pushary 1.9.22 → 1.9.24

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (105) hide show
  1. package/CHANGELOG.md +13 -0
  2. package/data/cursor-plugin/.cursor-plugin/plugin.json +1 -1
  3. package/data/cursor-plugin/CHANGELOG.md +4 -0
  4. package/data/cursor-plugin/scripts/pushary-gate.mjs +4 -2
  5. package/data/cursor-plugin/scripts/pushary-gate.test.mjs +14 -1
  6. package/dist/bin/pushary-bell-hook.js +25 -25
  7. package/dist/bin/pushary-bell.js +9 -9
  8. package/dist/bin/pushary-claude.js +27 -26
  9. package/dist/bin/pushary-clean.js +41 -93
  10. package/dist/bin/pushary-codex-bridge.js +17 -17
  11. package/dist/bin/pushary-codex-hook.js +33 -31
  12. package/dist/bin/pushary-codex.js +12 -12
  13. package/dist/bin/pushary-connect.js +24 -24
  14. package/dist/bin/pushary-cowork.js +5 -5
  15. package/dist/bin/pushary-daemon.js +31 -31
  16. package/dist/bin/pushary-disconnect.js +24 -24
  17. package/dist/bin/pushary-doctor.js +33 -33
  18. package/dist/bin/pushary-elicitation-hook.js +25 -25
  19. package/dist/bin/pushary-gemini-bridge.js +13 -13
  20. package/dist/bin/pushary-gemini-hook.js +27 -27
  21. package/dist/bin/pushary-hook.js +29 -29
  22. package/dist/bin/pushary-login.js +16 -16
  23. package/dist/bin/pushary-logout.js +77 -26
  24. package/dist/bin/pushary-mcp.js +9 -9
  25. package/dist/bin/pushary-mode.js +12 -12
  26. package/dist/bin/pushary-notification-hook.js +24 -24
  27. package/dist/bin/pushary-opencode-hook.js +26 -26
  28. package/dist/bin/pushary-permission-denied-hook.js +29 -29
  29. package/dist/bin/pushary-permission-hook.js +28 -28
  30. package/dist/bin/pushary-post-hook.js +24 -24
  31. package/dist/bin/pushary-prompt-hook.js +24 -24
  32. package/dist/bin/pushary-session-end-hook.js +24 -24
  33. package/dist/bin/pushary-session-start-hook.js +28 -28
  34. package/dist/bin/pushary-setup.js +46 -42
  35. package/dist/bin/pushary-stats.js +5 -5
  36. package/dist/bin/pushary-status.js +26 -26
  37. package/dist/bin/pushary-stop-hook.js +24 -24
  38. package/dist/bin/pushary-stopfailure-hook.js +24 -24
  39. package/dist/bin/pushary-suggestions.js +12 -12
  40. package/dist/bin/pushary-transcript-register.js +17 -17
  41. package/dist/bin/pushary-transcripts.js +7 -7
  42. package/dist/bin/pushary-upgrade.js +30 -30
  43. package/dist/bin/pushary-wait.js +12 -12
  44. package/dist/bin/pushary.js +6 -6
  45. package/dist/{chunk-2MW4OHWI.js → chunk-264EOGIK.js} +2 -2
  46. package/dist/{chunk-WAKQYJ6T.js → chunk-2E6AWHV7.js} +3 -3
  47. package/dist/{chunk-76YNWUXC.js → chunk-2F6UQ3YD.js} +1 -1
  48. package/dist/{chunk-YPZ4AE2R.js → chunk-2JTJZ7VI.js} +4 -4
  49. package/dist/{chunk-KH2EDRJQ.js → chunk-35U2QHH2.js} +2 -2
  50. package/dist/{chunk-GNQZY4GL.js → chunk-3WRJU7KN.js} +1 -1
  51. package/dist/{chunk-3BWW4UMT.js → chunk-7JHYWFY6.js} +2 -2
  52. package/dist/{chunk-ARJSQUIS.js → chunk-7Z2DLAEE.js} +2 -2
  53. package/dist/{chunk-AR4NXO4Q.js → chunk-CLVU24OZ.js} +2 -2
  54. package/dist/{chunk-YODL2CJV.js → chunk-CYGIJXAP.js} +2 -2
  55. package/dist/{chunk-P345G4DK.js → chunk-E4B7TXVS.js} +1 -1
  56. package/dist/{chunk-ZUOIDI6M.js → chunk-EE357RIP.js} +4 -4
  57. package/dist/{chunk-JQVGCDHW.js → chunk-EKPAV33G.js} +5 -5
  58. package/dist/{chunk-TH3HKKGW.js → chunk-G6GFNKF7.js} +18 -15
  59. package/dist/{chunk-T57BCGHQ.js → chunk-GBD6G4TA.js} +1 -1
  60. package/dist/{chunk-GFXZDU4V.js → chunk-GM2IFDVF.js} +38 -3
  61. package/dist/{chunk-5TLRS3AK.js → chunk-GXQVOKHJ.js} +2 -2
  62. package/dist/{chunk-NB2PY5JX.js → chunk-H2RD5EMR.js} +3 -3
  63. package/dist/{chunk-N2JP3RKP.js → chunk-HBR6ZZHN.js} +5 -5
  64. package/dist/{chunk-KCLWVCGN.js → chunk-HLXGEOX3.js} +4 -4
  65. package/dist/{chunk-Z7KB4R6U.js → chunk-IO5ZDIHY.js} +7 -7
  66. package/dist/{chunk-U2IEM5FF.js → chunk-IS737HST.js} +1 -1
  67. package/dist/{chunk-WE2RVY7V.js → chunk-JDWOK6PE.js} +1 -1
  68. package/dist/{chunk-CW3QUV6B.js → chunk-KT5BH6GC.js} +8 -8
  69. package/dist/{chunk-UFGU7AK3.js → chunk-KX776UXN.js} +2 -2
  70. package/dist/chunk-L5MCJNSI.js +166 -0
  71. package/dist/{chunk-KCXG2INQ.js → chunk-LHFK5F3T.js} +2 -2
  72. package/dist/{chunk-6TSEEKPL.js → chunk-LOERK6N3.js} +4 -4
  73. package/dist/{chunk-U26CAOZC.js → chunk-NJK4MGXL.js} +1 -1
  74. package/dist/{chunk-E7EOUEGQ.js → chunk-NQICO3ES.js} +4 -4
  75. package/dist/{chunk-U4OWRGYI.js → chunk-O3RRQTTV.js} +5 -5
  76. package/dist/{chunk-4AO2OVUA.js → chunk-OLWKCDK4.js} +6 -6
  77. package/dist/{chunk-TSFNX5J2.js → chunk-OSOCONIE.js} +5 -5
  78. package/dist/{chunk-75MJRC5I.js → chunk-OY6NJWDD.js} +1 -1
  79. package/dist/{chunk-YR3DHPYI.js → chunk-P447F2RB.js} +1 -1
  80. package/dist/{chunk-BDGKWUK2.js → chunk-Q7IEFI7V.js} +2 -2
  81. package/dist/{chunk-TZWZVAMN.js → chunk-QDKNLNCA.js} +3 -3
  82. package/dist/{chunk-BDV4WDIA.js → chunk-RFK2WN6S.js} +1 -1
  83. package/dist/{chunk-E3FSKKTJ.js → chunk-RIBIEQHU.js} +1 -1
  84. package/dist/{chunk-6SFTI7LM.js → chunk-RK7TDMQT.js} +3 -3
  85. package/dist/{chunk-G5YMVGAK.js → chunk-SBQCRQIP.js} +4 -4
  86. package/dist/{chunk-SGUGGHMC.js → chunk-SH2KK2ED.js} +3 -3
  87. package/dist/{chunk-E7HOX73X.js → chunk-T5KM7J75.js} +4 -4
  88. package/dist/{chunk-DV26ZWUC.js → chunk-T6TJA4RF.js} +2 -2
  89. package/dist/{chunk-6IOLTFNP.js → chunk-U23XTMBF.js} +21 -8
  90. package/dist/{chunk-YI543EKI.js → chunk-URCSJZNU.js} +3 -3
  91. package/dist/{chunk-YGR5PBOF.js → chunk-VFIZFKZY.js} +3 -3
  92. package/dist/{chunk-OZVZGWER.js → chunk-VICG46JC.js} +1 -1
  93. package/dist/{chunk-LH3GTSXC.js → chunk-W5NHIA4Y.js} +8 -8
  94. package/dist/{chunk-4PERN2SO.js → chunk-WYLA6J43.js} +1 -1
  95. package/dist/{chunk-XDTYGS6R.js → chunk-XA2RGGNR.js} +4 -4
  96. package/dist/{chunk-GWKT2ZZS.js → chunk-XQROISQB.js} +2 -2
  97. package/dist/{chunk-5AZ546F6.js → chunk-Z5L4NQHC.js} +1 -1
  98. package/dist/{chunk-AGIO7SF5.js → chunk-ZVON5PCF.js} +5 -5
  99. package/dist/{global-upgrade-F3QY6OHE.js → global-upgrade-DZGLAARJ.js} +6 -6
  100. package/dist/{paths-CBEAZNJR.js → paths-JATF66FP.js} +2 -2
  101. package/dist/{reapply-4HP6N7LY.js → reapply-7TDCFXNF.js} +20 -20
  102. package/dist/src/index.js +19 -19
  103. package/dist/{upgrade-lock-N3G5V2QS.js → upgrade-lock-LPIDFQEH.js} +3 -3
  104. package/package.json +1 -1
  105. package/dist/chunk-OYIN77HO.js +0 -72
@@ -1,9 +1,9 @@
1
1
  import {
2
2
  CODEX_HOOK_STATUS
3
- } from "./chunk-KCXG2INQ.js";
3
+ } from "./chunk-LHFK5F3T.js";
4
4
  import {
5
5
  NPX_LATEST_COMMAND
6
- } from "./chunk-TZWZVAMN.js";
6
+ } from "./chunk-QDKNLNCA.js";
7
7
 
8
8
  // src/setup/codex-trust.ts
9
9
  var CODEX_TRUST_TELEMETRY = {
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  pusharyDir
3
- } from "./chunk-E7EOUEGQ.js";
3
+ } from "./chunk-NQICO3ES.js";
4
4
  import {
5
5
  readJsonSafe,
6
6
  writeFileAtomic
@@ -13,7 +13,7 @@ import {
13
13
  serializeDeclinedAgents,
14
14
  withDeclinedAgent,
15
15
  withoutDeclinedAgent
16
- } from "./chunk-GFXZDU4V.js";
16
+ } from "./chunk-GM2IFDVF.js";
17
17
 
18
18
  // src/declined-agents-file.ts
19
19
  import { join } from "path";
@@ -6,12 +6,12 @@ import {
6
6
  permissionDeniedAction,
7
7
  releaseThrottle,
8
8
  reportEvent
9
- } from "./chunk-CW3QUV6B.js";
9
+ } from "./chunk-KT5BH6GC.js";
10
10
  import {
11
11
  machineDecisionFor,
12
12
  shouldDeferToNativeMode,
13
13
  wireVerdictFor
14
- } from "./chunk-GFXZDU4V.js";
14
+ } from "./chunk-GM2IFDVF.js";
15
15
 
16
16
  // src/machine-decision-audit.ts
17
17
  import { basename } from "path";
@@ -4,10 +4,10 @@ import {
4
4
  keyPrefix,
5
5
  readConfigFileKey,
6
6
  readMacAppKeyPrefix
7
- } from "./chunk-6IOLTFNP.js";
7
+ } from "./chunk-U23XTMBF.js";
8
8
  import {
9
9
  NPX_LATEST_COMMAND
10
- } from "./chunk-TZWZVAMN.js";
10
+ } from "./chunk-QDKNLNCA.js";
11
11
 
12
12
  // src/key-signed-out.ts
13
13
  var VERDICT_BY_CHECK = {
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  DEFAULT_SESSION
3
- } from "./chunk-CW3QUV6B.js";
3
+ } from "./chunk-KT5BH6GC.js";
4
4
 
5
5
  // src/answer.ts
6
6
  var isDeferAnswer = (value) => value === "defer";
@@ -2,25 +2,25 @@ import {
2
2
  SIGNED_OUT_ON_MAC_MESSAGE,
3
3
  describeSignedOutKey,
4
4
  readSignedOutDiagnosis
5
- } from "./chunk-YODL2CJV.js";
5
+ } from "./chunk-CYGIJXAP.js";
6
6
  import {
7
7
  createIo
8
8
  } from "./chunk-FO3MDD26.js";
9
9
  import {
10
10
  readKeySource
11
- } from "./chunk-6IOLTFNP.js";
11
+ } from "./chunk-U23XTMBF.js";
12
12
  import {
13
13
  absoluteUrl,
14
14
  checkApiKey,
15
15
  describeKeyCheck,
16
16
  keyCheckFromResponse
17
- } from "./chunk-NB2PY5JX.js";
17
+ } from "./chunk-H2RD5EMR.js";
18
18
  import {
19
19
  EXIT
20
20
  } from "./chunk-KZERVKTD.js";
21
21
  import {
22
22
  getBaseUrl
23
- } from "./chunk-75MJRC5I.js";
23
+ } from "./chunk-OY6NJWDD.js";
24
24
 
25
25
  // src/cli/report-key.ts
26
26
  var { dim, yellow } = createIo();
@@ -4,7 +4,7 @@ import {
4
4
  forkFinishWithUpgradeLock,
5
5
  installWithUpgradeLock,
6
6
  releaseAutoUpdateLock
7
- } from "./chunk-4PERN2SO.js";
7
+ } from "./chunk-WYLA6J43.js";
8
8
  import {
9
9
  describeAutoUpdateCheck,
10
10
  globalInstallLocation,
@@ -14,7 +14,7 @@ import {
14
14
  readAutoUpdateState,
15
15
  updateAutoUpdateState,
16
16
  upgradeEntryFor
17
- } from "./chunk-GWKT2ZZS.js";
17
+ } from "./chunk-XQROISQB.js";
18
18
  import {
19
19
  EXIT
20
20
  } from "./chunk-KZERVKTD.js";
@@ -27,10 +27,10 @@ import {
27
27
  npmErrorMessage,
28
28
  readGlobalCliInstallAt,
29
29
  readGlobalPrefix
30
- } from "./chunk-E7EOUEGQ.js";
30
+ } from "./chunk-NQICO3ES.js";
31
31
  import {
32
32
  NPX_LATEST_COMMAND
33
- } from "./chunk-TZWZVAMN.js";
33
+ } from "./chunk-QDKNLNCA.js";
34
34
  import {
35
35
  commandsPackage,
36
36
  globalUpgradeEntry,
@@ -39,7 +39,7 @@ import {
39
39
  isSameMajorVersion,
40
40
  ownPackageRoot,
41
41
  packageVersionAt
42
- } from "./chunk-GFXZDU4V.js";
42
+ } from "./chunk-GM2IFDVF.js";
43
43
 
44
44
  // src/global-upgrade.ts
45
45
  import { existsSync } from "fs";
@@ -1,20 +1,20 @@
1
1
  import {
2
2
  defersToNativeMode,
3
3
  reportMachineDenial
4
- } from "./chunk-AR4NXO4Q.js";
4
+ } from "./chunk-CLVU24OZ.js";
5
5
  import {
6
6
  isGatingMoment,
7
7
  recordKeylessMoment
8
- } from "./chunk-T57BCGHQ.js";
8
+ } from "./chunk-GBD6G4TA.js";
9
9
  import {
10
10
  announceSubscriptionRequired,
11
11
  isDeferAnswer,
12
12
  oncePerSession
13
- } from "./chunk-P345G4DK.js";
13
+ } from "./chunk-E4B7TXVS.js";
14
14
  import {
15
15
  activeHookSource,
16
16
  activeIdentity
17
- } from "./chunk-6TSEEKPL.js";
17
+ } from "./chunk-LOERK6N3.js";
18
18
  import {
19
19
  DEFAULT_SESSION,
20
20
  UNNAMED_ACTION,
@@ -39,7 +39,7 @@ import {
39
39
  reportEvent,
40
40
  scopePathFor,
41
41
  settleQuestionsForToolUse
42
- } from "./chunk-CW3QUV6B.js";
42
+ } from "./chunk-KT5BH6GC.js";
43
43
  import {
44
44
  askUser,
45
45
  cancelQuestion,
@@ -51,20 +51,20 @@ import {
51
51
  sendNotification,
52
52
  waitForQuestion,
53
53
  waitsForThePhone
54
- } from "./chunk-AGIO7SF5.js";
54
+ } from "./chunk-ZVON5PCF.js";
55
55
  import {
56
56
  SubscriptionRequiredError
57
- } from "./chunk-6SFTI7LM.js";
57
+ } from "./chunk-RK7TDMQT.js";
58
58
  import {
59
59
  getMachineId
60
- } from "./chunk-U2IEM5FF.js";
60
+ } from "./chunk-IS737HST.js";
61
61
  import {
62
62
  getApiKey,
63
63
  getBaseUrl
64
- } from "./chunk-75MJRC5I.js";
64
+ } from "./chunk-OY6NJWDD.js";
65
65
  import {
66
66
  NPX_LATEST_COMMAND
67
- } from "./chunk-TZWZVAMN.js";
67
+ } from "./chunk-QDKNLNCA.js";
68
68
  import {
69
69
  AGENT_QUESTION_STRATEGY,
70
70
  DECISION_STOP_REASON,
@@ -73,6 +73,7 @@ import {
73
73
  PLAN_DECLINED_REASON,
74
74
  SCOPE_BATCH_REASON,
75
75
  SOLE_GATE_SIGNED_OUT_REASON,
76
+ SOLE_GATE_SUBSCRIPTION_REASON,
76
77
  SOLE_GATE_UNDECIDED_REASON,
77
78
  UNVERIFIABLE_APPROVAL_REASON,
78
79
  WITHDRAWN_APPROVAL_REASON,
@@ -103,8 +104,9 @@ import {
103
104
  parseAgentQuestionAnswers,
104
105
  parseAgentQuestions,
105
106
  questionHandedToTheTerminal,
106
- resolveGate
107
- } from "./chunk-GFXZDU4V.js";
107
+ resolveGate,
108
+ timeoutActionWithoutLocalPrompt
109
+ } from "./chunk-GM2IFDVF.js";
108
110
 
109
111
  // src/claude-permission-rules.ts
110
112
  import { readFileSync, statSync } from "fs";
@@ -190,6 +192,7 @@ var outcomeOfFailedAsk = (error, sessionId, failure) => {
190
192
  announceSubscriptionRequired(error.upgradeUrl, sessionId);
191
193
  return void 0;
192
194
  };
195
+ var outcomeOfFailedPermissionAsk = (error, sessionId) => outcomeOfFailedAsk(error, sessionId, halted(UNVERIFIABLE_APPROVAL_REASON)) ?? undecidedCall(SOLE_GATE_SUBSCRIPTION_REASON);
193
196
  var storedWaitDeadline = (result, requestedDeadline) => {
194
197
  const stored = result.waitEndsAt ? Date.parse(result.waitEndsAt) : Number.NaN;
195
198
  return Number.isFinite(stored) ? Math.min(stored, requestedDeadline) : requestedDeadline;
@@ -214,7 +217,7 @@ var handlePushOnly = async (apiKey, description, projectName, timeoutSeconds, ti
214
217
  ...decision
215
218
  });
216
219
  } catch (error) {
217
- return outcomeOfFailedAsk(error, sessionId, halted(UNVERIFIABLE_APPROVAL_REASON));
220
+ return outcomeOfFailedPermissionAsk(error, sessionId);
218
221
  }
219
222
  if (isDecisionStopped(result)) return halted(DECISION_STOP_REASON);
220
223
  const deadline = storedWaitDeadline(result, requestedDeadline);
@@ -259,7 +262,7 @@ var handlePushFirst = async (apiKey, description, projectName, pushFirstSeconds,
259
262
  ...decision
260
263
  });
261
264
  } catch (error) {
262
- return outcomeOfFailedAsk(error, sessionId, halted(UNVERIFIABLE_APPROVAL_REASON));
265
+ return outcomeOfFailedPermissionAsk(error, sessionId);
263
266
  }
264
267
  if (isDecisionStopped(result)) return halted(DECISION_STOP_REASON);
265
268
  if (waitsForThePhone(result)) announceWait(pushFirstSeconds, result.answerUrl, sessionId);
@@ -343,7 +346,7 @@ var dispatchModeHandler = async (apiKey, input, toolPolicy, machineId, trainingC
343
346
  const runHandler = () => {
344
347
  switch (ownPrompt ? toolPolicy.mode : approvalModeWithoutLocalPrompt(toolPolicy.mode)) {
345
348
  case "push_only":
346
- return handlePushOnly(apiKey, description, projectName, toolPolicy.timeoutSeconds, toolPolicy.timeoutAction, sessionId, machineId, input.tool_name, toolTarget, decision, signals);
349
+ return handlePushOnly(apiKey, description, projectName, toolPolicy.timeoutSeconds, ownPrompt ? toolPolicy.timeoutAction : timeoutActionWithoutLocalPrompt(toolPolicy), sessionId, machineId, input.tool_name, toolTarget, decision, signals);
347
350
  case "terminal_only":
348
351
  return Promise.resolve(handleTerminalOnly());
349
352
  case "push_first":
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  isSafeReadOnlyCommand
3
- } from "./chunk-GFXZDU4V.js";
3
+ } from "./chunk-GM2IFDVF.js";
4
4
 
5
5
  // src/ledger.ts
6
6
  import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";
@@ -102,7 +102,7 @@ var AGENTS = {
102
102
  enforcement: "enforced",
103
103
  connectVia: "Native hooks + MCP",
104
104
  setupCommand: PUSHARY_SETUP_COMMAND,
105
- enforcementDetail: "Shell, writes and edits through native BeforeTool hooks."
105
+ enforcementDetail: "Shell, writes, edits and MCP calls through native BeforeTool hooks."
106
106
  },
107
107
  hermes: {
108
108
  ...defaults,
@@ -333,6 +333,7 @@ var toToolLookup = (profile, toolName, toolInput, resolvePath = (path) => path)
333
333
  var NO_AGENT_PROMPT_REASON = "Pushary needs an answer from the phone before this can run, and this agent has no approval prompt of its own here, so nothing ran. Ask the user, then try again.";
334
334
  var DENIED_BY_PUSHARY_REASON = "Denied from Pushary.";
335
335
  var SOLE_GATE_UNDECIDED_REASON = "Pushary could not decide on this call, so it did not run. Pushary is the only approval for this agent. Check that Pushary is signed in and online, then try again.";
336
+ var SOLE_GATE_SUBSCRIPTION_REASON = "Pushary needs an active subscription to approve this call, so it did not run. Pushary is the only approval for this agent. Renew Pushary, or disconnect this agent from Pushary.";
336
337
  var SOLE_GATE_SIGNED_OUT_REASON = "Pushary is not signed in on this computer, so nothing can approve this call and it did not run. Sign in to Pushary, or disconnect this agent from Pushary.";
337
338
  var UNCARRIED_ANSWER_REASON = "The answer from the phone cannot be passed to this agent, so the call did not run. Ask the question in chat instead.";
338
339
  var renderAllowDenyDecision = (verdict) => {
@@ -912,6 +913,8 @@ var approvalModeWithoutLocalPrompt = (mode) => {
912
913
  return mode;
913
914
  }
914
915
  };
916
+ var TIMEOUT_ACTION_THAT_REFUSES = "deny";
917
+ var timeoutActionWithoutLocalPrompt = ({ mode, timeoutAction }) => mode !== "push_only" && timeoutAction === "approve" ? TIMEOUT_ACTION_THAT_REFUSES : timeoutAction;
915
918
  var MAX_AGENT_QUESTIONS = 4;
916
919
  var parseAgentQuestion = (raw) => {
917
920
  const q = raw;
@@ -1510,7 +1513,14 @@ var DATE_UTC_FLAG = "-u";
1510
1513
  var isFlagToken = (token) => token.startsWith("-");
1511
1514
  var isPrintOnlySed = (args) => args[0] === SED_QUIET_FLAG && SED_PRINT_ONLY_SCRIPT.test(args[1] ?? "") && !args.slice(2).some(isFlagToken);
1512
1515
  var isReadOnlyDate = (args) => args.every((arg) => arg.startsWith(DATE_FORMAT_PREFIX) || arg === DATE_UTC_FLAG);
1513
- var isOutputOnlyPrintf = (args) => args[0] === END_OF_OPTIONS || !isFlagToken(args[0] ?? "");
1516
+ var PRINTF_TEXT_CONVERSION = /%(?:%|[-+ #0]*\d*(?:\.\d*)?[bcqs])/g;
1517
+ var PRINTF_CONVERSION_START = "%";
1518
+ var ARITHMETIC_SAFE_NUMBER = /^[-+]?(?:0[xX][0-9a-fA-F]+|\d+(?:\.\d+)?)$/;
1519
+ var printfAssignsNothing = (args) => args[0] === END_OF_OPTIONS || !isFlagToken(args[0] ?? "");
1520
+ var printfOperands = (args) => args[0] === END_OF_OPTIONS ? args.slice(1) : args;
1521
+ var convertsArgumentsOnlyAsText = (format) => !format.replace(PRINTF_TEXT_CONVERSION, "").includes(PRINTF_CONVERSION_START);
1522
+ var printfNeverEvaluatesAnArgument = ([format = "", ...values]) => convertsArgumentsOnlyAsText(format) || values.every((value) => ARITHMETIC_SAFE_NUMBER.test(value));
1523
+ var isOutputOnlyPrintf = (args) => printfAssignsNothing(args) && printfNeverEvaluatesAnArgument(printfOperands(args));
1514
1524
  var READ_ONLY_SEGMENT_SEPARATOR = /&&|\|\||[;|]/g;
1515
1525
  var PIPELINE_CHAIN_SEPARATOR = /&&|\|\||;/g;
1516
1526
  var EXPANSION_THAT_CAN_BECOME_A_FLAG = /\$|(?:^|\s)[*?[]/;
@@ -1900,7 +1910,27 @@ var mcpToolNameNeedsAPerson = (toolName) => {
1900
1910
  const phrase = words.join(" ");
1901
1911
  return words.some(mcpToolWordNeedsAPerson) || classifyDecisionRisk(phrase, phrase) !== "standard";
1902
1912
  };
1903
- var allowsSessionToolGrant = (toolName) => SESSION_TOOL_GRANT_TOOLS.has(toolName) || parseMcpToolName(toolName) !== void 0 && !isPusharyOwnTool(toolName.toLowerCase()) && !mcpToolNameNeedsAPerson(toolName);
1913
+ var MCP_TOOL_VERBS_THAT_ONLY_READ = /* @__PURE__ */ new Set([
1914
+ "get",
1915
+ "list",
1916
+ "search",
1917
+ "read",
1918
+ "fetch",
1919
+ "find",
1920
+ "view",
1921
+ "show",
1922
+ "describe",
1923
+ "lookup",
1924
+ "retrieve",
1925
+ "inspect",
1926
+ "browse",
1927
+ "count"
1928
+ ]);
1929
+ var mcpToolLeadsWithAReadVerb = (toolName) => {
1930
+ const tool = parseMcpToolName(toolName)?.tool;
1931
+ return tool !== void 0 && MCP_TOOL_VERBS_THAT_ONLY_READ.has(wordsOfMcpToolName(tool)[0] ?? "");
1932
+ };
1933
+ var allowsSessionToolGrant = (toolName) => SESSION_TOOL_GRANT_TOOLS.has(toolName) || mcpToolLeadsWithAReadVerb(toolName) && !isPusharyOwnTool(toolName.toLowerCase()) && !mcpToolNameNeedsAPerson(toolName);
1904
1934
  var isSessionToolGrant = (policy) => Boolean(policy.sessionId) && allowsSessionToolGrant(policy.tool) && isAutoApprove(policy);
1905
1935
  var API_KEY_PREFIX_SHAPE = "pk_[a-f0-9]+";
1906
1936
  var API_KEY_PREFIX_PATTERN = new RegExp(`^${API_KEY_PREFIX_SHAPE}$`);
@@ -2609,6 +2639,8 @@ var codexUnansweredPreToolUse = (ask) => {
2609
2639
  if (timeoutActionApplies(ask) && ask.timeoutAction === "deny") return CODEX_ASK_UNANSWERED;
2610
2640
  return codexRaisesItsOwnPrompts(ask.permissionMode) ? CODEX_ASK_PASSES : CODEX_ASK_UNANSWERED;
2611
2641
  };
2642
+ var CODEX_DEFER_WITHOUT_A_PROMPT = { kind: "deny", reason: NO_AGENT_PROMPT_REASON };
2643
+ var codexDeferredPreToolUse = (agentPromptFollows) => agentPromptFollows ? CODEX_ASK_PASSES : CODEX_DEFER_WITHOUT_A_PROMPT;
2612
2644
  var isScopeReason = (scopeReason) => typeof scopeReason === "string" && scopeReason.length > 0;
2613
2645
  var scopeBreachReasonOf = (verdict) => verdict.kind === "gate" && isScopeReason(verdict.scopeReason) ? verdict.scopeReason : void 0;
2614
2646
  var onlyCodexPreToolUseCanAsk = (verdict, permissionMode) => verdict.kind === "gate" && (scopeBreachReasonOf(verdict) !== void 0 || !codexRaisesItsOwnPrompts(permissionMode));
@@ -3154,6 +3186,7 @@ export {
3154
3186
  canonicalToolName,
3155
3187
  toToolLookup,
3156
3188
  SOLE_GATE_UNDECIDED_REASON,
3189
+ SOLE_GATE_SUBSCRIPTION_REASON,
3157
3190
  SOLE_GATE_SIGNED_OUT_REASON,
3158
3191
  renderPreToolUseVerdict,
3159
3192
  pusharyMissingReason,
@@ -3189,6 +3222,7 @@ export {
3189
3222
  normalizeKeyScope,
3190
3223
  isApprovalMode,
3191
3224
  approvalModeWithoutLocalPrompt,
3225
+ timeoutActionWithoutLocalPrompt,
3192
3226
  parseAgentQuestion,
3193
3227
  parseAgentQuestions,
3194
3228
  parseAgentQuestionAnswers,
@@ -3249,6 +3283,7 @@ export {
3249
3283
  NO_RESPONSE_REASON,
3250
3284
  codexHasNoPromptOfItsOwn,
3251
3285
  codexUnansweredPreToolUse,
3286
+ codexDeferredPreToolUse,
3252
3287
  scopeBreachReasonOf,
3253
3288
  codexCallNeedsAPerson,
3254
3289
  claudePermissionRulesFromSettings,
@@ -1,9 +1,9 @@
1
1
  import {
2
2
  configFilePath
3
- } from "./chunk-75MJRC5I.js";
3
+ } from "./chunk-OY6NJWDD.js";
4
4
  import {
5
5
  normalizeInstallSource
6
- } from "./chunk-GFXZDU4V.js";
6
+ } from "./chunk-GM2IFDVF.js";
7
7
 
8
8
  // src/install-source.ts
9
9
  import { readFileSync } from "fs";
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  pusharyFetch
3
- } from "./chunk-WAKQYJ6T.js";
3
+ } from "./chunk-2E6AWHV7.js";
4
4
  import {
5
5
  NetworkError
6
6
  } from "./chunk-7QLSKOSU.js";
@@ -9,11 +9,11 @@ import {
9
9
  } from "./chunk-KZERVKTD.js";
10
10
  import {
11
11
  getBaseUrl
12
- } from "./chunk-75MJRC5I.js";
12
+ } from "./chunk-OY6NJWDD.js";
13
13
  import {
14
14
  isValidApiKey,
15
15
  normalizeKeyScope
16
- } from "./chunk-GFXZDU4V.js";
16
+ } from "./chunk-GM2IFDVF.js";
17
17
 
18
18
  // src/session.ts
19
19
  var samePusharyAccount = (left, right) => left.kind === "ok" && right.kind === "ok" && left.identity.workspaceId !== "" && left.identity.workspaceId === right.identity.workspaceId && left.identity.siteId === right.identity.siteId;
@@ -4,14 +4,14 @@ import {
4
4
  } from "./chunk-XHKBHWLX.js";
5
5
  import {
6
6
  readControlMode
7
- } from "./chunk-6IOLTFNP.js";
7
+ } from "./chunk-U23XTMBF.js";
8
8
  import {
9
9
  getMachineId
10
- } from "./chunk-U2IEM5FF.js";
10
+ } from "./chunk-IS737HST.js";
11
11
  import {
12
12
  pusharyDir,
13
13
  resolveGlobalBinary
14
- } from "./chunk-E7EOUEGQ.js";
14
+ } from "./chunk-NQICO3ES.js";
15
15
  import {
16
16
  readJsonSafe,
17
17
  writeFileAtomic,
@@ -20,7 +20,7 @@ import {
20
20
  } from "./chunk-AQFEP65J.js";
21
21
  import {
22
22
  getApiKey
23
- } from "./chunk-75MJRC5I.js";
23
+ } from "./chunk-OY6NJWDD.js";
24
24
  import {
25
25
  CLI_PACKAGE_NAMES,
26
26
  cmdShimTarget,
@@ -28,7 +28,7 @@ import {
28
28
  globalPackageFolder,
29
29
  globalRootFor,
30
30
  isRecord
31
- } from "./chunk-GFXZDU4V.js";
31
+ } from "./chunk-GM2IFDVF.js";
32
32
 
33
33
  // src/daemon-lifecycle.ts
34
34
  import { dirname, join, win32 as win32Path } from "path";
@@ -1,17 +1,17 @@
1
1
  import {
2
2
  compatibleConfigFile,
3
3
  hasCompatibleHooks
4
- } from "./chunk-6TSEEKPL.js";
4
+ } from "./chunk-LOERK6N3.js";
5
5
  import {
6
6
  pusharyHookExecutable
7
- } from "./chunk-TSFNX5J2.js";
7
+ } from "./chunk-OSOCONIE.js";
8
8
  import {
9
9
  isProtectedByScope,
10
10
  registerHookEntry
11
- } from "./chunk-E7EOUEGQ.js";
11
+ } from "./chunk-NQICO3ES.js";
12
12
  import {
13
13
  isRecord
14
- } from "./chunk-GFXZDU4V.js";
14
+ } from "./chunk-GM2IFDVF.js";
15
15
 
16
16
  // src/cursor-config.ts
17
17
  var hookCommandOf = (entry) => {
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  ensureCodexTrustsPusharyHooks
3
- } from "./chunk-KCXG2INQ.js";
3
+ } from "./chunk-LHFK5F3T.js";
4
4
  import {
5
5
  detectClaudeVersion
6
6
  } from "./chunk-RIVNNBEK.js";
@@ -12,12 +12,12 @@ import {
12
12
  openCodeHookArgv,
13
13
  openCodePluginDir,
14
14
  openCodeWired
15
- } from "./chunk-U4OWRGYI.js";
15
+ } from "./chunk-O3RRQTTV.js";
16
16
  import {
17
17
  addClaudeMcpServer,
18
18
  addPusharyHooks,
19
19
  addPusharyToolPermissions
20
- } from "./chunk-6TSEEKPL.js";
20
+ } from "./chunk-LOERK6N3.js";
21
21
  import {
22
22
  claudeUnprovenHolds,
23
23
  claudeWired,
@@ -25,7 +25,7 @@ import {
25
25
  codexWired,
26
26
  geminiWired,
27
27
  planHooks
28
- } from "./chunk-TSFNX5J2.js";
28
+ } from "./chunk-OSOCONIE.js";
29
29
  import {
30
30
  CLAUDE_HOOK_BINARY,
31
31
  CLAUDE_HOOK_EVENTS,
@@ -36,7 +36,7 @@ import {
36
36
  needsReregistration,
37
37
  registrationSignatures,
38
38
  supportedClaudeEvents
39
- } from "./chunk-YGR5PBOF.js";
39
+ } from "./chunk-VFIZFKZY.js";
40
40
  import {
41
41
  formatVersion
42
42
  } from "./chunk-6ICPEJY5.js";
@@ -59,7 +59,7 @@ import {
59
59
  registrationHolderOf,
60
60
  resolveGlobalBinary,
61
61
  vscodePluginMcp
62
- } from "./chunk-E7EOUEGQ.js";
62
+ } from "./chunk-NQICO3ES.js";
63
63
  import {
64
64
  readJsonSafe,
65
65
  writeFileAtomic,
@@ -67,7 +67,7 @@ import {
67
67
  } from "./chunk-AQFEP65J.js";
68
68
  import {
69
69
  isRecord
70
- } from "./chunk-GFXZDU4V.js";
70
+ } from "./chunk-GM2IFDVF.js";
71
71
 
72
72
  // src/reapply.ts
73
73
  import { dirname, join } from "path";
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  pusharyDir
3
- } from "./chunk-E7EOUEGQ.js";
3
+ } from "./chunk-NQICO3ES.js";
4
4
  import {
5
5
  writeFileAtomic
6
6
  } from "./chunk-AQFEP65J.js";
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  readTranscriptPreference
3
- } from "./chunk-6IOLTFNP.js";
3
+ } from "./chunk-U23XTMBF.js";
4
4
 
5
5
  // src/transcript-setting.ts
6
6
  var transcriptEnvironmentPreference = () => {
@@ -2,7 +2,7 @@ import {
2
2
  IDLE_PROMPT_NOTIFICATION,
3
3
  NOTIFICATION_PUSH_TYPES,
4
4
  POSTTOOLUSE_MIRROR_ONLY_TOOLS
5
- } from "./chunk-BDV4WDIA.js";
5
+ } from "./chunk-RFK2WN6S.js";
6
6
  import {
7
7
  cancelQuestion,
8
8
  clientErrorKindOf,
@@ -10,26 +10,26 @@ import {
10
10
  reportClientError,
11
11
  sendNotification,
12
12
  waitForAnswer
13
- } from "./chunk-AGIO7SF5.js";
13
+ } from "./chunk-ZVON5PCF.js";
14
14
  import {
15
15
  withRetry
16
- } from "./chunk-6SFTI7LM.js";
16
+ } from "./chunk-RK7TDMQT.js";
17
17
  import {
18
18
  getMachineId
19
- } from "./chunk-U2IEM5FF.js";
19
+ } from "./chunk-IS737HST.js";
20
20
  import {
21
21
  reportedInstallSource
22
- } from "./chunk-5TLRS3AK.js";
22
+ } from "./chunk-GXQVOKHJ.js";
23
23
  import {
24
24
  canonicalJson
25
- } from "./chunk-E7EOUEGQ.js";
25
+ } from "./chunk-NQICO3ES.js";
26
26
  import {
27
27
  writeFileAtomic
28
28
  } from "./chunk-AQFEP65J.js";
29
29
  import {
30
30
  getApiKey,
31
31
  getBaseUrl
32
- } from "./chunk-75MJRC5I.js";
32
+ } from "./chunk-OY6NJWDD.js";
33
33
  import {
34
34
  ACTION_BODY_MAX,
35
35
  AGENT_LABELS_BY_TYPE,
@@ -60,7 +60,7 @@ import {
60
60
  resolvePolicy,
61
61
  toToolLookup,
62
62
  truncateLine
63
- } from "./chunk-GFXZDU4V.js";
63
+ } from "./chunk-GM2IFDVF.js";
64
64
 
65
65
  // ../hook-mapping/src/describe.ts
66
66
  import { isAbsolute, relative, resolve } from "path";
@@ -10,10 +10,10 @@ import {
10
10
  resolvePackageVersionFromBinary,
11
11
  resolvePathBinary,
12
12
  resolvePathBinaryAsync
13
- } from "./chunk-E7EOUEGQ.js";
13
+ } from "./chunk-NQICO3ES.js";
14
14
  import {
15
15
  MANAGED_PROVIDERS
16
- } from "./chunk-GFXZDU4V.js";
16
+ } from "./chunk-GM2IFDVF.js";
17
17
 
18
18
  // src/setup/codex-install.ts
19
19
  var NATIVE_BINARY_MIN_BYTES = 20 * 1024 * 1024;