pushary 1.9.46 → 1.9.47

package/dist/{chunk-EDSXF7NV.js → chunk-DY5PQSQB.js}

@@ -1043,6 +1043,23 @@ var shellWordsOf = (command) => {
   finishWord();
   return words;
 };
+var basenameOf = (token) => {
+  const slash = Math.max(token.lastIndexOf("/"), token.lastIndexOf("\\"));
+  return slash === -1 ? token : token.slice(slash + 1);
+};
+var TRUSTED_EXE_PREFIXES = [
+  "/bin/",
+  "/sbin/",
+  "/usr/bin/",
+  "/usr/sbin/",
+  "/usr/local/bin/",
+  "/opt/homebrew/bin/"
+];
+var isTrustedExecutable = (first) => {
+  if (!first.includes("/")) return true;
+  if (first.includes("..")) return false;
+  return TRUSTED_EXE_PREFIXES.some((prefix) => first.startsWith(prefix));
+};
 
 // ../contracts/src/powershell-analysis.ts
 var SINGLE_QUOTES = /* @__PURE__ */ new Set(["'", "\u2018", "\u2019", "\u201A", "\u201B"]);
@@ -2643,10 +2660,62 @@ var record = (value) => value !== null && typeof value === "object" && !Array.is
 var identifier = (value) => typeof value === "string" && value.length > 0 && value.length <= 200;
 var isQuestionOwner = (value) => record(value) && value.capability === PERSONAL_QUESTION_CAPABILITY && identifier(value.machineId) && identifier(value.generation) && identifier(value.threadId) && identifier(value.turnId) && identifier(value.itemId) && (identifier(value.requestId) || typeof value.requestId === "number" && Number.isSafeInteger(value.requestId)) && value.method === "item/tool/requestUserInput" && typeof value.subjectHash === "string" && /^[a-f0-9]{64}$/.test(value.subjectHash) && Object.keys(value).length === 9;
 
+// ../contracts/src/codex-shell-script.ts
+var CODEX_SHELL_COMMAND_FLAGS = ["-lc", "-c"];
+var SHELLS_CODEX_RUNS_A_SCRIPT_IN = ["sh", "bash", "zsh"];
+var WORDS_IN_A_SHELL_SCRIPT_COMMAND = 3;
+var WORD_SEPARATOR = " ";
+var ABSOLUTE_PATH_START = "/";
+var BARE_WORD_PART = /^[A-Za-z0-9_@+:./\]-]+/;
+var SINGLE_QUOTED_WORD_PART = /^'([^']*)'/;
+var DOUBLE_QUOTED_WORD_PART = /^"((?:[^"$`\\!]|\\["$`\\])*)"/;
+var ESCAPED_INSIDE_DOUBLE_QUOTES = /\\(["$`\\])/g;
+var leadingWordPart = (rest) => {
+  const bare = BARE_WORD_PART.exec(rest);
+  if (bare) return { text: bare[0], length: bare[0].length };
+  const single = SINGLE_QUOTED_WORD_PART.exec(rest);
+  if (single) return { text: single[1] ?? "", length: single[0].length };
+  const double = DOUBLE_QUOTED_WORD_PART.exec(rest);
+  return double ? { text: (double[1] ?? "").replace(ESCAPED_INSIDE_DOUBLE_QUOTES, "$1"), length: double[0].length } : null;
+};
+var leadingWord = (rest) => {
+  let text2 = "";
+  let length = 0;
+  for (let part = leadingWordPart(rest); part !== null; part = leadingWordPart(rest.slice(length))) {
+    text2 += part.text;
+    length += part.length;
+  }
+  return length === 0 ? null : { text: text2, length };
+};
+var wordsOfAJoinedCommand = (joined) => {
+  const words = [];
+  let rest = joined;
+  while (rest.length > 0) {
+    const word = leadingWord(rest);
+    if (word === null) return null;
+    words.push(word.text);
+    rest = rest.slice(word.length);
+    if (rest.length === 0) break;
+    if (!rest.startsWith(WORD_SEPARATOR) || rest.length === WORD_SEPARATOR.length) return null;
+    rest = rest.slice(WORD_SEPARATOR.length);
+  }
+  return words;
+};
+var isASystemShell = (program) => program.startsWith(ABSOLUTE_PATH_START) && isTrustedExecutable(program) && SHELLS_CODEX_RUNS_A_SCRIPT_IN.includes(basenameOf(program));
+var scriptACodexShellCommandRuns = (command) => {
+  const words = wordsOfAJoinedCommand(command);
+  if (words === null || words.length !== WORDS_IN_A_SHELL_SCRIPT_COMMAND) return null;
+  const [shell, flag, script] = words;
+  if (shell === void 0 || flag === void 0 || script === void 0) return null;
+  if (!isASystemShell(shell) || !CODEX_SHELL_COMMAND_FLAGS.includes(flag)) return null;
+  return script.trim().length === 0 ? null : script;
+};
+
 // ../contracts/src/codex-native-approval.ts
 var CODEX_NATIVE_APPROVAL_CAPABILITY = "codex-native-approval-v1";
 var CODEX_NATIVE_APPROVAL_METHODS = ["item/commandExecution/requestApproval", "item/fileChange/requestApproval", "mcpServer/elicitation/request"];
 var CODEX_NATIVE_APPROVAL_CHOICES = { once: "Allow once", session: "Allow this conversation", deny: "Deny" };
+var CODEX_NATIVE_APPROVAL_REPLIES = { ask: "ask", deny: "deny", native: "native", allow: "allow" };
 var record2 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 var identifier2 = (v) => typeof v === "string" && v.length > 0 && v.length <= 200;
 var text = (v) => typeof v === "string" && v.trim().length > 0 && v.length <= 16384;
@@ -2662,6 +2731,7 @@ var boundedJson = (value) => {
 };
 var BASE_KEYS = ["threadId", "turnId", "itemId", "startedAtMs", "reason"];
 var MCP_META_KEYS = ["codex_approval_kind", "codex_requires_user_input", "codex_request_type", "codex_strict_auto_review", "codex_sensitive_action", "approvals_reviewer", "persist", "source", "connector_id", "connector_name", "connector_description", "tool_name", "tool_title", "tool_description", "tool_params", "tool_params_display"];
+var MCP_FLAGS_THAT_ASK_FOR_A_PERSON = ["codex_requires_user_input", "codex_strict_auto_review", "codex_sensitive_action"];
 var COMPUTER_USE_META_KEYS = [...MCP_META_KEYS, "riskLevel", "subtitle", "tool_call_id"];
 var computerUseDisplay = (value) => Array.isArray(value) && value.length <= 16 && value.every((item) => record2(item) && keys(item, ["name", "display_name", "value"]) && text(item.name) && text(item.display_name) && text(item.value));
 var isExecpolicyAmendment = (value) => Array.isArray(value) && value.length > 0 && value.length <= 128 && value.every((token) => typeof token === "string" && token.length <= 16384);
@@ -2670,6 +2740,22 @@ var isCommandDecision = (value) => {
   if (!record2(value) || !keys(value, ["acceptWithExecpolicyAmendment"]) || !record2(value.acceptWithExecpolicyAmendment)) return false;
   return keys(value.acceptWithExecpolicyAmendment, ["execpolicy_amendment"]) && isExecpolicyAmendment(value.acceptWithExecpolicyAmendment.execpolicy_amendment);
 };
+var FILE_CHANGE_KINDS = ["add", "delete", "update"];
+var FILE_CHANGE_VERB = { add: "adding", delete: "deleting", update: "editing" };
+var FILE_CHANGE_LABEL = { add: "Add", delete: "Delete", update: "Edit" };
+var FILE_CHANGES_NAMED_IN_A_QUESTION = 3;
+var isFileChangeKind = (v) => FILE_CHANGE_KINDS.some((kind) => kind === v);
+var labelledFileChange = ({ kind, path }) => `${FILE_CHANGE_LABEL[kind]} ${path}`;
+var fileChangeQuestion = (changes) => {
+  const [only] = changes;
+  if (only && changes.length === 1) return `Allow ${FILE_CHANGE_VERB[only.kind]} ${only.path} once?`;
+  const named = changes.slice(0, FILE_CHANGES_NAMED_IN_A_QUESTION).map(labelledFileChange).join(", ");
+  const unnamed = changes.length - FILE_CHANGES_NAMED_IN_A_QUESTION;
+  return `Allow these ${changes.length} file changes once? ${named}${unnamed > 0 ? ` and ${unnamed} more` : ""}`;
+};
+var withCodexReason = (detail, reason) => text(reason) ? `${detail}
+
+Codex's reason: ${redactSecrets(reason)}` : detail;
 var parseCodexNativeApproval = (value) => {
   if (!record2(value) || !keys(value, ["method", "params", "changes"]) || !isMethod(value.method) || !record2(value.params) || !boundedJson(value)) return null;
   const p = value.params;
@@ -2681,7 +2767,8 @@ var parseCodexNativeApproval = (value) => {
     turnId: typeof p.turnId === "string" ? p.turnId : null,
     itemId: typeof p.itemId === "string" ? p.itemId : null,
     options: [CODEX_NATIVE_APPROVAL_CHOICES.once, CODEX_NATIVE_APPROVAL_CHOICES.deny],
-    negativeDecision: "decline"
+    negativeDecision: "decline",
+    codexAsksForAPerson: false
   };
   if (value.method === "mcpServer/elicitation/request") {
     const meta = p._meta;
@@ -2689,29 +2776,32 @@ var parseCodexNativeApproval = (value) => {
     if (value.changes !== void 0 || !keys(p, ["threadId", "turnId", "serverName", "mode", "message", "requestedSchema", "_meta"]) || !(p.mode === "form" || computerUse && (p.mode === "openai/form" || p.mode === "openaiForm")) || !identifier2(p.serverName) || !text(p.message) || p.message.length > 500 || !record2(p.requestedSchema) || !keys(p.requestedSchema, ["type", "properties", "required", "$schema"]) || p.requestedSchema.type !== "object" || !record2(p.requestedSchema.properties) || Object.keys(p.requestedSchema.properties).length !== 0 || p.requestedSchema.required != null && (!Array.isArray(p.requestedSchema.required) || p.requestedSchema.required.length !== 0)) return null;
     if (!record2(meta) || !keys(meta, computerUse ? COMPUTER_USE_META_KEYS : MCP_META_KEYS) || meta.codex_approval_kind !== "mcp_tool_call" || !identifier2(meta.tool_name) || !record2(meta.tool_params) || meta.tool_params_display != null && !(computerUse ? computerUseDisplay(meta.tool_params_display) : record2(meta.tool_params_display))) return null;
     if (computerUse && (meta.riskLevel !== "low" && meta.riskLevel !== "high" || meta.subtitle != null && !text(meta.subtitle) || !optionalIdentifier(meta.tool_call_id))) return null;
-    if (["codex_requires_user_input", "codex_strict_auto_review", "codex_sensitive_action"].some((key) => meta[key] != null && typeof meta[key] !== "boolean")) return null;
+    if (MCP_FLAGS_THAT_ASK_FOR_A_PERSON.some((key) => meta[key] != null && typeof meta[key] !== "boolean")) return null;
     if (meta.approvals_reviewer != null && meta.approvals_reviewer !== "user") return null;
     if (meta.codex_request_type != null && meta.codex_request_type !== "approval_request") return null;
     if (["source", "connector_id", "connector_name", "connector_description", "tool_title", "tool_description"].some((key) => meta[key] != null && !text(meta[key]))) return null;
     const persistence = meta.persist == null ? [] : typeof meta.persist === "string" ? [meta.persist] : meta.persist;
+    const codexAsksForAPerson = MCP_FLAGS_THAT_ASK_FOR_A_PERSON.some((key) => meta[key] === true);
     if (!Array.isArray(persistence) || persistence.some((v) => v !== "session" && v !== "always")) return null;
     if (computerUse) {
       if (!persistence.includes("session")) return null;
       return {
         ...base,
+        codexAsksForAPerson,
         toolName: `mcp__${p.serverName}__${meta.tool_name}`,
         toolInputs: [meta.tool_params],
         question: p.message,
-        detail: [`Risk: ${meta.riskLevel}`, meta.subtitle, JSON.stringify(meta.tool_params)].filter(Boolean).join("\n"),
+        detail: redactSecrets([`Risk: ${meta.riskLevel}`, meta.subtitle, JSON.stringify(meta.tool_params)].filter(Boolean).join("\n")),
         options: [CODEX_NATIVE_APPROVAL_CHOICES.session, CODEX_NATIVE_APPROVAL_CHOICES.deny]
       };
     }
     return {
       ...base,
+      codexAsksForAPerson,
       toolName: `mcp__${p.serverName}__${meta.tool_name}`,
       toolInputs: [meta.tool_params],
       question: p.message,
-      detail: JSON.stringify(meta.tool_params),
+      detail: redactSecrets(JSON.stringify(meta.tool_params)),
       options: persistence.includes("session") ? [CODEX_NATIVE_APPROVAL_CHOICES.once, CODEX_NATIVE_APPROVAL_CHOICES.session, CODEX_NATIVE_APPROVAL_CHOICES.deny] : base.options
     };
   }
@@ -2720,31 +2810,34 @@ var parseCodexNativeApproval = (value) => {
     if (value.changes !== void 0 || !keys(p, [...BASE_KEYS, "approvalId", "kind", "environmentId", "command", "cwd", "commandActions", "networkApprovalContext", "proposedExecpolicyAmendment", "proposedNetworkPolicyAmendments", "availableDecisions"]) || !optionalIdentifier(p.approvalId) || p.kind != null && p.kind !== "command" || p.environmentId != null && p.environmentId !== "local" || p.networkApprovalContext != null || p.proposedNetworkPolicyAmendments != null || p.proposedExecpolicyAmendment != null && !isExecpolicyAmendment(p.proposedExecpolicyAmendment) || !text(p.command) || !text(p.cwd)) return null;
     const decisions = p.availableDecisions ?? ["accept", "decline", "cancel"];
     if (!Array.isArray(decisions) || !decisions.includes("accept") || !decisions.some((v) => v === "decline" || v === "cancel") || !decisions.every(isCommandDecision)) return null;
+    const command = scriptACodexShellCommandRuns(p.command) ?? p.command;
     return {
       ...base,
       toolName: "Bash",
-      toolInputs: [{ command: p.command }],
+      toolInputs: [{ command }],
       cwd: p.cwd,
       question: "Allow this command once?",
-      detail: p.command,
+      detail: withCodexReason(`${redactSecrets(command)}
+
+Directory: ${redactSecrets(p.cwd)}`, p.reason),
       negativeDecision: decisions.includes("decline") ? "decline" : "cancel"
     };
   }
   if (!keys(p, [...BASE_KEYS, "grantRoot"]) || p.grantRoot != null || !Array.isArray(value.changes) || value.changes.length === 0 || value.changes.length > 32) return null;
-  const paths = [], diffs = [];
+  const changes = [];
   for (const change of value.changes) {
-    if (!record2(change) || !keys(change, ["path", "kind", "diff"]) || !text(change.path) || typeof change.diff !== "string" || !record2(change.kind) || !keys(change.kind, ["type", "move_path"]) || !["add", "delete", "update"].includes(String(change.kind.type)) || change.kind.move_path != null) return null;
-    paths.push(change.path);
-    diffs.push(`${change.path}
-${change.diff}`);
+    if (!record2(change) || !keys(change, ["path", "kind", "diff"]) || !text(change.path) || typeof change.diff !== "string" || !record2(change.kind) || !keys(change.kind, ["type", "move_path"]) || !isFileChangeKind(change.kind.type) || change.kind.move_path != null) return null;
+    changes.push({ kind: change.kind.type, path: change.path, diff: change.diff });
   }
+  const paths = changes.map((change) => change.path);
   return {
     ...base,
     toolName: "Edit",
     toolInputs: paths.map((file_path) => ({ file_path })),
     scopePaths: paths,
-    question: `Allow these ${paths.length} file changes once?`,
-    detail: diffs.join("\n\n")
+    question: fileChangeQuestion(changes),
+    detail: withCodexReason(changes.map((change) => `${redactSecrets(labelledFileChange(change))}
+${redactSecretsDeep(change.diff)}`).join("\n\n"), p.reason)
   };
 };
 var codexNativeApprovalResponse = (approval, answer) => {
@@ -3326,23 +3419,6 @@ var SAFE_FIND_TOKENS = /* @__PURE__ */ new Set([
   "-O"
 ]);
 var SAFE_REDIRECTION = /\s*(?:[0-9]*>&[0-9-]+|(?:[0-9]*|&)>>?\s*\/dev\/null)/g;
-var basenameOf = (token) => {
-  const slash = Math.max(token.lastIndexOf("/"), token.lastIndexOf("\\"));
-  return slash === -1 ? token : token.slice(slash + 1);
-};
-var TRUSTED_EXE_PREFIXES = [
-  "/bin/",
-  "/sbin/",
-  "/usr/bin/",
-  "/usr/sbin/",
-  "/usr/local/bin/",
-  "/opt/homebrew/bin/"
-];
-var isTrustedExecutable = (first) => {
-  if (!first.includes("/")) return true;
-  if (first.includes("..")) return false;
-  return TRUSTED_EXE_PREFIXES.some((prefix) => first.startsWith(prefix));
-};
 var isSafeSimpleCommand = (segment) => {
   const tokens = shellWordsOf(segment)?.map((word) => word.text);
   if (!tokens || tokens.length === 0) return false;
@@ -6283,8 +6359,11 @@ export {
   isAutoUpdateResult,
   PERSONAL_QUESTION_CAPABILITY,
   isQuestionOwner,
+  CODEX_SHELL_COMMAND_FLAGS,
   CODEX_NATIVE_APPROVAL_CAPABILITY,
   CODEX_NATIVE_APPROVAL_METHODS,
+  CODEX_NATIVE_APPROVAL_CHOICES,
+  CODEX_NATIVE_APPROVAL_REPLIES,
   parseCodexNativeApproval,
   codexNativeApprovalResponse,
   normalizeKeyScope,

package/dist/{chunk-EP4MD6TH.js → chunk-FDDZEYGM.js}

@@ -2,23 +2,23 @@ import {
   CLAUDE_HOOK_EVENTS,
   GEMINI_HOOK_EVENTS,
   hasGeminiHooks
-} from "./chunk-35TUEZ5E.js";
+} from "./chunk-PHKISQPB.js";
 import {
   AGENT_CHOICES
-} from "./chunk-NO3ADUD4.js";
+} from "./chunk-3KSN65VJ.js";
 import {
   BELL_HOOK_BINARY
-} from "./chunk-UCRG5QGN.js";
+} from "./chunk-DDS472RO.js";
 import {
   CODEX_HOOK_EVENTS,
   hasCodexHooks,
   holdBudgetOf
-} from "./chunk-EW52AGOV.js";
+} from "./chunk-MCL5IS6A.js";
 import {
   CURSOR_GATE_EVENTS,
   HOOK_LOCATOR_BINARY,
   hookCommandHoldBudget
-} from "./chunk-EDSXF7NV.js";
+} from "./chunk-DY5PQSQB.js";
 
 // src/diagnostics/bridge.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-UP2RNIHL.js → chunk-FWQ2O5BI.js}

@@ -1,18 +1,18 @@
 import {
   macAppBridgeAvailable
-} from "./chunk-VTF7LKDB.js";
+} from "./chunk-3F3JHJPS.js";
 import {
   keyPrefix
-} from "./chunk-LA4S2KIM.js";
+} from "./chunk-S3657KK2.js";
 import {
   bridgeAgentKey
-} from "./chunk-EW52AGOV.js";
+} from "./chunk-MCL5IS6A.js";
 import {
   readJsonSafe
 } from "./chunk-AQFEP65J.js";
 import {
   isValidApiKey
-} from "./chunk-EDSXF7NV.js";
+} from "./chunk-DY5PQSQB.js";
 
 // src/shared-mcp-key.ts
 var asRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;

package/dist/{chunk-KJNWVAS6.js → chunk-FY6ZTTDQ.js}

@@ -1,16 +1,16 @@
 import {
   readExistingMachineId
-} from "./chunk-ULEX43F7.js";
+} from "./chunk-VQZ4FP6Z.js";
 import {
   NetworkError
 } from "./chunk-7QLSKOSU.js";
 import {
   getBaseUrl
-} from "./chunk-7XSIUY5F.js";
+} from "./chunk-PRQMACC7.js";
 import {
   clientContextHeaders,
   getPackageVersion
-} from "./chunk-EDSXF7NV.js";
+} from "./chunk-DY5PQSQB.js";
 
 // src/cli/net.ts
 import { createRequire } from "module";

package/dist/{chunk-UGXRDY3O.js → chunk-GLVPA4EK.js}

@@ -5,18 +5,18 @@ import {
 import {
   SubscriptionRequiredError,
   callMcpTool
-} from "./chunk-FQW7AV6U.js";
+} from "./chunk-6VFP72GX.js";
 import {
   installNetworkDefaults,
   isNetworkFailure
-} from "./chunk-KJNWVAS6.js";
+} from "./chunk-FY6ZTTDQ.js";
 import {
   clientReportClaims
-} from "./chunk-EW52AGOV.js";
+} from "./chunk-MCL5IS6A.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-7XSIUY5F.js";
+} from "./chunk-PRQMACC7.js";
 import {
   ASK_AGENT_NAME_MAX,
   CLIENT_REPORT_PATH,
@@ -26,7 +26,7 @@ import {
   localRepoKey,
   normalizeRepoRemote,
   truncateLine
-} from "./chunk-EDSXF7NV.js";
+} from "./chunk-DY5PQSQB.js";
 
 // src/client-report-claim.ts
 import { createHash } from "crypto";

package/dist/{chunk-MBB4XJIN.js → chunk-GOTCSFLS.js}

@@ -1,6 +1,6 @@
 import {
   ensureCodexTrustsPusharyHooks
-} from "./chunk-2ZD53EQW.js";
+} from "./chunk-TSI25WVW.js";
 import {
   OPENCODE_HOOK_BINARY,
   agentHookOwner,
@@ -9,7 +9,7 @@ import {
   openCodeHookArgv,
   openCodePluginDir,
   openCodeWired
-} from "./chunk-VTF7LKDB.js";
+} from "./chunk-3F3JHJPS.js";
 import {
   addClaudeMcpServer,
   addCompatibleHooks,
@@ -17,7 +17,7 @@ import {
   addPusharyToolPermissions,
   compatibleConfigFile,
   hasCompatibleHooks
-} from "./chunk-OI6YNNI5.js";
+} from "./chunk-TP5SLM2I.js";
 import {
   claudeUnprovenHolds,
   claudeWired,
@@ -25,7 +25,7 @@ import {
   codexWired,
   geminiWired,
   planHooks
-} from "./chunk-EP4MD6TH.js";
+} from "./chunk-FDDZEYGM.js";
 import {
   CLAUDE_HOOK_BINARY,
   CLAUDE_HOOK_EVENTS,
@@ -36,7 +36,7 @@ import {
   needsReregistration,
   registrationSignatures,
   supportedClaudeEvents
-} from "./chunk-35TUEZ5E.js";
+} from "./chunk-PHKISQPB.js";
 import {
   detectClaudeVersion
 } from "./chunk-RIVNNBEK.js";
@@ -63,7 +63,7 @@ import {
   resolveGlobalBinDir,
   resolveGlobalBinary,
   vscodePluginMcp
-} from "./chunk-EW52AGOV.js";
+} from "./chunk-MCL5IS6A.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -73,7 +73,7 @@ import {
   HOOK_COMPATIBLE_PROFILES,
   isCompatibleAgentType,
   isRecord
-} from "./chunk-EDSXF7NV.js";
+} from "./chunk-DY5PQSQB.js";
 
 // src/reapply.ts
 import { dirname, join } from "path";

package/dist/{chunk-NULG2ZUG.js → chunk-J3CYUXGX.js}

@@ -14,19 +14,19 @@ import {
 } from "./chunk-FO3MDD26.js";
 import {
   reportedInstallSource
-} from "./chunk-W7MXYDGP.js";
+} from "./chunk-ADKWE35P.js";
 import {
   callMcpTool
-} from "./chunk-FQW7AV6U.js";
+} from "./chunk-6VFP72GX.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-WN3MDHAM.js";
+} from "./chunk-VE4LQ23C.js";
 import {
   NO_PAIRING_COMPUTER,
   PAIR_TTL_SECONDS,
   classifyConfirmResponse,
   isAnswerSource
-} from "./chunk-EDSXF7NV.js";
+} from "./chunk-DY5PQSQB.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {

package/dist/{chunk-JPGY5LSF.js → chunk-K2KGB7TK.js}

@@ -1,9 +1,9 @@
 import {
   APPROVAL_SETTINGS_PATH
-} from "./chunk-HX34VBPE.js";
+} from "./chunk-X6ILS4XE.js";
 import {
   readMacAppAgentKey
-} from "./chunk-UP2RNIHL.js";
+} from "./chunk-FWQ2O5BI.js";
 import {
   findExportedKeyLines,
   isAdoptedMacAppKey,
@@ -13,13 +13,13 @@ import {
   readConfigFileKey,
   readKeySource,
   readMacAppKeyPrefix
-} from "./chunk-LA4S2KIM.js";
+} from "./chunk-S3657KK2.js";
 import {
   absoluteUrl
-} from "./chunk-2X3PPRNC.js";
+} from "./chunk-KQDHOQRG.js";
 import {
   isValidApiKey
-} from "./chunk-EDSXF7NV.js";
+} from "./chunk-DY5PQSQB.js";
 
 // src/key-revocation.ts
 var SELF_REVOKE_PATH = "/api/v1/server/keys/self/revoke";

package/dist/{chunk-5NXD6ZHQ.js → chunk-K2YVKKYV.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-EW52AGOV.js";
+} from "./chunk-MCL5IS6A.js";
 import {
   readJsonSafe,
   writeFileAtomic
@@ -13,7 +13,7 @@ import {
   serializeDeclinedAgents,
   withDeclinedAgent,
   withoutDeclinedAgent
-} from "./chunk-EDSXF7NV.js";
+} from "./chunk-DY5PQSQB.js";
 
 // src/declined-agents-file.ts
 import { join } from "path";

package/dist/{chunk-2X3PPRNC.js → chunk-KQDHOQRG.js}

@@ -1,6 +1,6 @@
 import {
   pusharyFetch
-} from "./chunk-KJNWVAS6.js";
+} from "./chunk-FY6ZTTDQ.js";
 import {
   NetworkError
 } from "./chunk-7QLSKOSU.js";
@@ -9,11 +9,11 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   getBaseUrl
-} from "./chunk-7XSIUY5F.js";
+} from "./chunk-PRQMACC7.js";
 import {
   isValidApiKey,
   normalizeKeyScope
-} from "./chunk-EDSXF7NV.js";
+} from "./chunk-DY5PQSQB.js";
 
 // src/session.ts
 var samePusharyAccount = (left, right) => left.kind === "ok" && right.kind === "ok" && left.identity.workspaceId !== "" && left.identity.workspaceId === right.identity.workspaceId && left.identity.siteId === right.identity.siteId;

package/dist/{chunk-PZPYL65I.js → chunk-LFMC5AE2.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-EDSXF7NV.js";
+} from "./chunk-DY5PQSQB.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-P2FHZ65U.js → chunk-LQRPQXAG.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-3EGEA4KH.js";
 import {
   getBaseUrl
-} from "./chunk-7XSIUY5F.js";
+} from "./chunk-PRQMACC7.js";
 
 // src/cli/login-ui.ts
 import { hostname } from "os";

package/dist/{chunk-2PTJHEX4.js → chunk-M47U54AO.js}

@@ -10,10 +10,10 @@ import {
   resolvePackageVersionFromBinary,
   resolvePathBinary,
   resolvePathBinaryAsync
-} from "./chunk-EW52AGOV.js";
+} from "./chunk-MCL5IS6A.js";
 import {
   MANAGED_PROVIDERS
-} from "./chunk-EDSXF7NV.js";
+} from "./chunk-DY5PQSQB.js";
 
 // src/setup/codex-install.ts
 var NATIVE_BINARY_MIN_BYTES = 20 * 1024 * 1024;

package/dist/{chunk-EW52AGOV.js → chunk-MCL5IS6A.js}

@@ -14,7 +14,7 @@ import {
   isReleaseVersion,
   ownPackageName,
   withHookHoldBudget
-} from "./chunk-EDSXF7NV.js";
+} from "./chunk-DY5PQSQB.js";
 
 // src/setup/paths.ts
 import { homedir as homedir2 } from "os";
@@ -402,9 +402,9 @@ var installGlobally = (options) => {
   }
   const started = (async () => {
     if (!npmIsOnPath()) throw new NpmMissingError();
-    const { withUpgradeLock } = await import("./global-upgrade-A7EADTOL.js");
-    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-YUSXU5I5.js");
-    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-UIPHTZH4.js");
+    const { withUpgradeLock } = await import("./global-upgrade-KHP36X27.js");
+    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-RF3LR2HC.js");
+    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-63XAPFWJ.js");
     let result = "skipped";
     const install = async () => {
       const platform = process.platform;

package/dist/{chunk-2IFTZZ5K.js → chunk-MM472M4O.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_HOLD_BUDGET_ENV,
   hookHoldBudgetProof
-} from "./chunk-EDSXF7NV.js";
+} from "./chunk-DY5PQSQB.js";
 
 // src/hold-budget.ts
 var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {

package/dist/{chunk-CJKEU4EZ.js → chunk-MZQ5M6F6.js}

@@ -1,18 +1,18 @@
 import {
   registerTranscript
-} from "./chunk-I5EQ5NJD.js";
+} from "./chunk-CVCOZWSB.js";
 import {
   namedEvent
-} from "./chunk-OI6YNNI5.js";
+} from "./chunk-TP5SLM2I.js";
 import {
   writeDegraded
-} from "./chunk-UGXRDY3O.js";
+} from "./chunk-GLVPA4EK.js";
 import {
   claudeShapedHookInput,
   hookCompatibleProfileBySource,
   isGrokHookPayload,
   isGrokSessionEndStop
-} from "./chunk-EDSXF7NV.js";
+} from "./chunk-DY5PQSQB.js";
 
 // src/tool-hook-input.ts
 var OPTIONAL_TEXT_FIELDS = ["hook_event_name", "session_id", "cwd", "transcript_path", "tool_use_id", "permission_mode"];

package/dist/{chunk-LEMQA4HM.js → chunk-N6JNKOKJ.js}

@@ -1,14 +1,14 @@
 import {
   MCP_BRIDGE_BINARY
-} from "./chunk-XAMFOUXA.js";
+} from "./chunk-UFTPB3LZ.js";
 import {
   KEY_FILE_MODE
-} from "./chunk-LA4S2KIM.js";
+} from "./chunk-S3657KK2.js";
 import {
   NpmInstallError,
   NpmMissingError,
   NpmPermissionError
-} from "./chunk-EW52AGOV.js";
+} from "./chunk-MCL5IS6A.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -16,10 +16,10 @@ import {
 } from "./chunk-AQFEP65J.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-WN3MDHAM.js";
+} from "./chunk-VE4LQ23C.js";
 import {
   readSetupAgentFailures
-} from "./chunk-EDSXF7NV.js";
+} from "./chunk-DY5PQSQB.js";
 
 // src/instruction-file.ts
 import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from "fs";

package/dist/{chunk-T623UG5T.js → chunk-OL7QCMQK.js}

@@ -1,6 +1,6 @@
 import {
   SETUP_FLAGS
-} from "./chunk-NO3ADUD4.js";
+} from "./chunk-3KSN65VJ.js";
 import {
   parseFlags
 } from "./chunk-GMXKITVA.js";
@@ -9,7 +9,7 @@ import {
 } from "./chunk-7QLSKOSU.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-WN3MDHAM.js";
+} from "./chunk-VE4LQ23C.js";
 import {
   CLAUDE_CONNECTOR_GUIDE,
   CLAUDE_CONNECTOR_STEPS,
@@ -17,7 +17,7 @@ import {
   CLAUDE_CONNECTOR_URL,
   COWORK_CONNECTOR_LIMIT,
   COWORK_STANDING_INSTRUCTIONS
-} from "./chunk-EDSXF7NV.js";
+} from "./chunk-DY5PQSQB.js";
 
 // src/cli/cowork.ts
 import { readFileSync } from "fs";