pushary 1.9.22 → 1.9.23

package/dist/{chunk-DV26ZWUC.js → chunk-73HGV4R6.js}

@@ -3,11 +3,11 @@ import {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-E3FSKKTJ.js";
+} from "./chunk-N4DMADJM.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-GNQZY4GL.js";
+} from "./chunk-QFNY4KUQ.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;

package/dist/{chunk-UFGU7AK3.js → chunk-7J2AX5T6.js}

@@ -10,10 +10,10 @@ import {
   resolvePackageVersionFromBinary,
   resolvePathBinary,
   resolvePathBinaryAsync
-} from "./chunk-E7EOUEGQ.js";
+} from "./chunk-QIODXPTP.js";
 import {
   MANAGED_PROVIDERS
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-OH647UT3.js";
 
 // src/setup/codex-install.ts
 var NATIVE_BINARY_MIN_BYTES = 20 * 1024 * 1024;

package/dist/{chunk-YGR5PBOF.js → chunk-7RGEJOQS.js}

@@ -5,16 +5,16 @@ import {
 import {
   NOTIFICATION_MATCHED_TYPES,
   POSTTOOLUSE_MIRRORED_TOOLS
-} from "./chunk-BDV4WDIA.js";
+} from "./chunk-KJA6IGOZ.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-E7EOUEGQ.js";
+} from "./chunk-QIODXPTP.js";
 import {
   CLAUDE_PRETOOLUSE_MATCHER,
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-OH647UT3.js";
 
 // src/gemini-config.ts
 var GEMINI_HOOK_BINARY = "pushary-gemini-hook";

package/dist/{chunk-TSFNX5J2.js → chunk-A5U62Q6K.js}

@@ -2,23 +2,23 @@ import {
   CLAUDE_HOOK_EVENTS,
   GEMINI_HOOK_EVENTS,
   hasGeminiHooks
-} from "./chunk-YGR5PBOF.js";
+} from "./chunk-7RGEJOQS.js";
 import {
   AGENT_CHOICES
-} from "./chunk-U26CAOZC.js";
+} from "./chunk-R5C3QCVT.js";
 import {
   BELL_HOOK_BINARY
-} from "./chunk-OZVZGWER.js";
+} from "./chunk-AFP3HZVK.js";
 import {
   CODEX_HOOK_EVENTS,
   hasCodexHooks,
   holdBudgetOf
-} from "./chunk-E7EOUEGQ.js";
+} from "./chunk-QIODXPTP.js";
 import {
   CURSOR_GATE_EVENTS,
   HOOK_LOCATOR_BINARY,
   hookCommandHoldBudget
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-OH647UT3.js";
 
 // src/diagnostics/bridge.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-OZVZGWER.js → chunk-AFP3HZVK.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-E7EOUEGQ.js";
+} from "./chunk-QIODXPTP.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-6IOLTFNP.js → chunk-AQ3TSQA2.js}

@@ -1,6 +1,6 @@
 import {
   resolveInstallSourceFor
-} from "./chunk-5TLRS3AK.js";
+} from "./chunk-6HT2TUZD.js";
 import {
   backupFile,
   readJsonSafe,
@@ -9,11 +9,11 @@ import {
 } from "./chunk-AQFEP65J.js";
 import {
   configFilePath
-} from "./chunk-75MJRC5I.js";
+} from "./chunk-OQPEHKH2.js";
 import {
   API_KEY_PREFIX_PATTERN,
   isRecord
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-OH647UT3.js";
 
 // src/shell-alias.ts
 import { homedir } from "os";

package/dist/{chunk-LH3GTSXC.js → chunk-AV5VX7OK.js}

@@ -6,38 +6,38 @@ import {
 } from "./chunk-VTR4VRL2.js";
 import {
   ensureDaemonRunning
-} from "./chunk-N2JP3RKP.js";
+} from "./chunk-SSWK2WYX.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-E3FSKKTJ.js";
+} from "./chunk-N4DMADJM.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-GNQZY4GL.js";
+} from "./chunk-QFNY4KUQ.js";
 import {
   transcriptEnvironmentPreference,
   transcriptsEnabled
-} from "./chunk-WE2RVY7V.js";
+} from "./chunk-M6R3SZZS.js";
 import {
   hookOwnerOf
-} from "./chunk-TSFNX5J2.js";
+} from "./chunk-A5U62Q6K.js";
 import {
   readTranscriptPreference
-} from "./chunk-6IOLTFNP.js";
+} from "./chunk-AQ3TSQA2.js";
 import {
   codexHome,
   pusharyDir
-} from "./chunk-E7EOUEGQ.js";
+} from "./chunk-QIODXPTP.js";
 import {
   writeJsonAtomic
 } from "./chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-75MJRC5I.js";
+} from "./chunk-OQPEHKH2.js";
 
 // src/transcript-registration.ts
 import { createHash } from "crypto";

package/dist/{chunk-SGUGGHMC.js → chunk-AXSHPFU3.js}

@@ -1,13 +1,13 @@
 import {
   openCodeConfigDirFrom
-} from "./chunk-U4OWRGYI.js";
+} from "./chunk-ZGYO6OQE.js";
 import {
   codexHomeFrom,
   resolvePathBinary
-} from "./chunk-E7EOUEGQ.js";
+} from "./chunk-QIODXPTP.js";
 import {
   HOOK_COMPATIBLE_PROFILES
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-OH647UT3.js";
 
 // src/hermes-config.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-YI543EKI.js → chunk-BY5EKA6W.js}

@@ -1,6 +1,6 @@
 import {
   SETUP_FLAGS
-} from "./chunk-U26CAOZC.js";
+} from "./chunk-R5C3QCVT.js";
 import {
   parseFlags
 } from "./chunk-GMXKITVA.js";
@@ -9,7 +9,7 @@ import {
 } from "./chunk-7QLSKOSU.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-TZWZVAMN.js";
+} from "./chunk-LEQRIJ4H.js";
 import {
   CLAUDE_CONNECTOR_GUIDE,
   CLAUDE_CONNECTOR_STEPS,
@@ -17,7 +17,7 @@ import {
   CLAUDE_CONNECTOR_URL,
   COWORK_CONNECTOR_LIMIT,
   COWORK_STANDING_INSTRUCTIONS
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-OH647UT3.js";
 
 // src/cli/cowork.ts
 import { readFileSync } from "fs";

package/dist/{chunk-KH2EDRJQ.js → chunk-CJTQNUUT.js}

@@ -1,12 +1,12 @@
 import {
   pusharyDir
-} from "./chunk-E7EOUEGQ.js";
+} from "./chunk-QIODXPTP.js";
 import {
   readJsonSafe
 } from "./chunk-AQFEP65J.js";
 import {
   isRecord
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-OH647UT3.js";
 
 // src/process-ownership.ts
 import { createHash, randomUUID } from "crypto";

package/dist/{chunk-G5YMVGAK.js → chunk-DKBPNHAI.js}

@@ -14,19 +14,19 @@ import {
 } from "./chunk-FO3MDD26.js";
 import {
   callMcpTool
-} from "./chunk-6SFTI7LM.js";
+} from "./chunk-E2LGKG75.js";
 import {
   reportedInstallSource
-} from "./chunk-5TLRS3AK.js";
+} from "./chunk-6HT2TUZD.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-TZWZVAMN.js";
+} from "./chunk-LEQRIJ4H.js";
 import {
   NO_PAIRING_COMPUTER,
   PAIR_TTL_SECONDS,
   classifyConfirmResponse,
   isAnswerSource
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-OH647UT3.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {

package/dist/{chunk-6SFTI7LM.js → chunk-E2LGKG75.js}

@@ -1,12 +1,12 @@
 import {
   keyCheckFromResponse
-} from "./chunk-NB2PY5JX.js";
+} from "./chunk-Z4UDB7EC.js";
 import {
   installNetworkDefaults
-} from "./chunk-WAKQYJ6T.js";
+} from "./chunk-XBETSM5T.js";
 import {
   getBaseUrl
-} from "./chunk-75MJRC5I.js";
+} from "./chunk-OQPEHKH2.js";
 
 // src/retry.ts
 var isRetryable = (err) => {

package/dist/{chunk-U2IEM5FF.js → chunk-EDN4F6GX.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-E7EOUEGQ.js";
+} from "./chunk-QIODXPTP.js";
 import {
   writeFileAtomic
 } from "./chunk-AQFEP65J.js";

package/dist/{chunk-AR4NXO4Q.js → chunk-FBV2KS3Z.js}

@@ -6,12 +6,12 @@ import {
   permissionDeniedAction,
   releaseThrottle,
   reportEvent
-} from "./chunk-CW3QUV6B.js";
+} from "./chunk-GYP6DLA4.js";
 import {
   machineDecisionFor,
   shouldDeferToNativeMode,
   wireVerdictFor
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-OH647UT3.js";
 
 // src/machine-decision-audit.ts
 import { basename } from "path";

package/dist/{chunk-2MW4OHWI.js → chunk-FIYCICHC.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   renderCommandHelp
-} from "./chunk-TZWZVAMN.js";
+} from "./chunk-LEQRIJ4H.js";
 import {
   getPackageVersion
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-OH647UT3.js";
 
 // src/cli/usage.ts
 var exitOnHelpFlag = (command) => {

package/dist/{chunk-T57BCGHQ.js → chunk-GN6BJXC7.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-OH647UT3.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-CW3QUV6B.js → chunk-GYP6DLA4.js}

@@ -2,7 +2,7 @@ import {
   IDLE_PROMPT_NOTIFICATION,
   NOTIFICATION_PUSH_TYPES,
   POSTTOOLUSE_MIRROR_ONLY_TOOLS
-} from "./chunk-BDV4WDIA.js";
+} from "./chunk-KJA6IGOZ.js";
 import {
   cancelQuestion,
   clientErrorKindOf,
@@ -10,26 +10,26 @@ import {
   reportClientError,
   sendNotification,
   waitForAnswer
-} from "./chunk-AGIO7SF5.js";
+} from "./chunk-4GKQDFH6.js";
 import {
   withRetry
-} from "./chunk-6SFTI7LM.js";
+} from "./chunk-E2LGKG75.js";
 import {
   getMachineId
-} from "./chunk-U2IEM5FF.js";
+} from "./chunk-EDN4F6GX.js";
 import {
   reportedInstallSource
-} from "./chunk-5TLRS3AK.js";
+} from "./chunk-6HT2TUZD.js";
 import {
   canonicalJson
-} from "./chunk-E7EOUEGQ.js";
+} from "./chunk-QIODXPTP.js";
 import {
   writeFileAtomic
 } from "./chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-75MJRC5I.js";
+} from "./chunk-OQPEHKH2.js";
 import {
   ACTION_BODY_MAX,
   AGENT_LABELS_BY_TYPE,
@@ -60,7 +60,7 @@ import {
   resolvePolicy,
   toToolLookup,
   truncateLine
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-OH647UT3.js";
 
 // ../hook-mapping/src/describe.ts
 import { isAbsolute, relative, resolve } from "path";

package/dist/{chunk-3BWW4UMT.js → chunk-HXZG5WHU.js}

@@ -1,9 +1,9 @@
 import {
   CODEX_HOOK_STATUS
-} from "./chunk-KCXG2INQ.js";
+} from "./chunk-RHIKMNWJ.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-TZWZVAMN.js";
+} from "./chunk-LEQRIJ4H.js";
 
 // src/setup/codex-trust.ts
 var CODEX_TRUST_TELEMETRY = {

package/dist/{chunk-JQVGCDHW.js → chunk-I46QTKYI.js}

@@ -4,7 +4,7 @@ import {
   forkFinishWithUpgradeLock,
   installWithUpgradeLock,
   releaseAutoUpdateLock
-} from "./chunk-4PERN2SO.js";
+} from "./chunk-JCEUDLGW.js";
 import {
   describeAutoUpdateCheck,
   globalInstallLocation,
@@ -14,7 +14,7 @@ import {
   readAutoUpdateState,
   updateAutoUpdateState,
   upgradeEntryFor
-} from "./chunk-GWKT2ZZS.js";
+} from "./chunk-USUI4P63.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
@@ -27,10 +27,10 @@ import {
   npmErrorMessage,
   readGlobalCliInstallAt,
   readGlobalPrefix
-} from "./chunk-E7EOUEGQ.js";
+} from "./chunk-QIODXPTP.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-TZWZVAMN.js";
+} from "./chunk-LEQRIJ4H.js";
 import {
   commandsPackage,
   globalUpgradeEntry,
@@ -39,7 +39,7 @@ import {
   isSameMajorVersion,
   ownPackageRoot,
   packageVersionAt
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-OH647UT3.js";
 
 // src/global-upgrade.ts
 import { existsSync } from "fs";

package/dist/{chunk-Z7KB4R6U.js → chunk-ISAKLEKE.js}

@@ -1,6 +1,6 @@
 import {
   ensureCodexTrustsPusharyHooks
-} from "./chunk-KCXG2INQ.js";
+} from "./chunk-RHIKMNWJ.js";
 import {
   detectClaudeVersion
 } from "./chunk-RIVNNBEK.js";
@@ -12,12 +12,12 @@ import {
   openCodeHookArgv,
   openCodePluginDir,
   openCodeWired
-} from "./chunk-U4OWRGYI.js";
+} from "./chunk-ZGYO6OQE.js";
 import {
   addClaudeMcpServer,
   addPusharyHooks,
   addPusharyToolPermissions
-} from "./chunk-6TSEEKPL.js";
+} from "./chunk-K2EYK5RL.js";
 import {
   claudeUnprovenHolds,
   claudeWired,
@@ -25,7 +25,7 @@ import {
   codexWired,
   geminiWired,
   planHooks
-} from "./chunk-TSFNX5J2.js";
+} from "./chunk-A5U62Q6K.js";
 import {
   CLAUDE_HOOK_BINARY,
   CLAUDE_HOOK_EVENTS,
@@ -36,7 +36,7 @@ import {
   needsReregistration,
   registrationSignatures,
   supportedClaudeEvents
-} from "./chunk-YGR5PBOF.js";
+} from "./chunk-7RGEJOQS.js";
 import {
   formatVersion
 } from "./chunk-6ICPEJY5.js";
@@ -59,7 +59,7 @@ import {
   registrationHolderOf,
   resolveGlobalBinary,
   vscodePluginMcp
-} from "./chunk-E7EOUEGQ.js";
+} from "./chunk-QIODXPTP.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -67,7 +67,7 @@ import {
 } from "./chunk-AQFEP65J.js";
 import {
   isRecord
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-OH647UT3.js";
 
 // src/reapply.ts
 import { dirname, join } from "path";

package/dist/{chunk-4PERN2SO.js → chunk-JCEUDLGW.js}

@@ -2,7 +2,7 @@ import {
   autoUpdateLock,
   installPackageGlobally,
   npmErrorMessage
-} from "./chunk-E7EOUEGQ.js";
+} from "./chunk-QIODXPTP.js";
 import {
   writeJsonAtomic
 } from "./chunk-AQFEP65J.js";

package/dist/{chunk-5AZ546F6.js → chunk-JNKHCGHR.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_HOLD_BUDGET_ENV,
   hookHoldBudgetProof
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-OH647UT3.js";
 
 // src/hold-budget.ts
 var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {

package/dist/{chunk-6TSEEKPL.js → chunk-K2EYK5RL.js}

@@ -3,18 +3,18 @@ import {
   addGeminiMcpServer,
   removeGeminiMcpServer,
   supportedClaudeEvents
-} from "./chunk-YGR5PBOF.js";
+} from "./chunk-7RGEJOQS.js";
 import {
   CLAUDE_CODE_AGENT,
   parseApplyPatchFiles
-} from "./chunk-CW3QUV6B.js";
+} from "./chunk-GYP6DLA4.js";
 import {
   guardBinary,
   guardBinaryRefusing,
   holdBudgetOf,
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-E7EOUEGQ.js";
+} from "./chunk-QIODXPTP.js";
 import {
   HOOK_LOCATOR_BINARY,
   PHONE_ANSWERED_TOOLS,
@@ -24,7 +24,7 @@ import {
   refusalOutput,
   toToolLookup,
   withHookHoldBudget
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-OH647UT3.js";
 
 // src/claude-config.ts
 import { join } from "path";

package/dist/{chunk-BDV4WDIA.js → chunk-KJA6IGOZ.js}

@@ -1,6 +1,6 @@
 import {
   PRETOOLUSE_GATED_TOOLS
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-OH647UT3.js";
 
 // src/claude-tools.ts
 var POSTTOOLUSE_MIRROR_ONLY_TOOLS = ["TodoWrite", "Task", "WebFetch", "WebSearch"];

package/dist/{chunk-TZWZVAMN.js → chunk-LEQRIJ4H.js}

@@ -2,7 +2,7 @@ import {
   DISCONNECT_AGENT_IDS,
   SETUP_AGENT_CHOICES,
   isApprovalMode
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-OH647UT3.js";
 
 // src/cli/mode-request.ts
 var parseDuration = (value) => {

package/dist/{chunk-WE2RVY7V.js → chunk-M6R3SZZS.js}

@@ -1,6 +1,6 @@
 import {
   readTranscriptPreference
-} from "./chunk-6IOLTFNP.js";
+} from "./chunk-AQ3TSQA2.js";
 
 // src/transcript-setting.ts
 var transcriptEnvironmentPreference = () => {

package/dist/{chunk-P345G4DK.js → chunk-M7DCI44L.js}

@@ -1,6 +1,6 @@
 import {
   DEFAULT_SESSION
-} from "./chunk-CW3QUV6B.js";
+} from "./chunk-GYP6DLA4.js";
 
 // src/answer.ts
 var isDeferAnswer = (value) => value === "defer";

package/dist/{chunk-E3FSKKTJ.js → chunk-N4DMADJM.js}

@@ -1,6 +1,6 @@
 import {
   redactSecretsFromContent
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-OH647UT3.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";

package/dist/{chunk-ARJSQUIS.js → chunk-NHBPW6C4.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-E7EOUEGQ.js";
+} from "./chunk-QIODXPTP.js";
 import {
   readJsonSafe,
   writeFileAtomic
@@ -13,7 +13,7 @@ import {
   serializeDeclinedAgents,
   withDeclinedAgent,
   withoutDeclinedAgent
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-OH647UT3.js";
 
 // src/declined-agents-file.ts
 import { join } from "path";

package/dist/{chunk-YR3DHPYI.js → chunk-NSCETODW.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-3EGEA4KH.js";
 import {
   getBaseUrl
-} from "./chunk-75MJRC5I.js";
+} from "./chunk-OQPEHKH2.js";
 
 // src/cli/login-ui.ts
 import { hostname } from "os";

package/dist/{chunk-GFXZDU4V.js → chunk-OH647UT3.js}

@@ -102,7 +102,7 @@ var AGENTS = {
     enforcement: "enforced",
     connectVia: "Native hooks + MCP",
     setupCommand: PUSHARY_SETUP_COMMAND,
-    enforcementDetail: "Shell, writes and edits through native BeforeTool hooks."
+    enforcementDetail: "Shell, writes, edits and MCP calls through native BeforeTool hooks."
   },
   hermes: {
     ...defaults,
@@ -333,6 +333,7 @@ var toToolLookup = (profile, toolName, toolInput, resolvePath = (path) => path)
 var NO_AGENT_PROMPT_REASON = "Pushary needs an answer from the phone before this can run, and this agent has no approval prompt of its own here, so nothing ran. Ask the user, then try again.";
 var DENIED_BY_PUSHARY_REASON = "Denied from Pushary.";
 var SOLE_GATE_UNDECIDED_REASON = "Pushary could not decide on this call, so it did not run. Pushary is the only approval for this agent. Check that Pushary is signed in and online, then try again.";
+var SOLE_GATE_SUBSCRIPTION_REASON = "Pushary needs an active subscription to approve this call, so it did not run. Pushary is the only approval for this agent. Renew Pushary, or disconnect this agent from Pushary.";
 var SOLE_GATE_SIGNED_OUT_REASON = "Pushary is not signed in on this computer, so nothing can approve this call and it did not run. Sign in to Pushary, or disconnect this agent from Pushary.";
 var UNCARRIED_ANSWER_REASON = "The answer from the phone cannot be passed to this agent, so the call did not run. Ask the question in chat instead.";
 var renderAllowDenyDecision = (verdict) => {
@@ -1510,7 +1511,14 @@ var DATE_UTC_FLAG = "-u";
 var isFlagToken = (token) => token.startsWith("-");
 var isPrintOnlySed = (args) => args[0] === SED_QUIET_FLAG && SED_PRINT_ONLY_SCRIPT.test(args[1] ?? "") && !args.slice(2).some(isFlagToken);
 var isReadOnlyDate = (args) => args.every((arg) => arg.startsWith(DATE_FORMAT_PREFIX) || arg === DATE_UTC_FLAG);
-var isOutputOnlyPrintf = (args) => args[0] === END_OF_OPTIONS || !isFlagToken(args[0] ?? "");
+var PRINTF_TEXT_CONVERSION = /%(?:%|[-+ #0]*\d*(?:\.\d*)?[bcqs])/g;
+var PRINTF_CONVERSION_START = "%";
+var ARITHMETIC_SAFE_NUMBER = /^[-+]?(?:0[xX][0-9a-fA-F]+|\d+(?:\.\d+)?)$/;
+var printfAssignsNothing = (args) => args[0] === END_OF_OPTIONS || !isFlagToken(args[0] ?? "");
+var printfOperands = (args) => args[0] === END_OF_OPTIONS ? args.slice(1) : args;
+var convertsArgumentsOnlyAsText = (format) => !format.replace(PRINTF_TEXT_CONVERSION, "").includes(PRINTF_CONVERSION_START);
+var printfNeverEvaluatesAnArgument = ([format = "", ...values]) => convertsArgumentsOnlyAsText(format) || values.every((value) => ARITHMETIC_SAFE_NUMBER.test(value));
+var isOutputOnlyPrintf = (args) => printfAssignsNothing(args) && printfNeverEvaluatesAnArgument(printfOperands(args));
 var READ_ONLY_SEGMENT_SEPARATOR = /&&|\|\||[;|]/g;
 var PIPELINE_CHAIN_SEPARATOR = /&&|\|\||;/g;
 var EXPANSION_THAT_CAN_BECOME_A_FLAG = /\$|(?:^|\s)[*?[]/;
@@ -2609,6 +2617,8 @@ var codexUnansweredPreToolUse = (ask) => {
   if (timeoutActionApplies(ask) && ask.timeoutAction === "deny") return CODEX_ASK_UNANSWERED;
   return codexRaisesItsOwnPrompts(ask.permissionMode) ? CODEX_ASK_PASSES : CODEX_ASK_UNANSWERED;
 };
+var CODEX_DEFER_WITHOUT_A_PROMPT = { kind: "deny", reason: NO_AGENT_PROMPT_REASON };
+var codexDeferredPreToolUse = (agentPromptFollows) => agentPromptFollows ? CODEX_ASK_PASSES : CODEX_DEFER_WITHOUT_A_PROMPT;
 var isScopeReason = (scopeReason) => typeof scopeReason === "string" && scopeReason.length > 0;
 var scopeBreachReasonOf = (verdict) => verdict.kind === "gate" && isScopeReason(verdict.scopeReason) ? verdict.scopeReason : void 0;
 var onlyCodexPreToolUseCanAsk = (verdict, permissionMode) => verdict.kind === "gate" && (scopeBreachReasonOf(verdict) !== void 0 || !codexRaisesItsOwnPrompts(permissionMode));
@@ -3154,6 +3164,7 @@ export {
   canonicalToolName,
   toToolLookup,
   SOLE_GATE_UNDECIDED_REASON,
+  SOLE_GATE_SUBSCRIPTION_REASON,
   SOLE_GATE_SIGNED_OUT_REASON,
   renderPreToolUseVerdict,
   pusharyMissingReason,
@@ -3249,6 +3260,7 @@ export {
   NO_RESPONSE_REASON,
   codexHasNoPromptOfItsOwn,
   codexUnansweredPreToolUse,
+  codexDeferredPreToolUse,
   scopeBreachReasonOf,
   codexCallNeedsAPerson,
   claudePermissionRulesFromSettings,