pushary 1.9.59 → 1.9.60

package/dist/{chunk-US3IT6ZC.js → chunk-2QREHU4O.js}

@@ -12,6 +12,9 @@ import {
   ownPackageName
 } from "./chunk-QTOLNRET.js";
 
+// src/shell-quote.ts
+var shellDoubleQuoted = (text) => `"${text.replace(/(["\\$`])/g, "\\$1")}"`;
+
 // src/npm.ts
 import { promisify } from "util";
 import { exec, execFile, execFileSync, execSync } from "child_process";
@@ -320,7 +323,10 @@ var resolveGlobalBinDir = (probe) => {
   const resolved = resolveGlobalBinary(probe);
   return resolved ? resolved.slice(0, resolved.length - probe.length - 1) : void 0;
 };
-var quoteIfNeeded = (path) => /\s/.test(path) ? `"${path}"` : path;
+var quoteIfNeeded = (path, platform = process.platform) => {
+  if (platform === "win32") return /\s/.test(path) ? `"${path}"` : path;
+  return /^[\w@%+=:,./-]+$/.test(path) ? path : shellDoubleQuoted(path);
+};
 var fetchLatestPublishedVersion = async (request) => {
   try {
     const response = await (request.fetchImpl ?? fetch)(latestReleaseUrl(request.packageName), {
@@ -360,9 +366,9 @@ var installGlobally = (options) => {
   }
   const started = (async () => {
     if (!npmIsOnPath()) throw new NpmMissingError();
-    const { withUpgradeLock } = await import("./global-upgrade-YWIVJIUR.js");
-    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-TJPKU5HL.js");
-    const { autoUpdateLock } = await import("./paths-ES3V7BWQ.js");
+    const { withUpgradeLock } = await import("./global-upgrade-ETDP32LO.js");
+    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-T6ILR644.js");
+    const { autoUpdateLock } = await import("./paths-IIOQZESZ.js");
     let result = "skipped";
     const install = async () => {
       const platform = process.platform;
@@ -395,6 +401,7 @@ var installGlobally = (options) => {
 };
 
 export {
+  shellDoubleQuoted,
   LATEST_TAG,
   cleanNpmEnv,
   npmErrorMessage,

package/dist/{chunk-W47WL6JY.js → chunk-33OOEVPG.js}

@@ -1,6 +1,6 @@
 import {
   PRETOOLUSE_GATED_TOOLS
-} from "./chunk-762CDAJJ.js";
+} from "./chunk-AXJLJJ3M.js";
 
 // src/claude-tools.ts
 var POSTTOOLUSE_MIRROR_ONLY_TOOLS = ["TodoWrite", "Task", "WebFetch", "WebSearch"];

package/dist/{chunk-AS4Z6KS4.js → chunk-4MUFZU2G.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-KZCYHWDF.js";
+} from "./chunk-6MJWYYAS.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-JAKBCKEB.js → chunk-4MWRR5IT.js}

@@ -1,18 +1,19 @@
 import {
   readExistingMachineId
-} from "./chunk-M46WDK64.js";
+} from "./chunk-O6IUZGWV.js";
 import {
   NetworkError
-} from "./chunk-7QLSKOSU.js";
+} from "./chunk-PPY5N2E6.js";
 import {
   getBaseUrl
-} from "./chunk-4XXZUFWN.js";
+} from "./chunk-BG4Y64FW.js";
 import {
   getPackageVersion
 } from "./chunk-QTOLNRET.js";
 import {
-  clientContextHeaders
-} from "./chunk-762CDAJJ.js";
+  clientContextHeaders,
+  redactSecretsFromContent
+} from "./chunk-AXJLJJ3M.js";
 
 // src/cli/net.ts
 import { createRequire } from "module";
@@ -112,8 +113,8 @@ var pusharyFetch = async (url, init = {}) => {
   } catch (err) {
     if (isNetworkFailure(err)) {
       const proxy = proxyFromEnv();
-      const via = proxy ? ` (via proxy ${proxy})` : "";
-      throw new NetworkError(`Could not reach ${new URL(url).host}${via}: ${err instanceof Error ? err.message : String(err)}`);
+      const via = proxy ? " (via configured proxy)" : "";
+      throw new NetworkError(redactSecretsFromContent(`Could not reach ${new URL(url).host}${via}: ${err instanceof Error ? err.message : String(err)}`));
     }
     throw err;
   }

package/dist/{chunk-TCH5UCPR.js → chunk-4PZXI7WU.js}

@@ -8,13 +8,13 @@ import {
   everyProgramFileIsThere,
   installedCodexApp,
   shellQuoted
-} from "./chunk-CPRA7IEK.js";
+} from "./chunk-Y5V4PA2Z.js";
 import {
   writeHuman
 } from "./chunk-QCGNGEGE.js";
 import {
   xml
-} from "./chunk-4QF2YLYK.js";
+} from "./chunk-HC3FHDKB.js";
 import {
   CODEX_APP_LAUNCH_AT_LOGIN_VERB,
   CODEX_APP_LAUNCH_VARIABLE

package/dist/{chunk-IBXHVYN2.js → chunk-56JCQQLS.js}

@@ -7,10 +7,10 @@ import {
   codexHome,
   codexHooksJsonIn,
   isPusharyCodexCommand
-} from "./chunk-KZCYHWDF.js";
+} from "./chunk-6MJWYYAS.js";
 import {
   resolvePathBinary
-} from "./chunk-US3IT6ZC.js";
+} from "./chunk-2QREHU4O.js";
 import {
   getPackageVersion
 } from "./chunk-QTOLNRET.js";

package/dist/{chunk-5BNXJTOZ.js → chunk-5RU35K57.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-POFBE6ZY.js";
 import {
   autoUpdateState
-} from "./chunk-KZCYHWDF.js";
+} from "./chunk-6MJWYYAS.js";
 import {
   readJsonSafe,
   writeJsonAtomic
@@ -17,7 +17,7 @@ import {
 } from "./chunk-QTOLNRET.js";
 import {
   isAutoUpdateResult
-} from "./chunk-762CDAJJ.js";
+} from "./chunk-AXJLJJ3M.js";
 
 // src/auto-update.ts
 import { spawn } from "child_process";
@@ -130,15 +130,6 @@ var readLocalAutoUpdateReport = () => {
     return null;
   }
 };
-var parseAutoUpdateFlag = (args) => {
-  const token = args.find((arg) => arg === AUTO_UPDATE_FLAG || arg.startsWith(`${AUTO_UPDATE_FLAG}=`));
-  if (token === void 0) return { kind: "absent" };
-  if (token === AUTO_UPDATE_FLAG) return { kind: "run" };
-  const value = token.slice(AUTO_UPDATE_FLAG.length + 1);
-  if (value === "on") return { kind: "set", enabled: true };
-  if (value === "off") return { kind: "set", enabled: false };
-  return { kind: "invalid", value };
-};
 var AUTO_UPDATE_RESULT_LABELS = {
   updated: "updated",
   finish_pending: "installed; configuration refresh pending",
@@ -209,13 +200,13 @@ var triggerAutoUpdate = (trigger) => {
 
 export {
   AUTO_UPDATE_DISABLE_ENV,
+  AUTO_UPDATE_FLAG,
   isAutoUpdateDisabledByEnv,
   autoUpdateOffReason,
   globalInstallLocation,
   upgradeEntryFor,
   nextFinishAttempt,
   readLocalAutoUpdateReport,
-  parseAutoUpdateFlag,
   describeAutoUpdateCheck,
   isUnfinishedAutoUpdate,
   holdsUnfinishedFinish,

package/dist/{chunk-T65RIQK2.js → chunk-625DZLT5.js}

@@ -1,7 +1,7 @@
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "./chunk-LAEW5QQD.js";
+} from "./chunk-RPPXQNIA.js";
 import {
   AUTO_DECISION_WINDOW_MS,
   DEFAULT_SESSION,
@@ -10,18 +10,18 @@ import {
   permissionDeniedAction,
   releaseThrottle,
   reportEvent
-} from "./chunk-5JWCWALO.js";
+} from "./chunk-W2IVTHIG.js";
 import {
   askUser,
   isDecisionStopped,
   waitForQuestion
-} from "./chunk-WW24SG27.js";
+} from "./chunk-EZHY65QA.js";
 import {
   SubscriptionRequiredError
-} from "./chunk-5EFNBL6V.js";
+} from "./chunk-SEILUNWB.js";
 import {
   getMachineId
-} from "./chunk-M46WDK64.js";
+} from "./chunk-O6IUZGWV.js";
 import {
   ASK_CONTEXT_MAX,
   agentQuestionContext,
@@ -33,7 +33,7 @@ import {
   questionsShownAsASet,
   shouldDeferToNativeMode,
   wireVerdictFor
-} from "./chunk-762CDAJJ.js";
+} from "./chunk-AXJLJJ3M.js";
 
 // src/machine-decision-audit.ts
 import { basename } from "path";

package/dist/{chunk-5PP4455M.js → chunk-6LOQE4J4.js}

@@ -1,6 +1,6 @@
 import {
   realpath
-} from "./chunk-M6MOQBR5.js";
+} from "./chunk-USE5IEEW.js";
 import {
   findNativeClaudeInstall
 } from "./chunk-VUFHYMSP.js";
@@ -13,10 +13,10 @@ import {
   resolvePackageVersionFromBinary,
   resolvePathBinary,
   resolvePathBinaryAsync
-} from "./chunk-US3IT6ZC.js";
+} from "./chunk-2QREHU4O.js";
 import {
   MANAGED_PROVIDERS
-} from "./chunk-762CDAJJ.js";
+} from "./chunk-AXJLJJ3M.js";
 
 // src/live-capabilities.ts
 import { homedir } from "os";

package/dist/{chunk-KQHY6L3X.js → chunk-6MC2XXFD.js}

@@ -1,18 +1,18 @@
 import {
   registerTranscript
-} from "./chunk-2WMZDKPM.js";
+} from "./chunk-CEQ2AZH4.js";
 import {
   namedEvent
-} from "./chunk-KQWN7C5C.js";
+} from "./chunk-PUHP4IBA.js";
 import {
   writeDegraded
-} from "./chunk-WW24SG27.js";
+} from "./chunk-EZHY65QA.js";
 import {
   claudeShapedHookInput,
   hookCompatibleProfileBySource,
   isGrokHookPayload,
   isGrokSessionEndStop
-} from "./chunk-762CDAJJ.js";
+} from "./chunk-AXJLJJ3M.js";
 
 // src/tool-hook-input.ts
 var OPTIONAL_TEXT_FIELDS = ["hook_event_name", "session_id", "cwd", "transcript_path", "tool_use_id", "permission_mode"];

package/dist/{chunk-KZCYHWDF.js → chunk-6MJWYYAS.js}

@@ -1,21 +1,31 @@
 import {
-  quoteIfNeeded
-} from "./chunk-US3IT6ZC.js";
+  quoteIfNeeded,
+  shellDoubleQuoted
+} from "./chunk-2QREHU4O.js";
 import {
   CODEX_QUESTION_TOOLS,
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY,
   withHookHoldBudget
-} from "./chunk-762CDAJJ.js";
+} from "./chunk-AXJLJJ3M.js";
 
 // src/setup/paths.ts
-import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
+import { createHash as createHash2 } from "crypto";
+
+// src/claude-config-paths.ts
+import { homedir } from "os";
+import { join, resolve } from "path";
+var claudeConfigDir = (home = homedir(), environment = process.env) => resolve(environment.CLAUDE_CONFIG_DIR || join(home, ".claude"));
+var claudeUserConfigFile = (home = homedir(), environment = process.env) => join(environment.CLAUDE_CONFIG_DIR ? claudeConfigDir(home, environment) : home, ".claude.json");
+
+// src/setup/paths.ts
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
 
 // src/codex-config.ts
 import { createHash } from "crypto";
-import { homedir } from "os";
-import { join } from "path";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
 
 // src/registration-holder.ts
 var asRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
@@ -52,7 +62,6 @@ var holdBudgetOf = (hook) => hook.holds ? hook.timeout : void 0;
 var LOCATE = 'B=$(command -v "$0") || exit 0; [ -f "$B" ] || exit 0; [ -x "$B" ] || exit 0';
 var NODE_PRESENT = "command -v node >/dev/null 2>&1 || exit 0";
 var CURSOR_NO_OPINION = { permission: "deny", user_message: "Command denied via Pushary.", agent_message: "Pushary hook is unavailable. Repair the integration before retrying." };
-var shellDoubleQuoted = (text) => `"${text.replace(/(["\\$`])/g, "\\$1")}"`;
 var CURSOR_NATIVE_PROMPT = { permission: "ask" };
 var CURSOR_NATIVE_PROMPT_EVENTS = ["beforeShellExecution", "beforeMCPExecution"];
 var hookEventIsOneOf = (events) => events.flatMap((event) => [`*\\"hook_event_name\\":\\"${event}\\"*`, `*\\"hook_event_name\\":\\ \\"${event}\\"*`]).join("|");
@@ -80,7 +89,7 @@ var guardKindOf = (target) => {
 var targetPath = (target) => target.kind === "binary" ? target.path : target.script;
 var runsThroughNode = (target) => target.kind !== "binary";
 var guardHookCommand = (target, platform = process.platform) => {
-  const path = quoteIfNeeded(targetPath(target));
+  const path = quoteIfNeeded(targetPath(target), platform);
   if (platform === "win32") return runsThroughNode(target) ? `node ${path}` : path;
   return `${HOOK_SHELL} '${HOOK_GUARD_SCRIPTS[guardKindOf(target)]}' ${path}`;
 };
@@ -135,13 +144,13 @@ var canonicalJson = (value) => {
 
 // src/codex-config.ts
 var CODEX_HOOK_BINARY = "pushary-codex-hook";
-var codexHome = () => codexHomeFrom(homedir());
-var codexHomeFrom = (home) => process.env.CODEX_HOME?.trim() || join(home, ".codex");
-var codexConfigToml = () => join(codexHome(), "config.toml");
-var codexHooksJsonIn = (home) => join(home, "hooks.json");
+var codexHome = () => codexHomeFrom(homedir2());
+var codexHomeFrom = (home) => process.env.CODEX_HOME?.trim() || join2(home, ".codex");
+var codexConfigToml = () => join2(codexHome(), "config.toml");
+var codexHooksJsonIn = (home) => join2(home, "hooks.json");
 var codexHooksJson = () => codexHooksJsonIn(codexHome());
-var codexAgentsMd = () => join(codexHome(), "AGENTS.md");
-var codexSkillDir = () => join(codexHome(), "skills", "pushary");
+var codexAgentsMd = () => join2(codexHome(), "AGENTS.md");
+var codexSkillDir = () => join2(codexHome(), "skills", "pushary");
 var CODEX_TOOL_CALL_MATCHER = "Bash|apply_patch|mcp__.*";
 var CODEX_PRE_TOOL_USE_MATCHER = [CODEX_TOOL_CALL_MATCHER, ...CODEX_QUESTION_TOOLS].join("|");
 var CODEX_HOOK_EVENTS = [
@@ -446,45 +455,49 @@ var staleTrustKeys = (state, hooksJsonPath, event, currentKey, ourHash) => {
 };
 
 // src/setup/paths.ts
-var claudeSettings = () => join2(homedir2(), ".claude", "settings.json");
-var claudeJson = () => join2(homedir2(), ".claude.json");
-var claudeSkillDir = () => join2(homedir2(), ".claude", "skills", "pushary");
-var cursorPluginDir = () => join2(homedir2(), ".cursor", "plugins", "local", "pushary");
-var cursorUserHooks = () => join2(homedir2(), ".cursor", "hooks.json");
-var cursorPluginMcp = () => join2(cursorPluginDir(), "mcp.json");
-var cursorPluginManifest = () => join2(cursorPluginDir(), ".cursor-plugin", "plugin.json");
-var cursorPluginRule = () => join2(cursorPluginDir(), "rules", "pushary.mdc");
-var cursorUserMcp = () => join2(homedir2(), ".cursor", "mcp.json");
-var vscodePluginDir = () => join2(homedir2(), ".pushary", "plugins", "vscode");
-var vscodePluginMcp = () => join2(vscodePluginDir(), ".mcp.json");
-var claudeSettingsLocal = () => join2(homedir2(), ".claude", "settings.local.json");
-var pusharyDir = () => join2(homedir2(), ".pushary");
-var claudeMcpReceipt = () => join2(pusharyDir(), "setup", "claude-mcp.json");
-var bridgeAgentKey = () => join2(pusharyDir(), "bridge-auth", "agent-key.json");
-var autoUpdateState = () => join2(pusharyDir(), "auto-update.json");
-var autoUpdateLock = () => join2(pusharyDir(), "auto-update.lock");
-var serviceOwedBackMark = () => join2(pusharyDir(), "service-owed-back");
-var autoUpdateLog = () => join2(pusharyDir(), "logs", "auto-update.log");
-var clientReportClaims = () => join2(pusharyDir(), "client-reports");
-var claudeRegistrationReceipt = () => join2(pusharyDir(), "setup", "claude-registration.json");
-var hermesConfig = () => join2(homedir2(), ".hermes", "config.yaml");
-var hermesConfigReceipt = () => join2(pusharyDir(), "setup", "hermes-config.json");
-var fxQuestionRuleReceipt = () => join2(pusharyDir(), "setup", "fx-question-rule.json");
-var hookTakeoverReceipt = (agent) => join2(pusharyDir(), "setup", `hook-takeover-${agent}.json`);
-var codexSkillDir2 = () => join2(codexHome(), "skills", "pushary");
-var codexAgentsMd2 = () => join2(codexHome(), "AGENTS.md");
-var geminiSettings = () => join2(homedir2(), ".gemini", "settings.json");
-var geminiMd = () => join2(homedir2(), ".gemini", "GEMINI.md");
-var pusharyConfigFile = () => join2(homedir2(), ".pushary", "config.json");
-var fxConfigDir = () => join2(homedir2(), ".fx");
-var fxMcpProfile = () => join2(fxConfigDir(), "mcp.json");
-var fxSettings = () => join2(fxConfigDir(), "settings.json");
-var fxAgentsMd = () => join2(fxConfigDir(), "AGENTS.md");
+var claudeSettings = (environment = process.env) => join3(claudeConfigDir(homedir3(), environment), "settings.json");
+var claudeJson = (environment = process.env) => claudeUserConfigFile(homedir3(), environment);
+var claudeSkillDir = (environment = process.env) => join3(claudeConfigDir(homedir3(), environment), "skills", "pushary");
+var cursorPluginDir = () => join3(homedir3(), ".cursor", "plugins", "local", "pushary");
+var cursorUserHooks = () => join3(homedir3(), ".cursor", "hooks.json");
+var cursorPluginMcp = () => join3(cursorPluginDir(), "mcp.json");
+var cursorPluginManifest = () => join3(cursorPluginDir(), ".cursor-plugin", "plugin.json");
+var cursorPluginRule = () => join3(cursorPluginDir(), "rules", "pushary.mdc");
+var cursorUserMcp = () => join3(homedir3(), ".cursor", "mcp.json");
+var vscodePluginDir = () => join3(homedir3(), ".pushary", "plugins", "vscode");
+var vscodePluginMcp = () => join3(vscodePluginDir(), ".mcp.json");
+var claudeSettingsLocal = () => join3(claudeConfigDir(), "settings.local.json");
+var pusharyDir = () => join3(homedir3(), ".pushary");
+var claudeSetupDir = () => process.env.CLAUDE_CONFIG_DIR ? join3(pusharyDir(), "setup", "claude-profiles", createHash2("sha256").update(claudeUserConfigFile()).digest("hex").slice(0, 32)) : join3(pusharyDir(), "setup");
+var claudeMcpReceipt = () => join3(claudeSetupDir(), "claude-mcp.json");
+var bridgeAgentKey = () => join3(pusharyDir(), "bridge-auth", "agent-key.json");
+var autoUpdateState = () => join3(pusharyDir(), "auto-update.json");
+var autoUpdateLock = () => join3(pusharyDir(), "auto-update.lock");
+var serviceOwedBackMark = () => join3(pusharyDir(), "service-owed-back");
+var autoUpdateLog = () => join3(pusharyDir(), "logs", "auto-update.log");
+var clientReportClaims = () => join3(pusharyDir(), "client-reports");
+var claudeRegistrationReceipt = () => join3(claudeSetupDir(), "claude-registration.json");
+var hermesConfig = () => join3(homedir3(), ".hermes", "config.yaml");
+var hermesConfigReceipt = () => join3(pusharyDir(), "setup", "hermes-config.json");
+var fxQuestionRuleReceipt = () => join3(pusharyDir(), "setup", "fx-question-rule.json");
+var hookTakeoverReceipt = (agent) => join3(agent === "claude_code" ? claudeSetupDir() : join3(pusharyDir(), "setup"), `hook-takeover-${agent}.json`);
+var codexSkillDir2 = () => join3(codexHome(), "skills", "pushary");
+var codexAgentsMd2 = () => join3(codexHome(), "AGENTS.md");
+var geminiSettings = () => join3(homedir3(), ".gemini", "settings.json");
+var geminiMd = () => join3(homedir3(), ".gemini", "GEMINI.md");
+var pusharyConfigFile = () => join3(homedir3(), ".pushary", "config.json");
+var fxConfigDir = () => join3(homedir3(), ".fx");
+var fxMcpProfile = () => join3(fxConfigDir(), "mcp.json");
+var fxSettings = () => join3(fxConfigDir(), "settings.json");
+var fxAgentsMd = () => join3(fxConfigDir(), "AGENTS.md");
 
 export {
+  claudeConfigDir,
+  claudeUserConfigFile,
   registeredCommands,
   namesOurBinary,
   registrationHolderOf,
+  HOOK_SHELL,
   holdBudgetOf,
   guardBinary,
   guardBinaryRefusing,

package/dist/chunk-7BHI3PZN.js

@@ -0,0 +1,41 @@
+import {
+  exitCodeFor,
+  messageFor
+} from "./chunk-PPY5N2E6.js";
+import {
+  EXIT
+} from "./chunk-KZERVKTD.js";
+import {
+  redactSecretsFromContent
+} from "./chunk-AXJLJJ3M.js";
+
+// src/cli/json.ts
+var writeStdoutFully = (text) => new Promise((resolve, reject) => {
+  const settle = (error) => {
+    if (!error) process.stdout.off("error", settle);
+    if (error && (!("code" in error) || error.code !== "EPIPE")) reject(error);
+    else resolve();
+  };
+  process.stdout.once("error", settle);
+  process.stdout.write(text, settle);
+});
+var writeJsonError = async (command, error, argv = process.argv.slice(2)) => {
+  const exitCode = exitCodeFor(error);
+  const end = argv.indexOf("--");
+  const flags = end < 0 ? argv : argv.slice(0, end);
+  if (!flags.includes("--json") && !flags.includes("-json")) return { written: false, exitCode };
+  await writeStdoutFully(`${JSON.stringify({
+    ok: false,
+    command,
+    reason: exitCode === EXIT.USAGE ? "usage" : "failed",
+    message: redactSecretsFromContent(messageFor(error)),
+    exitCode
+  })}
+`);
+  return { written: true, exitCode };
+};
+
+export {
+  writeStdoutFully,
+  writeJsonError
+};

package/dist/{chunk-D6CXQIXO.js → chunk-7JXJJNQ5.js}

@@ -1,6 +1,6 @@
 import {
   readTranscriptPreference
-} from "./chunk-KAJDKYUM.js";
+} from "./chunk-WN3RACVD.js";
 
 // src/transcript-setting.ts
 var transcriptEnvironmentPreference = () => {

package/dist/{chunk-MSU3VKGJ.js → chunk-7WFRY6OL.js}

@@ -1,12 +1,12 @@
 import {
   pusharyDir
-} from "./chunk-KZCYHWDF.js";
+} from "./chunk-6MJWYYAS.js";
 import {
   readJsonSafe
 } from "./chunk-QENTGE75.js";
 import {
   isRecord
-} from "./chunk-762CDAJJ.js";
+} from "./chunk-AXJLJJ3M.js";
 
 // src/process-ownership.ts
 import { createHash, randomUUID } from "crypto";

package/dist/{chunk-AY32RSUC.js → chunk-ADR3KHOC.js}

@@ -4,10 +4,10 @@ import {
   keyPrefix,
   readConfigFileKey,
   readMacAppKeyPrefix
-} from "./chunk-KAJDKYUM.js";
+} from "./chunk-WN3RACVD.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-BMPZ5HVJ.js";
+} from "./chunk-ERK24P76.js";
 
 // src/key-signed-out.ts
 var VERDICT_BY_CHECK = {

package/dist/{chunk-MMLIQDTG.js → chunk-ATKN4BJT.js}

@@ -1,6 +1,6 @@
 import {
   readConfigFileKey
-} from "./chunk-KAJDKYUM.js";
+} from "./chunk-WN3RACVD.js";
 
 // src/bell/fleet.ts
 import { closeSync, constants, futimesSync, lstatSync, mkdirSync, openSync, readdirSync, unlinkSync } from "fs";

package/dist/{chunk-762CDAJJ.js → chunk-AXJLJJ3M.js}

@@ -384,6 +384,13 @@ var AGENTS = {
     enforcementDetail: "Shell, edits and MCP calls through native PreToolUse hooks. Grok's own permission checks still apply after a phone approval.",
     capabilityNote: "Grok fails open if it kills a hook or cannot run it. Setup leaves Grok's permission mode unchanged. Native question and plan dialogs stay in Grok; proactive phone questions use Pushary MCP."
   },
+  grok_bot: {
+    ...defaults,
+    label: "Grok Bot",
+    connectVia: "Grok Bot app plugin (remote MCP connector)",
+    setupGuide: "[Grok Bot setup](/docs/agents/guides/grok-bot)",
+    capabilityNote: "Grok Bot keeps its own approval cards, and Pushary cannot stop a Bot in the middle of a task. A question nobody answers expires after about ten minutes and is never treated as a yes."
+  },
   windsurf: {
     ...defaults,
     label: "Windsurf",

package/dist/{chunk-4XXZUFWN.js → chunk-BG4Y64FW.js}

@@ -1,6 +1,6 @@
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-BMPZ5HVJ.js";
+} from "./chunk-ERK24P76.js";
 
 // src/config.ts
 import { readFileSync } from "fs";

package/dist/{chunk-X4ES7QBT.js → chunk-CDQHQAS7.js}

@@ -2,23 +2,24 @@ import {
   CLAUDE_HOOK_EVENTS,
   GEMINI_HOOK_EVENTS,
   hasGeminiHooks
-} from "./chunk-TDOKDCFH.js";
+} from "./chunk-IF26ZGZ7.js";
 import {
   AGENT_CHOICES
-} from "./chunk-75UYYIFJ.js";
+} from "./chunk-XV6S5PWW.js";
 import {
   BELL_HOOK_BINARY
-} from "./chunk-AS4Z6KS4.js";
+} from "./chunk-4MUFZU2G.js";
 import {
   CODEX_HOOK_EVENTS,
+  HOOK_SHELL,
   hasCodexHooks,
   holdBudgetOf
-} from "./chunk-KZCYHWDF.js";
+} from "./chunk-6MJWYYAS.js";
 import {
   CURSOR_GATE_EVENTS,
   HOOK_LOCATOR_BINARY,
   hookCommandHoldBudget
-} from "./chunk-762CDAJJ.js";
+} from "./chunk-AXJLJJ3M.js";
 
 // src/diagnostics/bridge.ts
 import { execFileSync } from "child_process";
@@ -101,9 +102,10 @@ var record = (value) => value && typeof value === "object" && !Array.isArray(val
 var CLAUDE_HOOK_BINARY = /pushary-[a-z-]*hook/;
 var EXACT_HOOK_BINARY = /^pushary-[a-z-]*(hook|gate)$/;
 var pusharyHookExecutable = (command) => {
-  const tokens = command.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
+  const tokens = command.match(/"(?:\\.|[^"\\])*"|'[^']*'|\S+/g) ?? [];
   for (const raw of tokens.reverse()) {
-    const token = raw[0] === '"' && raw.at(-1) === '"' || raw[0] === "'" && raw.at(-1) === "'" ? raw.slice(1, -1) : raw;
+    const unquoted = raw[0] === '"' && raw.at(-1) === '"' || raw[0] === "'" && raw.at(-1) === "'" ? raw.slice(1, -1) : raw;
+    const token = command.startsWith(`${HOOK_SHELL} `) && raw[0] === '"' ? unquoted.replace(/\\(["\\$`])/g, "$1") : unquoted;
     const name = token.split(/[/\\]/).pop()?.replace(/\.(cmd|exe|mjs)$/i, "") ?? "";
     if (name === HOOK_LOCATOR_BINARY || EXACT_HOOK_BINARY.test(name)) return token;
   }