pushary 1.9.73 → 1.9.75

package/dist/{chunk-AC5TVOAH.js → chunk-ZX3KEXO3.js}

@@ -3,112 +3,214 @@ import {
   loadPin,
   savePin,
   verifyRecipients
-} from "./chunk-FB262EOM.js";
+} from "./chunk-T6RWREWU.js";
 import {
   ensureDaemonRunning
-} from "./chunk-WJJVCDEU.js";
+} from "./chunk-DCHZ5JOI.js";
 import {
   hookOwnerOf
-} from "./chunk-QAWWTRDD.js";
+} from "./chunk-TPYZFYQ5.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
+  decryptRecord,
+  encryptRecord,
   fetchTranscriptRecipients,
   generateSessionKey,
   recordSealerFor,
   uploadTranscriptRecords,
   wrapSessionKey
-} from "./chunk-JC7XUZST.js";
+} from "./chunk-SONZCJY5.js";
+import {
+  external_exports
+} from "./chunk-XMSDA5WA.js";
 import {
   transcriptEnvironmentPreference,
   transcriptsEnabled
-} from "./chunk-S63VIM7E.js";
+} from "./chunk-RPKFXNOJ.js";
 import {
   readTranscriptPreference
-} from "./chunk-NGNBX3YH.js";
+} from "./chunk-LIDUPDEY.js";
 import {
   claudeConfigDir,
   codexHome,
   pusharyDir
-} from "./chunk-7S46LCKD.js";
+} from "./chunk-2J4IVUEA.js";
 import {
   writeJsonAtomic
-} from "./chunk-RZVWEDIS.js";
+} from "./chunk-AUDYAVNM.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-R5PZPROX.js";
+} from "./chunk-53D6FFVE.js";
+import {
+  PENDING_COMMAND_PREFIX,
+  redactSecretsFromContent
+} from "./chunk-QRS7FQHE.js";
 
 // src/transcript-registration.ts
 import { createHash } from "crypto";
-import { readFileSync as readFileSync3, readdirSync as readdirSync2, statSync as statSync3, unlinkSync } from "fs";
-import { basename, isAbsolute, join as join3, resolve as resolve2, sep } from "path";
+import { readFileSync as readFileSync4, readdirSync as readdirSync2, statSync as statSync3, unlinkSync as unlinkSync2 } from "fs";
+import { basename, isAbsolute, join as join4, resolve as resolve2, sep } from "path";
 
-// src/transcript-source.ts
-var normalizeTranscriptLines = (lines, source) => {
-  if (source === "claude") return [...lines];
-  return lines.flatMap((line) => {
-    try {
-      const record = JSON.parse(line);
-      const item = record.payload;
-      if (record.type !== "response_item" || item?.type !== "message" || !["user", "assistant"].includes(item.role)) return [];
-      const content = (Array.isArray(item.content) ? item.content : []).flatMap((block) => ["input_text", "output_text"].includes(block.type ?? "") && typeof block.text === "string" ? [{ type: "text", text: block.text }] : []);
-      return content.length ? [JSON.stringify({ timestamp: record.timestamp, message: { role: item.role, content } })] : [];
-    } catch {
-      return [];
-    }
-  });
+// src/claude-display-draft.ts
+import { closeSync, fstatSync, lstatSync, openSync, readFileSync, readSync, unlinkSync } from "fs";
+import { join } from "path";
+
+// src/transcript-redaction.ts
+var redactDraft = (text, complete = false) => {
+  let end = complete ? text.length : text.lastIndexOf("\n") + 1;
+  const pem = /-----BEGIN [^\n]*PRIVATE KEY-----/g;
+  for (const match of text.matchAll(pem)) {
+    if (!/-----END [^\n]*PRIVATE KEY-----/.test(text.slice(match.index, end))) end = Math.min(end, match.index);
+  }
+  const quoted = /(?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[=:]\s*(["'])/gi;
+  for (const match of text.matchAll(quoted)) {
+    const close = text.indexOf(match[1], match.index + match[0].length);
+    if (close < 0 || close >= end) end = Math.min(end, match.index);
+  }
+  return redactSecretsFromContent(text.slice(0, end));
 };
-var createdDuringEpoch = (sighting, epochStartedAtMs) => sighting.birthtimeMs !== null && sighting.birthtimeMs >= epochStartedAtMs && sighting.birthtimeMs <= sighting.seenAtMs;
-var everythingAlreadyWritten = (sighting) => ({ identity: sighting.identity, offset: sighting.sizeBytes, startedBeforeEpoch: true });
-var cutoffAtFirstSight = (sighting, epochStartedAtMs) => sighting.identity === null || createdDuringEpoch(sighting, epochStartedAtMs) ? { identity: sighting.identity, offset: 0, startedBeforeEpoch: false } : everythingAlreadyWritten(sighting);
-var replacedOrShrunk = (previous, sighting) => previous.identity !== sighting.identity || sighting.sizeBytes < previous.offset;
-var nextTranscriptCutoff = (previous, sighting, epochStartedAtMs) => {
-  if (!previous) return cutoffAtFirstSight(sighting, epochStartedAtMs);
-  if (sighting.identity === null) return previous;
-  if (previous.identity === null) return { ...previous, identity: sighting.identity };
-  return replacedOrShrunk(previous, sighting) ? everythingAlreadyWritten(sighting) : previous;
+
+// src/claude-display-draft.ts
+var MAX_TEXT = 32 * 1024;
+var MAX_TAIL = 256 * 1024;
+var MAX_AGE_MS = 9e4;
+var identifier = external_exports.string().regex(/^[\w-]{1,128}$/);
+var displaySchema = external_exports.object({
+  hook_event_name: external_exports.literal("MessageDisplay"),
+  session_id: identifier,
+  message_id: identifier,
+  index: external_exports.number().int().nonnegative(),
+  final: external_exports.boolean(),
+  delta: external_exports.string().max(MAX_TEXT),
+  transcript_path: external_exports.string().min(1),
+  agent_id: external_exports.undefined()
+});
+var containsPhoneInstruction = (content) => content.some((text) => {
+  if (typeof text !== "string") return false;
+  const prefixAt = text.indexOf(PENDING_COMMAND_PREFIX);
+  return prefixAt >= 0 && text.slice(prefixAt + PENDING_COMMAND_PREFIX.length).trim().length > 0;
+});
+var anchorSchema = external_exports.object({ uuid: identifier, isSidechain: external_exports.literal(false).optional() }).and(external_exports.union([
+  external_exports.object({ type: external_exports.enum(["user", "assistant"]) }),
+  external_exports.object({ type: external_exports.literal("attachment"), attachment: external_exports.object({
+    type: external_exports.literal("hook_additional_context"),
+    content: external_exports.array(external_exports.unknown()).refine(containsPhoneInstruction)
+  }) })
+]));
+var stateSchema = external_exports.object({
+  displayId: identifier,
+  afterRecordId: identifier,
+  index: external_exports.number().int().nonnegative(),
+  text: external_exports.string().max(MAX_TEXT),
+  complete: external_exports.boolean(),
+  startedAt: external_exports.number().int().positive(),
+  updatedAt: external_exports.number().int().positive()
+});
+var fileFor = (id, directory) => join(directory, `${id}.display`);
+var readState = (sessionId, runtime) => {
+  if (!identifier.safeParse(sessionId).success) return null;
+  try {
+    const path = fileFor(sessionId, runtime.directory);
+    const info = lstatSync(path);
+    if (!info.isFile() || info.nlink !== 1 || info.size > MAX_TAIL || (info.mode & 511) !== 384) return null;
+    const envelope = external_exports.object({ content: external_exports.string() }).parse(JSON.parse(readFileSync(path, "utf8")));
+    const plain = decryptRecord(envelope.content, runtime.sessionKey);
+    if (!plain) return null;
+    const state = stateSchema.parse(JSON.parse(plain));
+    return runtime.now - state.updatedAt <= MAX_AGE_MS && runtime.now >= state.updatedAt ? state : null;
+  } catch {
+    return null;
+  }
 };
-var advancedTranscriptCutoff = (current, readFrom, settledThroughOffset) => current !== void 0 && current.identity === readFrom.identity && settledThroughOffset > current.offset ? { ...current, offset: settledThroughOffset } : current;
-var isTranscriptObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-var parsedTranscriptRecord = (line) => {
+var conversationAnchor = (path) => {
+  let descriptor;
   try {
-    const value = JSON.parse(line);
-    return isTranscriptObject(value) ? value : null;
+    descriptor = openSync(path, "r");
+    const size = fstatSync(descriptor).size;
+    const start = Math.max(0, size - MAX_TAIL);
+    const buffer = Buffer.alloc(Math.min(size, MAX_TAIL));
+    const length = readSync(descriptor, buffer, 0, buffer.length, start);
+    const lines = buffer.subarray(0, length).toString("utf8").split("\n");
+    if (start > 0) lines.shift();
+    lines.pop();
+    for (const line of lines.reverse()) {
+      try {
+        const value = anchorSchema.safeParse(JSON.parse(line));
+        if (value.success) return value.data.uuid;
+      } catch {
+        continue;
+      }
+    }
   } catch {
     return null;
+  } finally {
+    if (descriptor !== void 0) closeSync(descriptor);
   }
+  return null;
 };
-var stampedBefore = (record, momentMs) => {
-  if (typeof record.timestamp !== "string") return false;
-  const stamped = Date.parse(record.timestamp);
-  return Number.isFinite(stamped) && stamped < momentMs;
+var captureDisplayDraft = (input, runtime) => {
+  const parsed = displaySchema.safeParse(input);
+  if (!parsed.success) return false;
+  const event = parsed.data;
+  const previous = readState(event.session_id, runtime);
+  if (previous?.displayId === event.message_id && event.index <= previous.index) return false;
+  if (event.index !== 0 && (previous?.displayId !== event.message_id || previous.complete)) return false;
+  if (event.index !== 0 && previous && event.index !== previous.index + 1) {
+    try {
+      unlinkSync(fileFor(event.session_id, runtime.directory));
+    } catch {
+    }
+    return false;
+  }
+  if (event.index === 0 && event.final) return false;
+  const anchor = event.index === 0 ? conversationAnchor(event.transcript_path) : previous?.afterRecordId;
+  if (!anchor) return false;
+  const text = (event.index === 0 ? "" : previous?.text ?? "") + event.delta;
+  if (Buffer.byteLength(text, "utf8") > MAX_TEXT) return false;
+  const state = {
+    displayId: event.message_id,
+    afterRecordId: anchor,
+    index: event.index,
+    text,
+    complete: event.final,
+    startedAt: event.index === 0 ? runtime.now : previous?.startedAt ?? runtime.now,
+    updatedAt: runtime.now
+  };
+  const target = fileFor(event.session_id, runtime.directory);
+  const existing = lstatSync(target, { throwIfNoEntry: false });
+  if (existing && (!existing.isFile() || existing.nlink !== 1 || (existing.mode & 511) !== 384)) return false;
+  writeJsonAtomic(target, { content: encryptRecord(JSON.stringify(state), runtime.sessionKey) }, 384);
+  return true;
+};
+var readDisplayDraft = (sessionId, runtime) => {
+  const state = readState(sessionId, runtime);
+  if (!state) return null;
+  const text = redactDraft(state.text, state.complete);
+  if (!text) return null;
+  return { startedAt: state.startedAt, revision: state.index + 1, preview: {
+    displayId: state.displayId,
+    afterRecordId: state.afterRecordId,
+    text,
+    status: state.complete ? "complete" : "streaming"
+  } };
 };
-var isCompactionSummary = (record) => record.isCompactSummary === true;
-var transcriptLinesSeenLive = (lines, epochStartedAtMs, startedBeforeEpoch) => lines.filter((line) => {
-  const record = parsedTranscriptRecord(line);
-  if (record === null) return true;
-  return !stampedBefore(record, epochStartedAtMs) && !(startedBeforeEpoch && isCompactionSummary(record));
-});
-
-// src/transcript-sync.ts
-import { join as join2, resolve } from "path";
-import { closeSync, existsSync as existsSync2, fstatSync, openSync, readFileSync as readFileSync2, readSync, statSync as statSync2 } from "fs";
 
 // src/transcript-session-key.ts
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "fs";
+import { existsSync, mkdirSync, readFileSync as readFileSync2, readdirSync, rmSync, statSync, writeFileSync } from "fs";
 import { homedir } from "os";
-import { join } from "path";
-var sessionDir = () => process.env.PUSHARY_SESSION_KEY_DIR?.trim() || join(homedir(), ".pushary", "sessions");
+import { join as join2 } from "path";
+var sessionKeyDirectory = () => process.env.PUSHARY_SESSION_KEY_DIR?.trim() || join2(homedir(), ".pushary", "sessions");
 var SESSION_KEY_TTL_MS = 48 * 60 * 60 * 1e3;
 var SAFE_SESSION_ID = /^[A-Za-z0-9._-]{1,128}$/;
-var fileFor = (sessionId, directory) => SAFE_SESSION_ID.test(sessionId) ? join(directory, `${sessionId}.json`) : null;
-var loadSessionKey = (sessionId, directory = sessionDir()) => {
-  const path = fileFor(sessionId, directory);
+var fileFor2 = (sessionId, directory) => SAFE_SESSION_ID.test(sessionId) ? join2(directory, `${sessionId}.json`) : null;
+var loadSessionKey = (sessionId, directory = sessionKeyDirectory()) => {
+  const path = fileFor2(sessionId, directory);
   if (!path || !existsSync(path)) return null;
   try {
     if (Date.now() - statSync(path).mtimeMs > SESSION_KEY_TTL_MS) return null;
-    const raw = JSON.parse(readFileSync(path, "utf-8"));
+    const raw = JSON.parse(readFileSync2(path, "utf-8"));
     const key = typeof raw.sessionKey === "string" ? Buffer.from(raw.sessionKey, "base64") : null;
     if (!key || key.length !== 32) return null;
     return {
@@ -123,8 +225,8 @@ var loadSessionKey = (sessionId, directory = sessionDir()) => {
     return null;
   }
 };
-var saveSessionKey = (sessionId, value, directory = sessionDir()) => {
-  const path = fileFor(sessionId, directory);
+var saveSessionKey = (sessionId, value, directory = sessionKeyDirectory()) => {
+  const path = fileFor2(sessionId, directory);
   if (!path) return;
   try {
     mkdirSync(directory, { recursive: true, mode: 448 });
@@ -143,13 +245,13 @@ var saveSessionKey = (sessionId, value, directory = sessionDir()) => {
   } catch {
   }
 };
-var sweepStaleSessionKeys = (now = Date.now(), dir = sessionDir()) => {
+var sweepStaleSessionKeys = (now = Date.now(), dir = sessionKeyDirectory()) => {
   if (!existsSync(dir)) return 0;
   let removed = 0;
   try {
     for (const name of readdirSync(dir)) {
-      if (!name.endsWith(".json")) continue;
-      const path = join(dir, name);
+      if (!name.endsWith(".json") && !name.endsWith(".display")) continue;
+      const path = join2(dir, name);
       try {
         if (now - statSync(path).mtimeMs <= SESSION_KEY_TTL_MS) continue;
         rmSync(path, { force: true });
@@ -163,11 +265,155 @@ var sweepStaleSessionKeys = (now = Date.now(), dir = sessionDir()) => {
   return removed;
 };
 
+// src/transcript-draft-publisher.ts
+var startDraftPublisher = (options) => {
+  let running = true;
+  let pending;
+  let active;
+  let sent = "";
+  let retryAt = 0;
+  let retryMs = 1e3;
+  let reportedFailure = false;
+  const publish = async () => {
+    const controller = new AbortController();
+    active = controller;
+    try {
+      const sessionId = options.sessionId();
+      if (!sessionId) return;
+      const key = loadSessionKey(sessionId, options.keyDirectory);
+      if (!key?.keyUploaded) return;
+      const draft = options.snapshot(key.sessionKey);
+      if (!draft) return;
+      const identity = JSON.stringify([sessionId, draft.startedAt, draft.revision]);
+      if (identity === sent) return;
+      const response = await fetch(`${options.baseUrl}/api/agent/transcript`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${options.apiKey}`, "Content-Type": "application/json" },
+        body: JSON.stringify({ sessionId, draft: {
+          startedAt: draft.startedAt,
+          revision: draft.revision,
+          content: encryptRecord(JSON.stringify(draft.preview), key.sessionKey)
+        } }),
+        signal: AbortSignal.any([controller.signal, AbortSignal.timeout(5e3)])
+      });
+      if (!response.ok) throw new Error(`HTTP ${response.status}`);
+      sent = identity;
+      retryAt = 0;
+      retryMs = 1e3;
+      reportedFailure = false;
+    } catch (error) {
+      retryAt = Date.now() + retryMs;
+      retryMs = Math.min(3e4, retryMs * 2);
+      if (running && !controller.signal.aborted && !reportedFailure) {
+        reportedFailure = true;
+        process.stderr.write(`[pushary] live transcript preview could not sync (${error instanceof Error ? error.message : "request failed"}); saved history remains available.
+`);
+      }
+    } finally {
+      active = void 0;
+    }
+  };
+  const flush = async (final = false) => {
+    if (!running) return;
+    if (!options.enabled()) {
+      active?.abort();
+      return;
+    }
+    if (pending || !final && Date.now() < retryAt) return;
+    pending = publish();
+    try {
+      await pending;
+    } finally {
+      pending = void 0;
+    }
+  };
+  const timer = setInterval(() => {
+    void flush();
+  }, 500);
+  timer.unref();
+  const stop = () => {
+    running = false;
+    clearInterval(timer);
+    active?.abort();
+  };
+  return {
+    stop,
+    finish: async () => {
+      clearInterval(timer);
+      await pending;
+      await flush(true);
+      stop();
+    }
+  };
+};
+
+// src/claude-display-publisher.ts
+var startDisplayPublisher = (options) => {
+  const directory = options.directory ?? sessionKeyDirectory();
+  return startDraftPublisher({
+    apiKey: options.apiKey,
+    baseUrl: options.baseUrl,
+    keyDirectory: directory,
+    sessionId: () => options.sessionId,
+    enabled: options.enabled,
+    snapshot: (sessionKey) => readDisplayDraft(options.sessionId, { directory, sessionKey, now: Date.now() })
+  }).stop;
+};
+
+// src/transcript-source.ts
+var normalizeTranscriptLines = (lines, source) => {
+  if (source === "claude") return [...lines];
+  return lines.flatMap((line) => {
+    try {
+      const record = JSON.parse(line);
+      const item = record.payload;
+      if (record.type !== "response_item" || item?.type !== "message" || !["user", "assistant"].includes(item.role)) return [];
+      const content = (Array.isArray(item.content) ? item.content : []).flatMap((block) => ["input_text", "output_text"].includes(block.type ?? "") && typeof block.text === "string" ? [{ type: "text", text: block.text }] : []);
+      return content.length ? [JSON.stringify({ timestamp: record.timestamp, message: { role: item.role, content } })] : [];
+    } catch {
+      return [];
+    }
+  });
+};
+var createdDuringEpoch = (sighting, epochStartedAtMs) => sighting.birthtimeMs !== null && sighting.birthtimeMs >= epochStartedAtMs && sighting.birthtimeMs <= sighting.seenAtMs;
+var everythingAlreadyWritten = (sighting) => ({ identity: sighting.identity, offset: sighting.sizeBytes, startedBeforeEpoch: true });
+var cutoffAtFirstSight = (sighting, epochStartedAtMs) => sighting.identity === null || createdDuringEpoch(sighting, epochStartedAtMs) ? { identity: sighting.identity, offset: 0, startedBeforeEpoch: false } : everythingAlreadyWritten(sighting);
+var replacedOrShrunk = (previous, sighting) => previous.identity !== sighting.identity || sighting.sizeBytes < previous.offset;
+var nextTranscriptCutoff = (previous, sighting, epochStartedAtMs) => {
+  if (!previous) return cutoffAtFirstSight(sighting, epochStartedAtMs);
+  if (sighting.identity === null) return previous;
+  if (previous.identity === null) return { ...previous, identity: sighting.identity };
+  return replacedOrShrunk(previous, sighting) ? everythingAlreadyWritten(sighting) : previous;
+};
+var advancedTranscriptCutoff = (current, readFrom, settledThroughOffset) => current !== void 0 && current.identity === readFrom.identity && settledThroughOffset > current.offset ? { ...current, offset: settledThroughOffset } : current;
+var isTranscriptObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var parsedTranscriptRecord = (line) => {
+  try {
+    const value = JSON.parse(line);
+    return isTranscriptObject(value) ? value : null;
+  } catch {
+    return null;
+  }
+};
+var stampedBefore = (record, momentMs) => {
+  if (typeof record.timestamp !== "string") return false;
+  const stamped = Date.parse(record.timestamp);
+  return Number.isFinite(stamped) && stamped < momentMs;
+};
+var isCompactionSummary = (record) => record.isCompactSummary === true;
+var transcriptLinesSeenLive = (lines, epochStartedAtMs, startedBeforeEpoch) => lines.filter((line) => {
+  const record = parsedTranscriptRecord(line);
+  if (record === null) return true;
+  return !stampedBefore(record, epochStartedAtMs) && !(startedBeforeEpoch && isCompactionSummary(record));
+});
+
 // src/transcript-sync.ts
+import { join as join3, resolve } from "path";
+import { closeSync as closeSync2, existsSync as existsSync2, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync3, readSync as readSync2, statSync as statSync2 } from "fs";
 var claudeTranscriptPath = (cwd, sessionId) => {
   const projectId = resolve(cwd).replace(/[^a-zA-Z0-9-]/g, "-");
   const configDir = claudeConfigDir();
-  return join2(configDir, "projects", projectId, `${sessionId}.jsonl`);
+  return join3(configDir, "projects", projectId, `${sessionId}.jsonl`);
 };
 var createSyncState = () => ({
   sessionKey: null,
@@ -269,7 +515,7 @@ var chunkRecords = (records) => {
 };
 var readLines = (path) => {
   try {
-    return existsSync2(path) ? readFileSync2(path, "utf-8").split("\n") : [];
+    return existsSync2(path) ? readFileSync3(path, "utf-8").split("\n") : [];
   } catch {
     return [];
   }
@@ -315,7 +561,7 @@ var readThroughALineEnd = (descriptor, offset, unread) => {
   let window = Math.min(unread, MAXIMUM_TRANSCRIPT_READ_BYTES);
   for (; ; ) {
     const buffer = Buffer.alloc(window);
-    const received = buffer.subarray(0, readSync(descriptor, buffer, 0, window, offset));
+    const received = buffer.subarray(0, readSync2(descriptor, buffer, 0, window, offset));
     if (window >= unread || received.length < window || received.includes(LINE_FEED)) return received;
     window = Math.min(unread, window * 2);
   }
@@ -323,12 +569,12 @@ var readThroughALineEnd = (descriptor, offset, unread) => {
 var readLinesSinceCutoff = (epoch, path, seenAtMs) => {
   let descriptor;
   try {
-    descriptor = openSync(path, "r");
+    descriptor = openSync2(path, "r");
   } catch {
     return nothingUnread(sightTranscript(epoch, path, seenAtMs));
   }
   try {
-    const info = fstatSync(descriptor);
+    const info = fstatSync2(descriptor);
     const cutoff = recordSighting(epoch, path, sightingOf(info, seenAtMs));
     const unread = info.size - cutoff.offset;
     if (unread <= 0) return nothingUnread(cutoff);
@@ -342,7 +588,7 @@ var readLinesSinceCutoff = (epoch, path, seenAtMs) => {
       reachedEnd
     };
   } finally {
-    closeSync(descriptor);
+    closeSync2(descriptor);
   }
 };
 var linesSeenDuringEpoch = (epoch, path, source, seenAtMs) => {
@@ -443,8 +689,16 @@ var startTranscriptSync = (opts) => {
     }, delayMs);
     if (typeof timer.unref === "function") timer.unref();
   };
+  const stopDisplay = (opts.source ?? "claude") === "claude" ? startDisplayPublisher({
+    apiKey: opts.apiKey,
+    sessionId: opts.sessionId,
+    baseUrl: opts.baseUrl ?? getBaseUrl(),
+    directory: opts.storage?.sessionKeyDirectory,
+    enabled: () => running && !state.keyRejected && (opts.enabled ? opts.enabled() : transcriptsEnabled())
+  }) : void 0;
   schedule(0);
   return () => {
+    stopDisplay?.();
     running = false;
     if (timer) clearTimeout(timer);
   };
@@ -452,30 +706,30 @@ var startTranscriptSync = (opts) => {
 
 // src/transcript-registration.ts
 import { homedir as homedir2 } from "os";
-var defaultRegistryDirectory = () => process.env.PUSHARY_TRANSCRIPT_REGISTRY_DIR || join3(pusharyDir(), "transcript-capture");
+var defaultRegistryDirectory = () => process.env.PUSHARY_TRANSCRIPT_REGISTRY_DIR || join4(pusharyDir(), "transcript-capture");
 var cliRegistry = (apiKey = getApiKey()) => ({ apiKey, baseUrl: getBaseUrl(), directory: defaultRegistryDirectory() });
 var accountFor = (registry) => createHash("sha256").update(`${registry.baseUrl}\0${registry.apiKey}`).digest("hex");
 var TTL = 48 * 60 * 60 * 1e3;
-var read = (path) => JSON.parse(readFileSync3(path, "utf8"));
+var read = (path) => JSON.parse(readFileSync4(path, "utf8"));
 var consent = (record) => record.consentOverride ?? readTranscriptPreference() ?? false;
 var withoutTrailingSlash = (url) => url.replace(/\/+$/, "");
 var sameServer = (url, registry) => withoutTrailingSlash(url) === withoutTrailingSlash(registry.baseUrl);
-var fileFor2 = (registry, sessionId) => join3(registry.directory, `${createHash("sha256").update(accountFor(registry) + sessionId).digest("hex")}.json`);
+var fileFor3 = (registry, sessionId) => join4(registry.directory, `${createHash("sha256").update(accountFor(registry) + sessionId).digest("hex")}.json`);
 var permitted = (registry, raw) => raw.account === accountFor(registry) && consent(raw) && !raw.drained && (raw.source !== "claude" || !!raw.expectedSiteId || !macOwnsClaudeHooks(raw.cwd)) && (!raw.expectedSiteId || raw.expectedSiteId === raw.verifiedSiteId && !!raw.expectedBaseUrl && sameServer(raw.expectedBaseUrl, registry));
 var registeredTranscriptEnabled = (apiKey, sessionId, registry = cliRegistry(apiKey)) => {
   try {
-    return permitted(registry, read(fileFor2(registry, sessionId)));
+    return permitted(registry, read(fileFor3(registry, sessionId)));
   } catch {
     return false;
   }
 };
 var macOwnsClaudeHooks = (cwd) => [
-  join3(claudeConfigDir(), "settings.json"),
-  join3(cwd, ".claude", "settings.json"),
-  join3(cwd, ".claude", "settings.local.json")
+  join4(claudeConfigDir(), "settings.json"),
+  join4(cwd, ".claude", "settings.json"),
+  join4(cwd, ".claude", "settings.local.json")
 ].some((path) => {
   try {
-    return hookOwnerOf(JSON.parse(readFileSync3(path, "utf8"))) === "app";
+    return hookOwnerOf(JSON.parse(readFileSync4(path, "utf8"))) === "app";
   } catch {
     return false;
   }
@@ -483,9 +737,9 @@ var macOwnsClaudeHooks = (cwd) => [
 var TRANSCRIPT_ROOT_NAME = { claude: "projects", codex: "sessions" };
 var transcriptRoots = (source) => {
   const home = homedir2();
-  if (source === "codex") return [join3(codexHome(), TRANSCRIPT_ROOT_NAME.codex)];
+  if (source === "codex") return [join4(codexHome(), TRANSCRIPT_ROOT_NAME.codex)];
   const configured = process.env.CLAUDE_CONFIG_DIR;
-  return [join3(configured || join3(home, ".claude"), TRANSCRIPT_ROOT_NAME.claude), join3(home, ".claude", TRANSCRIPT_ROOT_NAME.claude)];
+  return [join4(configured || join4(home, ".claude"), TRANSCRIPT_ROOT_NAME.claude), join4(home, ".claude", TRANSCRIPT_ROOT_NAME.claude)];
 };
 var isAgentTranscriptRoot = (root, source) => isAbsolute(root) && resolve2(root) === root && basename(root) === TRANSCRIPT_ROOT_NAME[source];
 var acceptedTranscriptRoots = (source, registeredRoot) => typeof registeredRoot === "string" && isAgentTranscriptRoot(registeredRoot, source) ? [...transcriptRoots(source), registeredRoot] : transcriptRoots(source);
@@ -513,7 +767,7 @@ var registerTranscript = (source, input, startDaemon = () => {
   try {
     const registry = options.registry ?? cliRegistry();
     const account = accountFor(registry);
-    const path = fileFor2(registry, registration.sessionId);
+    const path = fileFor3(registry, registration.sessionId);
     let previous;
     try {
       previous = read(path);
@@ -563,11 +817,11 @@ var startRegisteredTranscripts = (apiKey, machineId, options = {}) => {
     try {
       let unreadable = 0;
       const files = readdirSync2(registry.directory).filter((name) => name.endsWith(".json")).flatMap((name) => {
-        const path = join3(registry.directory, name);
+        const path = join4(registry.directory, name);
         try {
           const time = statSync3(path).mtimeMs;
           if (Date.now() - time > TTL) {
-            unlinkSync(path);
+            unlinkSync2(path);
             return [];
           }
           return [{ path, time, raw: read(path) }];
@@ -657,9 +911,14 @@ var startRegisteredTranscripts = (apiKey, machineId, options = {}) => {
 };
 
 export {
+  redactDraft,
+  captureDisplayDraft,
+  sessionKeyDirectory,
   loadSessionKey,
+  startDraftPublisher,
   claudeTranscriptPath,
   registeredTranscriptEnabled,
+  captureRegistration,
   registerTranscript,
   startRegisteredTranscripts
 };

package/dist/{codex-app-cards-switch-M7VH7AZH.js → codex-app-cards-switch-CN3G7GZW.js}

@@ -22,22 +22,22 @@ import {
   turnCodexAppCardsOff,
   turnCodexAppCardsOn,
   whyLaunchctlFailed
-} from "./chunk-PM2MHBMF.js";
-import "./chunk-Z7AIYWZ2.js";
+} from "./chunk-3PPL64AG.js";
+import "./chunk-EH5OLIP2.js";
 import "./chunk-XCEN33UP.js";
 import "./chunk-QCGNGEGE.js";
-import "./chunk-WJJVCDEU.js";
+import "./chunk-DCHZ5JOI.js";
 import "./chunk-XHKBHWLX.js";
-import "./chunk-NGNBX3YH.js";
+import "./chunk-LIDUPDEY.js";
 import "./chunk-E46NE7FB.js";
-import "./chunk-UUCRWEEU.js";
-import "./chunk-7FROPPIH.js";
-import "./chunk-7S46LCKD.js";
-import "./chunk-RZVWEDIS.js";
-import "./chunk-R5PZPROX.js";
-import "./chunk-PPKIL4EL.js";
+import "./chunk-BGEUAJYL.js";
+import "./chunk-DARPCQPY.js";
+import "./chunk-2J4IVUEA.js";
+import "./chunk-AUDYAVNM.js";
+import "./chunk-53D6FFVE.js";
+import "./chunk-UIS332AZ.js";
 import "./chunk-QTOLNRET.js";
-import "./chunk-AVHL2ZTS.js";
+import "./chunk-QRS7FQHE.js";
 import "./chunk-MLKGABMK.js";
 export {
   CODEX_APP_CARDS_DIRECTORY,

package/dist/{codex-desktop-launch-6DASTBBA.js → codex-desktop-launch-GFZXCDSL.js}

@@ -11,7 +11,7 @@ import {
   installedCodexApp,
   shellQuoted,
   writeDesktopProxy
-} from "./chunk-Z7AIYWZ2.js";
+} from "./chunk-EH5OLIP2.js";
 import "./chunk-XCEN33UP.js";
 import {
   CODEX_APP_LAUNCH_VARIABLE