pushary 1.9.71 → 1.9.73

package/dist/{chunk-HR6M44CX.js → chunk-F3WI32HG.js}

@@ -1,25 +1,25 @@
 import {
   registerTranscript
-} from "./chunk-IYMYGKFB.js";
+} from "./chunk-AC5TVOAH.js";
 import {
   namedEvent
-} from "./chunk-LRS4TJU2.js";
+} from "./chunk-UIF7HWHX.js";
 import {
   isBridgeLocator,
   liveBridgeProbe,
   pusharyHookExecutable,
   resolveBridgeStub
-} from "./chunk-WOZLV3LN.js";
+} from "./chunk-QAWWTRDD.js";
 import {
   writeDegraded
-} from "./chunk-YG3NFC5N.js";
+} from "./chunk-CMYFV3VC.js";
 import {
   cursorUserHooks
-} from "./chunk-SMIU5URV.js";
+} from "./chunk-7S46LCKD.js";
 import {
   atLeast,
   parseVersion
-} from "./chunk-T7FPZN5V.js";
+} from "./chunk-RZVWEDIS.js";
 import {
   CURSOR_GATE_COVERAGE,
   CURSOR_GATE_SCRIPT,
@@ -33,7 +33,7 @@ import {
   isGrokSessionEndStop,
   isRecord,
   toolsCoveredByGateEntry
-} from "./chunk-JGEPODEP.js";
+} from "./chunk-AVHL2ZTS.js";
 
 // src/tool-hook-input.ts
 var OPTIONAL_TEXT_FIELDS = ["hook_event_name", "session_id", "cwd", "transcript_path", "tool_use_id", "permission_mode", "cursor_version"];

package/dist/{chunk-6W2ASRZO.js → chunk-FAKEKFCI.js}

@@ -5,19 +5,19 @@ import {
   hermesAppWiringRecord,
   hermesConfigReceipt,
   hermesSetupReceipt
-} from "./chunk-SMIU5URV.js";
+} from "./chunk-7S46LCKD.js";
 import {
   readJsonSafe,
   resolvePathBinary,
   writeJsonAtomic
-} from "./chunk-T7FPZN5V.js";
+} from "./chunk-RZVWEDIS.js";
 import {
   isNewerVersion,
   isReleaseVersion
 } from "./chunk-QTOLNRET.js";
 import {
   isRecord
-} from "./chunk-JGEPODEP.js";
+} from "./chunk-AVHL2ZTS.js";
 
 // src/hermes/plugin-payload.ts
 import { createHash } from "crypto";

package/dist/{chunk-FTOKESSK.js → chunk-FB262EOM.js}

@@ -1,6 +1,6 @@
 import {
   writeJsonAtomicDurable
-} from "./chunk-T7FPZN5V.js";
+} from "./chunk-RZVWEDIS.js";
 
 // src/transcript-recipient-pin.ts
 import { existsSync, mkdirSync, readFileSync, rmSync } from "fs";

package/dist/{chunk-4XFFGFHN.js → chunk-FK3JSDH5.js}

@@ -4,24 +4,24 @@ import {
   outcomeOfFailedAsk,
   reportMachineDenial,
   storedWaitDeadline
-} from "./chunk-4QPF4BGP.js";
+} from "./chunk-2JFEMKDG.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-XJMUEOXT.js";
+} from "./chunk-3JJI5O5N.js";
 import {
   isAdmitted,
   readAdmissionRules
-} from "./chunk-HR6M44CX.js";
+} from "./chunk-F3WI32HG.js";
 import {
   isDeferAnswer,
   oncePerSession
-} from "./chunk-3CN2EFKK.js";
+} from "./chunk-AXZ67XVN.js";
 import {
   activeHookSource,
   activeIdentity,
   namedSource
-} from "./chunk-LRS4TJU2.js";
+} from "./chunk-UIF7HWHX.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -45,10 +45,10 @@ import {
   reportEvent,
   scopePathFor,
   settleQuestionsForToolUse
-} from "./chunk-5NQ3SMVP.js";
+} from "./chunk-AJWGZJFS.js";
 import {
   repoKeyFor
-} from "./chunk-NPO3ZTR4.js";
+} from "./chunk-QMPM3CAN.js";
 import {
   askUser,
   cancelQuestion,
@@ -65,20 +65,20 @@ import {
   waitForQuestion,
   waitsForThePhone,
   withdrawQuestion
-} from "./chunk-YG3NFC5N.js";
+} from "./chunk-CMYFV3VC.js";
 import {
   getMachineId
-} from "./chunk-LWAYXE7G.js";
+} from "./chunk-UUCRWEEU.js";
 import {
   claudeConfigDir
-} from "./chunk-SMIU5URV.js";
+} from "./chunk-7S46LCKD.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-X2KK42JA.js";
+} from "./chunk-R5PZPROX.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-AZ56FPRG.js";
+} from "./chunk-PPKIL4EL.js";
 import {
   AGENT_QUESTION_STRATEGY,
   AGENT_QUESTION_TOOL,
@@ -133,7 +133,7 @@ import {
   terminalStaysLiveForTheCall,
   timeoutActionWithoutLocalPrompt,
   unansweredRefusalReason
-} from "./chunk-JGEPODEP.js";
+} from "./chunk-AVHL2ZTS.js";
 
 // src/terminal-answer-watch.ts
 import { closeSync, openSync, readSync, statSync } from "fs";

package/dist/{chunk-3FY5ZPIZ.js → chunk-GBR6E7AY.js}

@@ -7,7 +7,7 @@ import {
   recordSealerFor,
   uploadTranscriptRecords,
   wrapSessionKey
-} from "./chunk-LA3MMHLO.js";
+} from "./chunk-JC7XUZST.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;

package/dist/{chunk-NHC5YUH6.js → chunk-IN3MPEFA.js}

@@ -1,20 +1,20 @@
 import {
   openCodeConfigDirFrom
-} from "./chunk-AN26S5DC.js";
+} from "./chunk-3RAWW5DH.js";
 import {
   nativeClaudeInstallPath
-} from "./chunk-BJRLJJS2.js";
+} from "./chunk-TFDMJHAB.js";
 import {
   grokHome
-} from "./chunk-LRS4TJU2.js";
+} from "./chunk-UIF7HWHX.js";
 import {
   claudeConfigDir,
   clineDataDirectory,
   codexHomeFrom
-} from "./chunk-SMIU5URV.js";
+} from "./chunk-7S46LCKD.js";
 import {
   HOOK_COMPATIBLE_PROFILES
-} from "./chunk-JGEPODEP.js";
+} from "./chunk-AVHL2ZTS.js";
 
 // src/vscode-config.ts
 import { homedir } from "os";

package/dist/{chunk-LA3MMHLO.js → chunk-JC7XUZST.js}

@@ -1,10 +1,10 @@
 import {
   getBaseUrl
-} from "./chunk-X2KK42JA.js";
+} from "./chunk-R5PZPROX.js";
 import {
   compressTranscriptRecord,
   redactSecretsFromContent
-} from "./chunk-JGEPODEP.js";
+} from "./chunk-AVHL2ZTS.js";
 
 // src/transcript-api.ts
 var fetchTranscriptRecipients = async (apiKey, baseUrl = getBaseUrl()) => {
@@ -174,7 +174,10 @@ var INTERNAL_TYPES = /* @__PURE__ */ new Set([
   "agent-name",
   "bridge-session",
   "artifact-autoreact-ledger",
-  "artifact-comment-monitor"
+  "artifact-comment-monitor",
+  "api-request",
+  "api-request-blob",
+  "api-request-shape"
 ]);
 var redactDeep = (value) => {
   if (typeof value === "string") return redactSecretsFromContent(value);

package/dist/{chunk-2XD4TTUM.js → chunk-JNTYPMVU.js}

@@ -1,13 +1,13 @@
 import {
   ensureCodexTrustsPusharyHooks
-} from "./chunk-XZTFYFC7.js";
+} from "./chunk-VJUDBZGC.js";
 import {
   hermesReceiptPaths,
   hermesSetupPredatesThePluginFolder,
   installHermesPlugin,
   refreshHermesPluginFiles,
   shippedHermesPlugin
-} from "./chunk-6W2ASRZO.js";
+} from "./chunk-FAKEKFCI.js";
 import {
   fxIgnoresInstructionsFile,
   fxInstructionsBody,
@@ -16,7 +16,7 @@ import {
   macAppFxBridge,
   refreshClineKey,
   switchFxHttpEntryToBridge
-} from "./chunk-DOMDCMGC.js";
+} from "./chunk-KSLBS3II.js";
 import {
   OPENCODE_HOOK_BINARY,
   agentHookOwner,
@@ -28,16 +28,16 @@ import {
   openCodePluginDir,
   openCodeWired,
   withOpenCodeAskRules
-} from "./chunk-AN26S5DC.js";
+} from "./chunk-3RAWW5DH.js";
 import {
   detectClaudeVersion
-} from "./chunk-LKAO35SY.js";
+} from "./chunk-JYOR57ZW.js";
 import {
   addCompatibleHooks,
   compatibleConfigFile,
   compatibleInstructionsFile,
   hasCompatibleHooks
-} from "./chunk-LRS4TJU2.js";
+} from "./chunk-UIF7HWHX.js";
 import {
   GEMINI_HOOK_BINARY,
   addGeminiHooks,
@@ -49,7 +49,7 @@ import {
   geminiWired,
   hasGeminiHooks,
   planHooks
-} from "./chunk-WOZLV3LN.js";
+} from "./chunk-QAWWTRDD.js";
 import {
   CLAUDE_HOOK_BINARY,
   CLAUDE_HOOK_EVENTS,
@@ -94,7 +94,7 @@ import {
   renderAgentInstructions,
   supportedClaudeEvents,
   vscodePluginMcp
-} from "./chunk-SMIU5URV.js";
+} from "./chunk-7S46LCKD.js";
 import {
   formatVersion,
   readJsonSafe,
@@ -102,12 +102,12 @@ import {
   resolveGlobalBinary,
   writeFileAtomic,
   writeJsonAtomic
-} from "./chunk-T7FPZN5V.js";
+} from "./chunk-RZVWEDIS.js";
 import {
   HOOK_COMPATIBLE_PROFILES,
   isCompatibleAgentType,
   isRecord
-} from "./chunk-JGEPODEP.js";
+} from "./chunk-AVHL2ZTS.js";
 
 // src/reapply.ts
 import { dirname, join } from "path";

package/dist/{chunk-B3KPRSCM.js → chunk-JWBZUTYF.js}

@@ -1,19 +1,19 @@
 import {
   macAppBridgeAvailable
-} from "./chunk-AN26S5DC.js";
+} from "./chunk-3RAWW5DH.js";
 import {
   keyPrefix
-} from "./chunk-D536PHXF.js";
+} from "./chunk-NGNBX3YH.js";
 import {
   bridgeAgentKey
-} from "./chunk-SMIU5URV.js";
+} from "./chunk-7S46LCKD.js";
 import {
   readJsonSafe
-} from "./chunk-T7FPZN5V.js";
+} from "./chunk-RZVWEDIS.js";
 import {
   isRecord,
   isValidApiKey
-} from "./chunk-JGEPODEP.js";
+} from "./chunk-AVHL2ZTS.js";
 
 // src/shared-mcp-key.ts
 var asRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;

package/dist/{chunk-LKAO35SY.js → chunk-JYOR57ZW.js}

@@ -1,12 +1,12 @@
 import {
   findNativeClaudeInstall
-} from "./chunk-BJRLJJS2.js";
+} from "./chunk-TFDMJHAB.js";
 import {
   parseVersion
-} from "./chunk-T7FPZN5V.js";
+} from "./chunk-RZVWEDIS.js";
 import {
   isRecord
-} from "./chunk-JGEPODEP.js";
+} from "./chunk-AVHL2ZTS.js";
 
 // src/setup/agent-probe.ts
 import { execSync } from "child_process";

package/dist/{chunk-MGF7D2ZL.js → chunk-KDQLKND5.js}

@@ -4,30 +4,34 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "./chunk-3FY5ZPIZ.js";
+} from "./chunk-GBR6E7AY.js";
+import {
+  CommandReceipts,
+  controllerCommandSchema
+} from "./chunk-N5P2FLOJ.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
   describeIdleWindow,
   idleDeadlinePassed,
   startProcessOwnership
-} from "./chunk-ITKAMUHG.js";
+} from "./chunk-PNXNWZ5P.js";
 import {
   spawnClaude
 } from "./chunk-XHKBHWLX.js";
 import {
   repoKeyFor
-} from "./chunk-NPO3ZTR4.js";
+} from "./chunk-QMPM3CAN.js";
 import {
   isAskUserResponse,
   isDecisionStopped,
   isWaitForAnswerResponse,
   withdrawQuestion,
   writeDegraded
-} from "./chunk-YG3NFC5N.js";
+} from "./chunk-CMYFV3VC.js";
 import {
   callMcpTool,
   isRetryable
-} from "./chunk-GIE7PLZD.js";
+} from "./chunk-7M4AA7QF.js";
 import {
   AGENT_QUESTION_DESCRIPTION_MAX,
   AGENT_QUESTION_HEADER_MAX,
@@ -48,7 +52,7 @@ import {
   parseCodexQuestions,
   planElicitationAsk,
   readElicitationFields
-} from "./chunk-JGEPODEP.js";
+} from "./chunk-AVHL2ZTS.js";
 
 // src/codex-question-owner.ts
 import { createHash } from "crypto";
@@ -777,49 +781,42 @@ var runCodexBridge = async (options) => {
       if (startedTurnId && startedTurnId !== lastCompletedTurnId) activeTurnId = startedTurnId;
     };
     if (options.prompt) await startTurn(options.prompt, `spawn-${options.spawnId}`);
-    let pendingAck = null;
+    const receipts = new CommandReceipts({
+      submit: async (command) => {
+        await startTurn(command.text, command.id);
+        return "delivered";
+      },
+      log: (message) => process.stderr.write(`${message}
+`)
+    });
     while (!options.signal.aborted && !rpc.isClosed) {
       if (idleDeadlineReached()) {
         idledOut = true;
         break;
       }
       try {
-        if (pendingAck) {
-          const acknowledged = await postLiveSession(options, "/api/agent/command/ack", pendingAck);
-          if (acknowledged.ok) pendingAck = null;
-        }
-        if (pendingAck) {
-          await liveSessionSleep(options.pollIntervalMs ?? 2e3, options.signal);
-          continue;
-        }
+        await receipts.flush();
         const response = await postLiveSession(options, "/api/agent/command/drain", {
           sessionId: threadId,
           machineId: options.machineId,
-          ackMode: true
+          ackMode: true,
+          receiptVersion: 1
         });
         if (response.ok) {
-          const command = object((await response.json()).command);
-          const commandId = string(command?.id);
-          const text = string(command?.text);
-          if (commandId && text) {
+          const body = await response.json();
+          const parsed = controllerCommandSchema.safeParse(object(body)?.command);
+          if (parsed.success) {
             idleSince = now();
-            try {
-              await startTurn(text, commandId);
-              pendingAck = {
-                commandId,
+            await receipts.receive(parsed.data, async (state, dispatchId) => {
+              const response2 = await postLiveSession(options, "/api/agent/command/ack", {
+                commandId: parsed.data.id,
                 sessionId: threadId,
                 machineId: options.machineId,
-                state: "delivered"
-              };
-            } catch {
-              pendingAck = {
-                commandId,
-                sessionId: threadId,
-                machineId: options.machineId,
-                state: "failed",
-                failureCode: "codex_rejected"
-              };
-            }
+                state,
+                dispatchId
+              });
+              return response2.ok;
+            });
           }
         }
       } catch {
@@ -856,6 +853,10 @@ var runCodexBridge = async (options) => {
         await liveSessionSleep(200 * (attempt + 1), options.signal);
       }
     }
+    if (options.signal.aborted) {
+      await report("session_closed", "Session stopped").catch(() => null);
+      return "stopped";
+    }
     await report("error", `Live bridge failed: ${message}`.slice(0, FAILURE_MESSAGE_MAX)).catch(() => null);
     return "failed";
   } finally {

package/dist/{chunk-DOMDCMGC.js → chunk-KSLBS3II.js}

@@ -4,13 +4,13 @@ import {
   configFailureKind,
   retryAgentCommand,
   writeSetupConfigFile
-} from "./chunk-QWCOMSDH.js";
+} from "./chunk-EUEGCEA7.js";
 import {
   MCP_BRIDGE_BINARY
-} from "./chunk-ONZ3UGNY.js";
+} from "./chunk-W47XZJSH.js";
 import {
   KEY_FILE_MODE
-} from "./chunk-D536PHXF.js";
+} from "./chunk-NGNBX3YH.js";
 import {
   CLINE_SERVER_NAME_TAKEN,
   CLINE_SETTINGS_REFUSALS,
@@ -32,13 +32,13 @@ import {
   withClinePusharyServer,
   withRefreshedClineKey,
   withoutClinePusharyServer
-} from "./chunk-SMIU5URV.js";
+} from "./chunk-7S46LCKD.js";
 import {
   readJsonSafe,
   resolveGlobalBinary,
   writeFileAtomic,
   writeJsonAtomic
-} from "./chunk-T7FPZN5V.js";
+} from "./chunk-RZVWEDIS.js";
 
 // src/fx-config.ts
 var FX_SERVER_NAME = "pushary";

package/dist/chunk-L2FQBHIR.js

@@ -0,0 +1,74 @@
+import {
+  external_exports
+} from "./chunk-XMSDA5WA.js";
+
+// src/native-transcript-account.ts
+import { createHash } from "crypto";
+import { existsSync, lstatSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var MAXIMUM_OWNER_DOCUMENT_BYTES = 16384;
+var MAXIMUM_READ_POSITIONS_BYTES = 4 * 1024 * 1024;
+var OWNER_ONLY_FILE_MODE = 384;
+var OWNER_ONLY_DIRECTORY_MODE = 448;
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+var credentialSchema = external_exports.object({
+  key: external_exports.string().min(1).max(1024),
+  siteID: external_exports.string().min(1),
+  machineID: external_exports.string().min(1),
+  baseURL: external_exports.string().url(),
+  keyScope: external_exports.literal("agent")
+});
+var consentSchema = credentialSchema.pick({ siteID: true, machineID: true, baseURL: true }).extend({ enabled: external_exports.literal(true), grantedAtMs: external_exports.number().int().positive() });
+var readPositionSchema = external_exports.object({
+  identity: external_exports.string().nullable(),
+  offset: external_exports.number().int().nonnegative(),
+  startedBeforeEpoch: external_exports.boolean()
+});
+var readPositionsSchema = external_exports.object({
+  epochStartedAtMs: external_exports.number().int().positive(),
+  positions: external_exports.record(external_exports.string(), readPositionSchema)
+});
+var ownerDocument = (path, maximumBytes = MAXIMUM_OWNER_DOCUMENT_BYTES) => {
+  const info = lstatSync(path);
+  if (!info.isFile() || info.nlink !== 1 || info.uid !== process.getuid?.() || (info.mode & 511) !== OWNER_ONLY_FILE_MODE || info.size > maximumBytes) return null;
+  return JSON.parse(readFileSync(path, "utf8"));
+};
+var acceptsServer = (baseURL) => {
+  const url = new URL(baseURL);
+  return url.protocol === "https:" || url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname);
+};
+var nativeConsentFile = (home) => join(home, ".pushary", "native-transcript-consent.json");
+var nativeBridgeAccount = (home = homedir()) => {
+  try {
+    const root = join(home, ".pushary");
+    const directory = lstatSync(join(root, "bridge-auth"));
+    if (!directory.isDirectory() || directory.uid !== process.getuid?.() || (directory.mode & 511) !== OWNER_ONLY_DIRECTORY_MODE) return null;
+    const account = credentialSchema.parse(ownerDocument(join(root, "bridge-auth", "agent-key.json")));
+    const machineId = readFileSync(join(root, "machine-id"), "utf8").trim();
+    if (machineId !== account.machineID || !acceptsServer(account.baseURL)) return null;
+    return account;
+  } catch {
+    return null;
+  }
+};
+var nativeTranscriptGrant = (home = homedir()) => {
+  try {
+    const account = nativeBridgeAccount(home);
+    if (!account) return null;
+    const consent = consentSchema.parse(ownerDocument(nativeConsentFile(home)));
+    if (account.siteID !== consent.siteID || account.machineID !== consent.machineID || account.baseURL !== consent.baseURL) return null;
+    return { account, grantedAtMs: consent.grantedAtMs };
+  } catch {
+    return null;
+  }
+};
+var macAppHistoryDecision = (home = homedir()) => {
+  if (nativeTranscriptGrant(home)) return "saves";
+  return existsSync(nativeConsentFile(home)) ? "does_not_save" : "none";
+};
+
+export {
+  nativeBridgeAccount,
+  macAppHistoryDecision
+};

package/dist/{chunk-JEZGDP55.js → chunk-N4VRSFRZ.js}

@@ -1,9 +1,9 @@
 import {
   readMacAppAgentKey
-} from "./chunk-B3KPRSCM.js";
+} from "./chunk-JWBZUTYF.js";
 import {
   API_KEYS_PATH
-} from "./chunk-VMQEB56V.js";
+} from "./chunk-TQ2L3ECX.js";
 import {
   findExportedKeyLines,
   isAdoptedMacAppKey,
@@ -13,13 +13,13 @@ import {
   readConfigFileKey,
   readKeySource,
   readMacAppKeyPrefix
-} from "./chunk-D536PHXF.js";
+} from "./chunk-NGNBX3YH.js";
 import {
   absoluteUrl
-} from "./chunk-ZZ7VB6QC.js";
+} from "./chunk-S7VMHSJW.js";
 import {
   isValidApiKey
-} from "./chunk-JGEPODEP.js";
+} from "./chunk-AVHL2ZTS.js";
 
 // src/key-revocation.ts
 var SELF_REVOKE_PATH = "/api/v1/server/keys/self/revoke";