pushary 1.9.5 → 1.9.7

package/dist/{chunk-UM7DXK6V.js → chunk-D6S5EKXA.js}

@@ -1,23 +1,23 @@
 import {
   clientErrorKindOf,
   reportClientError
-} from "./chunk-CPMVKL6H.js";
+} from "./chunk-AVNKVF7N.js";
 import {
   SubscriptionRequiredError,
   callMcpTool
-} from "./chunk-CV2IAVD5.js";
+} from "./chunk-L76HTPU6.js";
 import {
   installNetworkDefaults
-} from "./chunk-ELQAQZNO.js";
+} from "./chunk-JXISQ7DT.js";
 import {
   getBaseUrl
-} from "./chunk-2DSUVY6R.js";
+} from "./chunk-Z6HPS67T.js";
 import {
   ASK_AGENT_NAME_MAX,
   ASK_QUESTION_MAX,
   DECISION_LINE_MAX,
   truncateLine
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/api.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-2JOP4D2G.js → chunk-EB4XGVBG.js}

@@ -1,10 +1,10 @@
 import {
   pusharyHookExecutable
-} from "./chunk-RKEVFUBN.js";
+} from "./chunk-4YO4T5FV.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-ZBF5WAP7.js";
+} from "./chunk-ZUTU43FT.js";
 
 // src/skills-cli.ts
 import { execSync } from "child_process";

package/dist/{chunk-4LVFBQJ3.js → chunk-GKI6LFAV.js}

@@ -3,11 +3,11 @@ import {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-IX5EFNCI.js";
+} from "./chunk-AUUXS44H.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-7AV2KBZC.js";
+} from "./chunk-4FK6RZVJ.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;

package/dist/{chunk-NUYECJ57.js → chunk-H37L7TT3.js}

@@ -1,6 +1,6 @@
 import {
   readConfigFileKey
-} from "./chunk-5DU7LJ7L.js";
+} from "./chunk-ADSQDYYG.js";
 
 // src/bell/fleet.ts
 import { closeSync, constants, futimesSync, lstatSync, mkdirSync, openSync, readdirSync, unlinkSync } from "fs";

package/dist/{chunk-FNOY2K4N.js → chunk-H7MMU64M.js}

@@ -8,10 +8,10 @@ import {
   codexHooksJsonIn,
   isPusharyCodexCommand,
   resolvePathBinary
-} from "./chunk-ZBF5WAP7.js";
+} from "./chunk-ZUTU43FT.js";
 import {
   getPackageVersion
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/codex-app-server.ts
 import { existsSync, realpathSync } from "fs";
@@ -327,6 +327,7 @@ var readCodexTrustForPusharyHooks = async (options = {}) => {
 };
 
 export {
+  CODEX_HOOK_STATUS,
   assessCodexHookTrust,
   ensureCodexTrustsPusharyHooks,
   readCodexTrustForPusharyHooks

package/dist/{chunk-XXBOA4ZL.js → chunk-HPRZJKRO.js}

@@ -1,6 +1,6 @@
 import {
   readTranscriptPreference
-} from "./chunk-5DU7LJ7L.js";
+} from "./chunk-ADSQDYYG.js";
 
 // src/transcript-setting.ts
 var transcriptEnvironmentPreference = () => {

package/dist/{chunk-NI2BRIHL.js → chunk-JCWZ23MJ.js}

@@ -5,16 +5,16 @@ import {
 import {
   NOTIFICATION_MATCHED_TYPES,
   POSTTOOLUSE_MIRRORED_TOOLS
-} from "./chunk-KSJCYP4I.js";
+} from "./chunk-6DJTDHBI.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-ZBF5WAP7.js";
+} from "./chunk-ZUTU43FT.js";
 import {
   CLAUDE_PRETOOLUSE_MATCHER,
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/gemini-config.ts
 var GEMINI_HOOK_BINARY = "pushary-gemini-hook";

package/dist/chunk-JWKBDSPF.js

@@ -0,0 +1,69 @@
+import {
+  CODEX_HOOK_STATUS
+} from "./chunk-H7MMU64M.js";
+import {
+  NPX_LATEST_COMMAND
+} from "./chunk-STQRUH3S.js";
+
+// src/setup/codex-trust.ts
+var CODEX_TRUST_TELEMETRY = {
+  verified: "verified",
+  refused: "manual",
+  unlisted: "manual",
+  skipped: "unverified",
+  unavailable: "unverified"
+};
+var isUnanswered = (confirmation) => confirmation.kind === "skipped" || confirmation.kind === "unavailable";
+var codexTrustOutcome = (confirmation, portedTrustWritten) => isUnanswered(confirmation) && !portedTrustWritten ? "manual" : CODEX_TRUST_TELEMETRY[confirmation.kind];
+var CODEX_TRUST_REFUSED = "Codex did not accept the trust Pushary asked for, so its hooks are not trusted yet. Open Codex, run /hooks, and choose Trust for the Pushary hooks.";
+var CODEX_HOOK_REMEDY = {
+  asynchronous: "re-run setup to restore blocking permission hooks",
+  missing: "re-run setup to register the permission hooks",
+  disabled: "type /hooks in Codex to enable the permission hooks",
+  untrusted: "type /hooks in Codex and trust them, once"
+};
+var CODEX_HOOK_REPAIRS = [
+  ["asynchronous", CODEX_HOOK_STATUS.asynchronous],
+  ["missing", CODEX_HOOK_STATUS.notListed],
+  ["disabled", CODEX_HOOK_STATUS.disabled]
+];
+var eventsReporting = (readings, status) => readings.filter((reading) => reading.status === status).map((reading) => reading.event);
+var codexHookRemedy = (readings) => {
+  for (const [kind, status] of CODEX_HOOK_REPAIRS) {
+    const events = eventsReporting(readings, status);
+    if (events.length > 0) return { kind, events };
+  }
+  return { kind: "trust" };
+};
+var needsCodexTrustStep = (confirmation) => confirmation.kind !== "refused" || codexHookRemedy(confirmation.hooks).kind === "trust";
+var describeCodexHookRepair = (kind, events) => `Codex reports the Pushary hooks ${kind} (${events.join(", ")}). To fix it, ${CODEX_HOOK_REMEDY[kind]}.`;
+var describeRefusedCodexTrust = (readings, writeError) => {
+  const remedy = codexHookRemedy(readings);
+  if (remedy.kind !== "trust") return describeCodexHookRepair(remedy.kind, remedy.events);
+  return writeError ? `${CODEX_TRUST_REFUSED} Codex said: ${writeError}` : CODEX_TRUST_REFUSED;
+};
+var describeUnlistedCodexHooks = (warnings) => {
+  const said = warnings[0] ? ` Codex said: ${warnings[0]}` : "";
+  return `Codex does not list the Pushary hooks, so it will not run them.${said} Run ${NPX_LATEST_COMMAND} doctor for details.`;
+};
+var describeCodexTrustConfirmation = (confirmation) => {
+  switch (confirmation.kind) {
+    case "verified":
+      return confirmation.wrote ? "Codex trusted the Pushary hooks when asked, and confirmed it." : "Codex confirms the Pushary hooks are trusted.";
+    case "refused":
+      return describeRefusedCodexTrust(confirmation.hooks, confirmation.writeError);
+    case "unlisted":
+      return describeUnlistedCodexHooks(confirmation.warnings);
+    case "skipped":
+      return `Pushary did not ask Codex to confirm the trust: ${confirmation.reason}.`;
+    case "unavailable":
+      return `Codex could not be asked to confirm the Pushary hooks are trusted (${confirmation.reason}).`;
+  }
+};
+
+export {
+  codexTrustOutcome,
+  CODEX_HOOK_REMEDY,
+  needsCodexTrustStep,
+  describeCodexTrustConfirmation
+};

package/dist/{chunk-XEZWDDR5.js → chunk-JWQZSYCK.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-ZBF5WAP7.js";
+} from "./chunk-ZUTU43FT.js";
 import {
   readJsonSafe
 } from "./chunk-T7E75EKA.js";

package/dist/{chunk-ELQAQZNO.js → chunk-JXISQ7DT.js}

@@ -1,16 +1,16 @@
 import {
   readExistingMachineId
-} from "./chunk-K2J6OGGN.js";
+} from "./chunk-KYO45G5L.js";
 import {
   NetworkError
 } from "./chunk-7QLSKOSU.js";
 import {
   getBaseUrl
-} from "./chunk-2DSUVY6R.js";
+} from "./chunk-Z6HPS67T.js";
 import {
   clientContextHeaders,
   getPackageVersion
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/cli/net.ts
 import { createRequire } from "module";

package/dist/{chunk-L5XJZKF2.js → chunk-KFKL3FHS.js}

@@ -1,6 +1,6 @@
 import {
   pusharyFetch
-} from "./chunk-ELQAQZNO.js";
+} from "./chunk-JXISQ7DT.js";
 import {
   NetworkError
 } from "./chunk-7QLSKOSU.js";
@@ -9,11 +9,11 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   getBaseUrl
-} from "./chunk-2DSUVY6R.js";
+} from "./chunk-Z6HPS67T.js";
 import {
   isValidApiKey,
   normalizeKeyScope
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/session.ts
 var samePusharyAccount = (left, right) => left.kind === "ok" && right.kind === "ok" && left.identity.workspaceId !== "" && left.identity.workspaceId === right.identity.workspaceId && left.identity.siteId === right.identity.siteId;

package/dist/{chunk-QEY4SCXT.js → chunk-KT5E2RLS.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_HOLD_BUDGET_ENV,
   hookHoldBudgetProof
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/hold-budget.ts
 var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {

package/dist/{chunk-K2J6OGGN.js → chunk-KYO45G5L.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-ZBF5WAP7.js";
+} from "./chunk-ZUTU43FT.js";
 import {
   writeFileAtomic
 } from "./chunk-T7E75EKA.js";

package/dist/{chunk-CV2IAVD5.js → chunk-L76HTPU6.js}

@@ -1,12 +1,12 @@
 import {
   keyCheckFromResponse
-} from "./chunk-L5XJZKF2.js";
+} from "./chunk-KFKL3FHS.js";
 import {
   installNetworkDefaults
-} from "./chunk-ELQAQZNO.js";
+} from "./chunk-JXISQ7DT.js";
 import {
   getBaseUrl
-} from "./chunk-2DSUVY6R.js";
+} from "./chunk-Z6HPS67T.js";
 
 // src/retry.ts
 var isRetryable = (err) => {

package/dist/{chunk-GBKM4ULB.js → chunk-MBK7N46B.js}

@@ -3,27 +3,27 @@ import {
   expectedLaunchCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "./chunk-6OUATBSK.js";
+} from "./chunk-T7Y5EADL.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   hasDaemonServiceDefinition,
   readDaemonNeedsLogin,
   readDaemonStatus
-} from "./chunk-KTIY7ZIA.js";
+} from "./chunk-VXRXFU6Q.js";
 import {
   readControlMode,
   readKeySource
-} from "./chunk-5DU7LJ7L.js";
+} from "./chunk-ADSQDYYG.js";
 import {
   getMachineId
-} from "./chunk-K2J6OGGN.js";
+} from "./chunk-KYO45G5L.js";
 import {
   getBaseUrl
-} from "./chunk-2DSUVY6R.js";
+} from "./chunk-Z6HPS67T.js";
 import {
   getPackageVersion
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/machines.ts
 import { hostname } from "os";

package/dist/{chunk-5T65DZBH.js → chunk-MNWRUGMH.js}

@@ -1,6 +1,6 @@
 import {
   HOOK_LOCATOR_BINARY
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/diagnostics/bridge.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-NH63BTRO.js → chunk-MZPXVH4A.js}

@@ -3,28 +3,28 @@ import {
   addPusharyToolPermissions,
   isPusharyHook,
   removeClaudeMcpServers
-} from "./chunk-V3TD72QA.js";
+} from "./chunk-ANEAA37E.js";
 import {
   CLAUDE_HOOK_EVENTS,
   addGeminiMcpServer,
   removeGeminiMcpServer
-} from "./chunk-NI2BRIHL.js";
+} from "./chunk-JCWZ23MJ.js";
 import {
   CLAUDE_CODE_AGENT,
   parseApplyPatchFiles
-} from "./chunk-JSVBVV2Q.js";
+} from "./chunk-QFEM7R6T.js";
 import {
   guardBinary,
   holdBudgetOf,
   registerHookEntry
-} from "./chunk-ZBF5WAP7.js";
+} from "./chunk-ZUTU43FT.js";
 import {
   PHONE_ANSWERED_TOOLS,
   hookCompatibleProfile,
   hookCompatibleProfileBySource,
   toToolLookup,
   withHookHoldBudget
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/compatible-config.ts
 import { homedir } from "os";

package/dist/{chunk-EYKHHCLA.js → chunk-N4EUSDKX.js}

@@ -14,19 +14,19 @@ import {
 } from "./chunk-U4TMAANR.js";
 import {
   callMcpTool
-} from "./chunk-CV2IAVD5.js";
+} from "./chunk-L76HTPU6.js";
 import {
   reportedInstallSource
-} from "./chunk-FQKFONAS.js";
+} from "./chunk-4D2AYNSE.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-HOTK2D2S.js";
+} from "./chunk-STQRUH3S.js";
 import {
   NO_PAIRING_COMPUTER,
   PAIR_TTL_SECONDS,
   classifyConfirmResponse,
   isAnswerSource
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {

package/dist/{chunk-G3W5GP6O.js → chunk-NIBFSARF.js}

@@ -1,11 +1,18 @@
 import {
   ensureCodexTrustsPusharyHooks
-} from "./chunk-FNOY2K4N.js";
+} from "./chunk-H7MMU64M.js";
+import {
+  OPENCODE_HOOK_BINARY,
+  installOpenCodePlugin,
+  openCodeHookArgv,
+  openCodePluginDir,
+  openCodeWired
+} from "./chunk-X5NXPCIC.js";
 import {
   addClaudeMcpServer,
   addPusharyHooks,
   addPusharyToolPermissions
-} from "./chunk-V3TD72QA.js";
+} from "./chunk-ANEAA37E.js";
 import {
   detectClaudeVersion
 } from "./chunk-RIVNNBEK.js";
@@ -15,7 +22,7 @@ import {
   codexUnprovenHolds,
   codexWired,
   geminiWired
-} from "./chunk-RKEVFUBN.js";
+} from "./chunk-4YO4T5FV.js";
 import {
   CLAUDE_HOOK_BINARY,
   CLAUDE_HOOK_EVENTS,
@@ -26,7 +33,7 @@ import {
   needsReregistration,
   registrationSignatures,
   supportedClaudeEvents
-} from "./chunk-NI2BRIHL.js";
+} from "./chunk-JCWZ23MJ.js";
 import {
   formatVersion
 } from "./chunk-6ICPEJY5.js";
@@ -49,7 +56,7 @@ import {
   registrationHolderOf,
   resolveGlobalBinary,
   vscodePluginMcp
-} from "./chunk-ZBF5WAP7.js";
+} from "./chunk-ZUTU43FT.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -305,13 +312,24 @@ var reapplyCursorPlugin = (apiKey, paths = {}) => reapplyPluginMcp(
   apiKey
 );
 var reapplyVsCodePlugin = (apiKey, paths = {}) => reapplyPluginMcp(paths.pluginMcpPath ?? vscodePluginMcp(), apiKey);
+var reapplyOpenCodePlugin = (paths = {}) => {
+  const pluginDir = paths.pluginDir ?? openCodePluginDir();
+  if (!openCodeWired(pluginDir)) return { configured: false, reapplied: false, hooks: false, mcp: false };
+  try {
+    installOpenCodePlugin(openCodeHookArgv((paths.resolveBinary ?? resolveGlobalBinary)(OPENCODE_HOOK_BINARY)), pluginDir);
+    return { configured: true, reapplied: true, hooks: true, mcp: false };
+  } catch {
+    return { configured: true, reapplied: false, hooks: false, mcp: false, failed: true };
+  }
+};
 var reapplyAllAgents = (apiKey) => {
   const runners = [
     { id: "claude", label: "Claude Code", run: () => reapplyClaudeSettings(apiKey) },
     { id: "codex", label: "Codex", run: () => reapplyCodexSettings(apiKey) },
     { id: "gemini", label: "Gemini CLI", run: () => reapplyGeminiSettings(apiKey) },
     { id: "cursor", label: "Cursor", run: () => reapplyCursorPlugin(apiKey) },
-    { id: "vscode", label: "VS Code", run: () => reapplyVsCodePlugin(apiKey) }
+    { id: "vscode", label: "VS Code", run: () => reapplyVsCodePlugin(apiKey) },
+    { id: "opencode", label: "OpenCode", run: () => reapplyOpenCodePlugin() }
   ];
   const done = [];
   for (const runner of runners) {
@@ -336,6 +354,7 @@ export {
   reapplyGeminiSettings,
   reapplyCursorPlugin,
   reapplyVsCodePlugin,
+  reapplyOpenCodePlugin,
   reapplyAllAgents,
   ensureCodexTrustAfterReapply
 };

package/dist/{chunk-JSVBVV2Q.js → chunk-QFEM7R6T.js}

@@ -14,36 +14,36 @@ import {
   IDLE_PROMPT_NOTIFICATION,
   NOTIFICATION_PUSH_TYPES,
   POSTTOOLUSE_MIRROR_ONLY_TOOLS
-} from "./chunk-KSJCYP4I.js";
+} from "./chunk-6DJTDHBI.js";
 import {
   cancelQuestion,
   isPolicyConfig,
   sendNotification,
   waitForAnswer
-} from "./chunk-UM7DXK6V.js";
+} from "./chunk-D6S5EKXA.js";
 import {
   clientErrorKindOf,
   reportClientError
-} from "./chunk-CPMVKL6H.js";
+} from "./chunk-AVNKVF7N.js";
 import {
   withRetry
-} from "./chunk-CV2IAVD5.js";
+} from "./chunk-L76HTPU6.js";
 import {
   getMachineId
-} from "./chunk-K2J6OGGN.js";
+} from "./chunk-KYO45G5L.js";
 import {
   reportedInstallSource
-} from "./chunk-FQKFONAS.js";
+} from "./chunk-4D2AYNSE.js";
 import {
   canonicalJson
-} from "./chunk-ZBF5WAP7.js";
+} from "./chunk-ZUTU43FT.js";
 import {
   writeFileAtomic
 } from "./chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-2DSUVY6R.js";
+} from "./chunk-Z6HPS67T.js";
 import {
   ACTION_BODY_MAX,
   AGENT_LABELS_BY_TYPE,
@@ -70,7 +70,7 @@ import {
   resolvePolicy,
   toToolLookup,
   truncateLine
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/policy.ts
 import { createHash } from "crypto";

package/dist/{chunk-TNCINDSF.js → chunk-QQ4HBXZC.js}

@@ -1,17 +1,17 @@
 import {
   MCP_BRIDGE_BINARY
-} from "./chunk-2KH5NTKR.js";
+} from "./chunk-W2KI5KPD.js";
 import {
   openCodeConfigDirFrom
-} from "./chunk-GRFV6GPY.js";
+} from "./chunk-X5NXPCIC.js";
 import {
   KEY_FILE_MODE
-} from "./chunk-5DU7LJ7L.js";
+} from "./chunk-ADSQDYYG.js";
 import {
   NpmMissingError,
   codexHomeFrom,
   resolvePathBinary
-} from "./chunk-ZBF5WAP7.js";
+} from "./chunk-ZUTU43FT.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -19,10 +19,10 @@ import {
 } from "./chunk-T7E75EKA.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-HOTK2D2S.js";
+} from "./chunk-STQRUH3S.js";
 import {
   HOOK_COMPATIBLE_PROFILES
-} from "./chunk-SBR2UKUO.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/hermes-config.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-SBR2UKUO.js → chunk-QR6VE5ME.js}

@@ -520,6 +520,8 @@ var redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE.
 
 // ../contracts/src/shell-analysis.ts
 var SHELL_WORD_SEPARATOR = /[ \t\n]/;
+var ARITHMETIC_EVALUATING_EXPANSION = /\$[#+=~^]*(?:[A-Za-z_][A-Za-z0-9_]*|[0-9]+|[-?$!@*#])?\[/;
+var VISIBLE_ESCAPE = /\\[\s\S]/g;
 var trimShellWhitespace = (command) => command.replace(/^[ \t\n]+|[ \t\n]+$/g, "");
 var DOUBLE_QUOTE_ESCAPABLE = /* @__PURE__ */ new Set(['"', "\\", "$", "`"]);
 var SEGMENT_SEPARATORS = /* @__PURE__ */ new Set([";", "\n", "&", "|"]);
@@ -576,6 +578,14 @@ var shellVisibleText = (command) => {
   }
   return visible;
 };
+var isInertOutsideExpansion = ({ quote, kind }) => kind === "escape" || kind === "text" && quote === "'";
+var opensArithmeticEvaluation = (command) => {
+  const lexemes = scanShell(command);
+  if (lexemes === null) return true;
+  const expandableText = lexemes.map((lexeme) => isInertOutsideExpansion(lexeme) ? "_".repeat(lexeme.text.length) : lexeme.text).join("");
+  return ARITHMETIC_EVALUATING_EXPANSION.test(expandableText);
+};
+var withoutShellEscapes = (visible) => visible.replace(VISIBLE_ESCAPE, (escape) => "_".repeat(escape.length));
 var shellWordsOf = (command) => {
   const lexemes = scanShell(command);
   if (lexemes === null) return null;
@@ -687,6 +697,26 @@ var clientContextHeaders = (source) => {
   if (isClientPlatform(source.platform)) headers[CLIENT_CONTEXT_HEADERS.platform] = source.platform;
   return headers;
 };
+var AGENT_SITE_REJECTION_REASONS = [
+  "pairing_user_blank",
+  "pairing_user_mismatch",
+  "site_header_blank",
+  "device_token_blank",
+  "device_token_too_long",
+  "device_not_found",
+  "not_site_member",
+  "sandbox_site",
+  "no_current_site"
+];
+var AUTH_REJECTION_REASONS = [
+  "malformed_key",
+  "unknown_key",
+  "expired_key",
+  "scope_denied",
+  "oauth_rejected",
+  "site_not_found",
+  ...AGENT_SITE_REJECTION_REASONS
+];
 
 // ../contracts/src/index.ts
 var KEY_SCOPES = ["full_access", "agent", "connector", "bound"];
@@ -1047,7 +1077,6 @@ var SAFE_SHELL_COMMANDS = /* @__PURE__ */ new Set([
   "tail",
   "wc",
   "echo",
-  "printf",
   "which",
   "type",
   "whoami",
@@ -1220,6 +1249,7 @@ var isSafeSimpleCommand = (segment) => {
   }
   if (exe === "sed") return isPrintOnlySed(tokens.slice(1));
   if (exe === "date") return isReadOnlyDate(tokens.slice(1));
+  if (exe === "printf") return isOutputOnlyPrintf(tokens.slice(1));
   return SAFE_SHELL_COMMANDS.has(exe);
 };
 var SED_PRINT_ONLY_SCRIPT = /^(?:\d+|\$)(?:,(?:\d+|\$))?p$/;
@@ -1229,11 +1259,12 @@ var DATE_UTC_FLAG = "-u";
 var isFlagToken = (token) => token.startsWith("-");
 var isPrintOnlySed = (args) => args[0] === SED_QUIET_FLAG && SED_PRINT_ONLY_SCRIPT.test(args[1] ?? "") && !args.slice(2).some(isFlagToken);
 var isReadOnlyDate = (args) => args.every((arg) => arg.startsWith(DATE_FORMAT_PREFIX) || arg === DATE_UTC_FLAG);
+var isOutputOnlyPrintf = (args) => args[0] === END_OF_OPTIONS || !isFlagToken(args[0] ?? "");
 var READ_ONLY_SEGMENT_SEPARATOR = /&&|\|\||[;|]/g;
 var PIPELINE_CHAIN_SEPARATOR = /&&|\|\||;/g;
 var EXPANSION_THAT_CAN_BECOME_A_FLAG = /\$|(?:^|\s)[*?[]/;
 var SHELL_QUOTE_CHARACTERS = /['"]/g;
-var INSPECTED_ARGUMENT_COMMANDS = /* @__PURE__ */ new Set(["git", "find", "sed", "date"]);
+var INSPECTED_ARGUMENT_COMMANDS = /* @__PURE__ */ new Set(["git", "find", "sed", "date", "printf"]);
 var argumentsMayExpand = (segment) => {
   const visible = shellVisibleText(segment);
   return visible === null || EXPANSION_THAT_CAN_BECOME_A_FLAG.test(visible.replace(SHELL_QUOTE_CHARACTERS, ""));
@@ -1242,7 +1273,7 @@ var blankedSafeRedirections = (text) => text.replace(SAFE_REDIRECTION, (redirect
 var segmentsSplitWhereVisible = (command, visible, separators) => {
   const segments = [];
   let start = 0;
-  for (const separator of visible.matchAll(separators)) {
+  for (const separator of withoutShellEscapes(visible).matchAll(separators)) {
     segments.push(command.slice(start, separator.index));
     start = separator.index + separator[0].length;
   }
@@ -1257,6 +1288,7 @@ var isSafeReadOnlyCommand = (command) => {
   if (visible === null || /[`{}]|\$'/.test(visible)) return false;
   if (/\\(?![()!])/.test(visible)) return false;
   if (/(?<!\\)[()]/.test(visible)) return false;
+  if (opensArithmeticEvaluation(trimmed)) return false;
   const visibleWithoutRedirection = blankedSafeRedirections(visible);
   if (/[<>]/.test(visibleWithoutRedirection)) return false;
   if (visibleWithoutRedirection.replace(/&&/g, "  ").includes("&")) return false;