pushary 1.9.30 → 1.9.31

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 1.9.31
+
+- SQL sent through `psql`, `mysql` and `mariadb` is now read the way the database reads it. These used to run under an approve rule and now ask: a write after a dollar quote with a non-ASCII tag, such as `psql -c 'SELECT $é$ -- $é$; UPDATE users SET x=1'`; a write after a carriage return that ends a `--` comment; and a write inside a MySQL `/*! ... */` or MariaDB `/*M! ... */` comment, which those clients run.
+- `SELECT ... INTO` and a `LOCK` statement now count as writes and ask, as do `EXECUTE IMMEDIATE` and `PREPARE ... FROM`.
+- A command after `bash -c` and its options is now seen, so a `Bash(git push:*)` deny rule now refuses `bash -c -x 'git push'`, `bash -c -- 'git push'` and `zsh -c -x 'git push'`, which used to run.
+- `env` options are read the way GNU and macOS `env` read them, abbreviations included, so the same deny rule now refuses `env --spl='git push'`. When the two versions of `env` would run different commands, Pushary asks.
+- Codex: `gh api -iXDELETE` and `gh api -iX DELETE` are read as DELETE requests and ask, instead of being passed back to Codex.
+- A tool name that is not one concrete tool, such as `*`, can no longer be saved as an Always allow rule.
+- History capture works when Claude Code or Codex keeps its files under a custom `CLAUDE_CONFIG_DIR` or `CODEX_HOME`.
+- `pushary-mcp` tells Pushary which computer is asking, so the phone's Try it step checks the computer you chose.
+
 ## 1.9.30
 
 - "Always allow PowerShell" and "Always allow Monitor" now ask about the same consequences "Always allow Bash" does. A Monitor command is judged exactly as the same Bash command. In PowerShell that includes `Remove-Item -Recurse`, `irm ... | iex`, a downloaded script then run, `Set-Content .env`, `Stop-Service`, `Format-Volume` and a recursive `Get-ChildItem` piped to `Remove-Item`. A plain `Remove-Item file.txt`, `git push`, `Stop-Process`, `-WhatIf` and every read such as `Get-ChildItem` keep running.

package/data/SKILL.md

@@ -174,20 +174,46 @@ Put a boundary that is not a file path in `promises`, never in `allowedPaths`. R
 
 **Look at the machine first. Do not guess the install path.** Run these. Each one is read-only and fast. Run them as separate commands.
 
+Use `uname -s` in a Unix shell (`Darwin` is Mac, `Linux` is Linux). In
+PowerShell, inspect `$env:OS` (`Windows_NT` is Windows). Platform discovery must
+not depend on Node: the native Mac route does not require it.
+
+In a Unix shell, run these separately:
+
 ```bash
-node -p "process.platform"
+uname -s
 [ -n "${PUSHARY_API_KEY:+x}" ] && echo key-in-env
-node -e "try{process.exit(JSON.parse(require('fs').readFileSync(process.env.HOME+'/.pushary/config.json','utf8')).apiKey?.trim()?0:1)}catch{process.exit(1)}" && echo keyed
+command -v node >/dev/null 2>&1 && echo node-available
+command -v npm >/dev/null 2>&1 && echo npm-available
 test -x ~/.pushary/bin/pushary-bridge && echo mac-app
 ```
 
-The third and fourth tests answer different questions.
+On Mac, check the stored key without Node or printing its value:
+
+```bash
+if pushary_key_check=$(/usr/bin/plutil -extract apiKey raw -expect string -o - ~/.pushary/config.json 2>/dev/null); then
+  printf '%s\n' "$pushary_key_check" | /usr/bin/awk 'NF { found=1 } END { exit !found }' && echo keyed
+fi
+unset pushary_key_check
+```
+
+When Node is available, other Unix platforms can check the stored key with:
 
-The third says a key is stored **and is not empty**. Test the value, not the file.
+```bash
+node -e "try{process.exit(JSON.parse(require('fs').readFileSync(process.env.HOME+'/.pushary/config.json','utf8')).apiKey?.trim()?0:1)}catch{process.exit(1)}" && echo keyed
+```
+
+In PowerShell, check for a nonempty environment/stored key without printing it;
+use `Get-Content` and `ConvertFrom-Json` for the config in `$env:USERPROFILE`.
+Check `Get-Command node,npm` before choosing the terminal installer.
+
+The stored-key and bridge tests answer different questions.
+
+The stored-key test says a key is stored **and is not empty**. Test the value, not the file.
 The file stays behind after a logout removes the key. A test for the file alone
 tells a logged-out user they are ready.
 
-The fourth says the Mac app is installed here. Only the Mac app writes that file.
+The bridge test says the Mac app is installed here. Only the Mac app writes that file.
 
 Check the environment before the stored key. An exported key wins over a stored
 one. Never print the key itself.
@@ -196,14 +222,22 @@ Then take one branch.
 
 ### Branch 1. `key-in-env`, `keyed`, or `mac-app`
 
-This machine is set up. Offer no install. Do not run `setup` again.
+This machine has an existing installation or credential. Offer no new install.
+Verify its readiness before reporting success. Do not run `setup` again.
 
 `mac-app` counts on its own. The Mac app signs in for the user. It writes the key
 into the agent configuration files it wires, not into `~/.pushary/config.json`. A
-machine the app set up therefore prints `mac-app` and nothing else. Treat it as
-ready.
+machine the app set up therefore prints `mac-app` and nothing else. The locator
+proves installation, not sign-in, entitlement, current agent admission or delivery.
+
+For `mac-app` without Node/npm, open Pushary and check the intended account,
+subscription and Agents connection state there. Use the native app to connect or
+repair the selected agents and phone. Then send a harmless question from the
+current agent and confirm its returned answer. Do not install Node to inspect
+the native setup and do not claim a CLI status exit code when no CLI ran.
 
-Check it with `npx pushary@latest status --json`. The exit code is the answer:
+When Node/npm are available, check it with `npx pushary@latest status --json`.
+The exit code is the answer:
 
 | Code | Meaning |
 | --- | --- |
@@ -224,7 +258,7 @@ grep -lq pushary-bridge ~/.claude/settings.json ~/.gemini/settings.json ~/.curso
 
 If the app owns them, `setup` would keep them and write almost nothing, so telling the user to re-run it is bad advice. Point them at the Pushary app instead.
 
-### Branch 2. `darwin`, no key, no `mac-app`
+### Branch 2. `Darwin`, no key, no `mac-app`
 
 Offer the Mac app first. It needs no Node and no terminal. It writes the agent configuration itself, and it answers questions in the notch at the desk.
 
@@ -236,7 +270,7 @@ They can also download it from https://pushary.com/download. It needs macOS 14 o
 
 The command line works on macOS too. Offer it if the user prefers the terminal, or if the user runs Hermes, because Hermes needs a Python the app cannot install.
 
-### Branch 3. `linux` or `win32`
+### Branch 3. `Linux` or `Windows_NT`
 
 There is no Mac app for these machines. Use the command line. It is fully supported.
 
@@ -251,7 +285,7 @@ Node 20.17+, 22.13+ or 23.5+ is necessary. Then the user needs a phone to answer
 
 On Windows, setup writes no shell file, so `~/.pushary/config.json` is the only key store. On a Linux machine with no screen, browser login does not work, but the pairing QR does.
 
-### Branch 4. `darwin`, `mac-app`, and the user asked for the command line
+### Branch 4. `Darwin`, `mac-app`, and the user asked for the command line
 
 Run `setup`. It reads the key the app signed in with, so it mints no second key, and it keeps the hooks the app owns. Pass `--take-over-hooks` only when the user wants the command line to own them instead.
 

package/data/cursor-plugin/skills/pushary/SKILL.md

@@ -167,20 +167,46 @@ Put a boundary that is not a file path in `promises`, never in `allowedPaths`. R
 
 **Look at the machine first. Do not guess the install path.** Run these. Each one is read-only and fast. Run them as separate commands.
 
+Use `uname -s` in a Unix shell (`Darwin` is Mac, `Linux` is Linux). In
+PowerShell, inspect `$env:OS` (`Windows_NT` is Windows). Platform discovery must
+not depend on Node: the native Mac route does not require it.
+
+In a Unix shell, run these separately:
+
 ```bash
-node -p "process.platform"
+uname -s
 [ -n "${PUSHARY_API_KEY:+x}" ] && echo key-in-env
-node -e "try{process.exit(JSON.parse(require('fs').readFileSync(process.env.HOME+'/.pushary/config.json','utf8')).apiKey?.trim()?0:1)}catch{process.exit(1)}" && echo keyed
+command -v node >/dev/null 2>&1 && echo node-available
+command -v npm >/dev/null 2>&1 && echo npm-available
 test -x ~/.pushary/bin/pushary-bridge && echo mac-app
 ```
 
-The third and fourth tests answer different questions.
+On Mac, check the stored key without Node or printing its value:
+
+```bash
+if pushary_key_check=$(/usr/bin/plutil -extract apiKey raw -expect string -o - ~/.pushary/config.json 2>/dev/null); then
+  printf '%s\n' "$pushary_key_check" | /usr/bin/awk 'NF { found=1 } END { exit !found }' && echo keyed
+fi
+unset pushary_key_check
+```
+
+When Node is available, other Unix platforms can check the stored key with:
 
-The third says a key is stored **and is not empty**. Test the value, not the file.
+```bash
+node -e "try{process.exit(JSON.parse(require('fs').readFileSync(process.env.HOME+'/.pushary/config.json','utf8')).apiKey?.trim()?0:1)}catch{process.exit(1)}" && echo keyed
+```
+
+In PowerShell, check for a nonempty environment/stored key without printing it;
+use `Get-Content` and `ConvertFrom-Json` for the config in `$env:USERPROFILE`.
+Check `Get-Command node,npm` before choosing the terminal installer.
+
+The stored-key and bridge tests answer different questions.
+
+The stored-key test says a key is stored **and is not empty**. Test the value, not the file.
 The file stays behind after a logout removes the key. A test for the file alone
 tells a logged-out user they are ready.
 
-The fourth says the Mac app is installed here. Only the Mac app writes that file.
+The bridge test says the Mac app is installed here. Only the Mac app writes that file.
 
 Check the environment before the stored key. An exported key wins over a stored
 one. Never print the key itself.
@@ -189,14 +215,22 @@ Then take one branch.
 
 ### Branch 1. `key-in-env`, `keyed`, or `mac-app`
 
-This machine is set up. Offer no install. Do not run `setup` again.
+This machine has an existing installation or credential. Offer no new install.
+Verify its readiness before reporting success. Do not run `setup` again.
 
 `mac-app` counts on its own. The Mac app signs in for the user. It writes the key
 into the agent configuration files it wires, not into `~/.pushary/config.json`. A
-machine the app set up therefore prints `mac-app` and nothing else. Treat it as
-ready.
+machine the app set up therefore prints `mac-app` and nothing else. The locator
+proves installation, not sign-in, entitlement, current agent admission or delivery.
+
+For `mac-app` without Node/npm, open Pushary and check the intended account,
+subscription and Agents connection state there. Use the native app to connect or
+repair the selected agents and phone. Then send a harmless question from the
+current agent and confirm its returned answer. Do not install Node to inspect
+the native setup and do not claim a CLI status exit code when no CLI ran.
 
-Check it with `npx pushary@latest status --json`. The exit code is the answer:
+When Node/npm are available, check it with `npx pushary@latest status --json`.
+The exit code is the answer:
 
 | Code | Meaning |
 | --- | --- |
@@ -217,7 +251,7 @@ grep -lq pushary-bridge ~/.claude/settings.json ~/.gemini/settings.json ~/.curso
 
 If the app owns them, `setup` would keep them and write almost nothing, so telling the user to re-run it is bad advice. Point them at the Pushary app instead.
 
-### Branch 2. `darwin`, no key, no `mac-app`
+### Branch 2. `Darwin`, no key, no `mac-app`
 
 Offer the Mac app first. It needs no Node and no terminal. It writes the agent configuration itself, and it answers questions in the notch at the desk.
 
@@ -229,7 +263,7 @@ They can also download it from https://pushary.com/download. It needs macOS 14 o
 
 The command line works on macOS too. Offer it if the user prefers the terminal, or if the user runs Hermes, because Hermes needs a Python the app cannot install.
 
-### Branch 3. `linux` or `win32`
+### Branch 3. `Linux` or `Windows_NT`
 
 There is no Mac app for these machines. Use the command line. It is fully supported.
 
@@ -244,7 +278,7 @@ Node 20.17+, 22.13+ or 23.5+ is necessary. Then the user needs a phone to answer
 
 On Windows, setup writes no shell file, so `~/.pushary/config.json` is the only key store. On a Linux machine with no screen, browser login does not work, but the pairing QR does.
 
-### Branch 4. `darwin`, `mac-app`, and the user asked for the command line
+### Branch 4. `Darwin`, `mac-app`, and the user asked for the command line
 
 Run `setup`. It reads the key the app signed in with, so it mints no second key, and it keeps the hooks the app owns. Pass `--take-over-hooks` only when the user wants the command line to own them instead.
 

package/data/vscode-plugin/skills/pushary/SKILL.md

@@ -167,20 +167,46 @@ Put a boundary that is not a file path in `promises`, never in `allowedPaths`. R
 
 **Look at the machine first. Do not guess the install path.** Run these. Each one is read-only and fast. Run them as separate commands.
 
+Use `uname -s` in a Unix shell (`Darwin` is Mac, `Linux` is Linux). In
+PowerShell, inspect `$env:OS` (`Windows_NT` is Windows). Platform discovery must
+not depend on Node: the native Mac route does not require it.
+
+In a Unix shell, run these separately:
+
 ```bash
-node -p "process.platform"
+uname -s
 [ -n "${PUSHARY_API_KEY:+x}" ] && echo key-in-env
-node -e "try{process.exit(JSON.parse(require('fs').readFileSync(process.env.HOME+'/.pushary/config.json','utf8')).apiKey?.trim()?0:1)}catch{process.exit(1)}" && echo keyed
+command -v node >/dev/null 2>&1 && echo node-available
+command -v npm >/dev/null 2>&1 && echo npm-available
 test -x ~/.pushary/bin/pushary-bridge && echo mac-app
 ```
 
-The third and fourth tests answer different questions.
+On Mac, check the stored key without Node or printing its value:
+
+```bash
+if pushary_key_check=$(/usr/bin/plutil -extract apiKey raw -expect string -o - ~/.pushary/config.json 2>/dev/null); then
+  printf '%s\n' "$pushary_key_check" | /usr/bin/awk 'NF { found=1 } END { exit !found }' && echo keyed
+fi
+unset pushary_key_check
+```
+
+When Node is available, other Unix platforms can check the stored key with:
 
-The third says a key is stored **and is not empty**. Test the value, not the file.
+```bash
+node -e "try{process.exit(JSON.parse(require('fs').readFileSync(process.env.HOME+'/.pushary/config.json','utf8')).apiKey?.trim()?0:1)}catch{process.exit(1)}" && echo keyed
+```
+
+In PowerShell, check for a nonempty environment/stored key without printing it;
+use `Get-Content` and `ConvertFrom-Json` for the config in `$env:USERPROFILE`.
+Check `Get-Command node,npm` before choosing the terminal installer.
+
+The stored-key and bridge tests answer different questions.
+
+The stored-key test says a key is stored **and is not empty**. Test the value, not the file.
 The file stays behind after a logout removes the key. A test for the file alone
 tells a logged-out user they are ready.
 
-The fourth says the Mac app is installed here. Only the Mac app writes that file.
+The bridge test says the Mac app is installed here. Only the Mac app writes that file.
 
 Check the environment before the stored key. An exported key wins over a stored
 one. Never print the key itself.
@@ -189,14 +215,22 @@ Then take one branch.
 
 ### Branch 1. `key-in-env`, `keyed`, or `mac-app`
 
-This machine is set up. Offer no install. Do not run `setup` again.
+This machine has an existing installation or credential. Offer no new install.
+Verify its readiness before reporting success. Do not run `setup` again.
 
 `mac-app` counts on its own. The Mac app signs in for the user. It writes the key
 into the agent configuration files it wires, not into `~/.pushary/config.json`. A
-machine the app set up therefore prints `mac-app` and nothing else. Treat it as
-ready.
+machine the app set up therefore prints `mac-app` and nothing else. The locator
+proves installation, not sign-in, entitlement, current agent admission or delivery.
+
+For `mac-app` without Node/npm, open Pushary and check the intended account,
+subscription and Agents connection state there. Use the native app to connect or
+repair the selected agents and phone. Then send a harmless question from the
+current agent and confirm its returned answer. Do not install Node to inspect
+the native setup and do not claim a CLI status exit code when no CLI ran.
 
-Check it with `npx pushary@latest status --json`. The exit code is the answer:
+When Node/npm are available, check it with `npx pushary@latest status --json`.
+The exit code is the answer:
 
 | Code | Meaning |
 | --- | --- |
@@ -217,7 +251,7 @@ grep -lq pushary-bridge ~/.claude/settings.json ~/.gemini/settings.json ~/.curso
 
 If the app owns them, `setup` would keep them and write almost nothing, so telling the user to re-run it is bad advice. Point them at the Pushary app instead.
 
-### Branch 2. `darwin`, no key, no `mac-app`
+### Branch 2. `Darwin`, no key, no `mac-app`
 
 Offer the Mac app first. It needs no Node and no terminal. It writes the agent configuration itself, and it answers questions in the notch at the desk.
 
@@ -229,7 +263,7 @@ They can also download it from https://pushary.com/download. It needs macOS 14 o
 
 The command line works on macOS too. Offer it if the user prefers the terminal, or if the user runs Hermes, because Hermes needs a Python the app cannot install.
 
-### Branch 3. `linux` or `win32`
+### Branch 3. `Linux` or `Windows_NT`
 
 There is no Mac app for these machines. Use the command line. It is fully supported.
 
@@ -244,7 +278,7 @@ Node 20.17+, 22.13+ or 23.5+ is necessary. Then the user needs a phone to answer
 
 On Windows, setup writes no shell file, so `~/.pushary/config.json` is the only key store. On a Linux machine with no screen, browser login does not work, but the pairing QR does.
 
-### Branch 4. `darwin`, `mac-app`, and the user asked for the command line
+### Branch 4. `Darwin`, `mac-app`, and the user asked for the command line
 
 Run `setup`. It reads the key the app signed in with, so it mints no second key, and it keeps the hooks the app owns. Pass `--take-over-hooks` only when the user wants the command line to own them instead.
 

package/dist/bin/pushary-bell-hook.js

@@ -1,41 +1,41 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-SAGO6JNL.js";
+} from "../chunk-75UCMLT5.js";
 import {
   readHookInput
-} from "../chunk-HMA7QQ3P.js";
-import "../chunk-JHVSVVHB.js";
-import "../chunk-VTR4VRL2.js";
-import "../chunk-QYD5TN2J.js";
-import "../chunk-E2WJLU5U.js";
-import "../chunk-IMUCTAM2.js";
-import "../chunk-434NFCK2.js";
+} from "../chunk-ALSIMOFS.js";
+import "../chunk-GSBOLJZ4.js";
+import "../chunk-DWQYCOPI.js";
+import "../chunk-VFNYTVTJ.js";
+import "../chunk-7447DYNW.js";
+import "../chunk-EPVY3JU3.js";
+import "../chunk-MRR4NQ3H.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-KT4SP73I.js";
-import "../chunk-GFY6XONT.js";
-import "../chunk-2OIGS4P2.js";
-import "../chunk-DP6FJABB.js";
-import "../chunk-S6J3A4DF.js";
+import "../chunk-SAHD5DYW.js";
+import "../chunk-FXJ5SEQT.js";
+import "../chunk-OS6AE2MR.js";
+import "../chunk-35RJKPIC.js";
+import "../chunk-IDGESFKZ.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-LD3A63IE.js";
-import "../chunk-XLNSQLTV.js";
-import "../chunk-Q6HJD6SH.js";
-import "../chunk-OQ5K6QHU.js";
+import "../chunk-IKJJB4QG.js";
+import "../chunk-X427XA76.js";
+import "../chunk-4JOWKPUF.js";
+import "../chunk-464FX6W5.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-7JO33ODX.js";
-import "../chunk-XKSAXKRY.js";
-import "../chunk-3QKX22ZA.js";
-import "../chunk-6DJBVMTR.js";
+import "../chunk-FEICGRNI.js";
+import "../chunk-SYUHM6V3.js";
+import "../chunk-4WGKAGIU.js";
+import "../chunk-NTWTU6FA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-KRZECDHA.js";
-import "../chunk-2QEW5FJK.js";
+import "../chunk-KBRKQMCI.js";
+import "../chunk-SRRJLA24.js";
 import "../chunk-AQFEP65J.js";
-import "../chunk-XNKFK27C.js";
-import "../chunk-SMA7LUCS.js";
-import "../chunk-JBVKA3UR.js";
+import "../chunk-5EX2SD5N.js";
+import "../chunk-2ROXUEZV.js";
+import "../chunk-TDLEFGAM.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,39 +5,39 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-SAGO6JNL.js";
+} from "../chunk-75UCMLT5.js";
 import {
   createIo
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-6R22H57A.js";
+} from "../chunk-CJCVPCOB.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-S6J3A4DF.js";
+} from "../chunk-IDGESFKZ.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-LD3A63IE.js";
+import "../chunk-IKJJB4QG.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-KRZECDHA.js";
+import "../chunk-KBRKQMCI.js";
 import {
   claudeSettings
-} from "../chunk-2QEW5FJK.js";
+} from "../chunk-SRRJLA24.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-AQFEP65J.js";
-import "../chunk-XNKFK27C.js";
-import "../chunk-SMA7LUCS.js";
+import "../chunk-5EX2SD5N.js";
+import "../chunk-2ROXUEZV.js";
 import {
   isRecord
-} from "../chunk-JBVKA3UR.js";
+} from "../chunk-TDLEFGAM.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,39 +8,39 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-CS5JKDWW.js";
+} from "../chunk-D3TVRNZC.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-J3HI2SRD.js";
+} from "../chunk-MG523AVN.js";
 import {
   claudeTranscriptPath,
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-JHVSVVHB.js";
-import "../chunk-VTR4VRL2.js";
+} from "../chunk-GSBOLJZ4.js";
+import "../chunk-DWQYCOPI.js";
 import {
   ensureDaemonRunning
-} from "../chunk-QYD5TN2J.js";
+} from "../chunk-VFNYTVTJ.js";
 import {
   encryptRecord
-} from "../chunk-E2WJLU5U.js";
-import "../chunk-IMUCTAM2.js";
+} from "../chunk-7447DYNW.js";
+import "../chunk-EPVY3JU3.js";
 import {
   transcriptsEnabled
-} from "../chunk-434NFCK2.js";
+} from "../chunk-MRR4NQ3H.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
-import "../chunk-GFY6XONT.js";
-import "../chunk-2OIGS4P2.js";
-import "../chunk-DP6FJABB.js";
-import "../chunk-S6J3A4DF.js";
+import "../chunk-FXJ5SEQT.js";
+import "../chunk-OS6AE2MR.js";
+import "../chunk-35RJKPIC.js";
+import "../chunk-IDGESFKZ.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-LD3A63IE.js";
+import "../chunk-IKJJB4QG.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -58,8 +58,8 @@ import {
   reportEvent,
   savePendingCommand,
   scopePathFor
-} from "../chunk-XLNSQLTV.js";
-import "../chunk-Q6HJD6SH.js";
+} from "../chunk-X427XA76.js";
+import "../chunk-4JOWKPUF.js";
 import {
   askUser,
   cancelQuestion,
@@ -70,28 +70,28 @@ import {
   waitForAnswer,
   waitsForThePhone,
   withdrawQuestion
-} from "../chunk-OQ5K6QHU.js";
+} from "../chunk-464FX6W5.js";
 import "../chunk-POFBE6ZY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-7JO33ODX.js";
-import "../chunk-XKSAXKRY.js";
-import "../chunk-3QKX22ZA.js";
+} from "../chunk-FEICGRNI.js";
+import "../chunk-SYUHM6V3.js";
+import "../chunk-4WGKAGIU.js";
 import {
   getMachineId
-} from "../chunk-6DJBVMTR.js";
+} from "../chunk-NTWTU6FA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-KRZECDHA.js";
-import "../chunk-2QEW5FJK.js";
+import "../chunk-KBRKQMCI.js";
+import "../chunk-SRRJLA24.js";
 import "../chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-XNKFK27C.js";
+} from "../chunk-5EX2SD5N.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-SMA7LUCS.js";
+} from "../chunk-2ROXUEZV.js";
 import {
   DECISION_STOP_REASON,
   HAND_BACK_WITHOUT_A_PROMPT,
@@ -101,7 +101,7 @@ import {
   redactSecretsFromContent,
   resolveGate,
   timeoutActionWithoutLocalPrompt
-} from "../chunk-JBVKA3UR.js";
+} from "../chunk-TDLEFGAM.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {