pushary 1.9.22 → 1.9.24

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 1.9.24
+
+- Under When I'm out, a call nobody answers is refused for every agent with no approval prompt of its own (Antigravity CLI, Cursor file edits, sessions started from your phone), even when your rule approves on timeout. The 1.9.17 notes said this; only Codex did it. Under Every time a rule that approves on timeout still runs the call after its full wait.
+- After three approvals nobody answered in a session, an Every time call whose rule approves on timeout keeps reaching your phone instead of running at once with nothing shown. Antigravity CLI sessions are no longer paused at all: agy sends nothing that could lift the pause, so every later call was refused until a new conversation.
+- "Allow for this session" is offered for an MCP tool only when its name says it reads, such as `get_issue` or `list_files`. A grant cannot see the arguments of later calls, so a tool such as `query` or `create_issue` asks every time. A session grant already given for such a tool stops applying.
+- `pushary sign-out --revoke` and `pushary clean --everything` revoke only a key this CLI created by browser sign-in or pairing. The Pushary Mac app's key, a key you pasted or passed with `--key`, and a key from an `export PUSHARY_API_KEY` line are removed from this computer and not revoked, because the Mac app or another machine may still use them; the output says so and links to the dashboard to revoke it there. Since 1.9.8 `sign-out --revoke` could revoke the Mac app's own key. A key saved before 1.9.24 has no record of how it was made, so it is removed and not revoked until your next sign-in records one.
+
+## 1.9.23
+
+- A `printf` whose format has a numeric conversion, such as `%d`, `%x` or `%f`, is no longer approved as a read unless every argument is a plain number. zsh, the default shell on a Mac, evaluates those arguments as arithmetic, and an argument such as `'PWD[$(command)]'` ran the command while Pushary approved it without asking. `printf '%s\n' text`, `printf hello` and `printf '%d\n' 42` are still approved as reads.
+- Codex with its approval policy set to never: answering "Handle on your machine" on your phone now refuses the call. Codex has no prompt of its own there, so the call used to run, a destructive one included. With Codex's own prompts on, the call still goes to that prompt.
+- Antigravity CLI: when your Pushary subscription has ended, a call Pushary would ask about is refused with a message that says so. Pushary is agy's only gate, and the call used to run with nothing asking. Renew, or run `pushary disconnect antigravity` to give approvals back to agy.
+
 ## 1.9.22
 
 - Each approval Claude Code or Codex sends through Pushary now carries the approval mode the agent reported for the session, such as `default` or `bypassPermissions`, so Pushary can tell which mode an approval was asked in. It is recorded with the approval and never used to decide one. A mode that is empty or not text is left out, and a long one is cut to 64 characters.

package/data/cursor-plugin/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "pushary",
   "displayName": "Pushary — Control Panel for AI Agents",
   "description": "Push notifications, human-in-the-loop questions, and permission gating for your AI coding agent. Get a push when a task finishes, answer the agent from your phone, and approve risky commands before they run.",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "author": { "name": "Pushary", "email": "business@pushary.com" },
   "homepage": "https://pushary.com",
   "repository": "https://github.com/Pushary/cursor-plugin",

package/data/cursor-plugin/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.2.6
+
+- Under When I'm out, a file change nobody answers is refused, even when your rule approves on timeout. Cursor's file hooks have no prompt of their own, so the change used to run once the wait ended. Under Every time a rule that approves on timeout still runs the change, as before.
+
 ## 0.2.5
 
 - Under When I'm out, a file change asks your phone every time, also while you are at the keyboard, and waits for your policy's timeout. Cursor's file hooks cannot show a prompt of their own. Before, the change was refused with "Switch to Every time" and nobody was asked, or it was refused after the 10 second push window when you were away. Shell commands and MCP calls keep When I'm out as it was, because Cursor prompts for those itself.

package/data/cursor-plugin/scripts/pushary-gate.mjs

@@ -37,6 +37,8 @@ const unresolved = (verdict) => genericToolHook && verdict?.reason === 'not_gate
 
 const approvalModeWithoutLocalPrompt = (mode) => mode === 'push_first' ? 'push_only' : mode
 const deliveryModeForThisHook = (mode) => genericToolHook ? approvalModeWithoutLocalPrompt(mode) : mode
+const timeoutActionWithoutLocalPrompt = ({ mode, timeoutAction }) => mode !== 'push_only' && timeoutAction === 'approve' ? 'deny' : timeoutAction
+const timeoutActionForThisHook = (tool) => genericToolHook ? timeoutActionWithoutLocalPrompt(tool) : tool.timeoutAction
 const localSurfaceHint = () => genericToolHook ? { localSurfaceAvailable: false } : {}
 
 let activeQuestion
@@ -705,7 +707,7 @@ setTimeout(async () => {
       case 'notify_only':
         return respond(await handleNotifyOnly(apiKey, request, project, ident))
       case 'push_only':
-        return respond(await handlePushOnly(apiKey, request, project, ident, tool.timeoutSeconds, tool.timeoutAction))
+        return respond(await handlePushOnly(apiKey, request, project, ident, tool.timeoutSeconds, timeoutActionForThisHook(tool)))
       case 'push_first':
       default:
         return respond(await handlePushFirst(apiKey, request, project, ident, tool.pushFirstSeconds))
@@ -718,7 +720,7 @@ setTimeout(async () => {
 
 // Exported for scripts/pushary-gate.test.mjs. main() only runs when the gate is
 // executed directly, so importing this file for a test does not read stdin.
-export { normalizeRepoRemote, deriveRepoKey, describeRequest, handlePushOnly, handlePushFirst, withdraw, approvalModeWithoutLocalPrompt }
+export { normalizeRepoRemote, deriveRepoKey, describeRequest, handlePushOnly, handlePushFirst, withdraw, approvalModeWithoutLocalPrompt, timeoutActionWithoutLocalPrompt }
 
 const isDirectRun = process.argv[1] && import.meta.url === `file://${process.argv[1]}`
 if (!isDirectRun) {

package/data/cursor-plugin/scripts/pushary-gate.test.mjs

@@ -14,7 +14,7 @@
 
 import assert from 'node:assert/strict'
 import { describe, it } from 'node:test'
-import { describeRequest, normalizeRepoRemote, redactSecrets } from './pushary-gate.mjs'
+import { describeRequest, normalizeRepoRemote, redactSecrets, timeoutActionWithoutLocalPrompt } from './pushary-gate.mjs'
 
 describe('repo identity', () => {
   it('collapses the forms of one remote', () => {
@@ -135,3 +135,16 @@ describe('approval text redaction', () => {
     assert.equal(redactSecrets('export API_KEY="abc123" && rm -rf build'), 'export API_KEY="[redacted]" && rm -rf build')
   })
 })
+
+describe('a rule that approves on timeout, for a file hook with no prompt of its own', () => {
+  it('approves only under Every time, and is refused under When I am out', () => {
+    assert.equal(timeoutActionWithoutLocalPrompt({ mode: 'push_only', timeoutAction: 'approve' }), 'approve')
+    assert.equal(timeoutActionWithoutLocalPrompt({ mode: 'push_first', timeoutAction: 'approve' }), 'deny')
+  })
+
+  it('leaves every other timeout action as the rule wrote it', () => {
+    for (const timeoutAction of ['deny', 'escalate', 'wait']) {
+      assert.equal(timeoutActionWithoutLocalPrompt({ mode: 'push_first', timeoutAction }), timeoutAction)
+    }
+  })
+})

package/dist/bin/pushary-bell-hook.js

@@ -1,41 +1,41 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-76YNWUXC.js";
+} from "../chunk-2F6UQ3YD.js";
 import {
   readHookInput
-} from "../chunk-E7HOX73X.js";
-import "../chunk-LH3GTSXC.js";
+} from "../chunk-T5KM7J75.js";
+import "../chunk-W5NHIA4Y.js";
 import "../chunk-VTR4VRL2.js";
-import "../chunk-N2JP3RKP.js";
-import "../chunk-E3FSKKTJ.js";
-import "../chunk-GNQZY4GL.js";
-import "../chunk-WE2RVY7V.js";
+import "../chunk-HBR6ZZHN.js";
+import "../chunk-RIBIEQHU.js";
+import "../chunk-3WRJU7KN.js";
+import "../chunk-JDWOK6PE.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-6TSEEKPL.js";
-import "../chunk-TSFNX5J2.js";
-import "../chunk-YGR5PBOF.js";
-import "../chunk-U26CAOZC.js";
-import "../chunk-OZVZGWER.js";
+import "../chunk-LOERK6N3.js";
+import "../chunk-OSOCONIE.js";
+import "../chunk-VFIZFKZY.js";
+import "../chunk-NJK4MGXL.js";
+import "../chunk-VICG46JC.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-6IOLTFNP.js";
-import "../chunk-CW3QUV6B.js";
-import "../chunk-BDV4WDIA.js";
-import "../chunk-AGIO7SF5.js";
+import "../chunk-U23XTMBF.js";
+import "../chunk-KT5BH6GC.js";
+import "../chunk-RFK2WN6S.js";
+import "../chunk-ZVON5PCF.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-6SFTI7LM.js";
-import "../chunk-NB2PY5JX.js";
-import "../chunk-WAKQYJ6T.js";
-import "../chunk-U2IEM5FF.js";
+import "../chunk-RK7TDMQT.js";
+import "../chunk-H2RD5EMR.js";
+import "../chunk-2E6AWHV7.js";
+import "../chunk-IS737HST.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-5TLRS3AK.js";
-import "../chunk-E7EOUEGQ.js";
+import "../chunk-GXQVOKHJ.js";
+import "../chunk-NQICO3ES.js";
 import "../chunk-AQFEP65J.js";
-import "../chunk-75MJRC5I.js";
-import "../chunk-TZWZVAMN.js";
-import "../chunk-GFXZDU4V.js";
+import "../chunk-OY6NJWDD.js";
+import "../chunk-QDKNLNCA.js";
+import "../chunk-GM2IFDVF.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,39 +5,39 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-76YNWUXC.js";
+} from "../chunk-2F6UQ3YD.js";
 import {
   createIo
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-2MW4OHWI.js";
+} from "../chunk-264EOGIK.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-OZVZGWER.js";
+} from "../chunk-VICG46JC.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-6IOLTFNP.js";
+import "../chunk-U23XTMBF.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-5TLRS3AK.js";
+import "../chunk-GXQVOKHJ.js";
 import {
   claudeSettings
-} from "../chunk-E7EOUEGQ.js";
+} from "../chunk-NQICO3ES.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-AQFEP65J.js";
-import "../chunk-75MJRC5I.js";
-import "../chunk-TZWZVAMN.js";
+import "../chunk-OY6NJWDD.js";
+import "../chunk-QDKNLNCA.js";
 import {
   isRecord
-} from "../chunk-GFXZDU4V.js";
+} from "../chunk-GM2IFDVF.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,39 +8,39 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-KH2EDRJQ.js";
+} from "../chunk-35U2QHH2.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-P345G4DK.js";
+} from "../chunk-E4B7TXVS.js";
 import {
   claudeTranscriptPath,
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-LH3GTSXC.js";
+} from "../chunk-W5NHIA4Y.js";
 import "../chunk-VTR4VRL2.js";
 import {
   ensureDaemonRunning
-} from "../chunk-N2JP3RKP.js";
+} from "../chunk-HBR6ZZHN.js";
 import {
   encryptRecord
-} from "../chunk-E3FSKKTJ.js";
-import "../chunk-GNQZY4GL.js";
+} from "../chunk-RIBIEQHU.js";
+import "../chunk-3WRJU7KN.js";
 import {
   transcriptsEnabled
-} from "../chunk-WE2RVY7V.js";
+} from "../chunk-JDWOK6PE.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
-import "../chunk-TSFNX5J2.js";
-import "../chunk-YGR5PBOF.js";
-import "../chunk-U26CAOZC.js";
-import "../chunk-OZVZGWER.js";
+import "../chunk-OSOCONIE.js";
+import "../chunk-VFIZFKZY.js";
+import "../chunk-NJK4MGXL.js";
+import "../chunk-VICG46JC.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-6IOLTFNP.js";
+import "../chunk-U23XTMBF.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -58,8 +58,8 @@ import {
   reportEvent,
   savePendingCommand,
   scopePathFor
-} from "../chunk-CW3QUV6B.js";
-import "../chunk-BDV4WDIA.js";
+} from "../chunk-KT5BH6GC.js";
+import "../chunk-RFK2WN6S.js";
 import {
   askUser,
   cancelQuestion,
@@ -69,35 +69,36 @@ import {
   waitForAnswer,
   waitsForThePhone,
   withdrawQuestion
-} from "../chunk-AGIO7SF5.js";
+} from "../chunk-ZVON5PCF.js";
 import "../chunk-POFBE6ZY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-6SFTI7LM.js";
-import "../chunk-NB2PY5JX.js";
-import "../chunk-WAKQYJ6T.js";
+} from "../chunk-RK7TDMQT.js";
+import "../chunk-H2RD5EMR.js";
+import "../chunk-2E6AWHV7.js";
 import {
   getMachineId
-} from "../chunk-U2IEM5FF.js";
+} from "../chunk-IS737HST.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-5TLRS3AK.js";
-import "../chunk-E7EOUEGQ.js";
+import "../chunk-GXQVOKHJ.js";
+import "../chunk-NQICO3ES.js";
 import "../chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-75MJRC5I.js";
+} from "../chunk-OY6NJWDD.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-TZWZVAMN.js";
+} from "../chunk-QDKNLNCA.js";
 import {
   DECISION_STOP_REASON,
   KILL_REASON,
   UNVERIFIABLE_APPROVAL_REASON,
   redactSecretsFromContent,
-  resolveGate
-} from "../chunk-GFXZDU4V.js";
+  resolveGate,
+  timeoutActionWithoutLocalPrompt
+} from "../chunk-GM2IFDVF.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {
@@ -454,7 +455,7 @@ var createRemoteApprover = (deps) => {
     const ceiling = policy.timeoutAction === "wait" ? MAX_APPROVAL_WINDOW_MS : base;
     return Math.min(Math.max(base, 15e3), Math.max(ceiling, 15e3));
   };
-  const applyTimeout = (policy, input) => policy.timeoutAction === "approve" ? allow(input) : deny("No approval received in time");
+  const applyTimeout = (policy, input) => timeoutActionWithoutLocalPrompt(policy) === "approve" ? allow(input) : deny("No approval received in time");
   const waitForPhone = async (entry, correlationId, windowMs) => {
     const deadline = now() + windowMs;
     while (now() < deadline && !entry.controller.signal.aborted) {

package/dist/bin/pushary-clean.js

@@ -5,15 +5,16 @@ import {
   createGuards
 } from "../chunk-EUW7JL2K.js";
 import {
-  describeRevokeAttempt,
-  keyNoLongerAccepted,
-  revokeOwnKey
-} from "../chunk-OYIN77HO.js";
+  describeCliKeyRevocation,
+  planCliKeyRevocations,
+  readCliHeldKeys,
+  revokeCliKeys
+} from "../chunk-L5MCJNSI.js";
 import {
   isCursorPluginLeftover,
   releaseSoleGate,
   withoutPusharyCursorHooks
-} from "../chunk-KCLWVCGN.js";
+} from "../chunk-HLXGEOX3.js";
 import {
   HERMES_PIP_PACKAGE,
   readHermesStatus,
@@ -22,27 +23,25 @@ import {
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-SGUGGHMC.js";
+} from "../chunk-SH2KK2ED.js";
 import {
   planFxRemoval,
   removeInstructionBlock
-} from "../chunk-XDTYGS6R.js";
-import "../chunk-BDGKWUK2.js";
+} from "../chunk-XA2RGGNR.js";
+import "../chunk-Q7IEFI7V.js";
 import {
   disableDaemonService
-} from "../chunk-N2JP3RKP.js";
+} from "../chunk-HBR6ZZHN.js";
 import "../chunk-XHKBHWLX.js";
-import {
-  APPROVAL_SETTINGS_PATH
-} from "../chunk-ZUOIDI6M.js";
+import "../chunk-EE357RIP.js";
 import {
   macAppKeepsMcpEntry,
   mcpServerBearer,
   pusharyKey,
   readMacAppAgentKey,
   setupReceiptKey
-} from "../chunk-YPZ4AE2R.js";
-import "../chunk-YODL2CJV.js";
+} from "../chunk-2JTJZ7VI.js";
+import "../chunk-CYGIJXAP.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -54,14 +53,14 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-U4OWRGYI.js";
+} from "../chunk-O3RRQTTV.js";
 import {
   ansiPainter,
   useColor
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-2MW4OHWI.js";
+} from "../chunk-264EOGIK.js";
 import {
   compatibleConfigFile,
   compatibleInstructionsFile,
@@ -74,7 +73,7 @@ import {
   removePusharySettings,
   removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-6TSEEKPL.js";
+} from "../chunk-LOERK6N3.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
@@ -82,42 +81,35 @@ import {
   resolveBridgeStub,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-TSFNX5J2.js";
+} from "../chunk-OSOCONIE.js";
 import {
   removeGeminiSettings
-} from "../chunk-YGR5PBOF.js";
-import "../chunk-U26CAOZC.js";
-import "../chunk-OZVZGWER.js";
+} from "../chunk-VFIZFKZY.js";
+import "../chunk-NJK4MGXL.js";
+import "../chunk-VICG46JC.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
 import {
   CANDIDATE_RCS,
-  findExportedKeyLines,
-  isAdoptedMacAppKey,
   isDisabledExport,
-  keyPrefix,
-  readConfigFileKey,
-  readKeySource,
-  readMacAppKeyPrefix,
-  removeClaudeAlias
-} from "../chunk-6IOLTFNP.js";
-import "../chunk-CW3QUV6B.js";
-import "../chunk-BDV4WDIA.js";
-import "../chunk-AGIO7SF5.js";
+  removeClaudeAlias,
+  shellProfileCandidates
+} from "../chunk-U23XTMBF.js";
+import "../chunk-KT5BH6GC.js";
+import "../chunk-RFK2WN6S.js";
+import "../chunk-ZVON5PCF.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-6SFTI7LM.js";
-import {
-  absoluteUrl
-} from "../chunk-NB2PY5JX.js";
-import "../chunk-WAKQYJ6T.js";
-import "../chunk-U2IEM5FF.js";
+import "../chunk-RK7TDMQT.js";
+import "../chunk-H2RD5EMR.js";
+import "../chunk-2E6AWHV7.js";
+import "../chunk-IS737HST.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-5TLRS3AK.js";
+import "../chunk-GXQVOKHJ.js";
 import {
   claudeJson,
   claudeMcpReceipt,
@@ -154,14 +146,14 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-E7EOUEGQ.js";
+} from "../chunk-NQICO3ES.js";
 import "../chunk-AQFEP65J.js";
 import {
   getBaseUrl
-} from "../chunk-75MJRC5I.js";
+} from "../chunk-OY6NJWDD.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-TZWZVAMN.js";
+} from "../chunk-QDKNLNCA.js";
 import {
   CLI_PACKAGE_NAMES,
   HOOK_COMPATIBLE_PROFILES,
@@ -173,7 +165,7 @@ import {
   globalRootFor,
   isValidApiKey,
   redactSecrets
-} from "../chunk-GFXZDU4V.js";
+} from "../chunk-GM2IFDVF.js";
 
 // bin/pushary-clean.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync4 } from "fs";
@@ -599,43 +591,6 @@ var cleanCompatibleAgent = (profile, scope, io, home) => {
   };
 };
 
-// src/cli/clean-key-revocation.ts
-var isMacAppCurrentOrAdoptedKey = (key, keys) => key === keys.macAppKey || isAdoptedMacAppKey(key, keys.macAppKeyPrefix);
-var revocationFor = (keys) => (key) => isMacAppCurrentOrAdoptedKey(key, keys) ? { kind: "mac_app_key", keyPrefix: keyPrefix(key) } : { kind: "revoke", key };
-var validKeys = (keys) => [...new Set(keys)].filter((key) => key !== null && isValidApiKey(key));
-var environmentOnlyKey = (keys, written) => validKeys([keys.envKey]).filter((key) => !written.includes(key)).map((key) => ({ kind: "environment_only", keyPrefix: keyPrefix(key) }));
-var planCliKeyRevocations = (keys) => {
-  const written = validKeys([keys.configKey, ...keys.profileKeys]);
-  return [...written.map(revocationFor(keys)), ...environmentOnlyKey(keys, written)];
-};
-var runRevocation = async (revocation, run) => {
-  if (revocation.kind !== "revoke") return revocation;
-  if (run.dryRun) return { kind: "would_revoke", keyPrefix: keyPrefix(revocation.key) };
-  return { kind: "attempted", keyPrefix: keyPrefix(revocation.key), attempt: await revokeOwnKey(revocation.key, run.baseUrl) };
-};
-var revokeCliKeys = async (revocations, run) => {
-  const outcomes = [];
-  for (const revocation of revocations) outcomes.push(await runRevocation(revocation, run));
-  return outcomes;
-};
-var describeCliKeyRevocation = (outcome, baseUrl) => {
-  const label = `API key ${outcome.keyPrefix}`;
-  switch (outcome.kind) {
-    case "would_revoke":
-      return { tone: "skipped", line: `${label} (would revoke it on pushary.com)`, next: null };
-    case "mac_app_key":
-      return { tone: "skipped", line: `${label} (not revoked: it is the Pushary Mac app's key)`, next: null };
-    case "environment_only":
-      return { tone: "skipped", line: `${label} in PUSHARY_API_KEY (left alone: Pushary did not write it)`, next: null };
-    case "attempted":
-      return keyNoLongerAccepted(outcome.attempt) ? { tone: "done", line: `${label}: ${describeRevokeAttempt(outcome.attempt)}`, next: null } : {
-        tone: "warning",
-        line: `${label}: ${describeRevokeAttempt(outcome.attempt)}`,
-        next: `It may still be valid. Revoke it at ${absoluteUrl(baseUrl, APPROVAL_SETTINGS_PATH)}`
-      };
-  }
-};
-
 // bin/pushary-clean.ts
 exitOnHelpFlag("clean");
 var paint = ansiPainter(() => useColor());
@@ -870,18 +825,11 @@ var printKeyRevocation = (report) => {
   console.log(`  ${KEY_REVOCATION_ICONS[report.tone]} ${report.line}`);
   if (report.next) console.log(`    ${dim(report.next)}`);
 };
-var revokeKeysThisCliHolds = async () => {
-  const baseUrl = getBaseUrl();
-  const source = readKeySource();
-  const revocations = planCliKeyRevocations({
-    configKey: readConfigFileKey(),
-    profileKeys: findExportedKeyLines().map((line) => line.key),
-    envKey: source.kind === "env" ? source.key : null,
-    macAppKey: readMacAppAgentKey(),
-    macAppKeyPrefix: readMacAppKeyPrefix()
-  });
-  const outcomes = await revokeCliKeys(revocations, { dryRun, baseUrl });
-  for (const outcome of outcomes) printKeyRevocation(describeCliKeyRevocation(outcome, baseUrl));
+var revokeKeysThisCliCreated = async () => {
+  const run = { dryRun, baseUrl: getBaseUrl() };
+  const revocations = planCliKeyRevocations(readCliHeldKeys(shellProfileCandidates()));
+  const outcomes = await revokeCliKeys(revocations, run);
+  for (const outcome of outcomes) printKeyRevocation(describeCliKeyRevocation(outcome, run));
 };
 var main = async () => {
   console.log();
@@ -961,7 +909,7 @@ var main = async () => {
     process.exit(EXIT.FAILED);
   }
   console.log(`  ${check} Background service ${dim(did("uninstalled"))}`);
-  if (everything) await revokeKeysThisCliHolds();
+  if (everything) await revokeKeysThisCliCreated();
   const claudeJson2 = readJson(CLAUDE_JSON);
   const keepClaudeMcp = macAppKeeps("claude_code", mcpServerBearer(claudeJson2?.mcpServers));
   const claudeHasPusharyEntry = () => Boolean(claudeJson2?.mcpServers?.pushary);

package/dist/bin/pushary-codex-bridge.js

@@ -5,10 +5,10 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-DV26ZWUC.js";
+} from "../chunk-T6TJA4RF.js";
 import {
   resolveProviderBinary
-} from "../chunk-UFGU7AK3.js";
+} from "../chunk-KX776UXN.js";
 import "../chunk-RIVNNBEK.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
@@ -16,50 +16,50 @@ import {
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-KH2EDRJQ.js";
-import "../chunk-E3FSKKTJ.js";
-import "../chunk-GNQZY4GL.js";
+} from "../chunk-35U2QHH2.js";
+import "../chunk-RIBIEQHU.js";
+import "../chunk-3WRJU7KN.js";
 import {
   transcriptsEnabled
-} from "../chunk-WE2RVY7V.js";
+} from "../chunk-JDWOK6PE.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-6IOLTFNP.js";
+import "../chunk-U23XTMBF.js";
 import {
   isAskUserResponse,
   isDecisionStopped,
   isWaitForAnswerResponse,
   withdrawQuestion,
   writeDegraded
-} from "../chunk-AGIO7SF5.js";
+} from "../chunk-ZVON5PCF.js";
 import "../chunk-POFBE6ZY.js";
 import {
   callMcpTool
-} from "../chunk-6SFTI7LM.js";
-import "../chunk-NB2PY5JX.js";
-import "../chunk-WAKQYJ6T.js";
+} from "../chunk-RK7TDMQT.js";
+import "../chunk-H2RD5EMR.js";
+import "../chunk-2E6AWHV7.js";
 import {
   getMachineId
-} from "../chunk-U2IEM5FF.js";
+} from "../chunk-IS737HST.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-5TLRS3AK.js";
-import "../chunk-E7EOUEGQ.js";
+import "../chunk-GXQVOKHJ.js";
+import "../chunk-NQICO3ES.js";
 import "../chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-75MJRC5I.js";
-import "../chunk-TZWZVAMN.js";
+} from "../chunk-OY6NJWDD.js";
+import "../chunk-QDKNLNCA.js";
 import {
   elicitationContent,
   parseAgentQuestion,
   parseAgentQuestionAnswers,
   planElicitationAsk,
   readElicitationFields
-} from "../chunk-GFXZDU4V.js";
+} from "../chunk-GM2IFDVF.js";
 
 // bin/pushary-codex-bridge.ts
 import { existsSync } from "fs";