pushary 1.9.26 → 1.9.27

package/dist/{chunk-TS3CRCI7.js → chunk-WGTD4NZV.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-POFBE6ZY.js";
 import {
   autoUpdateState
-} from "./chunk-3TRGUDQ3.js";
+} from "./chunk-YTTPPJZW.js";
 import {
   readJsonSafe,
   writeJsonAtomic
@@ -13,8 +13,9 @@ import {
   POSIX_GLOBAL_ROOT_SEGMENTS,
   cliPackagePathSegments,
   globalUpgradeEntry,
+  isAutoUpdateResult,
   ownPackageRoot
-} from "./chunk-TVP5UU33.js";
+} from "./chunk-ZQZRBPTP.js";
 
 // src/auto-update.ts
 import { spawn } from "child_process";
@@ -25,9 +26,7 @@ var PENDING_FINISH_RETRY_DELAYS_MS = [5 * 60 * 1e3, 60 * 60 * 1e3];
 var FIRST_FINISH_ATTEMPT = 1;
 var AUTO_UPDATE_FLAG = "--auto";
 var NON_GLOBAL_INSTALL_SEGMENTS = ["/_npx/", "/.volta/"];
-var AUTO_UPDATE_RESULTS = ["updated", "current", "needs_manual", "failed", "finish_pending", "finish_blocked"];
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var isAutoUpdateResult = (value) => typeof value === "string" && AUTO_UPDATE_RESULTS.some((result) => result === value);
 var stringField = (record, key) => {
   const value = record[key];
   return typeof value === "string" ? value : void 0;
@@ -101,6 +100,34 @@ var autoUpdateDecision = (input) => {
   if (checkedWithinInterval(input.state.lastCheckAt, input.now, autoUpdateCheckInterval(input.state))) return { kind: "skip", reason: "checked_recently" };
   return { kind: "check", ...location };
 };
+var autoUpdateReportState = (decision) => {
+  if (decision.kind === "check") return "on";
+  switch (decision.reason) {
+    case "subagent_start":
+    case "checked_recently":
+      return "on";
+    default:
+      return decision.reason;
+  }
+};
+var autoUpdateReport = (input) => ({
+  state: autoUpdateReportState(autoUpdateDecision({ ...input, isSubagentStart: false })),
+  lastResult: input.state.lastResult ?? null,
+  lastCheckAt: input.state.lastCheckAt ?? null
+});
+var readLocalAutoUpdateReport = () => {
+  try {
+    return autoUpdateReport({
+      env: process.env,
+      state: readAutoUpdateState(autoUpdateState()),
+      now: Date.now(),
+      platform: process.platform,
+      packageRoot: ownPackageRoot()
+    });
+  } catch {
+    return null;
+  }
+};
 var parseAutoUpdateFlag = (args) => {
   const token = args.find((arg) => arg === AUTO_UPDATE_FLAG || arg.startsWith(`${AUTO_UPDATE_FLAG}=`));
   if (token === void 0) return { kind: "absent" };
@@ -184,6 +211,7 @@ export {
   globalInstallLocation,
   upgradeEntryFor,
   nextFinishAttempt,
+  readLocalAutoUpdateReport,
   parseAutoUpdateFlag,
   describeAutoUpdateCheck,
   isUnfinishedAutoUpdate,

package/dist/{chunk-I52A3NLY.js → chunk-XESMYZLU.js}

@@ -2,7 +2,7 @@ import {
   autoUpdateLock,
   installPackageGlobally,
   npmErrorMessage
-} from "./chunk-3TRGUDQ3.js";
+} from "./chunk-YTTPPJZW.js";
 import {
   writeJsonAtomic
 } from "./chunk-AQFEP65J.js";

package/dist/{chunk-5UKZXDHV.js → chunk-XTTMUQ4Z.js}

@@ -1,6 +1,6 @@
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-47RVFUEG.js";
+} from "./chunk-Z5AAPX3O.js";
 
 // src/config.ts
 import { readFileSync } from "fs";

package/dist/{chunk-3TRGUDQ3.js → chunk-YTTPPJZW.js}

@@ -13,7 +13,7 @@ import {
   isReleaseVersion,
   ownPackageName,
   withHookHoldBudget
-} from "./chunk-TVP5UU33.js";
+} from "./chunk-ZQZRBPTP.js";
 
 // src/setup/paths.ts
 import { homedir as homedir2 } from "os";
@@ -395,9 +395,9 @@ var installGlobally = (options) => {
   }
   const started = (async () => {
     if (!npmIsOnPath()) throw new NpmMissingError();
-    const { withUpgradeLock } = await import("./global-upgrade-3XKMGVAR.js");
-    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-6LLAEJTW.js");
-    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-UB2IUM57.js");
+    const { withUpgradeLock } = await import("./global-upgrade-FKQPJL5P.js");
+    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-2SQCRMDL.js");
+    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-TU47TCRS.js");
     let result = "skipped";
     const install = async () => {
       const platform = process.platform;

package/dist/{chunk-CW72FZ2M.js → chunk-YZ7D3P3M.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-3TRGUDQ3.js";
+} from "./chunk-YTTPPJZW.js";
 import {
   readJsonSafe,
   writeFileAtomic
@@ -13,7 +13,7 @@ import {
   serializeDeclinedAgents,
   withDeclinedAgent,
   withoutDeclinedAgent
-} from "./chunk-TVP5UU33.js";
+} from "./chunk-ZQZRBPTP.js";
 
 // src/declined-agents-file.ts
 import { join } from "path";

package/dist/{chunk-47RVFUEG.js → chunk-Z5AAPX3O.js}

@@ -2,7 +2,7 @@ import {
   DISCONNECT_AGENT_IDS,
   SETUP_AGENT_CHOICES,
   isApprovalMode
-} from "./chunk-TVP5UU33.js";
+} from "./chunk-ZQZRBPTP.js";
 
 // src/cli/mode-request.ts
 var parseDuration = (value) => {

package/dist/{chunk-TVP5UU33.js → chunk-ZQZRBPTP.js}

@@ -989,6 +989,17 @@ var serializeDeclinedAgents = (agents) => `${JSON.stringify(declinedAgentsDocume
 var withDeclinedAgent = (agents, agent) => canonicalAgents([...agents, agent]);
 var withoutDeclinedAgent = (agents, agent) => agents.filter((candidate) => candidate !== agent);
 
+// ../contracts/src/cli-version-standing.ts
+var FIRST_AUTO_UPDATING_RELEASE = [1, 5, 0];
+var MIN_SAFE_RELEASE = [1, 9, 26];
+var formatReleaseVersion = (version) => version.join(".");
+var FIRST_AUTO_UPDATING_CLI_VERSION = formatReleaseVersion(FIRST_AUTO_UPDATING_RELEASE);
+var MIN_SAFE_CLI_VERSION = formatReleaseVersion(MIN_SAFE_RELEASE);
+
+// ../contracts/src/auto-update-report.ts
+var AUTO_UPDATE_RESULTS = ["updated", "current", "needs_manual", "failed", "finish_pending", "finish_blocked"];
+var isAutoUpdateResult = (value) => typeof value === "string" && AUTO_UPDATE_RESULTS.includes(value);
+
 // ../contracts/src/index.ts
 var KEY_SCOPES = ["full_access", "agent", "connector", "bound"];
 var normalizeKeyScope = (value) => typeof value === "string" && KEY_SCOPES.includes(value) ? value : null;
@@ -1663,15 +1674,16 @@ var verdictForPolicy = (policy) => {
   return "requires_human";
 };
 var policyIntent = (policy) => isAutoApprove(policy) ? PATTERN_INTENT.grant : PATTERN_INTENT.restrict;
-var selectGoverningRule = (policies, toolName, args, repoKey, sessionId) => {
+var restricts = (policy) => policyIntent(policy) === PATTERN_INTENT.restrict;
+var appliesToThisCall = (policy, repoKey, sessionId) => isRepoKeyMatch(policy.repoKey, repoKey) && (!policy.sessionId || policy.sessionId === sessionId);
+var selectGoverningRule = (policies, toolName, args, repoKey, sessionId, restrictedArgs = args) => {
   let best;
   let bestWeight = 0;
   let bestScoped = -1;
   let bestLength = -1;
   for (const candidate of policies) {
-    if (!isRepoKeyMatch(candidate.repoKey, repoKey)) continue;
-    if (candidate.sessionId && candidate.sessionId !== sessionId) continue;
-    const rank = matchToolPatternAny(candidate.tool, toolName, args, policyIntent(candidate));
+    if (!appliesToThisCall(candidate, repoKey, sessionId)) continue;
+    const rank = matchToolPatternAny(candidate.tool, toolName, restricts(candidate) ? restrictedArgs : args, policyIntent(candidate));
     if (rank === "none") continue;
     const weight = matchRankWeight(rank);
     const scoped = candidate.sessionId ? 2 : candidate.repoKey ? 1 : 0;
@@ -2448,15 +2460,14 @@ var replacesTheCrontab = ({ program, args }) => program !== void 0 && basenameOf
 var FIND_DELETE = "-delete";
 var FIND_RUNNERS = /* @__PURE__ */ new Set(["-exec", "-execdir", "-ok", "-okdir"]);
 var FIND_RUNNER_END = /* @__PURE__ */ new Set([";", "+"]);
+var FIND = "find";
+var commandsRunByFind = ({ program, args }) => program === void 0 || basenameOf(program.text) !== FIND ? [] : args.flatMap((arg, index) => FIND_RUNNERS.has(arg.text) ? [{ program: args[index + 1], args: args.slice(index + 2, findRunnerEnd(args, index + 2)) }] : []);
 var losesDataVisibly = (toolName, invocation, normalized, depth) => {
   const { program, args } = invocation;
   if (program === void 0) return false;
   const name = basenameOf(program.text);
-  if (name === "find") {
-    return args.some((arg) => arg.text === FIND_DELETE) || args.some((arg, index) => FIND_RUNNERS.has(arg.text) && invocationHasAVisibleConsequence(toolName, {
-      program: args[index + 1],
-      args: args.slice(index + 2, findRunnerEnd(args, index + 2))
-    }, depth + 1));
+  if (name === FIND) {
+    return args.some((arg) => arg.text === FIND_DELETE) || commandsRunByFind(invocation).some((run) => invocationHasAVisibleConsequence(toolName, run, depth + 1));
   }
   const destructiveArguments = destructiveArgumentsOf(name, args);
   return destructiveArguments !== void 0 && args.some((arg) => namesDestructiveArgument(arg.text, destructiveArguments)) || namesDestructiveWordInAnyCase(name, args.map((arg) => arg.text)) || gitDiscardsWork(invocation) || changesAService(invocation) || replacesTheCrontab(invocation) || isCoveredByPolicy(VISIBLE_DATA_LOSS_PATTERNS, toolName, normalized);
@@ -2619,7 +2630,8 @@ var runsADownloadedScript = (invocations) => {
 var pipedSegmentsOf = (command) => (shellSegmentsReadingAPipe(commandForReading(command)) ?? []).map((segment) => innermostInvocation(invocationOf(withoutShellGrouping(segment))));
 var pipesIntoASqlClient = (command) => pipedSegmentsOf(command).some((invocation) => sqlClientSyntaxOf(invocation) !== void 0);
 var pipesFetchedCodeIntoAnInterpreter = (command, invocations) => invocations.some(fetches) && pipedSegmentsOf(command).some(runsWhatItReads);
-var SHELL_GROUPING_PREFIX = /^\s*(?:(?:if|then|elif|else|do|while|until|!)\s+|[({]\s*)+/;
+var WORDS_THAT_OPEN_A_COMMAND = String.raw`if|then|elif|else|do|while|until|!`;
+var SHELL_GROUPING_PREFIX = new RegExp(String.raw`^\s*(?:(?:${WORDS_THAT_OPEN_A_COMMAND})\s+|[({]\s*)+`);
 var GROUP_OPENER_BY_CLOSER = /* @__PURE__ */ new Map([[")", "("], ["}", "{"]]);
 var occurrencesOf = (text, character) => text.split(character).length - 1;
 var closesAGroupItDidNotOpen = (text) => {
@@ -2736,6 +2748,116 @@ var commandHasAVisibleConsequenceAt = (toolName, command, depth) => {
   return invocations.some((invocation) => invocationHasAVisibleConsequence(toolName, invocation, depth)) || pipesIntoASqlClient(command) || pipesFetchedCodeIntoAnInterpreter(command, invocations) || runsADownloadedScript(invocations);
 };
 var commandHasAVisibleConsequence = (toolName, command) => commandHasAVisibleConsequenceAt(toolName, command, 0);
+var MAX_SPELLING_DEPTH = 3;
+var GIT_GLOBAL_OPTIONS_WITH_A_VALUE = /* @__PURE__ */ new Set([
+  "-C",
+  "-c",
+  "--git-dir",
+  "--work-tree",
+  "--namespace",
+  "--super-prefix",
+  "--config-env"
+]);
+var GIT_GLOBAL_FLAGS = /* @__PURE__ */ new Set([
+  "-p",
+  "--paginate",
+  "-P",
+  "--no-pager",
+  "--bare",
+  "--exec-path",
+  "--html-path",
+  "--man-path",
+  "--info-path",
+  "--no-replace-objects",
+  "--no-lazy-fetch",
+  "--no-optional-locks",
+  "--no-advice",
+  "--literal-pathspecs",
+  "--glob-pathspecs",
+  "--noglob-pathspecs",
+  "--icase-pathspecs"
+]);
+var GIT_OPTION_AND_ITS_VALUE = 2;
+var GIT_OPTION_ALONE = 1;
+var NOT_A_GIT_GLOBAL_OPTION = 0;
+var gitGlobalOptionWidth = (text) => {
+  if (GIT_GLOBAL_OPTIONS_WITH_A_VALUE.has(text)) return GIT_OPTION_AND_ITS_VALUE;
+  const name = longOptionName(text);
+  return GIT_GLOBAL_OPTIONS_WITH_A_VALUE.has(name) || GIT_GLOBAL_FLAGS.has(name) ? GIT_OPTION_ALONE : NOT_A_GIT_GLOBAL_OPTION;
+};
+var argsAfterGitGlobalOptions = (args) => {
+  let index = 0;
+  while (index < args.length) {
+    const width = gitGlobalOptionWidth(args[index]?.text ?? "");
+    if (width === NOT_A_GIT_GLOBAL_OPTION) break;
+    index += width;
+  }
+  return args.slice(index);
+};
+var gitReadingsPastGlobalOptions = ({ program, args }) => {
+  if (program === void 0 || basenameOf(program.text) !== GIT) return [];
+  const rest = argsAfterGitGlobalOptions(args);
+  return rest.length === args.length ? [] : [{ program, args: rest }];
+};
+var CURRENT_DIRECTORY_STEP = /\/\.(?=\/)/g;
+var LEADING_CURRENT_DIRECTORY = /^(?:\.\/+)+(?=[^/])/;
+var canonicalPathWord = (text) => text.replace(CURRENT_DIRECTORY_STEP, "").replace(LEADING_CURRENT_DIRECTORY, "");
+var verbatimInvocationText = (invocation) => wordsOfInvocation(invocation).map((word) => asOneShellWord(word.text)).join(" ");
+var canonicalInvocationText = (invocation) => invocationTextWith(invocation, (word) => asOneShellWord(canonicalPathWord(word.text)));
+var spellingsOfAnInvocation = (invocation, innermost) => [invocation, innermost, ...gitReadingsPastGlobalOptions(innermost), ...readingsPastGlobalFlags(innermost)].flatMap((reading) => [verbatimInvocationText(reading), canonicalInvocationText(reading)]);
+var NO_INLINE_SCRIPT = { kind: "none" };
+var HIDDEN_INLINE_SCRIPT = { kind: "hidden" };
+var passesAnInlineScript = ({ program, args }) => {
+  const name = basenameOf(program?.text ?? "");
+  return name === EVAL || SHELLS.has(name) && args.some((arg) => SCRIPT_FLAG_CLUSTER.test(arg.text));
+};
+var shellReadsItsScript = (invocation) => SHELLS.has(basenameOf(invocation.program?.text ?? "")) && runsWhatItReads(invocation);
+var inlineScriptsOf = (invocation, heredocs) => {
+  const script = shellScriptOf(invocation);
+  if (script !== null) return { kind: "readable", scripts: [script] };
+  if (passesAnInlineScript(invocation)) return HIDDEN_INLINE_SCRIPT;
+  if (!shellReadsItsScript(invocation)) return NO_INLINE_SCRIPT;
+  return heredocs.length > 0 ? { kind: "readable", scripts: heredocs } : HIDDEN_INLINE_SCRIPT;
+};
+var programIsHidden = ({ program }) => program?.expands ?? false;
+var SUBSTITUTION_AS_A_PROGRAM = new RegExp(String.raw`(?:^|[;&|({\n]|(?:^|[\s;&|({])(?:${WORDS_THAT_OPEN_A_COMMAND})\s)\s*"?(?:\$\(|\`)`);
+var runsASubstitutionAsAProgram = (command) => {
+  const visible = shellVisibleText(withHeredocBodiesSetAside(commandForReading(command)).text);
+  return visible !== null && SUBSTITUTION_AS_A_PROGRAM.test(visible);
+};
+var parsedSpelledSegment = (segment) => {
+  const text = withoutShellGrouping(segment);
+  return { text, invocation: invocationOf(text), heredocs: [], feedsASubstitution: false };
+};
+var roughSpelledSegment = ({ invocation, heredocs, feedsASubstitution }) => ({ text: verbatimInvocationText(invocation), invocation, heredocs, feedsASubstitution });
+var segmentHidesWhatItRuns = (segment, innermost, scripts) => programIsHidden(innermost) || scripts.kind === "hidden" || segment.feedsASubstitution && passesAnInlineScript(innermost);
+var commandsNestedIn = (innermost, scripts) => [
+  ...scripts.kind === "readable" ? scripts.scripts : [],
+  ...commandsRunByFind(innermost).map(verbatimInvocationText)
+];
+var spelledSegmentsOf = (command) => {
+  const parsed = readableCommandSegments(command);
+  return parsed === null ? roughSegmentsOf(command).map(roughSpelledSegment) : parsed.map(parsedSpelledSegment);
+};
+var SPELLINGS_OF_AN_UNREADABLE_COMMAND = { forms: [], hidesWhatItRuns: true };
+var commandSpellingsAt = (command, depth) => {
+  if (depth > MAX_SPELLING_DEPTH) return SPELLINGS_OF_AN_UNREADABLE_COMMAND;
+  const forms = [];
+  let hidesWhatItRuns = runsASubstitutionAsAProgram(command);
+  for (const segment of spelledSegmentsOf(command)) {
+    const innermost = innermostInvocation(segment.invocation);
+    const scripts = inlineScriptsOf(innermost, segment.heredocs);
+    forms.push(segment.text, ...spellingsOfAnInvocation(segment.invocation, innermost));
+    hidesWhatItRuns ||= segmentHidesWhatItRuns(segment, innermost, scripts);
+    for (const nested of commandsNestedIn(innermost, scripts)) {
+      const inner = commandSpellingsAt(nested, depth + 1);
+      forms.push(nested, ...inner.forms);
+      hidesWhatItRuns ||= inner.hidesWhatItRuns;
+    }
+  }
+  return { forms, hidesWhatItRuns };
+};
+var commandSpellings = (command) => commandSpellingsAt(command, 0);
 var withoutSessionToolGrants = (config) => ({
   ...config,
   policies: config.policies.filter((policy) => !isSessionToolGrant(policy))
@@ -3296,9 +3418,10 @@ var findBestRoute = (routes, toolName, args, repoKey) => {
   let bestWeight = 0;
   let bestScoped = -1;
   let bestLength = -1;
+  const { forms } = restrictionReadingOf(routes.map((route) => route.toolPattern), toolName, args);
   for (const candidate of routes) {
     if (!isRepoKeyMatch(candidate.repoKey, repoKey)) continue;
-    const rank = matchToolPatternAny(candidate.toolPattern, toolName, args, PATTERN_INTENT.restrict);
+    const rank = matchToolPatternAny(candidate.toolPattern, toolName, forms, PATTERN_INTENT.restrict);
     if (rank === "none") continue;
     const weight = matchRankWeight(rank);
     const scoped = candidate.repoKey ? 1 : 0;
@@ -3330,10 +3453,35 @@ var isNamedByARule = (rank) => rank !== void 0 && rank !== "wildcard";
 var isSpecificArgumentRank = (rank) => rank === "exact" || rank === "prefix";
 var shellReadOnlyFloorApplies = (toolName, arg, rank) => !isSpecificArgumentRank(rank) && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg);
 var coordinationFloorApplies = (toolName, rank) => isCodexCoordinationTool(toolName) && !isNamedByARule(rank);
+var POSIX_SHELL_TOOLS = /* @__PURE__ */ new Set(["Bash", "Monitor"]);
+var argumentsAsWritten = (args) => ({ forms: args, hidesWhatItRuns: false });
+var namesAnArgumentOf = (pattern, toolName) => pattern.startsWith(`${toolName}(`);
+var isSpelledOut = (form) => form.length > 0;
+var restrictionReadingOf = (restrictingPatterns, toolName, args) => {
+  const command = toolName in POLICY_COMMAND_KEYS ? args[0] : void 0;
+  if (command === void 0 || !restrictingPatterns.some((pattern) => namesAnArgumentOf(pattern, toolName))) {
+    return argumentsAsWritten(args);
+  }
+  const spellings = commandSpellings(command);
+  return {
+    forms: [.../* @__PURE__ */ new Set([...args, ...spellings.forms.filter(isSpelledOut)])],
+    hidesWhatItRuns: POSIX_SHELL_TOOLS.has(toolName) && spellings.hidesWhatItRuns
+  };
+};
+var restrictingPatternsOf = (policies) => policies.filter(restricts).map((policy) => policy.tool);
+var policyReadingOf = (policies, toolName, args) => restrictionReadingOf(restrictingPatternsOf(policies), toolName, args);
+var stricterRule = (current, challenger) => current !== void 0 && (challenger === void 0 || restraintRank(current.policy) > restraintRank(challenger.policy)) ? current : challenger;
+var restrictsAnArgumentOf = (policy, toolName) => restricts(policy) && namesAnArgumentOf(policy.tool, toolName);
+var strictestRuleNamingAnArgument = (pool, toolName, repoKey, sessionId) => pool.filter((policy) => restrictsAnArgumentOf(policy, toolName) && appliesToThisCall(policy, repoKey, sessionId)).reduce((strictest, policy) => stricterRule(strictest, { policy, rank: "prefix" }), void 0);
+var governingRuleForReading = (pool, toolName, args, reading, repoKey, sessionId) => {
+  const selected = selectGoverningRule(pool, toolName, args, repoKey, sessionId, reading.forms);
+  return reading.hidesWhatItRuns ? stricterRule(selected, strictestRuleNamingAnArgument(pool, toolName, repoKey, sessionId)) : selected;
+};
 var resolveAutoResolveOrigin = (config, toolName, toolInput, cwd, repoKey, sessionId) => {
   const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
   const arg = args[0];
-  const rank = selectGoverningRule(config.policies, toolName, args, repoKey, sessionId)?.rank;
+  const reading = policyReadingOf(config.policies, toolName, args);
+  const rank = governingRuleForReading(config.policies, toolName, args, reading, repoKey, sessionId)?.rank;
   if (shellReadOnlyFloorApplies(toolName, arg, rank) || coordinationFloorApplies(toolName, rank)) {
     return DECISION_ORIGIN.safeReadonly;
   }
@@ -3344,28 +3492,37 @@ var wildcardRuleOf = (pool) => {
   return wildcard ? { policy: wildcard, rank: "wildcard" } : void 0;
 };
 var withSiteDelivery = (rule, siteMode) => isAutoApprove(rule.policy) || isAutoDeny(rule.policy) ? rule : { ...rule, policy: { ...rule.policy, mode: siteMode.mode, pushFirstSeconds: siteMode.pushFirstSeconds } };
-var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
-  const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
-  const arg = args[0];
-  const specificRule = (pool) => pool.length === 0 ? void 0 : selectGoverningRule(pool, toolName, args, repoKey, sessionId);
+var layeredGoverningRule = (config, toolName, args, reading, repoKey, sessionId) => {
+  const specificRule = (pool) => pool.length === 0 ? void 0 : governingRuleForReading(pool, toolName, args, reading, repoKey, sessionId);
   const written = config.policies.filter((p) => !p.origin);
   const presets = config.policies.filter((p) => p.origin === "preset");
   const builtins = config.policies.filter((p) => p.origin === "builtin");
   const siteMode = wildcardRuleOf(written);
   const presetRule = specificRule(presets);
-  const match = specificRule(written) ?? (presetRule && siteMode ? withSiteDelivery(presetRule, siteMode.policy) : presetRule) ?? siteMode ?? wildcardRuleOf(presets) ?? specificRule(builtins) ?? wildcardRuleOf(builtins);
-  let base = match?.policy ?? {
-    tool: toolName,
-    timeoutSeconds: config.defaultTimeoutSeconds,
-    timeoutAction: config.defaultTimeoutAction,
-    mode: config.defaultMode ?? "push_first",
-    pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
-  };
+  return specificRule(written) ?? (presetRule && siteMode ? withSiteDelivery(presetRule, siteMode.policy) : presetRule) ?? siteMode ?? wildcardRuleOf(presets) ?? specificRule(builtins) ?? wildcardRuleOf(builtins);
+};
+var unmatchedPolicyOf = (config, toolName) => ({
+  tool: toolName,
+  timeoutSeconds: config.defaultTimeoutSeconds,
+  timeoutAction: config.defaultTimeoutAction,
+  mode: config.defaultMode ?? "push_first",
+  pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
+});
+var stricterOfTheReadings = (asWritten, asSpelled, unmatched) => restraintRank(asWritten?.policy ?? unmatched) > restraintRank(asSpelled?.policy ?? unmatched) ? asWritten : asSpelled;
+var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
+  const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
+  const arg = args[0];
+  const unmatched = unmatchedPolicyOf(config, toolName);
+  const asWritten = layeredGoverningRule(config, toolName, args, argumentsAsWritten(args), repoKey, sessionId);
+  const asSpelled = layeredGoverningRule(config, toolName, args, policyReadingOf(config.policies, toolName, args), repoKey, sessionId);
+  const match = stricterOfTheReadings(asWritten, asSpelled, unmatched);
+  let base = match?.policy ?? unmatched;
   const governedBySpecificRule = isSpecificArgumentRank(match?.rank);
   const governedBySessionToolGrant = match?.rank === "tool" && isSessionToolGrant(match.policy);
   const governedByStandingShellAllow = match?.rank === "tool" && isStandingShellAllow(match.policy);
   const governingMode = base.mode;
-  const approvedByReadOnlyFloor = !isAutoDeny(base) && (shellReadOnlyFloorApplies(toolName, arg, match?.rank) || coordinationFloorApplies(toolName, match?.rank));
+  const aRuleNamesASpelling = isSpecificArgumentRank(asSpelled?.rank);
+  const approvedByReadOnlyFloor = !isAutoDeny(base) && (shellReadOnlyFloorApplies(toolName, arg, match?.rank) && !aRuleNamesASpelling || coordinationFloorApplies(toolName, match?.rank));
   if (governedBySessionToolGrant && !approvedByReadOnlyFloor && typeof arg === "string" && commandNeedsAPerson(toolName, arg)) {
     return resolvePolicy(withoutSessionToolGrants(config), toolName, modeOverride, toolInput, cwd, repoKey, sessionId);
   }
@@ -3580,11 +3737,13 @@ var everyCommandSegmentGranted = (rules, toolName, command) => {
   const segments = readableCommandSegments(command);
   return segments !== null && segments.every((segment) => isSafeReadOnlyCommand(segment) || anyRuleGrants(rules, toolName, [segment]));
 };
-var restrictionFormsOf = (toolName, args) => {
+var agentRuleReadingOf = (rules, toolName, args) => {
+  const reading = restrictionReadingOf([...rules.ask, ...rules.deny], toolName, args);
   const command = toolName in POLICY_COMMAND_KEYS ? args[0] : void 0;
   const normalized = command === void 0 ? null : normalizedCommand(command);
-  return normalized === null ? args : [...args, normalized];
+  return normalized === null ? reading : { ...reading, forms: [...reading.forms, normalized] };
 };
+var anyRuleRestrictsReading = (rules, toolName, reading) => anyRuleRestricts(rules, toolName, reading.forms) || reading.hidesWhatItRuns && rules.some((rule) => namesAnArgumentOf(rule, toolName));
 var allowRulesGrant = (rules, toolName, args) => {
   const command = args[0];
   return toolName in POLICY_COMMAND_KEYS && command !== void 0 ? everyCommandSegmentGranted(rules, toolName, command) : anyRuleGrants(rules, toolName, args);
@@ -3596,8 +3755,8 @@ var inputNeedsAPerson = (toolName, toolInput) => {
 };
 var agentRulesAllowEveryInput = (rules, toolName, toolInputs, cwd) => rules.allow.length > 0 && toolInputs.length > 0 && toolInputs.every((toolInput) => {
   const args = policyArgForms(toolName, toolInput, cwd);
-  const restrictionForms = restrictionFormsOf(toolName, args);
-  return allowRulesGrant(rules.allow, toolName, args) && !anyRuleRestricts(rules.ask, toolName, restrictionForms) && !anyRuleRestricts(rules.deny, toolName, restrictionForms) && !inputNeedsAPerson(toolName, toolInput);
+  const reading = agentRuleReadingOf(rules, toolName, args);
+  return allowRulesGrant(rules.allow, toolName, args) && !anyRuleRestrictsReading(rules.ask, toolName, reading) && !anyRuleRestrictsReading(rules.deny, toolName, reading) && !inputNeedsAPerson(toolName, toolInput);
 });
 var isDefaultRule = (policy) => policy.origin === "builtin" || policy.tool === WILDCARD_TOOL_PATTERN;
 var isApprovalRoutePattern = (value) => typeof value === "object" && value !== null && typeof value.toolPattern === "string" && ["string", "undefined"].includes(typeof value.repoKey);
@@ -3611,7 +3770,8 @@ var aChosenRuleGoverns = (input) => {
   if (routes === null) return true;
   return input.toolInputs.some((toolInput) => {
     const args = policyArgForms(input.toolName, toolInput, input.cwd);
-    return selectGoverningRule(chosen, input.toolName, args, input.repoKey, input.sessionId) !== void 0 || findBestRoute(routes, input.toolName, args, input.repoKey) !== void 0;
+    const reading = policyReadingOf(chosen, input.toolName, args);
+    return governingRuleForReading(chosen, input.toolName, args, reading, input.repoKey, input.sessionId) !== void 0 || findBestRoute(routes, input.toolName, args, input.repoKey) !== void 0;
   });
 };
 var claudeAllowlistOwnsCall = (input, verdict, permissionMode, rules) => rules !== null && verdict.kind === "gate" && !verdict.scopeReason && !aChosenRuleGoverns(input) && !isAskedInEveryMode(input.toolName) && claudeConsultsItsAllowlist(permissionMode) && agentRulesAllowEveryInput(rules, input.toolName, input.toolInputs, input.cwd);
@@ -4133,6 +4293,7 @@ export {
   serializeDeclinedAgents,
   withDeclinedAgent,
   withoutDeclinedAgent,
+  isAutoUpdateResult,
   normalizeKeyScope,
   isApprovalMode,
   approvalModeWithoutLocalPrompt,

package/dist/{chunk-AG5ATWVT.js → chunk-ZWDXBLEZ.js}

@@ -1,12 +1,12 @@
 import {
   keyCheckFromResponse
-} from "./chunk-GRL4VVUP.js";
+} from "./chunk-MSKJRRHY.js";
 import {
   installNetworkDefaults
-} from "./chunk-CXG7XA4E.js";
+} from "./chunk-W4LNR7LP.js";
 import {
   getBaseUrl
-} from "./chunk-5UKZXDHV.js";
+} from "./chunk-XTTMUQ4Z.js";
 
 // src/retry.ts
 var isRetryable = (err) => {

package/dist/{global-upgrade-3XKMGVAR.js → global-upgrade-FKQPJL5P.js}

@@ -5,15 +5,15 @@ import {
   readGlobalUpgradeSubject,
   upgradeInstalledPackage,
   withUpgradeLock
-} from "./chunk-BWXRLXNE.js";
-import "./chunk-I52A3NLY.js";
-import "./chunk-TS3CRCI7.js";
+} from "./chunk-MDAJO2MP.js";
+import "./chunk-XESMYZLU.js";
+import "./chunk-WGTD4NZV.js";
 import "./chunk-POFBE6ZY.js";
 import "./chunk-KZERVKTD.js";
-import "./chunk-3TRGUDQ3.js";
+import "./chunk-YTTPPJZW.js";
 import "./chunk-AQFEP65J.js";
-import "./chunk-47RVFUEG.js";
-import "./chunk-TVP5UU33.js";
+import "./chunk-Z5AAPX3O.js";
+import "./chunk-ZQZRBPTP.js";
 export {
   finishGlobalUpgrade,
   finishUpgradeWithLock,

package/dist/{paths-UB2IUM57.js → paths-TU47TCRS.js}

@@ -32,8 +32,8 @@ import {
   pusharyDir,
   vscodePluginDir,
   vscodePluginMcp
-} from "./chunk-3TRGUDQ3.js";
-import "./chunk-TVP5UU33.js";
+} from "./chunk-YTTPPJZW.js";
+import "./chunk-ZQZRBPTP.js";
 export {
   autoUpdateLock,
   autoUpdateLog,

package/dist/{reapply-B7KMGQH7.js → reapply-CTJZBUJY.js}

@@ -10,34 +10,34 @@ import {
   reapplyOpenCodePlugin,
   reapplyVsCodePlugin,
   repairCodexHolds
-} from "./chunk-R5ABJ5H5.js";
-import "./chunk-LGMSGVDN.js";
+} from "./chunk-OPSLFAKF.js";
+import "./chunk-GORB726L.js";
 import "./chunk-RIVNNBEK.js";
 import "./chunk-XHKBHWLX.js";
-import "./chunk-TEQJNXJH.js";
-import "./chunk-AXOMDPA7.js";
-import "./chunk-L62RNE5F.js";
-import "./chunk-2YF72RC5.js";
-import "./chunk-Y5O4TO7U.js";
-import "./chunk-ZPLDPPZO.js";
+import "./chunk-5SKHXKIF.js";
+import "./chunk-TQE5VIDJ.js";
+import "./chunk-TWCWRHNK.js";
+import "./chunk-KN5ULH4O.js";
+import "./chunk-MRMIGVUI.js";
+import "./chunk-MTODICDT.js";
 import "./chunk-GMXKITVA.js";
 import "./chunk-6ICPEJY5.js";
-import "./chunk-BIV2LKDK.js";
-import "./chunk-XUVKAWV3.js";
-import "./chunk-DDRSG6JL.js";
+import "./chunk-VGVMBY4V.js";
+import "./chunk-CSXWXXFJ.js";
+import "./chunk-AT4URLSU.js";
 import "./chunk-POFBE6ZY.js";
-import "./chunk-AG5ATWVT.js";
-import "./chunk-GRL4VVUP.js";
-import "./chunk-CXG7XA4E.js";
-import "./chunk-4YWINUPJ.js";
+import "./chunk-ZWDXBLEZ.js";
+import "./chunk-MSKJRRHY.js";
+import "./chunk-W4LNR7LP.js";
+import "./chunk-U4Q3AKLU.js";
 import "./chunk-7QLSKOSU.js";
 import "./chunk-KZERVKTD.js";
-import "./chunk-KJ2W7ECE.js";
-import "./chunk-3TRGUDQ3.js";
+import "./chunk-UWEDDQHU.js";
+import "./chunk-YTTPPJZW.js";
 import "./chunk-AQFEP65J.js";
-import "./chunk-5UKZXDHV.js";
-import "./chunk-47RVFUEG.js";
-import "./chunk-TVP5UU33.js";
+import "./chunk-XTTMUQ4Z.js";
+import "./chunk-Z5AAPX3O.js";
+import "./chunk-ZQZRBPTP.js";
 export {
   ensureCodexTrustAfterReapply,
   inspectConfiguredManagedProviders,

package/dist/src/index.js

@@ -1,14 +1,14 @@
 import {
   handlePreToolUse
-} from "../chunk-GEN4YTNR.js";
-import "../chunk-FA3YPD4P.js";
-import "../chunk-3DLVLVEM.js";
-import "../chunk-ZXYHVZZZ.js";
+} from "../chunk-SLW45RGY.js";
+import "../chunk-E4NITECV.js";
+import "../chunk-LUJAURFP.js";
+import "../chunk-LOVDPKUU.js";
 import {
   fetchAccountPublicKey
-} from "../chunk-4GKLAQY4.js";
-import "../chunk-AXOMDPA7.js";
-import "../chunk-2YF72RC5.js";
+} from "../chunk-5LLH2TBR.js";
+import "../chunk-TQE5VIDJ.js";
+import "../chunk-KN5ULH4O.js";
 import "../chunk-6ICPEJY5.js";
 import {
   fetchModeOverride,
@@ -18,31 +18,31 @@ import {
   handlePostToolUse,
   handleStop,
   reportEvent
-} from "../chunk-BIV2LKDK.js";
-import "../chunk-XUVKAWV3.js";
+} from "../chunk-VGVMBY4V.js";
+import "../chunk-CSXWXXFJ.js";
 import {
   askUser,
   cancelQuestion,
   waitForAnswer
-} from "../chunk-DDRSG6JL.js";
+} from "../chunk-AT4URLSU.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-AG5ATWVT.js";
-import "../chunk-GRL4VVUP.js";
-import "../chunk-CXG7XA4E.js";
-import "../chunk-4YWINUPJ.js";
+import "../chunk-ZWDXBLEZ.js";
+import "../chunk-MSKJRRHY.js";
+import "../chunk-W4LNR7LP.js";
+import "../chunk-U4Q3AKLU.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-KJ2W7ECE.js";
-import "../chunk-3TRGUDQ3.js";
+import "../chunk-UWEDDQHU.js";
+import "../chunk-YTTPPJZW.js";
 import "../chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-5UKZXDHV.js";
-import "../chunk-47RVFUEG.js";
+} from "../chunk-XTTMUQ4Z.js";
+import "../chunk-Z5AAPX3O.js";
 import {
   resolvePolicy
-} from "../chunk-TVP5UU33.js";
+} from "../chunk-ZQZRBPTP.js";
 export {
   askUser,
   cancelQuestion,