pushary 1.9.20 → 1.9.22

package/dist/{chunk-6HMCOGKJ.js → chunk-GFXZDU4V.js}

@@ -676,6 +676,9 @@ var redactSecrets = (text) => applyRedactionRules(SECRET_REDACTION_RULES, text);
 var redactSecretsFromContent = (text) => applyRedactionRules(CUT_OFF_TEXT_REDACTION_RULES, text);
 var redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE.pattern, HIGH_ENTROPY_RULE.replacement);
 
+// ../contracts/src/json-record.ts
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+
 // ../contracts/src/shell-analysis.ts
 var SHELL_WORD_SEPARATOR = /[ \t\n]/;
 var ARITHMETIC_EVALUATING_EXPANSION = /\$[#+=~^]*(?:[A-Za-z_][A-Za-z0-9_]*|[0-9]+|[-?$!@*#])?\[/;
@@ -880,7 +883,6 @@ var AUTH_REJECTION_REASONS = [
 var DECLINED_AGENTS_FILE = "declined-agents.json";
 var DECLINED_AGENTS_VERSION = 1;
 var isDeclinableAgent = (value) => typeof value === "string" && DISCONNECT_AGENT_IDS.includes(value);
-var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var canonicalAgents = (agents) => [...new Set(agents)].sort();
 var parseDeclinedAgents = (value) => {
   if (!isRecord(value) || value.version !== DECLINED_AGENTS_VERSION || !Array.isArray(value.agents)) return [];
@@ -1063,7 +1065,6 @@ var hasNativeApprovalPrompt = (source, event) => !(source === "cursor" && event
 var SUPPORT_EMAIL = "business@pushary.com";
 var SUPPORT_DISCORD = "https://discord.gg/9v3VvUByrr";
 var HOOK_LOCATOR_BINARY = "pushary-bridge";
-var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isTokenCount = (value) => typeof value === "number" && Number.isInteger(value) && value >= 0;
 var reportableSessionId = (value) => typeof value === "string" && value.length > 0 && value.length <= SESSION_ID_MAX_LENGTH ? value : null;
 var HOOK_BATCH_MAX_BYTES = 4 * 1024 * 1024;
@@ -1901,7 +1902,9 @@ var mcpToolNameNeedsAPerson = (toolName) => {
 };
 var allowsSessionToolGrant = (toolName) => SESSION_TOOL_GRANT_TOOLS.has(toolName) || parseMcpToolName(toolName) !== void 0 && !isPusharyOwnTool(toolName.toLowerCase()) && !mcpToolNameNeedsAPerson(toolName);
 var isSessionToolGrant = (policy) => Boolean(policy.sessionId) && allowsSessionToolGrant(policy.tool) && isAutoApprove(policy);
-var API_KEY_PATTERN = /^pk_[a-f0-9]+\.[a-f0-9]+$/;
+var API_KEY_PREFIX_SHAPE = "pk_[a-f0-9]+";
+var API_KEY_PREFIX_PATTERN = new RegExp(`^${API_KEY_PREFIX_SHAPE}$`);
+var API_KEY_PATTERN = new RegExp(`^${API_KEY_PREFIX_SHAPE}\\.[a-f0-9]+$`);
 var isValidApiKey = (value) => API_KEY_PATTERN.test(value);
 var ACTION_BODY_MAX = 4e3;
 var DECISION_LINE_MAX = 500;
@@ -2122,9 +2125,19 @@ var SETTLED_OUTCOME = {
   deny: "deny"
 };
 var isSettledOutcome = (value) => typeof value === "string" && SETTLED_OUTCOMES.includes(value);
-var APPROVE_RESPONSES = /* @__PURE__ */ new Set(["yes", "approve", "approved"]);
-var DENY_RESPONSES = /* @__PURE__ */ new Set(["no", "deny", "denied", "reject", "rejected"]);
-var DEFER_RESPONSES = /* @__PURE__ */ new Set(["defer"]);
+var APPROVE_ANSWER = "yes";
+var DENY_ANSWER = "no";
+var DEFER_ANSWER = "defer";
+var PHONE_DENIAL_PREFIX = "Denied from your phone: ";
+var PHONE_DENIAL_REASON = "Denied via push notification";
+var denyReasonFrom = (value, note) => {
+  const trimmed = note?.trim();
+  if (trimmed) return `${PHONE_DENIAL_PREFIX}${trimmed}`;
+  return value && value !== DENY_ANSWER && value !== APPROVE_ANSWER ? `${PHONE_DENIAL_PREFIX}${value}` : PHONE_DENIAL_REASON;
+};
+var APPROVE_RESPONSES = /* @__PURE__ */ new Set([APPROVE_ANSWER, "approve", "approved"]);
+var DENY_RESPONSES = /* @__PURE__ */ new Set([DENY_ANSWER, "deny", "denied", "reject", "rejected"]);
+var DEFER_RESPONSES = /* @__PURE__ */ new Set([DEFER_ANSWER]);
 var classifyConfirmResponse = (response) => {
   const normalized = (response ?? "").trim().toLowerCase();
   if (APPROVE_RESPONSES.has(normalized)) return "approve";
@@ -2587,6 +2600,7 @@ var SCOPE_BATCH_REASON = "This patch exceeds the agreed scope. Split it into sin
 var unapprovedScopeReason = (scopeReason) => `${scopeReason}. Nobody approved this path, so the change was refused.`;
 var NO_RESPONSE_REASON = "No response within timeout";
 var codexRaisesItsOwnPrompts = (permissionMode) => permissionMode !== "bypassPermissions";
+var codexHasNoPromptOfItsOwn = (scopeReason, permissionMode) => scopeReason !== void 0 || !codexRaisesItsOwnPrompts(permissionMode);
 var CODEX_ASK_PASSES = { kind: "pass" };
 var CODEX_ASK_UNANSWERED = { kind: "deny", reason: NO_RESPONSE_REASON };
 var timeoutActionApplies = (ask) => ask.mode === "push_only" && ask.fullWindowServed;
@@ -2612,7 +2626,7 @@ var settingsPermissionList = (permissions, kind) => {
 };
 var boundedUnion = (lists) => [...new Set(lists.flat())].slice(0, MAX_AGENT_PERMISSION_RULES_PER_KIND);
 var claudePermissionRulesFromSettings = (documents) => {
-  const permissionBlocks = documents.flatMap((document) => isRecord2(document) && isRecord2(document.permissions) ? [document.permissions] : []);
+  const permissionBlocks = documents.flatMap((document) => isRecord(document) && isRecord(document.permissions) ? [document.permissions] : []);
   const collect = (kind) => boundedUnion(permissionBlocks.map((permissions) => settingsPermissionList(permissions, kind)));
   return { allow: collect("allow"), ask: collect("ask"), deny: collect("deny") };
 };
@@ -2676,6 +2690,7 @@ var modeStateFromResponse = (data) => {
 };
 var GATE_WIRE = 1;
 var GATE_MAX_TOOL_INPUTS = 32;
+var GATE_PERMISSION_MODE_MAX_LENGTH = 64;
 var GATE_BLOCK_REASON_MAX_LENGTH = 200;
 var wireVerdictFor = (verdict, deadlineSeconds) => {
   switch (verdict.kind) {
@@ -3033,16 +3048,16 @@ var globalInstallTarget = (owner, ownName) => {
       return LEGACY_PACKAGE;
   }
 };
-var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var declaresOwnershipProbe = (bin) => isRecord3(bin) && typeof bin[OWNERSHIP_PROBE_COMMAND] === "string";
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var declaresOwnershipProbe = (bin) => isRecord2(bin) && typeof bin[OWNERSHIP_PROBE_COMMAND] === "string";
 var cliManifestName = (manifest) => {
-  if (!isRecord3(manifest) || !isCliPackageName(manifest.name) || !declaresOwnershipProbe(manifest.bin)) return void 0;
+  if (!isRecord2(manifest) || !isCliPackageName(manifest.name) || !declaresOwnershipProbe(manifest.bin)) return void 0;
   return manifest.name;
 };
 var classifyGlobalFolder = (name, read) => {
   if (read.kind === "unreadable") return { kind: "unseen" };
   const { manifest } = read;
-  if (!isRecord3(manifest) || cliManifestName(manifest) !== name) return { kind: "foreign" };
+  if (!isRecord2(manifest) || cliManifestName(manifest) !== name) return { kind: "foreign" };
   return { kind: "ours", installed: { name, version: typeof manifest.version === "string" ? manifest.version : void 0 } };
 };
 var classifyGlobalInstall = (installed, owner) => {
@@ -3151,6 +3166,7 @@ export {
   redactSecrets,
   redactSecretsFromContent,
   redactSecretsDeep,
+  isRecord,
   degradedLine,
   hookWritePath,
   MAX_HOOK_ACTIVATION_EVIDENCE_ROWS,
@@ -3200,6 +3216,7 @@ export {
   isAutoApprove,
   FILE_TARGET_TOOLS,
   parseMcpToolName,
+  API_KEY_PREFIX_PATTERN,
   isValidApiKey,
   ACTION_BODY_MAX,
   DECISION_LINE_MAX,
@@ -3207,6 +3224,7 @@ export {
   ASK_AGENT_NAME_MAX,
   truncateLine,
   isAnswerSource,
+  denyReasonFrom,
   classifyConfirmResponse,
   buildDecisionEpisodeFeatures,
   resolveAutoResolveOrigin,
@@ -3229,7 +3247,7 @@ export {
   SCOPE_BATCH_REASON,
   unapprovedScopeReason,
   NO_RESPONSE_REASON,
-  codexRaisesItsOwnPrompts,
+  codexHasNoPromptOfItsOwn,
   codexUnansweredPreToolUse,
   scopeBreachReasonOf,
   codexCallNeedsAPerson,
@@ -3240,6 +3258,7 @@ export {
   modeStateFromResponse,
   GATE_WIRE,
   GATE_MAX_TOOL_INPUTS,
+  GATE_PERMISSION_MODE_MAX_LENGTH,
   GATE_BLOCK_REASON_MAX_LENGTH,
   wireVerdictFor,
   machineDecisionFor,

package/dist/{chunk-ATDOYZXC.js → chunk-GNQZY4GL.js}

@@ -1,6 +1,6 @@
 import {
   getBaseUrl
-} from "./chunk-XQ4HTTBB.js";
+} from "./chunk-75MJRC5I.js";
 
 // src/transcript-api.ts
 var fetchTranscriptRecipients = async (apiKey, baseUrl = getBaseUrl()) => {

package/dist/{chunk-LB4HVID5.js → chunk-GWKT2ZZS.js}

@@ -3,18 +3,18 @@ import {
 } from "./chunk-POFBE6ZY.js";
 import {
   autoUpdateState
-} from "./chunk-YJWEQZJC.js";
+} from "./chunk-E7EOUEGQ.js";
 import {
   readJsonSafe,
   writeJsonAtomic
-} from "./chunk-FT7UNIS3.js";
+} from "./chunk-AQFEP65J.js";
 import {
   CLI_PACKAGE_NAMES,
   POSIX_GLOBAL_ROOT_SEGMENTS,
   cliPackagePathSegments,
   globalUpgradeEntry,
   ownPackageRoot
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/auto-update.ts
 import { spawn } from "child_process";

package/dist/{chunk-6W6UY4AJ.js → chunk-JQVGCDHW.js}

@@ -4,7 +4,7 @@ import {
   forkFinishWithUpgradeLock,
   installWithUpgradeLock,
   releaseAutoUpdateLock
-} from "./chunk-P77EIWBJ.js";
+} from "./chunk-4PERN2SO.js";
 import {
   describeAutoUpdateCheck,
   globalInstallLocation,
@@ -14,7 +14,7 @@ import {
   readAutoUpdateState,
   updateAutoUpdateState,
   upgradeEntryFor
-} from "./chunk-LB4HVID5.js";
+} from "./chunk-GWKT2ZZS.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
@@ -27,10 +27,10 @@ import {
   npmErrorMessage,
   readGlobalCliInstallAt,
   readGlobalPrefix
-} from "./chunk-YJWEQZJC.js";
+} from "./chunk-E7EOUEGQ.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-LHGB64O2.js";
+} from "./chunk-TZWZVAMN.js";
 import {
   commandsPackage,
   globalUpgradeEntry,
@@ -39,7 +39,7 @@ import {
   isSameMajorVersion,
   ownPackageRoot,
   packageVersionAt
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/global-upgrade.ts
 import { existsSync } from "fs";

package/dist/{chunk-AESHOWIB.js → chunk-KCLWVCGN.js}

@@ -1,18 +1,21 @@
 import {
   compatibleConfigFile,
   hasCompatibleHooks
-} from "./chunk-DF2FSJ7B.js";
+} from "./chunk-6TSEEKPL.js";
 import {
   pusharyHookExecutable
-} from "./chunk-Q4EQHBA7.js";
+} from "./chunk-TSFNX5J2.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-YJWEQZJC.js";
+} from "./chunk-E7EOUEGQ.js";
+import {
+  isRecord
+} from "./chunk-GFXZDU4V.js";
 
 // src/cursor-config.ts
 var hookCommandOf = (entry) => {
-  const command = entry && typeof entry === "object" && !Array.isArray(entry) ? entry.command : void 0;
+  const command = isRecord(entry) ? entry.command : void 0;
   return typeof command === "string" ? command : "";
 };
 var isPusharyCursorEntry = (entry) => pusharyHookExecutable(hookCommandOf(entry)) !== null;
@@ -38,7 +41,7 @@ var isCursorPluginLeftover = (name) => name.startsWith(`${CURSOR_PLUGIN_NAME}${C
 var isPusharyCursorPluginManifest = (contents) => {
   try {
     const manifest = JSON.parse(contents);
-    return typeof manifest === "object" && manifest !== null && !Array.isArray(manifest) && manifest.name === CURSOR_PLUGIN_NAME;
+    return isRecord(manifest) && manifest.name === CURSOR_PLUGIN_NAME;
   } catch {
     return false;
   }

package/dist/{chunk-XDKZZSU6.js → chunk-KCXG2INQ.js}

@@ -8,10 +8,10 @@ import {
   codexHooksJsonIn,
   isPusharyCodexCommand,
   resolvePathBinary
-} from "./chunk-YJWEQZJC.js";
+} from "./chunk-E7EOUEGQ.js";
 import {
   getPackageVersion
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/codex-app-server.ts
 import { existsSync, realpathSync } from "fs";

package/dist/{chunk-7YTJOWYI.js → chunk-KH2EDRJQ.js}

@@ -1,9 +1,12 @@
 import {
   pusharyDir
-} from "./chunk-YJWEQZJC.js";
+} from "./chunk-E7EOUEGQ.js";
 import {
   readJsonSafe
-} from "./chunk-FT7UNIS3.js";
+} from "./chunk-AQFEP65J.js";
+import {
+  isRecord
+} from "./chunk-GFXZDU4V.js";
 
 // src/process-ownership.ts
 import { createHash, randomUUID } from "crypto";
@@ -21,7 +24,7 @@ var isProof = (value) => {
 };
 var removeProof = (path, token) => {
   const current = readJsonSafe(path);
-  if (current.kind !== "ok" || current.value.token !== token) return;
+  if (current.kind !== "ok" || !isRecord(current.value) || current.value.token !== token) return;
   try {
     unlinkSync(path);
   } catch {

package/dist/{chunk-PPAMIQOV.js → chunk-LH3GTSXC.js}

@@ -3,41 +3,41 @@ import {
   loadPin,
   savePin,
   verifyRecipients
-} from "./chunk-6WEC3KZP.js";
+} from "./chunk-VTR4VRL2.js";
 import {
   ensureDaemonRunning
-} from "./chunk-HPMP6QQD.js";
+} from "./chunk-N2JP3RKP.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-XGHXQUDG.js";
+} from "./chunk-E3FSKKTJ.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-ATDOYZXC.js";
+} from "./chunk-GNQZY4GL.js";
 import {
   transcriptEnvironmentPreference,
   transcriptsEnabled
-} from "./chunk-2V2CCTGQ.js";
+} from "./chunk-WE2RVY7V.js";
 import {
   hookOwnerOf
-} from "./chunk-Q4EQHBA7.js";
+} from "./chunk-TSFNX5J2.js";
 import {
   readTranscriptPreference
-} from "./chunk-4ABHSCFJ.js";
+} from "./chunk-6IOLTFNP.js";
 import {
   codexHome,
   pusharyDir
-} from "./chunk-YJWEQZJC.js";
+} from "./chunk-E7EOUEGQ.js";
 import {
   writeJsonAtomic
-} from "./chunk-FT7UNIS3.js";
+} from "./chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-XQ4HTTBB.js";
+} from "./chunk-75MJRC5I.js";
 
 // src/transcript-registration.ts
 import { createHash } from "crypto";

package/dist/{chunk-HPMP6QQD.js → chunk-N2JP3RKP.js}

@@ -4,30 +4,31 @@ import {
 } from "./chunk-XHKBHWLX.js";
 import {
   readControlMode
-} from "./chunk-4ABHSCFJ.js";
+} from "./chunk-6IOLTFNP.js";
 import {
   getMachineId
-} from "./chunk-XJGGGDHX.js";
+} from "./chunk-U2IEM5FF.js";
 import {
   pusharyDir,
   resolveGlobalBinary
-} from "./chunk-YJWEQZJC.js";
+} from "./chunk-E7EOUEGQ.js";
 import {
   readJsonSafe,
   writeFileAtomic,
   writeJsonAtomic,
   writeJsonAtomicDurable
-} from "./chunk-FT7UNIS3.js";
+} from "./chunk-AQFEP65J.js";
 import {
   getApiKey
-} from "./chunk-XQ4HTTBB.js";
+} from "./chunk-75MJRC5I.js";
 import {
   CLI_PACKAGE_NAMES,
   cmdShimTarget,
   getPackageVersion,
   globalPackageFolder,
-  globalRootFor
-} from "./chunk-6HMCOGKJ.js";
+  globalRootFor,
+  isRecord
+} from "./chunk-GFXZDU4V.js";
 
 // src/daemon-lifecycle.ts
 import { dirname, join, win32 as win32Path } from "path";
@@ -615,7 +616,7 @@ var acquireDaemonLease = (options = {}) => {
   let currentState = state;
   const isOwner = () => {
     const owner = readJsonSafe(lockPath(dir));
-    return owner.kind === "ok" && owner.value.instanceId === instanceId;
+    return owner.kind === "ok" && isRecord(owner.value) && owner.value.instanceId === instanceId;
   };
   const updateState = (next) => {
     if (!isOwner()) return;
@@ -659,7 +660,7 @@ var acquireDaemonLease = (options = {}) => {
       shouldYield: () => {
         if (!isOwner()) return true;
         const target = readJsonSafe(targetPath(dir));
-        return target.kind === "ok" && (typeof target.value.version === "string" && target.value.version !== installedVersion || isTimestamp(target.value.requestedAt) && Date.parse(target.value.requestedAt) > Date.parse(startedAt));
+        return target.kind === "ok" && isRecord(target.value) && (typeof target.value.version === "string" && target.value.version !== installedVersion || isTimestamp(target.value.requestedAt) && Date.parse(target.value.requestedAt) > Date.parse(startedAt));
       },
       release: () => {
         if (!isOwner()) return;

package/dist/{chunk-NESTNKCA.js → chunk-NB2PY5JX.js}

@@ -1,6 +1,6 @@
 import {
   pusharyFetch
-} from "./chunk-RZCTGLUJ.js";
+} from "./chunk-WAKQYJ6T.js";
 import {
   NetworkError
 } from "./chunk-7QLSKOSU.js";
@@ -9,11 +9,11 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   getBaseUrl
-} from "./chunk-XQ4HTTBB.js";
+} from "./chunk-75MJRC5I.js";
 import {
   isValidApiKey,
   normalizeKeyScope
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/session.ts
 var samePusharyAccount = (left, right) => left.kind === "ok" && right.kind === "ok" && left.identity.workspaceId !== "" && left.identity.workspaceId === right.identity.workspaceId && left.identity.siteId === right.identity.siteId;

package/dist/{chunk-SB2GN6OP.js → chunk-OYIN77HO.js}

@@ -20,7 +20,7 @@ var revokeAgentKey = async (apiKey, baseUrl, fetchImpl) => {
   });
   if (!response.ok) return { kind: "refused", status: response.status };
   const revoked = await readRevokedCount(response);
-  if (revoked === null) return { kind: "refused", status: response.status };
+  if (revoked === null) return { kind: "unconfirmed", status: response.status };
   return revoked > 0 ? { kind: "revoked" } : { kind: "not_accepted" };
 };
 var revokeOwnKey = async (apiKey, baseUrl, fetchImpl = fetch) => {
@@ -42,10 +42,11 @@ var REVOKE_DETAIL = {
   revoked: "Revoked the key on pushary.com.",
   not_accepted: "pushary.com had already stopped accepting the key.",
   refused: "pushary.com refused to revoke the key",
+  unconfirmed: "pushary.com did not confirm the key was revoked",
   unreachable: "Could not reach pushary.com to revoke the key"
 };
 var describeRevokeAttempt = (attempt) => {
-  if (attempt.kind === "refused") return `${REVOKE_DETAIL.refused} (HTTP ${attempt.status}).`;
+  if (attempt.kind === "refused" || attempt.kind === "unconfirmed") return `${REVOKE_DETAIL[attempt.kind]} (HTTP ${attempt.status}).`;
   if (attempt.kind === "unreachable") return `${REVOKE_DETAIL.unreachable}: ${attempt.detail}`;
   return REVOKE_DETAIL[attempt.kind];
 };

package/dist/{chunk-MMIN6VNU.js → chunk-OZVZGWER.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-YJWEQZJC.js";
+} from "./chunk-E7EOUEGQ.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-6I4D3XZ3.js → chunk-P345G4DK.js}

@@ -1,13 +1,8 @@
 import {
   DEFAULT_SESSION
-} from "./chunk-CW4CF7NU.js";
+} from "./chunk-CW3QUV6B.js";
 
 // src/answer.ts
-var denyReasonFrom = (value, note) => {
-  const trimmed = note?.trim();
-  if (trimmed) return `Denied from your phone: ${trimmed}`;
-  return value && value !== "no" && value !== "yes" ? `Denied from your phone: ${value}` : "Denied via push notification";
-};
 var isDeferAnswer = (value) => value === "defer";
 
 // src/session-notice.ts
@@ -38,7 +33,6 @@ var announceSubscriptionRequired = (upgradeUrl, sessionId) => {
 };
 
 export {
-  denyReasonFrom,
   isDeferAnswer,
   oncePerSession,
   announceSubscriptionRequired

package/dist/{chunk-422Z3LBB.js → chunk-SGUGGHMC.js}

@@ -1,13 +1,13 @@
 import {
   openCodeConfigDirFrom
-} from "./chunk-XVNZHIVF.js";
+} from "./chunk-U4OWRGYI.js";
 import {
   codexHomeFrom,
   resolvePathBinary
-} from "./chunk-YJWEQZJC.js";
+} from "./chunk-E7EOUEGQ.js";
 import {
   HOOK_COMPATIBLE_PROFILES
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/hermes-config.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-736I6CBY.js → chunk-T57BCGHQ.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-DNSYWI7D.js → chunk-TH3HKKGW.js}

@@ -1,21 +1,20 @@
 import {
   defersToNativeMode,
   reportMachineDenial
-} from "./chunk-DBEJIFJD.js";
+} from "./chunk-AR4NXO4Q.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-736I6CBY.js";
+} from "./chunk-T57BCGHQ.js";
 import {
   announceSubscriptionRequired,
-  denyReasonFrom,
   isDeferAnswer,
   oncePerSession
-} from "./chunk-6I4D3XZ3.js";
+} from "./chunk-P345G4DK.js";
 import {
   activeHookSource,
   activeIdentity
-} from "./chunk-DF2FSJ7B.js";
+} from "./chunk-6TSEEKPL.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -40,7 +39,7 @@ import {
   reportEvent,
   scopePathFor,
   settleQuestionsForToolUse
-} from "./chunk-CW4CF7NU.js";
+} from "./chunk-CW3QUV6B.js";
 import {
   askUser,
   cancelQuestion,
@@ -52,20 +51,20 @@ import {
   sendNotification,
   waitForQuestion,
   waitsForThePhone
-} from "./chunk-K5PUP76V.js";
+} from "./chunk-AGIO7SF5.js";
 import {
   SubscriptionRequiredError
-} from "./chunk-HILWD7WM.js";
+} from "./chunk-6SFTI7LM.js";
 import {
   getMachineId
-} from "./chunk-XJGGGDHX.js";
+} from "./chunk-U2IEM5FF.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-XQ4HTTBB.js";
+} from "./chunk-75MJRC5I.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-LHGB64O2.js";
+} from "./chunk-TZWZVAMN.js";
 import {
   AGENT_QUESTION_STRATEGY,
   DECISION_STOP_REASON,
@@ -89,6 +88,7 @@ import {
   claudePreToolUseOutput,
   claudeStoppedPermissionRequestOutput,
   claudeStoppedPreToolUseOutput,
+  denyReasonFrom,
   editGoesToTheAgentsPrompt,
   effectiveWaitSeconds,
   hasNativeApprovalPrompt,
@@ -104,7 +104,7 @@ import {
   parseAgentQuestions,
   questionHandedToTheTerminal,
   resolveGate
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/claude-permission-rules.ts
 import { readFileSync, statSync } from "fs";
@@ -336,7 +336,8 @@ var dispatchModeHandler = async (apiKey, input, toolPolicy, machineId, trainingC
     // creates a fresh decision exactly as before.
     toolUseId: input.tool_use_id,
     sessionToolAware: true,
-    ...ownPrompt ? {} : { localSurfaceAvailable: false }
+    ...ownPrompt ? {} : { localSurfaceAvailable: false },
+    permissionMode: input.permission_mode
   };
   const signals = {};
   const runHandler = () => {

package/dist/{chunk-Q4EQHBA7.js → chunk-TSFNX5J2.js}

@@ -2,23 +2,23 @@ import {
   CLAUDE_HOOK_EVENTS,
   GEMINI_HOOK_EVENTS,
   hasGeminiHooks
-} from "./chunk-VOIN2NZW.js";
+} from "./chunk-YGR5PBOF.js";
 import {
   AGENT_CHOICES
-} from "./chunk-YONHM5BQ.js";
+} from "./chunk-U26CAOZC.js";
 import {
   BELL_HOOK_BINARY
-} from "./chunk-MMIN6VNU.js";
+} from "./chunk-OZVZGWER.js";
 import {
   CODEX_HOOK_EVENTS,
   hasCodexHooks,
   holdBudgetOf
-} from "./chunk-YJWEQZJC.js";
+} from "./chunk-E7EOUEGQ.js";
 import {
   CURSOR_GATE_EVENTS,
   HOOK_LOCATOR_BINARY,
   hookCommandHoldBudget
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/diagnostics/bridge.ts
 import { execFileSync } from "child_process";
@@ -228,14 +228,6 @@ var hasAppCommand = (value) => commandsIn(value).some((command) => {
   const executable = pusharyHookExecutable(command);
   return executable !== null && isBridgeLocator(executable);
 });
-var mcpBearerKey = (document, containerKey, headersKey) => {
-  const servers = isRecord(document?.[containerKey]) ? document[containerKey] : null;
-  const pushary = isRecord(servers?.pushary) ? servers.pushary : null;
-  const headers = isRecord(pushary?.[headersKey]) ? pushary[headersKey] : null;
-  const authorization = headers?.Authorization;
-  const match = typeof authorization === "string" ? authorization.trim().match(/^Bearer\s+(\S+)$/) : null;
-  return match?.[1] ?? null;
-};
 var captureMcpServer = (document, containerKey) => {
   const container = document[containerKey];
   const servers = isRecord(container) ? container : null;
@@ -347,7 +339,6 @@ export {
   holdsLong,
   describeOtherHolder,
   describeHoldSentence,
-  mcpBearerKey,
   captureMcpServer,
   restoreMcpServer,
   captureHookTakeover,

package/dist/{chunk-LHGB64O2.js → chunk-TZWZVAMN.js}

@@ -2,7 +2,7 @@ import {
   DISCONNECT_AGENT_IDS,
   SETUP_AGENT_CHOICES,
   isApprovalMode
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/cli/mode-request.ts
 var parseDuration = (value) => {

package/dist/{chunk-YONHM5BQ.js → chunk-U26CAOZC.js}

@@ -10,7 +10,7 @@ import {
   isSetupConnectMode,
   isValidApiKey,
   normalizeAgentId
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-GFXZDU4V.js";
 
 // src/setup/options.ts
 var AGENT_CHOICES = SETUP_AGENT_CHOICES;