pushary 1.9.31 → 1.9.32

package/dist/{chunk-OTDRNEED.js → chunk-F3TI7CYV.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-3EGEA4KH.js";
 import {
   getBaseUrl
-} from "./chunk-5EX2SD5N.js";
+} from "./chunk-Z73AKQYU.js";
 
 // src/cli/login-ui.ts
 import { hostname } from "os";

package/dist/{chunk-77J4RVB2.js → chunk-FAINF4IK.js}

@@ -2,25 +2,25 @@ import {
   SIGNED_OUT_ON_MAC_MESSAGE,
   describeSignedOutKey,
   readSignedOutDiagnosis
-} from "./chunk-N4LLBUU2.js";
+} from "./chunk-JH2TTKC4.js";
 import {
   createIo
 } from "./chunk-FO3MDD26.js";
 import {
   readKeySource
-} from "./chunk-IKJJB4QG.js";
+} from "./chunk-H7F2IN22.js";
 import {
   absoluteUrl,
   checkApiKey,
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-SYUHM6V3.js";
+} from "./chunk-7ENPTXR4.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
 import {
   getBaseUrl
-} from "./chunk-5EX2SD5N.js";
+} from "./chunk-Z73AKQYU.js";
 
 // src/cli/report-key.ts
 var { dim, yellow } = createIo();

package/dist/{chunk-RN3KZDWP.js → chunk-FZ2EGAEA.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-SRRJLA24.js";
+} from "./chunk-MKYICE44.js";
 import {
   readJsonSafe,
   writeFileAtomic
@@ -13,7 +13,7 @@ import {
   serializeDeclinedAgents,
   withDeclinedAgent,
   withoutDeclinedAgent
-} from "./chunk-TDLEFGAM.js";
+} from "./chunk-JD6HIO7N.js";
 
 // src/declined-agents-file.ts
 import { join } from "path";

package/dist/{chunk-5FNE6ZVV.js → chunk-GF45OS6U.js}

@@ -1,9 +1,9 @@
 import {
   parseSseMessages
-} from "./chunk-FEICGRNI.js";
+} from "./chunk-UOVREWK3.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-2ROXUEZV.js";
+} from "./chunk-7OMOUQSU.js";
 
 // src/mcp-stdio-bridge.ts
 var MCP_BRIDGE_BINARY = "pushary-mcp";

package/dist/{chunk-IKJJB4QG.js → chunk-H7F2IN22.js}

@@ -1,6 +1,6 @@
 import {
   resolveInstallSourceFor
-} from "./chunk-KBRKQMCI.js";
+} from "./chunk-KTFZKXRE.js";
 import {
   backupFile,
   readJsonSafe,
@@ -9,11 +9,11 @@ import {
 } from "./chunk-AQFEP65J.js";
 import {
   configFilePath
-} from "./chunk-5EX2SD5N.js";
+} from "./chunk-Z73AKQYU.js";
 import {
   API_KEY_PREFIX_PATTERN,
   isRecord
-} from "./chunk-TDLEFGAM.js";
+} from "./chunk-JD6HIO7N.js";
 
 // src/shell-alias.ts
 import { homedir } from "os";

package/dist/{chunk-7447DYNW.js → chunk-HFRRSYTG.js}

@@ -1,6 +1,6 @@
 import {
   redactSecretsFromContent
-} from "./chunk-TDLEFGAM.js";
+} from "./chunk-JD6HIO7N.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";

package/dist/{chunk-FXJ5SEQT.js → chunk-I3N5LPFB.js}

@@ -2,23 +2,23 @@ import {
   CLAUDE_HOOK_EVENTS,
   GEMINI_HOOK_EVENTS,
   hasGeminiHooks
-} from "./chunk-OS6AE2MR.js";
+} from "./chunk-CBRLV3W7.js";
 import {
   AGENT_CHOICES
-} from "./chunk-35RJKPIC.js";
+} from "./chunk-Y53KKEMZ.js";
 import {
   BELL_HOOK_BINARY
-} from "./chunk-IDGESFKZ.js";
+} from "./chunk-I6D5BGFF.js";
 import {
   CODEX_HOOK_EVENTS,
   hasCodexHooks,
   holdBudgetOf
-} from "./chunk-SRRJLA24.js";
+} from "./chunk-MKYICE44.js";
 import {
   CURSOR_GATE_EVENTS,
   HOOK_LOCATOR_BINARY,
   hookCommandHoldBudget
-} from "./chunk-TDLEFGAM.js";
+} from "./chunk-JD6HIO7N.js";
 
 // src/diagnostics/bridge.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-IDGESFKZ.js → chunk-I6D5BGFF.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-SRRJLA24.js";
+} from "./chunk-MKYICE44.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-X5HK4XUN.js → chunk-IPJRYHDC.js}

@@ -1,13 +1,13 @@
 import {
   MCP_BRIDGE_BINARY
-} from "./chunk-5FNE6ZVV.js";
+} from "./chunk-GF45OS6U.js";
 import {
   KEY_FILE_MODE
-} from "./chunk-IKJJB4QG.js";
+} from "./chunk-H7F2IN22.js";
 import {
   NpmMissingError,
   NpmPermissionError
-} from "./chunk-SRRJLA24.js";
+} from "./chunk-MKYICE44.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -15,7 +15,7 @@ import {
 } from "./chunk-AQFEP65J.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-2ROXUEZV.js";
+} from "./chunk-7OMOUQSU.js";
 
 // src/instruction-file.ts
 import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from "fs";

package/dist/{chunk-QGCEQGH6.js → chunk-IW6MFF5I.js}

@@ -1,18 +1,18 @@
 import {
   macAppBridgeAvailable
-} from "./chunk-OULHOX5C.js";
+} from "./chunk-DXFMP37X.js";
 import {
   keyPrefix
-} from "./chunk-IKJJB4QG.js";
+} from "./chunk-H7F2IN22.js";
 import {
   bridgeAgentKey
-} from "./chunk-SRRJLA24.js";
+} from "./chunk-MKYICE44.js";
 import {
   readJsonSafe
 } from "./chunk-AQFEP65J.js";
 import {
   isValidApiKey
-} from "./chunk-TDLEFGAM.js";
+} from "./chunk-JD6HIO7N.js";
 
 // src/shared-mcp-key.ts
 var asRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;

package/dist/{chunk-5GDNIEL5.js → chunk-J2OVVMBU.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_HOLD_BUDGET_ENV,
   hookHoldBudgetProof
-} from "./chunk-TDLEFGAM.js";
+} from "./chunk-JD6HIO7N.js";
 
 // src/hold-budget.ts
 var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {

package/dist/{chunk-TDLEFGAM.js → chunk-JD6HIO7N.js}

@@ -1758,6 +1758,8 @@ var STATEMENT_SEPARATOR2 = ";";
 var SINGLE_QUOTE = "'";
 var DOUBLE_QUOTE = '"';
 var BACKTICK = "`";
+var BRACKET_IDENTIFIER_OPEN = "[";
+var BRACKET_IDENTIFIER_CLOSE = "]";
 var BACKSLASH = "\\";
 var DOLLAR = "$";
 var DASH_DASH = "--";
@@ -1877,6 +1879,7 @@ var swallowsABacktick = (source, start, end, lexicon) => {
   return false;
 };
 var unterminatedTextRunsToTheEnd = (reading) => reading.backslashMode === "literal";
+var visibleQuotedText = (content) => `${TOKEN_GAP}${content}${TOKEN_GAP}`;
 var quotedToken = (source, start, reading, inside) => {
   if (opensAUnicodeEscapedQuote(source, start)) return "uncertain";
   const syntax = syntaxOfQuoteAt(source, start, reading.lexicon);
@@ -1888,7 +1891,7 @@ var quotedToken = (source, start, reading, inside) => {
   }
   if (swallowsABacktick(source, start, end, reading.lexicon)) return "uncertain";
   const quote = source.charAt(start);
-  const text = syntax.content === "hidden" ? STRING_PLACEHOLDER : source.slice(start + opener.length, end - opener.length).replaceAll(quote + quote, quote);
+  const text = syntax.content === "hidden" ? STRING_PLACEHOLDER : visibleQuotedText(source.slice(start + opener.length, end - opener.length).replaceAll(quote + quote, quote));
   return { text, end, insideExecutableComment: inside };
 };
 var lineCommentEnd = (source, start, lexicon) => {
@@ -1951,9 +1954,16 @@ var clientCommandToken = (source, start, inside) => {
   const command = source.slice(start, start + CLIENT_COMMAND_LENGTH);
   return STATEMENT_TERMINATOR_CLIENT_COMMAND.test(command) ? { text: STATEMENT_SEPARATOR2, end: start + CLIENT_COMMAND_LENGTH, insideExecutableComment: inside } : "uncertain";
 };
+var squareBracketToken = (source, start, lexicon, inside) => {
+  if (lexicon.squareBrackets === "uncertain") return "uncertain";
+  if (lexicon.squareBrackets === "text") return { text: BRACKET_IDENTIFIER_OPEN, end: start + 1, insideExecutableComment: inside };
+  const closing = source.indexOf(BRACKET_IDENTIFIER_CLOSE, start + 1);
+  return closing === -1 ? "uncertain" : { text: visibleQuotedText(source.slice(start + 1, closing)), end: closing + 1, insideExecutableComment: inside };
+};
 var nextSqlToken = (source, start, reading, inside) => {
   const { lexicon } = reading;
   const character = source.charAt(start);
+  if (character === BRACKET_IDENTIFIER_OPEN) return squareBracketToken(source, start, lexicon, inside);
   if (isQuote(character)) return quotedToken(source, start, reading, inside);
   if (source.startsWith(DASH_DASH, start)) return dashDashToken(source, start, lexicon, inside);
   if (character === HASH) return hashToken(source, start, lexicon, inside);
@@ -1993,6 +2003,107 @@ var sqlOutsideLiterals = (source, lexicon) => {
   return { kind: "readable", texts: [...new Set(readings.map((reading) => reading.text))] };
 };
 
+// ../contracts/src/command-analysis/sql-clients.ts
+var STRING_WITH_DOUBLED_QUOTES = { backslashes: "uncertain-before-the-quote", content: "hidden" };
+var IDENTIFIER_WITH_DOUBLED_QUOTES = { backslashes: "uncertain-before-the-quote", content: "shown" };
+var MYSQL_STRING = { backslashes: "escape-unless-the-sql-mode-disables-it", content: "hidden" };
+var STRING_WITH_BACKSLASH_ESCAPES = { backslashes: "escape", content: "hidden" };
+var SHOWN_TEXT_WITH_BACKSLASH_ESCAPES = { backslashes: "escape", content: "shown" };
+var POSTGRES_LEXICON = {
+  squareBrackets: "text",
+  singleQuotes: STRING_WITH_DOUBLED_QUOTES,
+  doubleQuotes: IDENTIFIER_WITH_DOUBLED_QUOTES,
+  backticks: IDENTIFIER_WITH_DOUBLED_QUOTES,
+  tripleQuotes: "absent",
+  escapeStringPrefix: "backslash-escapes",
+  dollarQuotes: "string",
+  dashDash: "comment",
+  carriageReturnInLineComment: "ends-the-comment",
+  hash: "text",
+  executableComments: "uncertain",
+  nestedBlockComments: "nest",
+  backslashOutsideLiterals: "text",
+  clientCharsets: "may-be-multibyte"
+};
+var MYSQL_LEXICON = {
+  squareBrackets: "uncertain",
+  singleQuotes: MYSQL_STRING,
+  doubleQuotes: STRING_WITH_DOUBLED_QUOTES,
+  backticks: IDENTIFIER_WITH_DOUBLED_QUOTES,
+  tripleQuotes: "absent",
+  escapeStringPrefix: "absent",
+  dollarQuotes: "uncertain",
+  dashDash: "comment-before-whitespace",
+  carriageReturnInLineComment: "stays-in-the-comment",
+  hash: "comment",
+  executableComments: "executed",
+  nestedBlockComments: "uncertain",
+  backslashOutsideLiterals: "client-command",
+  clientCharsets: "may-be-multibyte"
+};
+var SQLITE_LEXICON = {
+  squareBrackets: "identifier",
+  singleQuotes: STRING_WITH_DOUBLED_QUOTES,
+  doubleQuotes: IDENTIFIER_WITH_DOUBLED_QUOTES,
+  backticks: IDENTIFIER_WITH_DOUBLED_QUOTES,
+  tripleQuotes: "absent",
+  escapeStringPrefix: "absent",
+  dollarQuotes: "uncertain",
+  dashDash: "comment",
+  carriageReturnInLineComment: "stays-in-the-comment",
+  hash: "text",
+  executableComments: "uncertain",
+  nestedBlockComments: "uncertain",
+  backslashOutsideLiterals: "text",
+  clientCharsets: "unicode"
+};
+var GOOGLE_SQL_LEXICON = {
+  squareBrackets: "text",
+  singleQuotes: STRING_WITH_BACKSLASH_ESCAPES,
+  doubleQuotes: SHOWN_TEXT_WITH_BACKSLASH_ESCAPES,
+  backticks: SHOWN_TEXT_WITH_BACKSLASH_ESCAPES,
+  tripleQuotes: "quote",
+  escapeStringPrefix: "absent",
+  dollarQuotes: "uncertain",
+  dashDash: "comment",
+  carriageReturnInLineComment: "uncertain",
+  hash: "comment",
+  executableComments: "uncertain",
+  nestedBlockComments: "uncertain",
+  backslashOutsideLiterals: "text",
+  clientCharsets: "unicode"
+};
+var UNVERIFIED_SQL_LEXICON = {
+  squareBrackets: "uncertain",
+  singleQuotes: STRING_WITH_DOUBLED_QUOTES,
+  doubleQuotes: IDENTIFIER_WITH_DOUBLED_QUOTES,
+  backticks: IDENTIFIER_WITH_DOUBLED_QUOTES,
+  tripleQuotes: "absent",
+  escapeStringPrefix: "absent",
+  dollarQuotes: "uncertain",
+  dashDash: "uncertain-before-text",
+  carriageReturnInLineComment: "uncertain",
+  hash: "uncertain",
+  executableComments: "uncertain",
+  nestedBlockComments: "uncertain",
+  backslashOutsideLiterals: "text",
+  clientCharsets: "may-be-multibyte"
+};
+var MYSQL_SYNTAX = { inlineFlags: /* @__PURE__ */ new Set(["-e", "--execute"]), scriptFlags: /* @__PURE__ */ new Set(), positionalSql: false, lexicon: MYSQL_LEXICON };
+var SQLITE_SYNTAX = { inlineFlags: /* @__PURE__ */ new Set(["-cmd"]), scriptFlags: /* @__PURE__ */ new Set(["-init"]), positionalSql: true, lexicon: SQLITE_LEXICON };
+var SQL_CLIENT_SYNTAX = /* @__PURE__ */ new Map([
+  ["psql", { inlineFlags: /* @__PURE__ */ new Set(["-c", "--command"]), scriptFlags: /* @__PURE__ */ new Set(["-f", "--file"]), positionalSql: false, lexicon: POSTGRES_LEXICON }],
+  ["mysql", MYSQL_SYNTAX],
+  ["mariadb", MYSQL_SYNTAX],
+  ["sqlite3", SQLITE_SYNTAX],
+  ["sqlite", SQLITE_SYNTAX],
+  ["duckdb", { inlineFlags: /* @__PURE__ */ new Set(["-c", "-s", "-cmd"]), scriptFlags: /* @__PURE__ */ new Set(["-f", "-init"]), positionalSql: true, lexicon: UNVERIFIED_SQL_LEXICON }],
+  ["clickhouse-client", { inlineFlags: /* @__PURE__ */ new Set(["-q", "--query"]), scriptFlags: /* @__PURE__ */ new Set(["--queries-file"]), positionalSql: false, lexicon: UNVERIFIED_SQL_LEXICON }],
+  ["bq", { inlineFlags: /* @__PURE__ */ new Set(), scriptFlags: /* @__PURE__ */ new Set(), positionalSql: true, lexicon: GOOGLE_SQL_LEXICON }],
+  ["mongosh", { inlineFlags: /* @__PURE__ */ new Set(["--eval"]), scriptFlags: /* @__PURE__ */ new Set(["-f", "--file"]), positionalSql: false, lexicon: UNVERIFIED_SQL_LEXICON }],
+  ["mongo", { inlineFlags: /* @__PURE__ */ new Set(["--eval"]), scriptFlags: /* @__PURE__ */ new Set(), positionalSql: false, lexicon: UNVERIFIED_SQL_LEXICON }]
+]);
+
 // ../contracts/src/command-analysis/env-invocation.ts
 var GNU_ENV = {
   shortOptions: { switches: /* @__PURE__ */ new Set(["i", "v", "0"]), withAValue: /* @__PURE__ */ new Set(["a", "C", "S", "u"]) },
@@ -3315,100 +3426,6 @@ var changesProduction = (invocation) => {
   const words = wordsOfInvocation(invocation);
   return words.some((word, index) => wordSelectsProduction(word, words[index - 1])) && (deployCliChangesSomething(words) || SCHEMA_CHANGE_WORD.test(normalizedInvocation(invocation)));
 };
-var STRING_WITH_DOUBLED_QUOTES = { backslashes: "uncertain-before-the-quote", content: "hidden" };
-var IDENTIFIER_WITH_DOUBLED_QUOTES = { backslashes: "uncertain-before-the-quote", content: "shown" };
-var MYSQL_STRING = { backslashes: "escape-unless-the-sql-mode-disables-it", content: "hidden" };
-var STRING_WITH_BACKSLASH_ESCAPES = { backslashes: "escape", content: "hidden" };
-var SHOWN_TEXT_WITH_BACKSLASH_ESCAPES = { backslashes: "escape", content: "shown" };
-var POSTGRES_LEXICON = {
-  singleQuotes: STRING_WITH_DOUBLED_QUOTES,
-  doubleQuotes: IDENTIFIER_WITH_DOUBLED_QUOTES,
-  backticks: IDENTIFIER_WITH_DOUBLED_QUOTES,
-  tripleQuotes: "absent",
-  escapeStringPrefix: "backslash-escapes",
-  dollarQuotes: "string",
-  dashDash: "comment",
-  carriageReturnInLineComment: "ends-the-comment",
-  hash: "text",
-  executableComments: "uncertain",
-  nestedBlockComments: "nest",
-  backslashOutsideLiterals: "text",
-  clientCharsets: "may-be-multibyte"
-};
-var MYSQL_LEXICON = {
-  singleQuotes: MYSQL_STRING,
-  doubleQuotes: STRING_WITH_DOUBLED_QUOTES,
-  backticks: IDENTIFIER_WITH_DOUBLED_QUOTES,
-  tripleQuotes: "absent",
-  escapeStringPrefix: "absent",
-  dollarQuotes: "uncertain",
-  dashDash: "comment-before-whitespace",
-  carriageReturnInLineComment: "stays-in-the-comment",
-  hash: "comment",
-  executableComments: "executed",
-  nestedBlockComments: "uncertain",
-  backslashOutsideLiterals: "client-command",
-  clientCharsets: "may-be-multibyte"
-};
-var SQLITE_LEXICON = {
-  singleQuotes: STRING_WITH_DOUBLED_QUOTES,
-  doubleQuotes: IDENTIFIER_WITH_DOUBLED_QUOTES,
-  backticks: IDENTIFIER_WITH_DOUBLED_QUOTES,
-  tripleQuotes: "absent",
-  escapeStringPrefix: "absent",
-  dollarQuotes: "uncertain",
-  dashDash: "comment",
-  carriageReturnInLineComment: "stays-in-the-comment",
-  hash: "text",
-  executableComments: "uncertain",
-  nestedBlockComments: "uncertain",
-  backslashOutsideLiterals: "text",
-  clientCharsets: "unicode"
-};
-var GOOGLE_SQL_LEXICON = {
-  singleQuotes: STRING_WITH_BACKSLASH_ESCAPES,
-  doubleQuotes: SHOWN_TEXT_WITH_BACKSLASH_ESCAPES,
-  backticks: SHOWN_TEXT_WITH_BACKSLASH_ESCAPES,
-  tripleQuotes: "quote",
-  escapeStringPrefix: "absent",
-  dollarQuotes: "uncertain",
-  dashDash: "comment",
-  carriageReturnInLineComment: "uncertain",
-  hash: "comment",
-  executableComments: "uncertain",
-  nestedBlockComments: "uncertain",
-  backslashOutsideLiterals: "text",
-  clientCharsets: "unicode"
-};
-var UNVERIFIED_SQL_LEXICON = {
-  singleQuotes: STRING_WITH_DOUBLED_QUOTES,
-  doubleQuotes: IDENTIFIER_WITH_DOUBLED_QUOTES,
-  backticks: IDENTIFIER_WITH_DOUBLED_QUOTES,
-  tripleQuotes: "absent",
-  escapeStringPrefix: "absent",
-  dollarQuotes: "uncertain",
-  dashDash: "uncertain-before-text",
-  carriageReturnInLineComment: "uncertain",
-  hash: "uncertain",
-  executableComments: "uncertain",
-  nestedBlockComments: "uncertain",
-  backslashOutsideLiterals: "text",
-  clientCharsets: "may-be-multibyte"
-};
-var MYSQL_SYNTAX = { inlineFlags: /* @__PURE__ */ new Set(["-e", "--execute"]), scriptFlags: /* @__PURE__ */ new Set(), positionalSql: false, lexicon: MYSQL_LEXICON };
-var SQLITE_SYNTAX = { inlineFlags: /* @__PURE__ */ new Set(["-cmd"]), scriptFlags: /* @__PURE__ */ new Set(["-init"]), positionalSql: true, lexicon: SQLITE_LEXICON };
-var SQL_CLIENT_SYNTAX = /* @__PURE__ */ new Map([
-  ["psql", { inlineFlags: /* @__PURE__ */ new Set(["-c", "--command"]), scriptFlags: /* @__PURE__ */ new Set(["-f", "--file"]), positionalSql: false, lexicon: POSTGRES_LEXICON }],
-  ["mysql", MYSQL_SYNTAX],
-  ["mariadb", MYSQL_SYNTAX],
-  ["sqlite3", SQLITE_SYNTAX],
-  ["sqlite", SQLITE_SYNTAX],
-  ["duckdb", { inlineFlags: /* @__PURE__ */ new Set(["-c", "-s", "-cmd"]), scriptFlags: /* @__PURE__ */ new Set(["-f", "-init"]), positionalSql: true, lexicon: UNVERIFIED_SQL_LEXICON }],
-  ["clickhouse-client", { inlineFlags: /* @__PURE__ */ new Set(["-q", "--query"]), scriptFlags: /* @__PURE__ */ new Set(["--queries-file"]), positionalSql: false, lexicon: UNVERIFIED_SQL_LEXICON }],
-  ["bq", { inlineFlags: /* @__PURE__ */ new Set(), scriptFlags: /* @__PURE__ */ new Set(), positionalSql: true, lexicon: GOOGLE_SQL_LEXICON }],
-  ["mongosh", { inlineFlags: /* @__PURE__ */ new Set(["--eval"]), scriptFlags: /* @__PURE__ */ new Set(["-f", "--file"]), positionalSql: false, lexicon: UNVERIFIED_SQL_LEXICON }],
-  ["mongo", { inlineFlags: /* @__PURE__ */ new Set(["--eval"]), scriptFlags: /* @__PURE__ */ new Set(), positionalSql: false, lexicon: UNVERIFIED_SQL_LEXICON }]
-]);
 var SQL_WRITE_STATEMENT = new RegExp([
   String.raw`\b(?:insert|update|delete|merge|upsert|alter|create|drop|truncate|grant|revoke|copy|vacuum|reindex|rename|attach|detach)\b`,
   String.raw`\breplace\s+into\b`,
@@ -3781,7 +3798,7 @@ var segmentWritesThroughARemoteApi = (segment, depth) => {
   const innermost = innermostInvocation(segment.invocation);
   return invocationWritesThroughARemoteApi(innermost) || commandsNestedIn(innermost, inlineScriptsOf(innermost, segment.heredocs)).some((nested) => commandWritesThroughARemoteApiAt(nested, depth + 1));
 };
-var commandWritesThroughARemoteApiAt = (command, depth) => depth <= MAX_SPELLING_DEPTH && spelledSegmentsOf(command).some((segment) => segmentWritesThroughARemoteApi(segment, depth));
+var commandWritesThroughARemoteApiAt = (command, depth) => depth > MAX_SPELLING_DEPTH || spelledSegmentsOf(command).some((segment) => segmentWritesThroughARemoteApi(segment, depth));
 var commandWritesThroughARemoteApi = (command) => commandWritesThroughARemoteApiAt(command, 0);
 var segmentNeedsAPerson = (toolName, segment) => {
   const invocation = invocationOf(segment);

package/dist/{chunk-N4LLBUU2.js → chunk-JH2TTKC4.js}

@@ -4,10 +4,10 @@ import {
   keyPrefix,
   readConfigFileKey,
   readMacAppKeyPrefix
-} from "./chunk-IKJJB4QG.js";
+} from "./chunk-H7F2IN22.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-2ROXUEZV.js";
+} from "./chunk-7OMOUQSU.js";
 
 // src/key-signed-out.ts
 var VERDICT_BY_CHECK = {

package/dist/{chunk-OSUAY4SA.js → chunk-K7NUD23S.js}

@@ -2,7 +2,7 @@ import {
   autoUpdateLock,
   installPackageGlobally,
   npmErrorMessage
-} from "./chunk-SRRJLA24.js";
+} from "./chunk-MKYICE44.js";
 import {
   writeJsonAtomic
 } from "./chunk-AQFEP65J.js";

package/dist/{chunk-KBRKQMCI.js → chunk-KTFZKXRE.js}

@@ -1,9 +1,9 @@
 import {
   configFilePath
-} from "./chunk-5EX2SD5N.js";
+} from "./chunk-Z73AKQYU.js";
 import {
   normalizeInstallSource
-} from "./chunk-TDLEFGAM.js";
+} from "./chunk-JD6HIO7N.js";
 
 // src/install-source.ts
 import { readFileSync } from "fs";

package/dist/{chunk-SJJA2GPD.js → chunk-L5WCPMWZ.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-POFBE6ZY.js";
 import {
   autoUpdateState
-} from "./chunk-SRRJLA24.js";
+} from "./chunk-MKYICE44.js";
 import {
   readJsonSafe,
   writeJsonAtomic
@@ -15,7 +15,7 @@ import {
   globalUpgradeEntry,
   isAutoUpdateResult,
   ownPackageRoot
-} from "./chunk-TDLEFGAM.js";
+} from "./chunk-JD6HIO7N.js";
 
 // src/auto-update.ts
 import { spawn } from "child_process";

package/dist/{chunk-464FX6W5.js → chunk-LA6Q2BJF.js}

@@ -5,18 +5,18 @@ import {
 import {
   SubscriptionRequiredError,
   callMcpTool
-} from "./chunk-FEICGRNI.js";
+} from "./chunk-UOVREWK3.js";
 import {
   installNetworkDefaults,
   isNetworkFailure
-} from "./chunk-4WGKAGIU.js";
+} from "./chunk-ALJEKG2D.js";
 import {
   clientReportClaims
-} from "./chunk-SRRJLA24.js";
+} from "./chunk-MKYICE44.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-5EX2SD5N.js";
+} from "./chunk-Z73AKQYU.js";
 import {
   ASK_AGENT_NAME_MAX,
   ASK_QUESTION_MAX,
@@ -25,7 +25,7 @@ import {
   GATE_PERMISSION_MODE_MAX_LENGTH,
   degradedLine,
   truncateLine
-} from "./chunk-TDLEFGAM.js";
+} from "./chunk-JD6HIO7N.js";
 
 // src/client-report-claim.ts
 import { createHash } from "crypto";

package/dist/{chunk-5F32ZTWD.js → chunk-LBD7QQ2V.js}

@@ -6,12 +6,12 @@ import {
   permissionDeniedAction,
   releaseThrottle,
   reportEvent
-} from "./chunk-X427XA76.js";
+} from "./chunk-BQQQ4NP5.js";
 import {
   machineDecisionFor,
   shouldDeferToNativeMode,
   wireVerdictFor
-} from "./chunk-TDLEFGAM.js";
+} from "./chunk-JD6HIO7N.js";
 
 // src/machine-decision-audit.ts
 import { basename } from "path";

package/dist/{chunk-SRRJLA24.js → chunk-MKYICE44.js}

@@ -13,7 +13,7 @@ import {
   isReleaseVersion,
   ownPackageName,
   withHookHoldBudget
-} from "./chunk-TDLEFGAM.js";
+} from "./chunk-JD6HIO7N.js";
 
 // src/setup/paths.ts
 import { homedir as homedir2 } from "os";
@@ -395,9 +395,9 @@ var installGlobally = (options) => {
   }
   const started = (async () => {
     if (!npmIsOnPath()) throw new NpmMissingError();
-    const { withUpgradeLock } = await import("./global-upgrade-YMBTZHDP.js");
-    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-TTZMLZPB.js");
-    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-BPFRUWMB.js");
+    const { withUpgradeLock } = await import("./global-upgrade-B6E7DWGC.js");
+    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-MLXS6NH2.js");
+    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-H4Q6OES7.js");
     let result = "skipped";
     const install = async () => {
       const platform = process.platform;

package/dist/{chunk-3EIJDBVB.js → chunk-NFABDPWT.js}

@@ -4,7 +4,7 @@ import {
   forkFinishWithUpgradeLock,
   installWithUpgradeLock,
   releaseAutoUpdateLock
-} from "./chunk-OSUAY4SA.js";
+} from "./chunk-K7NUD23S.js";
 import {
   describeAutoUpdateCheck,
   globalInstallLocation,
@@ -14,7 +14,7 @@ import {
   readAutoUpdateState,
   updateAutoUpdateState,
   upgradeEntryFor
-} from "./chunk-SJJA2GPD.js";
+} from "./chunk-L5WCPMWZ.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
@@ -27,10 +27,10 @@ import {
   npmErrorMessage,
   readGlobalCliInstallAt,
   readGlobalPrefix
-} from "./chunk-SRRJLA24.js";
+} from "./chunk-MKYICE44.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-2ROXUEZV.js";
+} from "./chunk-7OMOUQSU.js";
 import {
   commandsPackage,
   globalUpgradeEntry,
@@ -39,7 +39,7 @@ import {
   isSameMajorVersion,
   ownPackageRoot,
   packageVersionAt
-} from "./chunk-TDLEFGAM.js";
+} from "./chunk-JD6HIO7N.js";
 
 // src/global-upgrade.ts
 import { existsSync } from "fs";

package/dist/{chunk-AXANUGOV.js → chunk-NRM4QJKG.js}

@@ -10,10 +10,10 @@ import {
   resolvePackageVersionFromBinary,
   resolvePathBinary,
   resolvePathBinaryAsync
-} from "./chunk-SRRJLA24.js";
+} from "./chunk-MKYICE44.js";
 import {
   MANAGED_PROVIDERS
-} from "./chunk-TDLEFGAM.js";
+} from "./chunk-JD6HIO7N.js";
 
 // src/setup/codex-install.ts
 var NATIVE_BINARY_MIN_BYTES = 20 * 1024 * 1024;