pushary 1.9.66 → 1.9.68

package/dist/{chunk-376TUN72.js → chunk-MMTA7UKA.js}

@@ -1,13 +1,13 @@
 import {
   readJsonSafe,
   writeJsonAtomic
-} from "./chunk-KS3O6O7E.js";
+} from "./chunk-NAQCWM4U.js";
 import {
   configFilePath
-} from "./chunk-A47UKPC7.js";
+} from "./chunk-32OSSYGZ.js";
 import {
   readSetupOutcomeProperties
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/diagnostics/service-runtime.ts
 var unescapeXml = (value) => value.replaceAll("&quot;", '"').replaceAll("&apos;", "'").replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&amp;", "&");

package/dist/{chunk-XGFFNERF.js → chunk-MUDUWF74.js}

@@ -1,6 +1,6 @@
 import {
   readTranscriptPreference
-} from "./chunk-CNJ7SI5V.js";
+} from "./chunk-PBEW5CJK.js";
 
 // src/transcript-setting.ts
 var transcriptEnvironmentPreference = () => {

package/dist/{chunk-KS3O6O7E.js → chunk-NAQCWM4U.js}

@@ -443,9 +443,9 @@ var installGlobally = (options) => {
   }
   const started = (async () => {
     if (!npmIsOnPath()) throw new NpmMissingError();
-    const { withUpgradeLock } = await import("./global-upgrade-ABF5O3HU.js");
-    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-EZ5JIPJE.js");
-    const { autoUpdateLock } = await import("./paths-FO76CFRQ.js");
+    const { withUpgradeLock } = await import("./global-upgrade-XZ5L7LDB.js");
+    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-VQORI6G5.js");
+    const { autoUpdateLock } = await import("./paths-EOMNC4QM.js");
     let result = "skipped";
     const install = async () => {
       const platform = process.platform;

package/dist/{chunk-TQNFDNJA.js → chunk-NKPSJOHJ.js}

@@ -4,30 +4,30 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "./chunk-QOIPUYUD.js";
+} from "./chunk-XZKSUJ55.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
   describeIdleWindow,
   idleDeadlinePassed,
   startProcessOwnership
-} from "./chunk-3ELJIG2R.js";
+} from "./chunk-MCNHNIRC.js";
 import {
   spawnClaude
 } from "./chunk-XHKBHWLX.js";
 import {
   repoKeyFor
-} from "./chunk-XXIJBYNW.js";
+} from "./chunk-GMHQYX3D.js";
 import {
   isAskUserResponse,
   isDecisionStopped,
   isWaitForAnswerResponse,
   withdrawQuestion,
   writeDegraded
-} from "./chunk-ZAZUDYSF.js";
+} from "./chunk-QYTOYNV2.js";
 import {
   callMcpTool,
   isRetryable
-} from "./chunk-Q5RNYE2L.js";
+} from "./chunk-PZZKXX6Q.js";
 import {
   AGENT_QUESTION_DESCRIPTION_MAX,
   AGENT_QUESTION_HEADER_MAX,
@@ -48,7 +48,7 @@ import {
   parseCodexQuestions,
   planElicitationAsk,
   readElicitationFields
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/codex-question-owner.ts
 import { createHash } from "crypto";

package/dist/{chunk-DPU6H4JY.js → chunk-NLDEC4Y7.js}

@@ -8,20 +8,20 @@ import {
   everyProgramFileIsThere,
   installedCodexApp,
   shellQuoted
-} from "./chunk-AVWECJSN.js";
+} from "./chunk-ORHVVRVL.js";
 import {
   writeHuman
 } from "./chunk-QCGNGEGE.js";
 import {
   xml
-} from "./chunk-57NTMVMI.js";
+} from "./chunk-EUU5PDUI.js";
 import {
   CODEX_APP_LAUNCH_AT_LOGIN_VERB,
   CODEX_APP_LAUNCH_VARIABLE
 } from "./chunk-E46NE7FB.js";
 import {
   writeFileAtomic
-} from "./chunk-KS3O6O7E.js";
+} from "./chunk-NAQCWM4U.js";
 
 // src/codex-app-cards-switch.ts
 import { execFileSync as execFileSync2 } from "child_process";

package/dist/{chunk-XEXF2OFZ.js → chunk-NWN6GGJL.js}

@@ -1,10 +1,10 @@
 import {
   getBaseUrl
-} from "./chunk-A47UKPC7.js";
+} from "./chunk-32OSSYGZ.js";
 import {
   compressTranscriptRecord,
   redactSecretsFromContent
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/transcript-api.ts
 var fetchTranscriptRecipients = async (apiKey, baseUrl = getBaseUrl()) => {

package/dist/{chunk-IGO3AGZK.js → chunk-O655YCOG.js}

@@ -1,17 +1,17 @@
 import {
   compatibleConfigFile,
   hasCompatibleHooks
-} from "./chunk-3EZP5ZPS.js";
+} from "./chunk-TVVJ6OYG.js";
 import {
   pusharyHookExecutable
-} from "./chunk-YQDCTID4.js";
+} from "./chunk-73DHP3JX.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-GDLT32I4.js";
+} from "./chunk-LQAAOXYJ.js";
 import {
   isRecord
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/cursor-config.ts
 var hookCommandOf = (entry) => {

package/dist/{chunk-5FJDODOA.js → chunk-ODAAK2RZ.js}

@@ -3,13 +3,13 @@ import {
   NpmMissingError,
   NpmPermissionError,
   writeFileAtomic
-} from "./chunk-KS3O6O7E.js";
+} from "./chunk-NAQCWM4U.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-GO7YKPT3.js";
+} from "./chunk-X2MTVD4W.js";
 import {
   readSetupAgentFailures
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/setup/config-write.ts
 var AgentConfigWriteError = class extends Error {

package/dist/{chunk-AVWECJSN.js → chunk-ORHVVRVL.js}

@@ -294,7 +294,7 @@ var loadedOnce = (load) => {
 };
 
 // src/codex-desktop-proxy.ts
-var loadThePhone = () => import("./api-GDSVUTI2.js");
+var loadThePhone = () => import("./api-6Q7XIB67.js");
 var theFirstCardLoadsAgain = () => {
 };
 var APP_SERVER_COMMAND = "app-server";
@@ -827,7 +827,7 @@ var codexDesktopCommand = async (args, entry, readAccount) => {
     return runCodexDesktopProxy(engine2, args.slice(3), readAccount, { watchesForCards: layoutIsKnown });
   }
   if (args[0] === APP_CARDS_FLAG) {
-    const { codexAppCardsCommandOnThisMac } = await import("./codex-app-cards-switch-W7OLKOMO.js");
+    const { codexAppCardsCommandOnThisMac } = await import("./codex-app-cards-switch-VZ4XIDJO.js");
     return codexAppCardsCommandOnThisMac(args.slice(1), entry, readAccount);
   }
   if (args.length > 2) throw new Error("Usage: pushary codex --desktop [path/to/Codex.app]");

package/dist/{chunk-YB3HMDKE.js → chunk-P4XZX7CL.js}

@@ -4,10 +4,10 @@ import {
   keyPrefix,
   readConfigFileKey,
   readMacAppKeyPrefix
-} from "./chunk-CNJ7SI5V.js";
+} from "./chunk-PBEW5CJK.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-GO7YKPT3.js";
+} from "./chunk-X2MTVD4W.js";
 
 // src/key-signed-out.ts
 var VERDICT_BY_CHECK = {

package/dist/{chunk-CNJ7SI5V.js → chunk-PBEW5CJK.js}

@@ -1,19 +1,19 @@
 import {
   resolveInstallSourceFor
-} from "./chunk-XIJTXRWB.js";
+} from "./chunk-METUT7V4.js";
 import {
   backupFile,
   readJsonSafe,
   writeFileAtomic,
   writeJsonAtomic
-} from "./chunk-KS3O6O7E.js";
+} from "./chunk-NAQCWM4U.js";
 import {
   configFilePath
-} from "./chunk-A47UKPC7.js";
+} from "./chunk-32OSSYGZ.js";
 import {
   API_KEY_PREFIX_PATTERN,
   isRecord
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/shell-alias.ts
 import { homedir } from "os";

package/dist/{chunk-CN6JFM62.js → chunk-PEPRUUGM.js}

@@ -1,18 +1,19 @@
 import {
   macAppBridgeAvailable
-} from "./chunk-7LK3Y6ET.js";
+} from "./chunk-CB4U6WRP.js";
 import {
   keyPrefix
-} from "./chunk-CNJ7SI5V.js";
+} from "./chunk-PBEW5CJK.js";
 import {
   bridgeAgentKey
-} from "./chunk-GDLT32I4.js";
+} from "./chunk-LQAAOXYJ.js";
 import {
   readJsonSafe
-} from "./chunk-KS3O6O7E.js";
+} from "./chunk-NAQCWM4U.js";
 import {
+  isRecord,
   isValidApiKey
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/shared-mcp-key.ts
 var asRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
@@ -37,7 +38,13 @@ var readMacAppAgentKey = () => {
 };
 var macAppConnectionOf = (appKey, appInstalled) => appKey !== null && appInstalled() ? { kind: "connected", keyPrefix: keyPrefix(appKey) } : NOT_CONNECTED;
 var readMacAppConnection = () => macAppConnectionOf(readMacAppAgentKey(), macAppBridgeAvailable);
-var readMacAppConnectionWhenKeyless = (cliKey) => cliKey ? NOT_CONNECTED : readMacAppConnection();
+var keyWrittenByMacApp = (configFileKey, macAppKey = readMacAppAgentKey()) => Boolean(configFileKey) && configFileKey === macAppKey;
+var keyStoredIn = (configFile) => {
+  const stored = readJsonSafe(configFile);
+  return stored.kind === "ok" && isRecord(stored.value) ? pusharyKey(stored.value.apiKey) : null;
+};
+var configFileHoldsMacAppKey = (configFile, macAppKey = readMacAppAgentKey()) => keyWrittenByMacApp(keyStoredIn(configFile), macAppKey);
+var readMacAppConnectionWhenKeyless = (cliKey, cliKeyIsTheMacAppsOwn = false) => cliKey && !cliKeyIsTheMacAppsOwn ? NOT_CONNECTED : readMacAppConnection();
 
 export {
   pusharyKey,
@@ -48,5 +55,7 @@ export {
   PAIR_FROM_MAC_APP,
   readMacAppAgentKey,
   readMacAppConnection,
+  keyWrittenByMacApp,
+  configFileHoldsMacAppKey,
   readMacAppConnectionWhenKeyless
 };

package/dist/{chunk-QN25WBXL.js → chunk-PGOPIIOQ.js}

@@ -1,25 +1,25 @@
 import {
   registerTranscript
-} from "./chunk-SVKCYUYP.js";
+} from "./chunk-Q6JXE3PD.js";
 import {
   namedEvent
-} from "./chunk-3EZP5ZPS.js";
+} from "./chunk-TVVJ6OYG.js";
 import {
   isBridgeLocator,
   liveBridgeProbe,
   pusharyHookExecutable,
   resolveBridgeStub
-} from "./chunk-YQDCTID4.js";
+} from "./chunk-73DHP3JX.js";
 import {
   writeDegraded
-} from "./chunk-ZAZUDYSF.js";
+} from "./chunk-QYTOYNV2.js";
 import {
   cursorUserHooks
-} from "./chunk-GDLT32I4.js";
+} from "./chunk-LQAAOXYJ.js";
 import {
   atLeast,
   parseVersion
-} from "./chunk-KS3O6O7E.js";
+} from "./chunk-NAQCWM4U.js";
 import {
   CURSOR_GATE_COVERAGE,
   CURSOR_GATE_SCRIPT,
@@ -33,7 +33,7 @@ import {
   isGrokSessionEndStop,
   isRecord,
   toolsCoveredByGateEntry
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/tool-hook-input.ts
 var OPTIONAL_TEXT_FIELDS = ["hook_event_name", "session_id", "cwd", "transcript_path", "tool_use_id", "permission_mode", "cursor_version"];

package/dist/{chunk-Q5RNYE2L.js → chunk-PZZKXX6Q.js}

@@ -1,17 +1,17 @@
 import {
   keyCheckFromResponse
-} from "./chunk-QR2QWGQI.js";
+} from "./chunk-BSMHSN3Y.js";
 import {
   installNetworkDefaults
-} from "./chunk-GECU7V44.js";
+} from "./chunk-MHC34X5A.js";
 import {
   getBaseUrl
-} from "./chunk-A47UKPC7.js";
+} from "./chunk-32OSSYGZ.js";
 import {
   isRecord,
   isToolErrorResult,
   toolFailureCodeOfResult
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/retry.ts
 var isRetryable = (err) => {

package/dist/{chunk-SVKCYUYP.js → chunk-Q6JXE3PD.js}

@@ -3,13 +3,13 @@ import {
   loadPin,
   savePin,
   verifyRecipients
-} from "./chunk-DBUHSUL7.js";
+} from "./chunk-4TIN3T2A.js";
 import {
   ensureDaemonRunning
-} from "./chunk-57NTMVMI.js";
+} from "./chunk-EUU5PDUI.js";
 import {
   hookOwnerOf
-} from "./chunk-YQDCTID4.js";
+} from "./chunk-73DHP3JX.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
@@ -18,26 +18,26 @@ import {
   recordSealerFor,
   uploadTranscriptRecords,
   wrapSessionKey
-} from "./chunk-XEXF2OFZ.js";
+} from "./chunk-NWN6GGJL.js";
 import {
   transcriptEnvironmentPreference,
   transcriptsEnabled
-} from "./chunk-XGFFNERF.js";
+} from "./chunk-MUDUWF74.js";
 import {
   readTranscriptPreference
-} from "./chunk-CNJ7SI5V.js";
+} from "./chunk-PBEW5CJK.js";
 import {
   claudeConfigDir,
   codexHome,
   pusharyDir
-} from "./chunk-GDLT32I4.js";
+} from "./chunk-LQAAOXYJ.js";
 import {
   writeJsonAtomic
-} from "./chunk-KS3O6O7E.js";
+} from "./chunk-NAQCWM4U.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-A47UKPC7.js";
+} from "./chunk-32OSSYGZ.js";
 
 // src/transcript-registration.ts
 import { createHash } from "crypto";

package/dist/{chunk-ZAZUDYSF.js → chunk-QYTOYNV2.js}

@@ -6,18 +6,18 @@ import {
   McpToolError,
   SubscriptionRequiredError,
   callMcpTool
-} from "./chunk-Q5RNYE2L.js";
+} from "./chunk-PZZKXX6Q.js";
 import {
   installNetworkDefaults,
   isNetworkFailure
-} from "./chunk-GECU7V44.js";
+} from "./chunk-MHC34X5A.js";
 import {
   clientReportClaims
-} from "./chunk-GDLT32I4.js";
+} from "./chunk-LQAAOXYJ.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-A47UKPC7.js";
+} from "./chunk-32OSSYGZ.js";
 import {
   ASK_AGENT_NAME_MAX,
   CLIENT_REPORT_PATH,
@@ -26,7 +26,7 @@ import {
   TOOL_FAILURE_CODES,
   degradedLine,
   truncateLine
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/api.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-3FQX74E4.js → chunk-REQO3WWO.js}

@@ -1,16 +1,19 @@
 import {
   notificationAnswerStep
-} from "./chunk-MNNQEUQC.js";
+} from "./chunk-AJIT4SCL.js";
+import {
+  canChangeApprovalSettings
+} from "./chunk-7V63A4AI.js";
 import {
   matchMacAccountStep,
   retryAgentCommand
-} from "./chunk-5FJDODOA.js";
+} from "./chunk-ODAAK2RZ.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-GO7YKPT3.js";
+} from "./chunk-X2MTVD4W.js";
 
 // src/setup/closing.ts
 var ACTIVITY_URL = "pushary.com/dashboard/agent/activity";
@@ -37,16 +40,28 @@ var describeAnsweredHeadline = (answer) => {
   const seconds = answerSeconds(answer.latencyMs);
   return device ? `You're set. ${device} answered in ${seconds}s.` : `You're set. The test question was answered in ${seconds}s.`;
 };
-var COMMAND_SURFACE = [
-  { command: "pushary status", summary: "what this machine is connected to" },
+var CHANGEABLE_APPROVAL_COMMANDS = [
   { command: "pushary mode", summary: "choose where approval requests appear" },
-  { command: "pushary wait", summary: "show or set how long approvals wait for your phone" },
+  { command: "pushary wait", summary: "show or set how long approvals wait for your phone" }
+];
+var READABLE_APPROVAL_COMMANDS = [
+  { command: "pushary mode", summary: "show where approval requests appear" },
+  { command: "pushary wait", summary: "show how long approvals wait for your phone" }
+];
+var approvalCommandSummaries = (canChange) => canChange ? CHANGEABLE_APPROVAL_COMMANDS : READABLE_APPROVAL_COMMANDS;
+var commandSurfaceFor = (keyScope) => [
+  { command: "pushary status", summary: "what this machine is connected to" },
+  ...approvalCommandSummaries(canChangeApprovalSettings(keyScope)),
   { command: "pushary stats", summary: "what your agents have been asking" },
   { command: "pushary claude", summary: "run Claude Code with encrypted transcript support" },
   { command: "pushary doctor", summary: "check the install" }
 ];
-var SURFACE_COLUMN = Math.max(...COMMAND_SURFACE.map((entry) => entry.command.length)) + 2;
-var renderCommandSurface = () => COMMAND_SURFACE.map((entry) => `${entry.command.padEnd(SURFACE_COLUMN)}${entry.summary}`);
+var surfaceColumnOf = (surface) => Math.max(...surface.map((entry) => entry.command.length)) + 2;
+var renderCommandSurface = (keyScope) => {
+  const surface = commandSurfaceFor(keyScope);
+  const column = surfaceColumnOf(surface);
+  return surface.map((entry) => `${entry.command.padEnd(column)}${entry.summary}`);
+};
 var PHONE_START_VERIFIED_LINE = "Phone-start and steering: local and server checks passed just now. Recheck after sleep or network changes.";
 var PHONE_START_UNVERIFIED_LINE = "Phone-start and steering: unverified. Run pushary doctor to check the provider, background service and server route.";
 var PHONE_START_FELL_SHORT_LINES = {

package/dist/{chunk-EJR5JXMV.js → chunk-RQOT6QL3.js}

@@ -242,10 +242,10 @@ var AGENTS = {
     label: "Hermes",
     policyAgent: "hermes",
     enforcement: "enforced",
-    connectVia: "Native Python plugin + approval transport",
+    connectVia: "Native plugin in ~/.hermes/plugins + approval transport",
     setupCommand: PUSHARY_SETUP_COMMAND,
     enforcementDetail: "Hermes dangerous-command approvals when the Pushary transport is selected; optional PUSHARY_GATE_TOOLS gates named tools.",
-    capabilityNote: "Uses the Python plugin, not a macOS bridge HookSource. CLI disconnect and managed-provider controls are not implemented for Hermes."
+    capabilityNote: "Uses the Pushary plugin in ~/.hermes/plugins/pushary, not a macOS bridge HookSource. CLI disconnect and managed-provider controls are not implemented for Hermes."
   },
   cursor: {
     ...defaults,
@@ -2602,6 +2602,16 @@ var shellCommandStringOf = (shell, args) => {
   return operand === void 0 || operand.expands ? UNREADABLE2 : { kind: "readable", script: operand.text };
 };
 
+// ../contracts/src/partner-developer-guide.ts
+var PARTNER_API_KEYS_URL = "https://pushary.com/dashboard/agent/settings";
+var PARTNER_INSTALL_COMMAND = "npm i @pushary/server";
+var PARTNER_DEVELOPER_STEPS = [
+  `Install on our server: ${PARTNER_INSTALL_COMMAND}. Create the client with our Partner API key from ${PARTNER_API_KEYS_URL} and keep the key on the server.`,
+  "For each customer, call pushary.enroll(customerId) and show the universalLink it returns as a button or QR code in our app. They open it in the free Pushary app and allow notifications. Installing the app does not carry the link over, so keep it available until they finish.",
+  "Before a risky action, call pushary.authorize({ externalId: customerId, toolName, question }) and run the action only if approved is true.",
+  "If the answer can come later than the request, create a decision with pushary.decisions.create, save its id, and resume from pushary.decisions.get or the webhook."
+];
+
 // ../contracts/src/degraded.ts
 var DEGRADED_PREFIX = "[degraded]";
 var degradedPayload = (subsystem, report) => ({
@@ -2614,6 +2624,16 @@ var degradedPayload = (subsystem, report) => ({
 });
 var degradedLine = (subsystem, report) => `${DEGRADED_PREFIX} ${JSON.stringify(degradedPayload(subsystem, report))}`;
 
+// ../contracts/src/key-scope.ts
+var KEY_SCOPES = ["full_access", "agent", "connector", "bound"];
+var KEY_SCOPE = {
+  full_access: "full_access",
+  agent: "agent",
+  connector: "connector",
+  bound: "bound"
+};
+var normalizeKeyScope = (value) => typeof value === "string" && KEY_SCOPES.includes(value) ? value : null;
+
 // ../contracts/src/observability.ts
 var CLIENT_CONTEXT_HEADERS = {
   surface: "x-pushary-surface",
@@ -3072,10 +3092,26 @@ var compressTranscriptRecord = (raw, deflateRaw) => {
 };
 
 // ../contracts/src/index.ts
-var KEY_SCOPES = ["full_access", "agent", "connector", "bound"];
-var normalizeKeyScope = (value) => typeof value === "string" && KEY_SCOPES.includes(value) ? value : null;
 var APPROVAL_MODES = ["push_only", "terminal_only", "push_first", "notify_only"];
 var isApprovalMode = (value) => typeof value === "string" && APPROVAL_MODES.includes(value);
+var APPROVAL_MODE_META = {
+  push_first: {
+    label: "When away",
+    description: "Ask in the notch. Alert my phone when I\u2019m away."
+  },
+  push_only: {
+    label: "Always",
+    description: "Ask in the notch and on my phone."
+  },
+  notify_only: {
+    label: "Alert only",
+    description: "Notify my phone. I answer in the agent."
+  },
+  terminal_only: {
+    label: "In agent",
+    description: "I answer in the agent. No approval alerts."
+  }
+};
 var approvalWaitsAtTheAgentsPrompt = (mode) => {
   switch (mode) {
     case "push_first":
@@ -6355,6 +6391,8 @@ export {
   toolsCoveredByGateEntry,
   cursorGateOwnsToolCall,
   degradedLine,
+  KEY_SCOPE,
+  normalizeKeyScope,
   hookWritePath,
   MAX_HOOK_ACTIVATION_EVIDENCE_ROWS,
   isHookActivationReport,
@@ -6389,8 +6427,8 @@ export {
   parseCodexNativeApproval,
   codexNativeApprovalResponse,
   compressTranscriptRecord,
-  normalizeKeyScope,
   isApprovalMode,
+  APPROVAL_MODE_META,
   approvalModeWithoutLocalPrompt,
   timeoutActionWithoutLocalPrompt,
   isTimeoutAction,