
-  if (existing.kind === "unreadable" || existing.kind === "unparseable") {
+  if (existing.kind === "ok" && isRecord(existing.value)) return existing.value;
+  if (existing.kind !== "missing") {
     throw new Error(`${path} exists but could not be read. Fix or move it, then re-run. Nothing was changed.`);
   }
   return {};

package/dist/bin/pushary-claude.js

@@ -8,39 +8,39 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-KT36OCRW.js";
+} from "../chunk-7AFLHL2R.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-5LQRUBFB.js";
+} from "../chunk-PCVAK67W.js";
 import {
   claudeTranscriptPath,
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-XUUE6MYM.js";
-import "../chunk-6WEC3KZP.js";
+} from "../chunk-TJ4KMPYO.js";
+import "../chunk-VTR4VRL2.js";
 import {
   ensureDaemonRunning
-} from "../chunk-6GQDOO5P.js";
+} from "../chunk-L5NPRGVE.js";
 import {
   encryptRecord
-} from "../chunk-XGHXQUDG.js";
-import "../chunk-ATDOYZXC.js";
+} from "../chunk-6WINXCXY.js";
+import "../chunk-IM7EGZVH.js";
 import {
   transcriptsEnabled
-} from "../chunk-2V2CCTGQ.js";
+} from "../chunk-6WBIQQHO.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
-import "../chunk-SEZUF33H.js";
-import "../chunk-YAU4JCYI.js";
-import "../chunk-YONHM5BQ.js";
-import "../chunk-7TSL3JCX.js";
+import "../chunk-PYWZYM74.js";
+import "../chunk-YLLGKY7K.js";
+import "../chunk-247PAUW6.js";
+import "../chunk-AXBFNQG6.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-4ABHSCFJ.js";
+import "../chunk-FH4O3QGQ.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -58,8 +58,8 @@ import {
   reportEvent,
   savePendingCommand,
   scopePathFor
-} from "../chunk-NILVJ7HV.js";
-import "../chunk-CRW4P7JU.js";
+} from "../chunk-YCL2V5FD.js";
+import "../chunk-JHAPJRAN.js";
 import {
   askUser,
   cancelQuestion,
@@ -69,35 +69,35 @@ import {
   waitForAnswer,
   waitsForThePhone,
   withdrawQuestion
-} from "../chunk-DVLQ4TVD.js";
+} from "../chunk-Y2BOLNJV.js";
 import "../chunk-POFBE6ZY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-SXVXANPI.js";
-import "../chunk-UAA4BEYM.js";
-import "../chunk-B4OS2OVD.js";
+} from "../chunk-ZNAGS7O7.js";
+import "../chunk-UZ2YEGIT.js";
+import "../chunk-TBCXMW2C.js";
 import {
   getMachineId
-} from "../chunk-KRDQQL2X.js";
+} from "../chunk-NBGJ3EOE.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-MID7BURF.js";
-import "../chunk-FEKP3NJR.js";
-import "../chunk-FT7UNIS3.js";
+import "../chunk-NVXC6ZBR.js";
+import "../chunk-CEF4UQ3X.js";
+import "../chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-XQ4HTTBB.js";
+} from "../chunk-4WHNRAOK.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-LHGB64O2.js";
+} from "../chunk-B6KZME5D.js";
 import {
   DECISION_STOP_REASON,
   KILL_REASON,
   UNVERIFIABLE_APPROVAL_REASON,
   redactSecretsFromContent,
   resolveGate
-} from "../chunk-6HMCOGKJ.js";
+} from "../chunk-VBPASZU7.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {

package/dist/bin/pushary-clean.js

@@ -8,12 +8,12 @@ import {
   describeRevokeAttempt,
   keyNoLongerAccepted,
   revokeOwnKey
-} from "../chunk-SB2GN6OP.js";
+} from "../chunk-OYIN77HO.js";
 import {
   isCursorPluginLeftover,
   releaseSoleGate,
   withoutPusharyCursorHooks
-} from "../chunk-FRZS7XQF.js";
+} from "../chunk-U6GYFWT4.js";
 import {
   HERMES_PIP_PACKAGE,
   readHermesStatus,
@@ -22,27 +22,27 @@ import {
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-AXG5QMRM.js";
+} from "../chunk-QHY3UDYC.js";
 import {
   planFxRemoval,
   removeInstructionBlock
-} from "../chunk-5RMD75P2.js";
-import "../chunk-YXYSPMD3.js";
+} from "../chunk-4BKAZ4JN.js";
+import "../chunk-VD2AWSER.js";
 import {
   disableDaemonService
-} from "../chunk-6GQDOO5P.js";
+} from "../chunk-L5NPRGVE.js";
 import "../chunk-XHKBHWLX.js";
 import {
   APPROVAL_SETTINGS_PATH
-} from "../chunk-QDRDDVLH.js";
+} from "../chunk-SVQOEVAT.js";
 import {
   macAppKeepsMcpEntry,
   mcpServerBearer,
   pusharyKey,
   readMacAppAgentKey,
   setupReceiptKey
-} from "../chunk-HYPSYXP4.js";
-import "../chunk-2YAHQ763.js";
+} from "../chunk-4RJQPI36.js";
+import "../chunk-I52ALHOM.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -54,14 +54,14 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-DKFAJHLI.js";
+} from "../chunk-BERMVODT.js";
 import {
   ansiPainter,
   useColor
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-LXYNKZFP.js";
+} from "../chunk-BV5JPACQ.js";
 import {
   compatibleConfigFile,
   compatibleInstructionsFile,
@@ -74,7 +74,7 @@ import {
   removePusharySettings,
   removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-E2RXTRM2.js";
+} from "../chunk-BDL6GJOQ.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
@@ -82,12 +82,12 @@ import {
   resolveBridgeStub,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-SEZUF33H.js";
+} from "../chunk-PYWZYM74.js";
 import {
   removeGeminiSettings
-} from "../chunk-YAU4JCYI.js";
-import "../chunk-YONHM5BQ.js";
-import "../chunk-7TSL3JCX.js";
+} from "../chunk-YLLGKY7K.js";
+import "../chunk-247PAUW6.js";
+import "../chunk-AXBFNQG6.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
@@ -95,27 +95,29 @@ import "../chunk-6ICPEJY5.js";
 import {
   CANDIDATE_RCS,
   findExportedKeyLines,
+  isAdoptedMacAppKey,
   isDisabledExport,
   keyPrefix,
   readConfigFileKey,
+  readKeySource,
   readMacAppKeyPrefix,
   removeClaudeAlias
-} from "../chunk-4ABHSCFJ.js";
-import "../chunk-NILVJ7HV.js";
-import "../chunk-CRW4P7JU.js";
-import "../chunk-DVLQ4TVD.js";
+} from "../chunk-FH4O3QGQ.js";
+import "../chunk-YCL2V5FD.js";
+import "../chunk-JHAPJRAN.js";
+import "../chunk-Y2BOLNJV.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-SXVXANPI.js";
+import "../chunk-ZNAGS7O7.js";
 import {
   absoluteUrl
-} from "../chunk-UAA4BEYM.js";
-import "../chunk-B4OS2OVD.js";
-import "../chunk-KRDQQL2X.js";
+} from "../chunk-UZ2YEGIT.js";
+import "../chunk-TBCXMW2C.js";
+import "../chunk-NBGJ3EOE.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-MID7BURF.js";
+import "../chunk-NVXC6ZBR.js";
 import {
   claudeJson,
   claudeMcpReceipt,
@@ -152,14 +154,14 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-FEKP3NJR.js";
-import "../chunk-FT7UNIS3.js";
+} from "../chunk-CEF4UQ3X.js";
+import "../chunk-AQFEP65J.js";
 import {
   getBaseUrl
-} from "../chunk-XQ4HTTBB.js";
+} from "../chunk-4WHNRAOK.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-LHGB64O2.js";
+} from "../chunk-B6KZME5D.js";
 import {
   CLI_PACKAGE_NAMES,
   HOOK_COMPATIBLE_PROFILES,
@@ -171,7 +173,7 @@ import {
   globalRootFor,
   isValidApiKey,
   redactSecrets
-} from "../chunk-6HMCOGKJ.js";
+} from "../chunk-VBPASZU7.js";
 
 // bin/pushary-clean.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync4 } from "fs";
@@ -598,8 +600,8 @@ var cleanCompatibleAgent = (profile, scope, io, home) => {
 };
 
 // src/cli/clean-key-revocation.ts
-var isMacAppKey = (key, keys) => key === keys.macAppKey || keyPrefix(key) === keys.macAppKeyPrefix;
-var revocationFor = (keys) => (key) => isMacAppKey(key, keys) ? { kind: "mac_app_key", keyPrefix: keyPrefix(key) } : { kind: "revoke", key };
+var isMacAppCurrentOrAdoptedKey = (key, keys) => key === keys.macAppKey || isAdoptedMacAppKey(key, keys.macAppKeyPrefix);
+var revocationFor = (keys) => (key) => isMacAppCurrentOrAdoptedKey(key, keys) ? { kind: "mac_app_key", keyPrefix: keyPrefix(key) } : { kind: "revoke", key };
 var validKeys = (keys) => [...new Set(keys)].filter((key) => key !== null && isValidApiKey(key));
 var environmentOnlyKey = (keys, written) => validKeys([keys.envKey]).filter((key) => !written.includes(key)).map((key) => ({ kind: "environment_only", keyPrefix: keyPrefix(key) }));
 var planCliKeyRevocations = (keys) => {
@@ -870,10 +872,11 @@ var printKeyRevocation = (report) => {
 };
 var revokeKeysThisCliHolds = async () => {
   const baseUrl = getBaseUrl();
+  const source = readKeySource();
   const revocations = planCliKeyRevocations({
     configKey: readConfigFileKey(),
     profileKeys: findExportedKeyLines().map((line) => line.key),
-    envKey: process.env.PUSHARY_API_KEY?.trim() || null,
+    envKey: source.kind === "env" ? source.key : null,
     macAppKey: readMacAppAgentKey(),
     macAppKeyPrefix: readMacAppKeyPrefix()
   });

package/dist/bin/pushary-codex-bridge.js

@@ -5,10 +5,10 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-A6U4RRFM.js";
+} from "../chunk-LUDGBOLV.js";
 import {
   resolveProviderBinary
-} from "../chunk-OWUDBHXW.js";
+} from "../chunk-Z5EYCMJH.js";
 import "../chunk-RIVNNBEK.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
@@ -16,50 +16,50 @@ import {
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-KT36OCRW.js";
-import "../chunk-XGHXQUDG.js";
-import "../chunk-ATDOYZXC.js";
+} from "../chunk-7AFLHL2R.js";
+import "../chunk-6WINXCXY.js";
+import "../chunk-IM7EGZVH.js";
 import {
   transcriptsEnabled
-} from "../chunk-2V2CCTGQ.js";
+} from "../chunk-6WBIQQHO.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-4ABHSCFJ.js";
+import "../chunk-FH4O3QGQ.js";
 import {
   isAskUserResponse,
   isDecisionStopped,
   isWaitForAnswerResponse,
   withdrawQuestion,
   writeDegraded
-} from "../chunk-DVLQ4TVD.js";
+} from "../chunk-Y2BOLNJV.js";
 import "../chunk-POFBE6ZY.js";
 import {
   callMcpTool
-} from "../chunk-SXVXANPI.js";
-import "../chunk-UAA4BEYM.js";
-import "../chunk-B4OS2OVD.js";
+} from "../chunk-ZNAGS7O7.js";
+import "../chunk-UZ2YEGIT.js";
+import "../chunk-TBCXMW2C.js";
 import {
   getMachineId
-} from "../chunk-KRDQQL2X.js";
+} from "../chunk-NBGJ3EOE.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-MID7BURF.js";
-import "../chunk-FEKP3NJR.js";
-import "../chunk-FT7UNIS3.js";
+import "../chunk-NVXC6ZBR.js";
+import "../chunk-CEF4UQ3X.js";
+import "../chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-XQ4HTTBB.js";
-import "../chunk-LHGB64O2.js";
+} from "../chunk-4WHNRAOK.js";
+import "../chunk-B6KZME5D.js";
 import {
   elicitationContent,
   parseAgentQuestion,
   parseAgentQuestionAnswers,
   planElicitationAsk,
   readElicitationFields
-} from "../chunk-6HMCOGKJ.js";
+} from "../chunk-VBPASZU7.js";
 
 // bin/pushary-codex-bridge.ts
 import { existsSync } from "fs";

package/dist/bin/pushary-codex-hook.js

@@ -1,41 +1,41 @@
 #!/usr/bin/env node
 import {
   takeHookHoldBudget
-} from "../chunk-5C2GFTWE.js";
+} from "../chunk-TQIPIFL7.js";
 import {
   defersToNativeMode,
   reportMachineDenial
-} from "../chunk-23QKUOEV.js";
+} from "../chunk-G4TV5GYU.js";
 import {
   triggerAutoUpdate
-} from "../chunk-VCLDXVR3.js";
+} from "../chunk-5PW6GMQO.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-736I6CBY.js";
+} from "../chunk-UKCRTTKF.js";
 import {
   readHookInput
-} from "../chunk-T27NT7LJ.js";
+} from "../chunk-II6OFDB3.js";
 import {
   announceSubscriptionRequired,
   denyReasonFrom,
   isDeferAnswer
-} from "../chunk-5LQRUBFB.js";
-import "../chunk-XUUE6MYM.js";
-import "../chunk-6WEC3KZP.js";
-import "../chunk-6GQDOO5P.js";
-import "../chunk-XGHXQUDG.js";
-import "../chunk-ATDOYZXC.js";
-import "../chunk-2V2CCTGQ.js";
+} from "../chunk-PCVAK67W.js";
+import "../chunk-TJ4KMPYO.js";
+import "../chunk-VTR4VRL2.js";
+import "../chunk-L5NPRGVE.js";
+import "../chunk-6WINXCXY.js";
+import "../chunk-IM7EGZVH.js";
+import "../chunk-6WBIQQHO.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-E2RXTRM2.js";
-import "../chunk-SEZUF33H.js";
-import "../chunk-YAU4JCYI.js";
-import "../chunk-YONHM5BQ.js";
-import "../chunk-7TSL3JCX.js";
+import "../chunk-BDL6GJOQ.js";
+import "../chunk-PYWZYM74.js";
+import "../chunk-YLLGKY7K.js";
+import "../chunk-247PAUW6.js";
+import "../chunk-AXBFNQG6.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-4ABHSCFJ.js";
+import "../chunk-FH4O3QGQ.js";
 import {
   CODEX_AGENT,
   DEFAULT_SESSION,
@@ -79,8 +79,8 @@ import {
   toPolicyLookup,
   toPolicyLookups,
   userScope
-} from "../chunk-NILVJ7HV.js";
-import "../chunk-CRW4P7JU.js";
+} from "../chunk-YCL2V5FD.js";
+import "../chunk-JHAPJRAN.js";
 import {
   askUser,
   cancelQuestion,
@@ -93,31 +93,31 @@ import {
   sendNotification,
   unavailableQuestionUnlessSubscriptionRequired,
   waitForQuestion
-} from "../chunk-DVLQ4TVD.js";
+} from "../chunk-Y2BOLNJV.js";
 import "../chunk-POFBE6ZY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-SXVXANPI.js";
-import "../chunk-UAA4BEYM.js";
-import "../chunk-B4OS2OVD.js";
+} from "../chunk-ZNAGS7O7.js";
+import "../chunk-UZ2YEGIT.js";
+import "../chunk-TBCXMW2C.js";
 import {
   getMachineId
-} from "../chunk-KRDQQL2X.js";
+} from "../chunk-NBGJ3EOE.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-MID7BURF.js";
+import "../chunk-NVXC6ZBR.js";
 import {
   canonicalJson
-} from "../chunk-FEKP3NJR.js";
+} from "../chunk-CEF4UQ3X.js";
 import {
   writeFileAtomic
-} from "../chunk-FT7UNIS3.js";
+} from "../chunk-AQFEP65J.js";
 import {
   getApiKey
-} from "../chunk-XQ4HTTBB.js";
-import "../chunk-LHGB64O2.js";
+} from "../chunk-4WHNRAOK.js";
+import "../chunk-B6KZME5D.js";
 import {
   CODEX_RESCUE_TOOL_NAME,
   DECISION_STOP_REASON,
@@ -139,7 +139,7 @@ import {
   resolveGate,
   scopeBreachReasonOf,
   unapprovedScopeReason
-} from "../chunk-6HMCOGKJ.js";
+} from "../chunk-VBPASZU7.js";
 
 // bin/pushary-codex-hook.ts
 import { basename } from "path";
@@ -767,7 +767,7 @@ var decidePreToolUse = async (input) => {
 };
 var repairCodexHoldsQuietly = async () => {
   try {
-    const { repairCodexHolds } = await import("../reapply-7KPSIO4L.js");
+    const { repairCodexHolds } = await import("../reapply-BUCDXIIM.js");
     repairCodexHolds();
   } catch {
     return;