pushary 1.9.60 → 1.9.62

package/dist/bin/pushary-wait.js

@@ -2,29 +2,29 @@
 import {
   waitResponse,
   waitWindowResponse
-} from "../chunk-X3YKQJCZ.js";
+} from "../chunk-7NXB7OVX.js";
 import {
   describeWaitLadder
 } from "../chunk-CVWG2N3Y.js";
 import {
   exitOnFailedSettingsRequest
-} from "../chunk-YGE6ML3O.js";
-import "../chunk-ADR3KHOC.js";
+} from "../chunk-AFV3FQNG.js";
+import "../chunk-NAZRRXZM.js";
 import {
   createIo
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-K4MBKXAE.js";
+} from "../chunk-OZRT64BB.js";
 import {
   parseFlags
 } from "../chunk-NMUI3ZWG.js";
-import "../chunk-WN3RACVD.js";
-import "../chunk-METMK3L4.js";
+import "../chunk-W3CBFLIX.js";
+import "../chunk-Q4WTIKM6.js";
 import {
   pusharyFetch
-} from "../chunk-4MWRR5IT.js";
-import "../chunk-O6IUZGWV.js";
+} from "../chunk-HSRNWCXJ.js";
+import "../chunk-G3ZDCYMU.js";
 import {
   UsageError,
   exitCodeFor
@@ -32,17 +32,18 @@ import {
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-Y5VKZNFN.js";
-import "../chunk-6MJWYYAS.js";
-import "../chunk-2QREHU4O.js";
+import "../chunk-PSCXEH42.js";
+import "../chunk-6YSEOXP5.js";
+import "../chunk-CFIQ3252.js";
 import "../chunk-QENTGE75.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-BG4Y64FW.js";
-import "../chunk-ERK24P76.js";
+} from "../chunk-DFKEJARZ.js";
+import "../chunk-FG5HMJ7C.js";
 import "../chunk-QTOLNRET.js";
-import "../chunk-AXJLJJ3M.js";
+import "../chunk-FXECTHAG.js";
+import "../chunk-MLKGABMK.js";
 
 // bin/pushary-wait.ts
 exitOnHelpFlag("wait");

package/dist/bin/pushary.js

@@ -1,25 +1,26 @@
 #!/usr/bin/env node
 import {
   installNetworkDefaults
-} from "../chunk-4MWRR5IT.js";
-import "../chunk-O6IUZGWV.js";
+} from "../chunk-HSRNWCXJ.js";
+import "../chunk-G3ZDCYMU.js";
 import "../chunk-PPY5N2E6.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-6MJWYYAS.js";
-import "../chunk-2QREHU4O.js";
+import "../chunk-6YSEOXP5.js";
+import "../chunk-CFIQ3252.js";
 import "../chunk-QENTGE75.js";
-import "../chunk-BG4Y64FW.js";
+import "../chunk-DFKEJARZ.js";
 import {
   LISTED_COMMANDS,
   renderHelp,
   resolveCommandName
-} from "../chunk-ERK24P76.js";
+} from "../chunk-FG5HMJ7C.js";
 import {
   getPackageVersion
 } from "../chunk-QTOLNRET.js";
-import "../chunk-AXJLJJ3M.js";
+import "../chunk-FXECTHAG.js";
+import "../chunk-MLKGABMK.js";
 
 // src/cli/runtime.ts
 var supportsRuntime = (version) => {

package/dist/{chunk-RPPXQNIA.js → chunk-3IFCXMC6.js}

@@ -1,6 +1,6 @@
 import {
   DEFAULT_SESSION
-} from "./chunk-W2IVTHIG.js";
+} from "./chunk-LWR5VKNC.js";
 
 // src/answer.ts
 var isDeferAnswer = (value) => value === "defer";

package/dist/{chunk-WXPVVXBU.js → chunk-3LBB7GVF.js}

@@ -1,17 +1,17 @@
 import {
   compatibleConfigFile,
   hasCompatibleHooks
-} from "./chunk-PUHP4IBA.js";
+} from "./chunk-557ZE5EX.js";
 import {
   pusharyHookExecutable
-} from "./chunk-CDQHQAS7.js";
+} from "./chunk-7NJ4TDUH.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-6MJWYYAS.js";
+} from "./chunk-6YSEOXP5.js";
 import {
   isRecord
-} from "./chunk-AXJLJJ3M.js";
+} from "./chunk-FXECTHAG.js";
 
 // src/cursor-config.ts
 var hookCommandOf = (entry) => {

package/dist/{chunk-WFSGCFXQ.js → chunk-3YGUWPNZ.js}

@@ -4,13 +4,10 @@ import {
 } from "./chunk-QENTGE75.js";
 import {
   configFilePath
-} from "./chunk-BG4Y64FW.js";
+} from "./chunk-DFKEJARZ.js";
 import {
   readSetupOutcomeProperties
-} from "./chunk-AXJLJJ3M.js";
-
-// src/hooks-spec.ts
-var CURSOR_GATE_SCRIPT = "pushary-gate.mjs";
+} from "./chunk-FXECTHAG.js";
 
 // src/diagnostics/service-runtime.ts
 var unescapeXml = (value) => value.replaceAll("&quot;", '"').replaceAll("&apos;", "'").replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&amp;", "&");
@@ -69,7 +66,6 @@ var readSetupFailure = (path = failurePath()) => {
 export {
   saveSetupFailure,
   readSetupFailure,
-  CURSOR_GATE_SCRIPT,
   readServiceExecPath,
   versionManagerOf,
   describeVersionManagerPin

package/dist/{chunk-SVQWHV65.js → chunk-44FNEAXK.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-AXJLJJ3M.js";
+} from "./chunk-FXECTHAG.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-YPD3MTFU.js → chunk-4K6YZPZ3.js}

@@ -1,7 +1,7 @@
 import {
   localRepoKey,
   normalizeRepoRemote
-} from "./chunk-AXJLJJ3M.js";
+} from "./chunk-FXECTHAG.js";
 
 // src/repo.ts
 import { existsSync, readFileSync, statSync } from "fs";

package/dist/{chunk-PUHP4IBA.js → chunk-557ZE5EX.js}

@@ -3,18 +3,18 @@ import {
   addGeminiMcpServer,
   removeGeminiMcpServer,
   supportedClaudeEvents
-} from "./chunk-IF26ZGZ7.js";
+} from "./chunk-LCNN7UOE.js";
 import {
   CLAUDE_CODE_AGENT,
   compatibleToolLookup
-} from "./chunk-W2IVTHIG.js";
+} from "./chunk-LWR5VKNC.js";
 import {
   guardBinary,
   guardBinaryRefusing,
   holdBudgetOf,
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-6MJWYYAS.js";
+} from "./chunk-6YSEOXP5.js";
 import {
   HOOK_COMPATIBLE_PROFILES,
   HOOK_LOCATOR_BINARY,
@@ -26,7 +26,7 @@ import {
   pusharyMissingReason,
   refusalOutput,
   withHookHoldBudget
-} from "./chunk-AXJLJJ3M.js";
+} from "./chunk-FXECTHAG.js";
 
 // src/claude-config.ts
 import { join } from "path";

package/dist/{chunk-HC3FHDKB.js → chunk-5R23J52J.js}

@@ -4,16 +4,16 @@ import {
 } from "./chunk-XHKBHWLX.js";
 import {
   readControlMode
-} from "./chunk-WN3RACVD.js";
+} from "./chunk-W3CBFLIX.js";
 import {
   getMachineId
-} from "./chunk-O6IUZGWV.js";
+} from "./chunk-G3ZDCYMU.js";
 import {
   pusharyDir
-} from "./chunk-6MJWYYAS.js";
+} from "./chunk-6YSEOXP5.js";
 import {
   resolveGlobalBinary
-} from "./chunk-2QREHU4O.js";
+} from "./chunk-CFIQ3252.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -22,7 +22,7 @@ import {
 } from "./chunk-QENTGE75.js";
 import {
   getApiKey
-} from "./chunk-BG4Y64FW.js";
+} from "./chunk-DFKEJARZ.js";
 import {
   CLI_PACKAGE_NAMES,
   cmdShimTarget,
@@ -32,7 +32,7 @@ import {
 } from "./chunk-QTOLNRET.js";
 import {
   isRecord
-} from "./chunk-AXJLJJ3M.js";
+} from "./chunk-FXECTHAG.js";
 
 // src/daemon-lifecycle.ts
 import { dirname, join, win32 as win32Path } from "path";

package/dist/{chunk-625DZLT5.js → chunk-67Q3Q5IO.js}

@@ -1,7 +1,7 @@
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "./chunk-RPPXQNIA.js";
+} from "./chunk-3IFCXMC6.js";
 import {
   AUTO_DECISION_WINDOW_MS,
   DEFAULT_SESSION,
@@ -10,18 +10,19 @@ import {
   permissionDeniedAction,
   releaseThrottle,
   reportEvent
-} from "./chunk-W2IVTHIG.js";
+} from "./chunk-LWR5VKNC.js";
 import {
   askUser,
   isDecisionStopped,
+  isQuestionLimitRefusal,
   waitForQuestion
-} from "./chunk-EZHY65QA.js";
+} from "./chunk-RSNN2TPE.js";
 import {
   SubscriptionRequiredError
-} from "./chunk-SEILUNWB.js";
+} from "./chunk-ESXGCZDA.js";
 import {
   getMachineId
-} from "./chunk-O6IUZGWV.js";
+} from "./chunk-G3ZDCYMU.js";
 import {
   ASK_CONTEXT_MAX,
   agentQuestionContext,
@@ -33,7 +34,7 @@ import {
   questionsShownAsASet,
   shouldDeferToNativeMode,
   wireVerdictFor
-} from "./chunk-AXJLJJ3M.js";
+} from "./chunk-FXECTHAG.js";
 
 // src/machine-decision-audit.ts
 import { basename } from "path";
@@ -103,6 +104,7 @@ var cardOf = (question) => {
   };
 };
 var outcomeOfFailedAsk = (error, sessionId, failure) => {
+  if (isQuestionLimitRefusal(error)) return void 0;
   if (!(error instanceof SubscriptionRequiredError)) return failure;
   announceSubscriptionRequired(error.upgradeUrl, sessionId);
   return void 0;

package/dist/{chunk-QGSHV3WO.js → chunk-6HIYOY6I.js}

@@ -1,15 +1,15 @@
 import {
   compatibleConfigFile
-} from "./chunk-PUHP4IBA.js";
+} from "./chunk-557ZE5EX.js";
 import {
   hookOwnerOf,
   hookOwnerOfCommands,
   liveBridgeProbe,
   resolveBridgeStub
-} from "./chunk-CDQHQAS7.js";
+} from "./chunk-7NJ4TDUH.js";
 import {
   AGENT_CHOICES
-} from "./chunk-XV6S5PWW.js";
+} from "./chunk-MURJ4WAL.js";
 import {
   claudeSettings,
   codexHooksJson,
@@ -18,7 +18,7 @@ import {
   guardedArgv,
   pusharyDir,
   vscodePluginDir
-} from "./chunk-6MJWYYAS.js";
+} from "./chunk-6YSEOXP5.js";
 import {
   readJsonSafe
 } from "./chunk-QENTGE75.js";
@@ -29,7 +29,7 @@ import {
   OPENCODE_APPROVAL_EVENT,
   hookCompatibleProfile,
   isRecord
-} from "./chunk-AXJLJJ3M.js";
+} from "./chunk-FXECTHAG.js";
 
 // src/opencode-plugin.ts
 var OPENCODE_PLUGIN_MARKER = "pushary-opencode-plugin w1";
@@ -141,18 +141,21 @@ const tell = (payload) => {
 // tools: bash asks with { command }, write and edit both ask under "edit" with
 // { filepath, diff }, webfetch with { url }, and a shell command reaching outside
 // the worktree asks a second time under "external_directory".
-const inputFrom = (permission, metadata) => {
+const inputFrom = (permission, metadata, resources) => {
   const meta = metadata && typeof metadata === "object" ? metadata : {}
+  if (permission === "read" && resources?.length === 1) return { file_path: resources[0] }
   const command = text(meta.command)
   if (command) return { command }
-  const filepath = text(meta.filepath) ?? text(meta.file_path)
+  const preview = Array.isArray(meta.files) && meta.files.length === 1 ? meta.files[0] : undefined
+  const filepath = text(preview?.file) ?? text(meta.filepath) ?? text(meta.file_path) ?? text(meta.path)
   // The diff rides along, because it is what the person is actually approving.
   // OpenCode computes it before raising the permission and hands it over; without
   // it the phone shows a filename and nothing to judge.
-  if (filepath) return { file_path: filepath, ...(text(meta.diff) ? { diff: meta.diff } : {}) }
+  const diff = text(preview?.patch) ?? text(meta.diff)
+  if (filepath) return { file_path: filepath, ...(diff ? { diff } : {}) }
   const url = text(meta.url)
   if (url) return { url }
-  return { permission }
+  return { permission, ...(resources?.length ? { resources } : {}) }
 }
 
 // Two spellings of one request: the runtime publishes PermissionV1.Request
@@ -166,10 +169,11 @@ const askedFrom = (properties) => {
   return {
     id,
     sessionID,
-    permission: text(properties.permission) ?? text(properties.type) ?? "unknown",
+    permission: text(properties.action) ?? text(properties.permission) ?? text(properties.type) ?? "unknown",
     metadata: properties.metadata,
-    title: text(properties.title),
-    callID: text(properties.callID) ?? text(properties.tool && properties.tool.callID),
+    resources: Array.isArray(properties.resources) ? properties.resources.filter((item) => typeof item === "string") : undefined,
+    title: text(properties.title) ?? text(properties.message),
+    callID: text(properties.source && properties.source.id) ?? text(properties.callID) ?? text(properties.tool && properties.tool.callID),
   }
 }
 
@@ -178,7 +182,7 @@ const repliedID = (properties) => {
   return text(properties.requestID) ?? text(properties.permissionID) ?? text(properties.id)
 }
 
-export const PusharyPlugin = async ({ client, directory, worktree }) => {
+const PusharyPlugin = async ({ client, directory, worktree, replyPermission }) => {
   const cwd = directory || worktree || process.cwd()
   // OpenCode raises a permission under a coarse key \u2014 "edit" covers both write and
   // edit \u2014 and names the actual tool only on tool.execute.before. Keeping the
@@ -195,6 +199,12 @@ export const PusharyPlugin = async ({ client, directory, worktree }) => {
   // /session/{id}/permissions/{permissionID}, v2 exposes permission.reply against
   // /permission/{requestID}/reply. Both routes are live in the server today.
   const respond = async (asked, allow) => {
+    if (replyPermission) {
+      try {
+        await replyPermission({ sessionID: asked.sessionID, requestID: asked.id, decision: allow ? "once" : "reject" })
+      } catch {}
+      return
+    }
     const legacy = client && typeof client.postSessionIdPermissionsPermissionId === "function"
       ? () => client.postSessionIdPermissionsPermissionId({
           path: { id: asked.sessionID, permissionID: asked.id },
@@ -224,11 +234,17 @@ export const PusharyPlugin = async ({ client, directory, worktree }) => {
   }
 
   const gate = async (asked) => {
+    if (asked.permission === "external_directory") return
+    if (replyPermission && !["shell", "read", "edit", "webfetch"].includes(asked.permission)) return
+    if (Array.isArray(asked.metadata?.files) && asked.metadata.files.length > 1) return
+    if (["read", "edit"].includes(asked.permission) && asked.resources?.length > 1) return
+    const tool = tools.get(asked.callID)
+    if (["shell", "bash"].includes(tool?.name) && text(tool.input?.workdir) && tool.input.workdir !== cwd) return
     const reply = await run({
       ...base(asked.sessionID),
       hook_event_name: "${OPENCODE_APPROVAL_EVENT}",
-      tool_name: tools.get(asked.callID) ?? asked.permission,
-      tool_input: inputFrom(asked.permission, asked.metadata),
+      tool_name: tool?.name ?? asked.permission,
+      tool_input: inputFrom(asked.permission, { ...tool?.input, ...asked.metadata }, asked.resources),
       permission_id: asked.id,
       permission_type: asked.permission,
       title: asked.title,
@@ -256,7 +272,7 @@ export const PusharyPlugin = async ({ client, directory, worktree }) => {
 
   return {
     "tool.execute.before": async (input) => {
-      remember(tools, input && input.callID, input && input.tool)
+      remember(tools, input && input.callID, { name: input?.tool, input: input?.args })
     },
 
     "tool.execute.after": async (input, output) => {
@@ -267,7 +283,7 @@ export const PusharyPlugin = async ({ client, directory, worktree }) => {
         hook_event_name: "tool.execute.after",
         tool_name: text(input && input.tool) ?? "unknown",
         tool_input: input && input.args && typeof input.args === "object" ? input.args : {},
-        tool_result: { title: text(output && output.title), output: text(output && output.output) },
+        tool_result: output?.error ? { error: output.error } : { title: text(output && output.title), output: text(output && output.output) },
       })
     },
 
@@ -290,7 +306,7 @@ export const PusharyPlugin = async ({ client, directory, worktree }) => {
         const properties = event && event.properties
         if (${OPENCODE_APPROVAL_EVENTS_PLACEHOLDER}.includes(type)) {
           const asked = askedFrom(properties)
-          if (asked) void gate(asked)
+          if (asked && !waiting.has(asked.id)) void gate(asked)
           return
         }
         if (type === ${JSON.stringify(OPENCODE_REPLIED_EVENT)}) {
@@ -316,6 +332,49 @@ export const PusharyPlugin = async ({ client, directory, worktree }) => {
     },
   }
 }
+
+export default {
+  id: "pushary",
+  server: PusharyPlugin,
+  async setup(ctx) {
+    const hooks = await PusharyPlugin({
+      directory: ctx.location.directory,
+      replyPermission: (request) => ctx.permission.reply(request),
+    })
+    await ctx.tool.hook("execute.before", (event) => hooks["tool.execute.before"]({
+      callID: event.id, tool: event.tool, sessionID: event.sessionID, args: event.input,
+    }))
+    await ctx.tool.hook("execute.after", (event) => hooks["tool.execute.after"]({
+      callID: event.id, tool: event.tool, sessionID: event.sessionID, args: event.input,
+    }, { output: event.status === "completed" && Array.isArray(event.result.content)
+      ? event.result.content.filter((part) => part.type === "text").map((part) => part.text).join("\\n")
+      : undefined, error: event.status === "error" ? event.error.message : undefined }))
+    await ctx.session.hook("prompt", (event) => hooks["chat.message"]({ sessionID: event.sessionID }, {
+      parts: [{ type: "text", text: event.prompt.text }],
+    }))
+    const controller = new AbortController()
+    const consume = async () => {
+      try {
+        for await (const event of ctx.event.subscribe({ signal: controller.signal })) {
+          if (controller.signal.aborted) break
+          if (event.location && (event.location.directory !== ctx.location.directory || event.location.workspaceID !== ctx.location.workspaceID)) continue
+          const type = event.type === "session.execution.succeeded" ? "session.idle" : event.type
+          await hooks.event({ event: { type, properties: event.data } })
+        }
+      } catch {
+        if (!controller.signal.aborted) console.error("Pushary event subscription stopped; native prompts remain available.")
+      } finally {
+        await hooks.dispose()
+      }
+    }
+    const events = consume()
+    return async () => {
+      controller.abort()
+      await hooks.dispose()
+      await events
+    }
+  },
+}
 `;
 var openCodePluginModule = () => ({
   marker: OPENCODE_PLUGIN_MARKER,

package/dist/{chunk-L3AFVFGQ.js → chunk-6JAWNRDR.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-6MJWYYAS.js";
+} from "./chunk-6YSEOXP5.js";
 import {
   readJsonSafe,
   writeFileAtomic
@@ -13,7 +13,7 @@ import {
   serializeDeclinedAgents,
   withDeclinedAgent,
   withoutDeclinedAgent
-} from "./chunk-AXJLJJ3M.js";
+} from "./chunk-FXECTHAG.js";
 
 // src/declined-agents-file.ts
 import { join } from "path";

package/dist/{chunk-6MJWYYAS.js → chunk-6YSEOXP5.js}

@@ -1,13 +1,13 @@
 import {
   quoteIfNeeded,
   shellDoubleQuoted
-} from "./chunk-2QREHU4O.js";
+} from "./chunk-CFIQ3252.js";
 import {
   CODEX_QUESTION_TOOLS,
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY,
   withHookHoldBudget
-} from "./chunk-AXJLJJ3M.js";
+} from "./chunk-FXECTHAG.js";
 
 // src/setup/paths.ts
 import { createHash as createHash2 } from "crypto";
@@ -201,18 +201,59 @@ var ensureRecord = (target, key) => {
   return created;
 };
 var CODEX_MCP_URL = "https://pushary.com/api/mcp/mcp";
-var addCodexMcpServer = (config, apiKey) => {
+var CODEX_HTTP_ONLY_FIELDS = ["url", "http_headers", "env_http_headers", "http_headers_helper", "bearer_token", "bearer_token_env_var", "auth", "oauth", "oauth_resource"];
+var NATIVE_MCP_TRANSPORT_FIELDS = [...CODEX_HTTP_ONLY_FIELDS, "args", "env", "env_vars", "cwd"];
+var OLD_CLI_HTTP_FIELDS = /* @__PURE__ */ new Set(["url", "http_headers"]);
+var nativeCodexMcpCommand = () => join2(homedir2(), ".pushary", "bin", "pushary-mcp");
+var isNativeCodexMcpEntry = (entry, command) => {
+  const server = asRecord2(entry);
+  return server?.command === command && NATIVE_MCP_TRANSPORT_FIELDS.every((field) => !(field in server));
+};
+var carriesOnlyAnAuthorizationHeader = (headers) => {
+  const record = asRecord2(headers);
+  return record !== void 0 && Object.keys(record).length === 1 && typeof record.Authorization === "string";
+};
+var isOldCliMixedCodexMcpEntry = (entry, command) => {
+  const server = asRecord2(entry);
+  return server?.command === command && server.url === CODEX_MCP_URL && carriesOnlyAnAuthorizationHeader(server.http_headers) && NATIVE_MCP_TRANSPORT_FIELDS.every((field) => OLD_CLI_HTTP_FIELDS.has(field) || !(field in server));
+};
+var codexMcpMixesCommandWithHttp = (entry) => {
+  const server = asRecord2(entry);
+  return server !== void 0 && "command" in server && CODEX_HTTP_ONLY_FIELDS.some((field) => field in server);
+};
+var CODEX_RESTART_AFTER_TRANSPORT_CHANGE = "Fully quit and reopen Codex to load the updated Pushary configuration.";
+var codexMcpStartsCommand = (config) => {
+  const pushary = asRecord2(asRecord2(config.mcp_servers)?.pushary);
+  return pushary !== void 0 && "command" in pushary && pushary.enabled !== false;
+};
+var addCodexMcpServer = (config, apiKey, nativeOwnership = "preserve") => {
+  const existing = asRecord2(asRecord2(config.mcp_servers)?.pushary);
+  if (existing !== void 0 && "command" in existing) {
+    const command = nativeCodexMcpCommand();
+    if (!isOldCliMixedCodexMcpEntry(existing, command) && !isNativeCodexMcpEntry(existing, command)) {
+      throw new Error("Pushary MCP has an unrecognized or mixed transport. Its configuration was left unchanged.");
+    }
+    if (nativeOwnership === "preserve") {
+      for (const field of OLD_CLI_HTTP_FIELDS) delete existing[field];
+      return "kept-native";
+    }
+  }
   const servers = ensureRecord(config, "mcp_servers");
   const pushary = ensureRecord(servers, "pushary");
+  delete pushary.command;
   pushary.url = CODEX_MCP_URL;
   ensureRecord(pushary, "http_headers").Authorization = `Bearer ${apiKey}`;
   pushary.default_tools_approval_mode = "approve";
   delete pushary.bearer_token_env_var;
   delete pushary.tools;
+  return "wrote-key";
 };
 var readCodexMcpAuth = (config) => {
   const pushary = asRecord2(asRecord2(config.mcp_servers)?.pushary);
   if (!pushary) return void 0;
+  if ("command" in pushary) {
+    return isNativeCodexMcpEntry(pushary, nativeCodexMcpCommand()) ? { method: "native" } : void 0;
+  }
   const authorization = asRecord2(pushary.http_headers)?.Authorization;
   if (typeof authorization === "string" && authorization.startsWith("Bearer ")) {
     return { method: "embedded", key: authorization.slice("Bearer ".length).trim() };
@@ -517,6 +558,9 @@ export {
   codexSkillDir,
   CODEX_HOOK_EVENTS,
   CODEX_REQUIRED_APPROVAL_EVENTS,
+  codexMcpMixesCommandWithHttp,
+  CODEX_RESTART_AFTER_TRANSPORT_CHANGE,
+  codexMcpStartsCommand,
   addCodexMcpServer,
   readCodexMcpAuth,
   isPusharyCodexCommand,

package/dist/{chunk-VIJIG5YL.js → chunk-7E2ZN7XA.js}

@@ -1,10 +1,10 @@
 import {
   autoUpdateLock
-} from "./chunk-6MJWYYAS.js";
+} from "./chunk-6YSEOXP5.js";
 import {
   installPackageGlobally,
   npmErrorMessage
-} from "./chunk-2QREHU4O.js";
+} from "./chunk-CFIQ3252.js";
 import {
   writeJsonAtomic
 } from "./chunk-QENTGE75.js";