pushary 1.9.61 → 1.9.63

package/dist/bin/pushary-wait.js

@@ -2,29 +2,29 @@
 import {
   waitResponse,
   waitWindowResponse
-} from "../chunk-X3YKQJCZ.js";
+} from "../chunk-RAJ3QEIL.js";
 import {
   describeWaitLadder
 } from "../chunk-CVWG2N3Y.js";
 import {
   exitOnFailedSettingsRequest
-} from "../chunk-64S5PQBQ.js";
-import "../chunk-ADR3KHOC.js";
+} from "../chunk-GZS72NCF.js";
+import "../chunk-HZ72EMJE.js";
 import {
   createIo
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-K4MBKXAE.js";
+} from "../chunk-75ODMNOM.js";
 import {
   parseFlags
 } from "../chunk-NMUI3ZWG.js";
-import "../chunk-WN3RACVD.js";
-import "../chunk-YDR4BQ7R.js";
+import "../chunk-IOH2T3CB.js";
+import "../chunk-AB3VAQ25.js";
 import {
   pusharyFetch
-} from "../chunk-7BAO42UV.js";
-import "../chunk-SFAP4AJY.js";
+} from "../chunk-VFJSVPNL.js";
+import "../chunk-L5CDGXPO.js";
 import {
   UsageError,
   exitCodeFor
@@ -32,17 +32,17 @@ import {
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-Y5VKZNFN.js";
-import "../chunk-MWLTTLPK.js";
-import "../chunk-CJ5TCFD4.js";
+import "../chunk-V5W3CK7F.js";
 import "../chunk-QENTGE75.js";
+import "../chunk-MK4USZYQ.js";
+import "../chunk-5LOP4AVD.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-BG4Y64FW.js";
-import "../chunk-ERK24P76.js";
+} from "../chunk-BUQU3OPX.js";
+import "../chunk-6Z2VR3BA.js";
 import "../chunk-QTOLNRET.js";
-import "../chunk-AXJLJJ3M.js";
+import "../chunk-7NCLUA65.js";
 import "../chunk-MLKGABMK.js";
 
 // bin/pushary-wait.ts

package/dist/bin/pushary.js

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
 import {
   installNetworkDefaults
-} from "../chunk-7BAO42UV.js";
-import "../chunk-SFAP4AJY.js";
+} from "../chunk-VFJSVPNL.js";
+import "../chunk-L5CDGXPO.js";
 import "../chunk-PPY5N2E6.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-MWLTTLPK.js";
-import "../chunk-CJ5TCFD4.js";
 import "../chunk-QENTGE75.js";
-import "../chunk-BG4Y64FW.js";
+import "../chunk-MK4USZYQ.js";
+import "../chunk-5LOP4AVD.js";
+import "../chunk-BUQU3OPX.js";
 import {
   LISTED_COMMANDS,
   renderHelp,
   resolveCommandName
-} from "../chunk-ERK24P76.js";
+} from "../chunk-6Z2VR3BA.js";
 import {
   getPackageVersion
 } from "../chunk-QTOLNRET.js";
-import "../chunk-AXJLJJ3M.js";
+import "../chunk-7NCLUA65.js";
 import "../chunk-MLKGABMK.js";
 
 // src/cli/runtime.ts

package/dist/{chunk-ORX5BTV4.js → chunk-2MZ6ROWZ.js}

@@ -1,7 +1,7 @@
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "./chunk-ZEWIMY63.js";
+} from "./chunk-KL76XWZ7.js";
 import {
   AUTO_DECISION_WINDOW_MS,
   DEFAULT_SESSION,
@@ -10,18 +10,19 @@ import {
   permissionDeniedAction,
   releaseThrottle,
   reportEvent
-} from "./chunk-DQLCFGHK.js";
+} from "./chunk-PXAOEFJZ.js";
 import {
   askUser,
   isDecisionStopped,
+  isQuestionLimitRefusal,
   waitForQuestion
-} from "./chunk-RJHX66EY.js";
+} from "./chunk-TBKHQWIH.js";
 import {
   SubscriptionRequiredError
-} from "./chunk-XAO6EYGM.js";
+} from "./chunk-ELAK46NR.js";
 import {
   getMachineId
-} from "./chunk-SFAP4AJY.js";
+} from "./chunk-L5CDGXPO.js";
 import {
   ASK_CONTEXT_MAX,
   agentQuestionContext,
@@ -33,7 +34,7 @@ import {
   questionsShownAsASet,
   shouldDeferToNativeMode,
   wireVerdictFor
-} from "./chunk-AXJLJJ3M.js";
+} from "./chunk-7NCLUA65.js";
 
 // src/machine-decision-audit.ts
 import { basename } from "path";
@@ -103,6 +104,7 @@ var cardOf = (question) => {
   };
 };
 var outcomeOfFailedAsk = (error, sessionId, failure) => {
+  if (isQuestionLimitRefusal(error)) return void 0;
   if (!(error instanceof SubscriptionRequiredError)) return failure;
   announceSubscriptionRequired(error.upgradeUrl, sessionId);
   return void 0;

package/dist/{chunk-7BHI3PZN.js → chunk-3GVV7XVT.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   redactSecretsFromContent
-} from "./chunk-AXJLJJ3M.js";
+} from "./chunk-7NCLUA65.js";
 
 // src/cli/json.ts
 var writeStdoutFully = (text) => new Promise((resolve, reject) => {

package/dist/{chunk-GKFO5JLN.js → chunk-3QLFB2EY.js}

@@ -3,18 +3,18 @@ import {
   addGeminiMcpServer,
   removeGeminiMcpServer,
   supportedClaudeEvents
-} from "./chunk-RGSW36XH.js";
+} from "./chunk-BQFL2ECS.js";
 import {
   CLAUDE_CODE_AGENT,
   compatibleToolLookup
-} from "./chunk-DQLCFGHK.js";
+} from "./chunk-PXAOEFJZ.js";
 import {
   guardBinary,
   guardBinaryRefusing,
   holdBudgetOf,
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-MWLTTLPK.js";
+} from "./chunk-MK4USZYQ.js";
 import {
   HOOK_COMPATIBLE_PROFILES,
   HOOK_LOCATOR_BINARY,
@@ -26,7 +26,7 @@ import {
   pusharyMissingReason,
   refusalOutput,
   withHookHoldBudget
-} from "./chunk-AXJLJJ3M.js";
+} from "./chunk-7NCLUA65.js";
 
 // src/claude-config.ts
 import { join } from "path";

package/dist/{chunk-LBHJJEKT.js → chunk-4WFAP6QN.js}

@@ -4,25 +4,25 @@ import {
 } from "./chunk-XHKBHWLX.js";
 import {
   readControlMode
-} from "./chunk-WN3RACVD.js";
+} from "./chunk-IOH2T3CB.js";
 import {
   getMachineId
-} from "./chunk-SFAP4AJY.js";
-import {
-  pusharyDir
-} from "./chunk-MWLTTLPK.js";
-import {
-  resolveGlobalBinary
-} from "./chunk-CJ5TCFD4.js";
+} from "./chunk-L5CDGXPO.js";
 import {
   readJsonSafe,
   writeFileAtomic,
   writeJsonAtomic,
   writeJsonAtomicDurable
 } from "./chunk-QENTGE75.js";
+import {
+  pusharyDir
+} from "./chunk-MK4USZYQ.js";
+import {
+  resolveGlobalBinary
+} from "./chunk-5LOP4AVD.js";
 import {
   getApiKey
-} from "./chunk-BG4Y64FW.js";
+} from "./chunk-BUQU3OPX.js";
 import {
   CLI_PACKAGE_NAMES,
   cmdShimTarget,
@@ -32,7 +32,7 @@ import {
 } from "./chunk-QTOLNRET.js";
 import {
   isRecord
-} from "./chunk-AXJLJJ3M.js";
+} from "./chunk-7NCLUA65.js";
 
 // src/daemon-lifecycle.ts
 import { dirname, join, win32 as win32Path } from "path";

package/dist/{chunk-PITQ5ZIQ.js → chunk-5JK3DQGZ.js}

@@ -294,7 +294,7 @@ var loadedOnce = (load) => {
 };
 
 // src/codex-desktop-proxy.ts
-var loadThePhone = () => import("./api-LW3PJQYY.js");
+var loadThePhone = () => import("./api-UHUUAONF.js");
 var theFirstCardLoadsAgain = () => {
 };
 var APP_SERVER_COMMAND = "app-server";
@@ -827,7 +827,7 @@ var codexDesktopCommand = async (args, entry, readAccount) => {
     return runCodexDesktopProxy(engine2, args.slice(3), readAccount, { watchesForCards: layoutIsKnown });
   }
   if (args[0] === APP_CARDS_FLAG) {
-    const { codexAppCardsCommandOnThisMac } = await import("./codex-app-cards-switch-BD7LCI2I.js");
+    const { codexAppCardsCommandOnThisMac } = await import("./codex-app-cards-switch-LXMAIOFB.js");
     return codexAppCardsCommandOnThisMac(args.slice(1), entry, readAccount);
   }
   if (args.length > 2) throw new Error("Usage: pushary codex --desktop [path/to/Codex.app]");

package/dist/{chunk-CJ5TCFD4.js → chunk-5LOP4AVD.js}

@@ -366,9 +366,9 @@ var installGlobally = (options) => {
   }
   const started = (async () => {
     if (!npmIsOnPath()) throw new NpmMissingError();
-    const { withUpgradeLock } = await import("./global-upgrade-IUXJJDWF.js");
-    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-DDB7WEWC.js");
-    const { autoUpdateLock } = await import("./paths-A5GAR5PL.js");
+    const { withUpgradeLock } = await import("./global-upgrade-NRMHNLNU.js");
+    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-VAYJZVTB.js");
+    const { autoUpdateLock } = await import("./paths-7VTVOQXJ.js");
     let result = "skipped";
     const install = async () => {
       const platform = process.platform;

package/dist/{chunk-ERK24P76.js → chunk-6Z2VR3BA.js}

@@ -2,7 +2,7 @@ import {
   DISCONNECT_AGENT_IDS,
   SETUP_AGENT_CHOICES,
   isApprovalMode
-} from "./chunk-AXJLJJ3M.js";
+} from "./chunk-7NCLUA65.js";
 
 // src/cli/mode-request.ts
 var parseDuration = (value) => {
@@ -127,7 +127,7 @@ var COMMAND_LIST = [
   {
     name: "transcripts",
     module: "pushary-transcripts",
-    summary: "Show or re-trust the keys this machine seals transcripts to",
+    summary: "Turn transcript sync on or off, or show and re-trust the keys it seals to",
     detail: [
       "Sync stops if the phone key or the compliance recovery key changes, because a",
       "change is either your reinstall or a server handing itself a copy. Compare the",
@@ -168,6 +168,8 @@ var COMMAND_OPTIONS = {
     ["--yes", "Remove everything without asking"]
   ],
   transcripts: [
+    ["on", "Sync encrypted transcripts from this machine so your phone shows the conversation"],
+    ["off", "Stop syncing transcripts from this machine"],
     ["status", "Show the pinned keys and their fingerprints (default)"],
     ["trust --rotate", "Accept the keys the server is offering now and resume syncing"]
   ],

package/dist/{chunk-K4MBKXAE.js → chunk-75ODMNOM.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   renderCommandHelp
-} from "./chunk-ERK24P76.js";
+} from "./chunk-6Z2VR3BA.js";
 import {
   getPackageVersion
 } from "./chunk-QTOLNRET.js";

package/dist/{chunk-YPD3MTFU.js → chunk-7GRQGXF4.js}

@@ -1,7 +1,7 @@
 import {
   localRepoKey,
   normalizeRepoRemote
-} from "./chunk-AXJLJJ3M.js";
+} from "./chunk-7NCLUA65.js";
 
 // src/repo.ts
 import { existsSync, readFileSync, statSync } from "fs";

package/dist/{chunk-AXJLJJ3M.js → chunk-7NCLUA65.js}

@@ -168,7 +168,8 @@ var defaults = {
   activationGuide: null,
   enforcementDetail: "Cooperative. The agent chooses when to ask; no native permission interception.",
   capabilityNote: "",
-  documented: true
+  documented: true,
+  keepsSessionHistory: false
 };
 var AGENTS = {
   claude_code: {
@@ -184,7 +185,8 @@ var AGENTS = {
     enforcement: "enforced",
     connectVia: "Native hooks + MCP",
     setupCommand: PUSHARY_SETUP_COMMAND,
-    enforcementDetail: "Shell, writes and edits, subject to Claude Code permission mode and explicit policy."
+    enforcementDetail: "Shell, writes and edits, subject to Claude Code permission mode and explicit policy.",
+    keepsSessionHistory: true
   },
   claude_chat: {
     ...defaults,
@@ -211,7 +213,8 @@ var AGENTS = {
     enforcement: "enforced",
     connectVia: "Native hooks + MCP",
     setupCommand: PUSHARY_SETUP_COMMAND,
-    enforcementDetail: "Shell and apply_patch edits through native permission hooks; requires a compatible Codex runtime."
+    enforcementDetail: "Shell and apply_patch edits through native permission hooks; requires a compatible Codex runtime.",
+    keepsSessionHistory: true
   },
   chatgpt: {
     ...defaults,
@@ -231,7 +234,8 @@ var AGENTS = {
     enforcement: "enforced",
     connectVia: "Native hooks + MCP",
     setupCommand: PUSHARY_SETUP_COMMAND,
-    enforcementDetail: "Shell, writes, edits and MCP calls through native BeforeTool hooks."
+    enforcementDetail: "Shell, writes, edits and MCP calls through native BeforeTool hooks.",
+    keepsSessionHistory: true
   },
   hermes: {
     ...defaults,
@@ -427,6 +431,9 @@ var POLICY_AGENTS = [...Object.values(AGENTS).flatMap((agent) => agent.policyAge
 var AGENT_LABELS_BY_TYPE = Object.fromEntries(
   Object.entries(AGENTS).flatMap(([id, agent]) => agent.hasStoredIdentity ? [[id, agent.label]] : [])
 );
+var SESSION_HISTORY_AGENT_TYPES = Object.freeze(
+  Object.entries(AGENTS).flatMap(([id, agent]) => agent.keepsSessionHistory ? [id] : [])
+);
 var DISCONNECTABLE_AGENTS = Object.freeze(Object.values(AGENTS).flatMap((agent) => agent.disconnectable && agent.hookSource !== null ? [agent.hookSource] : []));
 var REPO_AWARE_AGENTS = Object.freeze(Object.values(AGENTS).flatMap((agent) => agent.repoAware ? [agent.policyAgent] : []));
 var MANAGED_PROVIDERS = Object.freeze(Object.values(AGENTS).flatMap((agent) => agent.managedProvider ? [agent.hookSource] : []));
@@ -976,6 +983,40 @@ var redactSecrets = (text2) => applyRedactionRules(SECRET_REDACTION_RULES, text2
 var redactSecretsFromContent = (text2) => applyRedactionRules(CUT_OFF_TEXT_REDACTION_RULES, text2);
 var redactSecretsDeep = (text2) => redactSecrets(text2).replace(HIGH_ENTROPY_RULE.pattern, HIGH_ENTROPY_RULE.replacement);
 
+// ../contracts/src/cursor.ts
+var CURSOR_GATE_EVENTS = ["beforeShellExecution", "beforeMCPExecution", "preToolUse"];
+var CURSOR_GATE_SCRIPT = "pushary-gate.mjs";
+var CURSOR_SHELL_TOOL = "Shell";
+var CURSOR_MCP_TOOL_PREFIX = "MCP:";
+var CURSOR_FILE_GATE_TOOLS = ["Write", "Delete", "Edit"];
+var CURSOR_GATE_COVERAGE = [
+  { event: "beforeShellExecution", covers: { kind: "named", tools: [CURSOR_SHELL_TOOL] }, matcherNamesTools: false },
+  { event: "beforeMCPExecution", covers: { kind: "prefix", prefix: CURSOR_MCP_TOOL_PREFIX }, matcherNamesTools: false },
+  { event: "preToolUse", covers: { kind: "named", tools: CURSOR_FILE_GATE_TOOLS }, matcherNamesTools: true }
+];
+var isCursorHookPayload = (value) => isRecord(value) && typeof value.cursor_version === "string" && value.cursor_version.length > 0;
+var NO_CURSOR_GATE = [];
+var PLAIN_TOOL_NAME = /^[\w:]+$/;
+var matcherMatchesEveryCall = (matcher) => matcher === void 0 || matcher === "" || matcher === "*";
+var isPlainToolName = (name) => PLAIN_TOOL_NAME.test(name);
+var toolNamesInMatcher = (matcher) => {
+  if (typeof matcher !== "string") return [];
+  const names = matcher.split("|");
+  return names.every(isPlainToolName) ? names : [];
+};
+var narrowedByMatcher = (covers, matcher) => {
+  if (covers.kind !== "named") return null;
+  const named = toolNamesInMatcher(matcher);
+  const tools = covers.tools.filter((tool) => named.includes(tool));
+  return tools.length > 0 ? { kind: "named", tools } : null;
+};
+var toolsCoveredByGateEntry = (coverage, matcher) => {
+  if (matcherMatchesEveryCall(matcher)) return coverage.covers;
+  return coverage.matcherNamesTools ? narrowedByMatcher(coverage.covers, matcher) : null;
+};
+var toolMatches = (match, toolName) => match.kind === "named" ? match.tools.includes(toolName) : toolName.startsWith(match.prefix);
+var cursorGateOwnsToolCall = (registration, toolName) => typeof toolName === "string" && registration.some((match) => toolMatches(match, toolName));
+
 // ../contracts/src/shell-analysis.ts
 var SHELL_WORD_SEPARATOR = /[ \t\n]/;
 var ARITHMETIC_EVALUATING_EXPANSION = /\$[#+=~^]*(?:[A-Za-z_][A-Za-z0-9_]*|[0-9]+|[-?$!@*#])?\[/;
@@ -2612,6 +2653,23 @@ var AUTH_REJECTION_REASONS = [
   "site_not_found",
   ...AGENT_SITE_REJECTION_REASONS
 ];
+var TOOL_FAILURE_META_KEY = "pushary/failure";
+var TOOL_FAILURE_CODES = {
+  questionLimit: "question_limit",
+  invalidRequest: "invalid_request"
+};
+var TOOL_FAILURE_CODE_VALUES = Object.values(TOOL_FAILURE_CODES);
+var isToolFailureCode = (value) => typeof value === "string" && TOOL_FAILURE_CODE_VALUES.includes(value);
+var isToolErrorResult = (result) => isRecord(result) && result.isError === true;
+var toolFailureMetaOf = (result) => {
+  const meta = result._meta;
+  return isRecord(meta) && Object.hasOwn(meta, TOOL_FAILURE_META_KEY) ? meta[TOOL_FAILURE_META_KEY] : void 0;
+};
+var toolFailureCodeOfResult = (result) => {
+  if (!isToolErrorResult(result)) return null;
+  const code = toolFailureMetaOf(result);
+  return isToolFailureCode(code) ? code : null;
+};
 
 // ../contracts/src/setup-wire.ts
 var PAIR_TTL_SECONDS = 900;
@@ -2988,6 +3046,20 @@ var codexNativeApprovalResponse = (approval, answer) => {
   return { decision: accepted ? "accept" : approval.negativeDecision };
 };
 
+// ../contracts/src/transcript-record.ts
+var COMPRESSED_TRANSCRIPT_RECORD_MARKER = 1;
+var TRANSCRIPT_RECORD_MAX_INFLATED_BYTES = 1024 * 1024;
+var compressionShrinks = (raw, deflated) => deflated.length + 1 < raw.length;
+var compressTranscriptRecord = (raw, deflateRaw) => {
+  if (raw.length > TRANSCRIPT_RECORD_MAX_INFLATED_BYTES) return raw;
+  const deflated = deflateRaw(raw);
+  if (!compressionShrinks(raw, deflated)) return raw;
+  const record3 = new Uint8Array(deflated.length + 1);
+  record3[0] = COMPRESSED_TRANSCRIPT_RECORD_MARKER;
+  record3.set(deflated, 1);
+  return record3;
+};
+
 // ../contracts/src/index.ts
 var KEY_SCOPES = ["full_access", "agent", "connector", "bound"];
 var normalizeKeyScope = (value) => typeof value === "string" && KEY_SCOPES.includes(value) ? value : null;
@@ -3112,10 +3184,10 @@ var hookWaitDeadline = (startMs, policyWaitSeconds, agent, nowMs) => {
 var hookWaitClamped = (startMs, policyWaitSeconds, agent, nowMs) => startMs + hookMaxWaitSeconds(agent) * 1e3 < nowMs + Math.max(policyWaitSeconds, 0) * 1e3;
 var effectiveWaitSeconds = (timeoutAction, policySeconds, agent) => timeoutAction === "wait" ? hookMaxWaitSeconds(agent) : policySeconds;
 var OPENCODE_APPROVAL_EVENT = "permission.ask";
-var CURSOR_GATE_EVENTS = ["beforeShellExecution", "beforeMCPExecution", "preToolUse"];
 var hasNativeApprovalPrompt = (source, event) => !(source === "cursor" && event === "preToolUse") && !(source === "antigravity" && event === "PreToolUse");
 var SUPPORT_EMAIL = "business@pushary.com";
 var SUPPORT_DISCORD = "https://discord.gg/9v3VvUByrr";
+var HOOK_VERSION_PATTERN = /^\d+\.\d+\.\d+$/;
 var HOOK_LOCATOR_BINARY = "pushary-bridge";
 var isTokenCount = (value) => typeof value === "number" && Number.isInteger(value) && value >= 0;
 var reportableSessionId = (value) => typeof value === "string" && value.length > 0 && value.length <= SESSION_ID_MAX_LENGTH ? value : null;
@@ -5769,9 +5841,16 @@ var codexAskUnanswered = (ask) => ({ kind: "deny", reason: unansweredRefusalReas
 var ruleApprovesAfterItsFullWindow = (ask) => ask.mode === "push_only" && ask.fullWindowServed && ask.timeoutAction === "approve";
 var codexUnansweredPreToolUse = (ask) => ruleApprovesAfterItsFullWindow(ask) ? CODEX_ASK_PASSES : codexAskUnanswered(ask);
 var HANDED_BACK_REASON = "Handling on your machine";
+var HAND_BACK_TO_THE_AGENTS_PROMPT = { kind: "agent_prompt" };
 var HAND_BACK_WITHOUT_A_PROMPT = { kind: "refuse", reason: NO_AGENT_PROMPT_REASON };
 var CODEX_HAND_BACK_REASON = "You chose to handle this on your machine, so it did not run. Ask Codex to run it again while you are at your computer, or run it yourself.";
 var CODEX_PRE_TOOL_USE_HAND_BACK = { kind: "refuse", reason: CODEX_HAND_BACK_REASON };
+var QUESTION_LIMIT_REASON = "Pushary already has as many open questions in this session as it allows, so nobody was asked about this and it did not run. Wait until the person answers or cancels one before trying it again.";
+var QUESTION_LIMIT_PROMPT_REASON = "Pushary has too many open questions in this session, so this was not sent to the phone. Approve it here.";
+var QUESTION_LIMIT_REFUSAL = { kind: "refuse", reason: QUESTION_LIMIT_REASON };
+var questionLimitRefuses = ({ refusesUnanswered, agentPromptFollows }) => refusesUnanswered || !agentPromptFollows;
+var questionLimitHandBack = (facts) => questionLimitRefuses(facts) ? QUESTION_LIMIT_REFUSAL : HAND_BACK_TO_THE_AGENTS_PROMPT;
+var refusesWhenUnanswered = ({ mode, timeoutAction }) => mode === "push_only" && timeoutAction === "deny";
 var codexDeferredPreToolUse = () => ({ kind: "deny", reason: CODEX_PRE_TOOL_USE_HAND_BACK.reason });
 var isScopeReason = (scopeReason) => typeof scopeReason === "string" && scopeReason.length > 0;
 var scopeBreachReasonOf = (verdict) => verdict.kind === "gate" && isScopeReason(verdict.scopeReason) ? verdict.scopeReason : void 0;
@@ -6239,6 +6318,13 @@ export {
   redactSecrets,
   redactSecretsFromContent,
   redactSecretsDeep,
+  CURSOR_GATE_EVENTS,
+  CURSOR_GATE_SCRIPT,
+  CURSOR_GATE_COVERAGE,
+  isCursorHookPayload,
+  NO_CURSOR_GATE,
+  toolsCoveredByGateEntry,
+  cursorGateOwnsToolCall,
   degradedLine,
   hookWritePath,
   MAX_HOOK_ACTIVATION_EVIDENCE_ROWS,
@@ -6246,6 +6332,9 @@ export {
   hookActivationResult,
   CLIENT_REPORT_PATH,
   clientContextHeaders,
+  TOOL_FAILURE_CODES,
+  isToolErrorResult,
+  toolFailureCodeOfResult,
   PAIR_TTL_SECONDS,
   computerOsOfPlatform,
   SETUP_AGENT_CHOICES,
@@ -6270,6 +6359,7 @@ export {
   CODEX_NATIVE_APPROVAL_REPLIES,
   parseCodexNativeApproval,
   codexNativeApprovalResponse,
+  compressTranscriptRecord,
   normalizeKeyScope,
   isApprovalMode,
   approvalModeWithoutLocalPrompt,
@@ -6290,10 +6380,10 @@ export {
   hookWaitClamped,
   effectiveWaitSeconds,
   OPENCODE_APPROVAL_EVENT,
-  CURSOR_GATE_EVENTS,
   hasNativeApprovalPrompt,
   SUPPORT_EMAIL,
   SUPPORT_DISCORD,
+  HOOK_VERSION_PATTERN,
   HOOK_LOCATOR_BINARY,
   isTokenCount,
   reportableSessionId,
@@ -6342,6 +6432,9 @@ export {
   codexUnansweredPreToolUse,
   HANDED_BACK_REASON,
   HAND_BACK_WITHOUT_A_PROMPT,
+  QUESTION_LIMIT_PROMPT_REASON,
+  questionLimitHandBack,
+  refusesWhenUnanswered,
   codexDeferredPreToolUse,
   scopeBreachReasonOf,
   codexPreToolUseDelivery,

package/dist/{chunk-YDR4BQ7R.js → chunk-AB3VAQ25.js}

@@ -1,6 +1,6 @@
 import {
   pusharyFetch
-} from "./chunk-7BAO42UV.js";
+} from "./chunk-VFJSVPNL.js";
 import {
   NetworkError
 } from "./chunk-PPY5N2E6.js";
@@ -9,11 +9,11 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   getBaseUrl
-} from "./chunk-BG4Y64FW.js";
+} from "./chunk-BUQU3OPX.js";
 import {
   isValidApiKey,
   normalizeKeyScope
-} from "./chunk-AXJLJJ3M.js";
+} from "./chunk-7NCLUA65.js";
 
 // src/session.ts
 var samePusharyAccount = (left, right) => left.kind === "ok" && right.kind === "ok" && left.identity.workspaceId !== "" && left.identity.workspaceId === right.identity.workspaceId && left.identity.siteId === right.identity.siteId;

package/dist/{chunk-2AELPDMT.js → chunk-BCVCUDFI.js}

@@ -1,9 +1,16 @@
 import {
+  compressTranscriptRecord,
   redactSecretsFromContent
-} from "./chunk-AXJLJJ3M.js";
+} from "./chunk-7NCLUA65.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";
+
+// ../contracts/src/transcript-record-node.ts
+import { deflateRawSync, inflateRawSync } from "zlib";
+var deflateRaw = (raw) => new Uint8Array(deflateRawSync(raw));
+
+// src/crypto.ts
 var EPH_PUB_LEN = nacl.box.publicKeyLength;
 var BOX_NONCE_LEN = nacl.box.nonceLength;
 var SECRETBOX_NONCE_LEN = nacl.secretbox.nonceLength;
@@ -23,14 +30,17 @@ var wrapSessionKey = (sessionKey, accountPublicKey) => {
   bundle.set(box, EPH_PUB_LEN + BOX_NONCE_LEN);
   return toBase64(bundle);
 };
-var encryptRecord = (plaintext, sessionKey) => {
+var sealRecordBytes = (plaintext, sessionKey) => {
   const nonce = nacl.randomBytes(SECRETBOX_NONCE_LEN);
-  const box = nacl.secretbox(utf8Encode(plaintext), nonce, sessionKey);
+  const box = nacl.secretbox(plaintext, nonce, sessionKey);
   const bundle = new Uint8Array(SECRETBOX_NONCE_LEN + box.length);
   bundle.set(nonce, 0);
   bundle.set(box, SECRETBOX_NONCE_LEN);
   return toBase64(bundle);
 };
+var encryptRecord = (plaintext, sessionKey) => sealRecordBytes(utf8Encode(plaintext), sessionKey);
+var encryptCompressedRecord = (plaintext, sessionKey) => sealRecordBytes(compressTranscriptRecord(utf8Encode(plaintext), deflateRaw), sessionKey);
+var recordSealerFor = (compressRecords) => compressRecords ? encryptCompressedRecord : encryptRecord;
 
 // src/transcript-capture.ts
 import { createHmac } from "crypto";
@@ -123,7 +133,7 @@ var redactDeep = (value) => {
   return value;
 };
 var localIdFor = (parsed, rawLine, sessionKey) => typeof parsed.uuid === "string" && parsed.uuid.length > 0 ? parsed.uuid : createHmac("sha256", sessionKey).update(rawLine).digest("hex").slice(0, 32);
-var buildTranscriptRecords = (lines, sessionKey, seen = /* @__PURE__ */ new Set()) => {
+var buildTranscriptRecords = (lines, sessionKey, seen = /* @__PURE__ */ new Set(), sealRecord = encryptRecord) => {
   const records = [];
   const nextSeen = new Set(seen);
   for (const line of lines) {
@@ -142,7 +152,7 @@ var buildTranscriptRecords = (lines, sessionKey, seen = /* @__PURE__ */ new Set(
     nextSeen.add(localId);
     const redacted = redactDeep(parsed);
     fitWithinPlaintextBudget(redacted);
-    const content = encryptRecord(JSON.stringify(redacted), sessionKey);
+    const content = sealRecord(JSON.stringify(redacted), sessionKey);
     records.push({ localId, content });
   }
   return { records, seen: nextSeen };
@@ -153,5 +163,6 @@ export {
   generateSessionKey,
   wrapSessionKey,
   encryptRecord,
+  recordSealerFor,
   buildTranscriptRecords
 };

package/dist/{chunk-RGSW36XH.js → chunk-BQFL2ECS.js}

@@ -5,16 +5,16 @@ import {
 import {
   NOTIFICATION_MATCHED_TYPES,
   POSTTOOLUSE_MIRRORED_TOOLS
-} from "./chunk-33OOEVPG.js";
+} from "./chunk-VC3HFFMQ.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-MWLTTLPK.js";
+} from "./chunk-MK4USZYQ.js";
 import {
   CLAUDE_PRETOOLUSE_MATCHER,
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY
-} from "./chunk-AXJLJJ3M.js";
+} from "./chunk-7NCLUA65.js";
 
 // src/gemini-config.ts
 var GEMINI_HOOK_BINARY = "pushary-gemini-hook";

package/dist/{chunk-BG4Y64FW.js → chunk-BUQU3OPX.js}

@@ -1,6 +1,6 @@
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-ERK24P76.js";
+} from "./chunk-6Z2VR3BA.js";
 
 // src/config.ts
 import { readFileSync } from "fs";

package/dist/{chunk-SHJVFW22.js → chunk-CLABCSZC.js}

@@ -1,12 +1,12 @@
-import {
-  pusharyDir
-} from "./chunk-MWLTTLPK.js";
 import {
   readJsonSafe
 } from "./chunk-QENTGE75.js";
+import {
+  pusharyDir
+} from "./chunk-MK4USZYQ.js";
 import {
   isRecord
-} from "./chunk-AXJLJJ3M.js";
+} from "./chunk-7NCLUA65.js";
 
 // src/process-ownership.ts
 import { createHash, randomUUID } from "crypto";