pushary 1.9.83 → 1.9.85

package/dist/{chunk-ELYJNNXG.js → chunk-ZUZ7NTWO.js}

@@ -1,18 +1,13 @@
 import {
-  changedRecipientsMessage,
-  loadPin,
-  savePin,
-  verifyRecipients
-} from "./chunk-7EIMASAA.js";
-import {
-  SESSION_HISTORY_RETENTION_DAYS
-} from "./chunk-MHUKYYYR.js";
+  SESSION_HISTORY_RETENTION_DAYS,
+  savedTranscriptReadPositions
+} from "./chunk-4TMKTLQX.js";
 import {
   ensureDaemonRunning
-} from "./chunk-6CJ4MSZU.js";
+} from "./chunk-SAPRO7FI.js";
 import {
   hookOwnerOf
-} from "./chunk-42RQG2VG.js";
+} from "./chunk-YU5ACKJP.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
@@ -23,46 +18,112 @@ import {
   recordSealerFor,
   uploadTranscriptRecords,
   wrapSessionKey
-} from "./chunk-IUZCERPQ.js";
+} from "./chunk-7GYDMVHV.js";
 import {
   external_exports
 } from "./chunk-XMSDA5WA.js";
 import {
   transcriptEnvironmentPreference,
   transcriptsEnabled
-} from "./chunk-GKWPIE6R.js";
+} from "./chunk-GWHZUHIK.js";
 import {
   readTranscriptPreference
-} from "./chunk-IBULUTHA.js";
+} from "./chunk-FRPR4OTH.js";
+import {
+  hookMeaning
+} from "./chunk-3MWQZKIO.js";
 import {
   claudeConfigDir,
   codexHome,
   pusharyDir
-} from "./chunk-B2RDWRKR.js";
+} from "./chunk-PHBZK4SC.js";
 import {
   writeJsonAtomic,
   writeJsonAtomicDurable
-} from "./chunk-YIAJOV2X.js";
+} from "./chunk-64XK7DLE.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-TBU4WXA4.js";
+} from "./chunk-JSZT4Q23.js";
 import {
   PENDING_COMMAND_PREFIX,
   SESSION_HISTORY_BACKFILL_LIMIT_BYTES,
   canonicalJsonText,
+  isHookSource,
   isRecord,
   redactSecretsFromContent
-} from "./chunk-L4THAI7Q.js";
+} from "./chunk-JHWOM55B.js";
+
+// src/transcript-recipient-pin.ts
+import { existsSync, mkdirSync, readFileSync, rmSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var pinFile = () => process.env.PUSHARY_RECIPIENT_PIN_FILE?.trim() || join(homedir(), ".pushary", "recipients.json");
+var asPin = (offer) => ({
+  phonePublicKey: offer.phonePublicKey,
+  providerKeyId: offer.provider?.keyId ?? null,
+  providerPublicKey: offer.provider?.publicKey ?? null
+});
+var loadPin = (path = pinFile()) => {
+  if (!existsSync(path)) return null;
+  try {
+    const raw = JSON.parse(readFileSync(path, "utf-8"));
+    if (typeof raw.phonePublicKey !== "string" || raw.phonePublicKey.length === 0) return null;
+    return {
+      phonePublicKey: raw.phonePublicKey,
+      providerKeyId: typeof raw.providerKeyId === "string" ? raw.providerKeyId : null,
+      providerPublicKey: typeof raw.providerPublicKey === "string" ? raw.providerPublicKey : null
+    };
+  } catch {
+    return null;
+  }
+};
+var savePin = (pin, path = pinFile()) => {
+  try {
+    mkdirSync(dirname(path), { recursive: true, mode: 448 });
+    writeJsonAtomicDurable(path, pin, 384);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var clearPin = () => {
+  try {
+    rmSync(pinFile(), { force: true });
+  } catch {
+  }
+};
+var verifyRecipients = (offer, pinned) => {
+  if (!pinned) return { kind: "first-use", pin: asPin(offer) };
+  const next = asPin(offer);
+  const changed = [];
+  if (next.phonePublicKey !== pinned.phonePublicKey) changed.push("the phone key this machine seals to");
+  if (next.providerKeyId !== pinned.providerKeyId) changed.push("the compliance recovery key id");
+  if (next.providerPublicKey !== pinned.providerPublicKey) changed.push("the compliance recovery key");
+  return changed.length === 0 ? { kind: "match" } : { kind: "changed", changed };
+};
+var fingerprint = (publicKey) => {
+  const hex = Buffer.from(publicKey, "base64").toString("hex").toUpperCase();
+  return (hex.slice(0, 8).match(/.{2}/g) ?? []).join(" ");
+};
+var changedRecipientsMessage = (verdict, offer) => [
+  "[pushary] Transcript sync stopped: the keys this machine seals transcripts to have changed.",
+  ...verdict.changed.map((what) => `[pushary]   changed: ${what}`),
+  `[pushary]   now offered: phone ${fingerprint(offer.phonePublicKey)}${offer.provider ? `, recovery ${offer.provider.keyId.slice(0, 8)}` : ", no recovery key"}`,
+  "[pushary] If you reinstalled the app or rotated a key, this is expected. Compare the",
+  "[pushary] fingerprint above with the one in the app under Settings, then run:",
+  "[pushary]   pushary transcripts trust --rotate",
+  "[pushary] Until then nothing is uploaded, so no turn is sealed to a key you have not seen."
+].join("\n");
 
 // src/transcript-registration.ts
 import { createHash as createHash4 } from "crypto";
-import { readFileSync as readFileSync6, readdirSync as readdirSync2, realpathSync, statSync as statSync3, unlinkSync as unlinkSync2 } from "fs";
-import { basename, dirname as dirname2, isAbsolute, join as join5, relative, resolve as resolve2, sep } from "path";
+import { lstatSync as lstatSync3, readFileSync as readFileSync7, readdirSync as readdirSync2, realpathSync, statSync as statSync3, unlinkSync as unlinkSync2 } from "fs";
+import { basename, dirname as dirname3, isAbsolute, join as join6, relative, resolve as resolve2, sep } from "path";
 
 // src/claude-display-draft.ts
-import { closeSync, fstatSync, lstatSync, openSync, readFileSync, readSync, unlinkSync } from "fs";
-import { join } from "path";
+import { closeSync, fstatSync, lstatSync, openSync, readFileSync as readFileSync2, readSync, unlinkSync } from "fs";
+import { join as join2 } from "path";
 
 // src/transcript-redaction.ts
 var redactDraft = (text, complete = false) => {
@@ -115,14 +176,14 @@ var stateSchema = external_exports.object({
   startedAt: external_exports.number().int().positive(),
   updatedAt: external_exports.number().int().positive()
 });
-var fileFor = (id, directory) => join(directory, `${id}.display`);
+var fileFor = (id, directory) => join2(directory, `${id}.display`);
 var readState = (sessionId, runtime) => {
   if (!identifier.safeParse(sessionId).success) return null;
   try {
     const path = fileFor(sessionId, runtime.directory);
     const info = lstatSync(path);
     if (!info.isFile() || info.nlink !== 1 || info.size > MAX_TAIL || (info.mode & 511) !== 384) return null;
-    const envelope = external_exports.object({ content: external_exports.string() }).parse(JSON.parse(readFileSync(path, "utf8")));
+    const envelope = external_exports.object({ content: external_exports.string() }).parse(JSON.parse(readFileSync2(path, "utf8")));
     const plain = decryptRecord(envelope.content, runtime.sessionKey);
     if (!plain) return null;
     const state = stateSchema.parse(JSON.parse(plain));
@@ -205,18 +266,18 @@ var readDisplayDraft = (sessionId, runtime) => {
 };
 
 // src/transcript-session-key.ts
-import { existsSync, mkdirSync, readFileSync as readFileSync2, readdirSync, rmSync, statSync } from "fs";
-import { homedir } from "os";
-import { join as join2 } from "path";
-var sessionKeyDirectory = () => process.env.PUSHARY_SESSION_KEY_DIR?.trim() || join2(homedir(), ".pushary", "sessions");
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, readdirSync, rmSync as rmSync2, statSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
+var sessionKeyDirectory = () => process.env.PUSHARY_SESSION_KEY_DIR?.trim() || join3(homedir2(), ".pushary", "sessions");
 var SESSION_DISPLAY_TTL_MS = 48 * 60 * 60 * 1e3;
 var SAFE_SESSION_ID = /^[A-Za-z0-9._-]{1,128}$/;
-var fileFor2 = (sessionId, directory) => SAFE_SESSION_ID.test(sessionId) ? join2(directory, `${sessionId}.json`) : null;
+var fileFor2 = (sessionId, directory) => SAFE_SESSION_ID.test(sessionId) ? join3(directory, `${sessionId}.json`) : null;
 var loadSessionKey = (sessionId, directory = sessionKeyDirectory()) => {
   const path = fileFor2(sessionId, directory);
-  if (!path || !existsSync(path)) return null;
+  if (!path || !existsSync2(path)) return null;
   try {
-    const raw = JSON.parse(readFileSync2(path, "utf-8"));
+    const raw = JSON.parse(readFileSync3(path, "utf-8"));
     const key = typeof raw.sessionKey === "string" ? Buffer.from(raw.sessionKey, "base64") : null;
     if (!key || key.length !== 32) return null;
     return {
@@ -235,7 +296,7 @@ var saveSessionKey = (sessionId, value, directory = sessionKeyDirectory()) => {
   const path = fileFor2(sessionId, directory);
   if (!path) return false;
   try {
-    mkdirSync(directory, { recursive: true, mode: 448 });
+    mkdirSync2(directory, { recursive: true, mode: 448 });
     writeJsonAtomicDurable(path, {
       sessionKey: Buffer.from(value.sessionKey).toString("base64"),
       wrappedKey: value.wrappedKey,
@@ -250,15 +311,15 @@ var saveSessionKey = (sessionId, value, directory = sessionKeyDirectory()) => {
   }
 };
 var sweepStaleSessionDisplays = (now = Date.now(), dir = sessionKeyDirectory()) => {
-  if (!existsSync(dir)) return 0;
+  if (!existsSync2(dir)) return 0;
   let removed = 0;
   try {
     for (const name of readdirSync(dir)) {
       if (!name.endsWith(".display")) continue;
-      const path = join2(dir, name);
+      const path = join3(dir, name);
       try {
         if (now - statSync(path).mtimeMs <= SESSION_DISPLAY_TTL_MS) continue;
-        rmSync(path, { force: true });
+        rmSync2(path, { force: true });
         removed += 1;
       } catch {
       }
@@ -366,8 +427,8 @@ var startDisplayPublisher = (options) => {
 
 // src/transcript-reader.ts
 import { createHash as createHash3 } from "crypto";
-import { join as join3 } from "path";
-import { closeSync as closeSync3, fstatSync as fstatSync3, openSync as openSync3, readFileSync as readFileSync5, readSync as readSync2, statSync as statSync2 } from "fs";
+import { join as join4 } from "path";
+import { closeSync as closeSync3, fstatSync as fstatSync3, openSync as openSync3, readFileSync as readFileSync6, readSync as readSync2, statSync as statSync2 } from "fs";
 
 // src/transcript-source.ts
 var normalizeTranscriptLines = (lines, source) => {
@@ -422,7 +483,7 @@ var transcriptLinesSince = (lines, oldestLineMs, dropCompactionSummaries) => lin
 });
 
 // src/transcript-snapshot-file.ts
-import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync3 } from "fs";
+import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync4 } from "fs";
 
 // src/transcript-snapshot-source.ts
 import { createHash } from "crypto";
@@ -551,10 +612,10 @@ var parseCursorSnapshot = (text) => {
     const record = JSON.parse(line);
     if (isRecord(record) && (record.type === "metadata" || record.type === "turn_ended")) continue;
     const message = cursorMessage.parse(record);
-    const fingerprint = createHash("sha256").update(canonicalJsonText(message)).digest("hex");
-    const occurrence = occurrences.get(fingerprint) ?? 0;
-    occurrences.set(fingerprint, occurrence + 1);
-    messages.push({ id: `cursor:${fingerprint}:${occurrence}`, role: message.role, content: message.message.content });
+    const fingerprint2 = createHash("sha256").update(canonicalJsonText(message)).digest("hex");
+    const occurrence = occurrences.get(fingerprint2) ?? 0;
+    occurrences.set(fingerprint2, occurrence + 1);
+    messages.push({ id: `cursor:${fingerprint2}:${occurrence}`, role: message.role, content: message.message.content });
   }
   return messages;
 };
@@ -587,7 +648,7 @@ var readTranscriptSnapshot = (path, source, sessionId) => {
   try {
     const before = fstatSync2(descriptor);
     if (!before.isFile() || before.size === 0 || before.size > SESSION_HISTORY_BACKFILL_LIMIT_BYTES) throw new Error("History snapshot is empty or exceeds its size limit");
-    const text = readFileSync3(descriptor, "utf8");
+    const text = readFileSync4(descriptor, "utf8");
     const after = fstatSync2(descriptor);
     if (before.size !== after.size || before.mtimeMs !== after.mtimeMs) throw new Error("History snapshot changed while reading");
     let messages;
@@ -610,8 +671,8 @@ var readTranscriptSnapshot = (path, source, sessionId) => {
 };
 
 // src/transcript-snapshot-journal.ts
-import { lstatSync as lstatSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync4 } from "fs";
-import { dirname } from "path";
+import { lstatSync as lstatSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync5 } from "fs";
+import { dirname as dirname2 } from "path";
 
 // src/transcript-projection.ts
 import { createHash as createHash2 } from "crypto";
@@ -619,7 +680,8 @@ var projectTranscriptSnapshot = (previous, messages) => {
   const revision = (previous?.revision ?? 0) + 1;
   const entries = /* @__PURE__ */ Object.create(null);
   const lines = [];
-  for (const [order, message] of messages.entries()) {
+  for (const message of messages) {
+    const order = message.sourcePosition;
     if (!message.id || message.id.length > 256 || Object.hasOwn(entries, message.id)) throw new Error("Invalid or duplicate history message identity");
     const record = { timestamp: message.timestamp, observedAtMs: message.observedAtMs, historyMessage: { role: message.role, content: message.content } };
     const digest = createHash2("sha256").update(JSON.stringify(record)).digest("hex");
@@ -660,7 +722,7 @@ var TranscriptSnapshotJournal = class {
       return;
     }
     if (!info.isFile() || info.nlink !== 1 || info.size > MAXIMUM_JOURNAL_BYTES || process.getuid && (info.uid !== process.getuid() || (info.mode & 511) !== 384)) throw new Error("Unsafe history checkpoint");
-    const saved = journalSchema.parse(JSON.parse(readFileSync4(path, "utf8")));
+    const saved = journalSchema.parse(JSON.parse(readFileSync5(path, "utf8")));
     if (saved.binding !== binding) throw new Error("History checkpoint belongs to another source");
     this.current = saved.epochStartedAtMs === epochStartedAtMs ? saved : { ...saved, epochStartedAtMs, initialized: false, observedAtMs: {}, pending: null, excludedIds: [], projection: { revision: Math.max(saved.projection?.revision ?? 0, saved.pending?.next.revision ?? 0), entries: {} } };
   }
@@ -677,7 +739,7 @@ var TranscriptSnapshotJournal = class {
     for (const message of messages) {
       if (!message.timestamp && !excluded.has(message.id) && !Object.hasOwn(observedAtMs, message.id)) observedAtMs[message.id] = nowMs;
     }
-    const allowed = messages.filter((message) => !excluded.has(message.id) && (message.timestamp ? Date.parse(message.timestamp) : observedAtMs[message.id] ?? 0) >= oldestMessageMs).map((message) => message.timestamp ? message : { ...message, observedAtMs: observedAtMs[message.id] });
+    const allowed = messages.flatMap((message, sourcePosition) => !excluded.has(message.id) && (message.timestamp ? Date.parse(message.timestamp) : observedAtMs[message.id] ?? 0) >= oldestMessageMs ? [{ ...message.timestamp ? message : { ...message, observedAtMs: observedAtMs[message.id] }, sourcePosition }] : []);
     const projected = projectTranscriptSnapshot(this.current.projection, allowed);
     if (projected.lines.length === 0) {
       const metadataChanged = excluded.size !== this.current.excludedIds.length || Object.keys(observedAtMs).length !== Object.keys(this.current.observedAtMs).length;
@@ -705,7 +767,7 @@ var TranscriptSnapshotJournal = class {
   }
   store(next) {
     if (Buffer.byteLength(JSON.stringify(next)) > MAXIMUM_JOURNAL_BYTES) throw new Error("History checkpoint exceeds its size limit");
-    mkdirSync2(dirname(this.path), { recursive: true, mode: 448 });
+    mkdirSync3(dirname2(this.path), { recursive: true, mode: 448 });
     writeJsonAtomicDurable(this.path, next, 384);
     this.current = journalSchema.parse(next);
   }
@@ -801,7 +863,7 @@ var appendOnlyReader = (path, source, epoch) => ({
   read(retentionDays, nowMs) {
     const version = sourceVersion(path);
     const read2 = epoch ? linesSeenDuringEpoch(epoch, path, source, nowMs, retentionDays) : null;
-    const lines = read2?.lines ?? normalizeTranscriptLines(readFileSync5(path, "utf8").split("\n"), source);
+    const lines = read2?.lines ?? normalizeTranscriptLines(readFileSync6(path, "utf8").split("\n"), source);
     return {
       lines,
       acknowledge() {
@@ -815,7 +877,7 @@ var appendOnlyReader = (path, source, epoch) => ({
 var snapshotReader = (options, source) => {
   const { path, epoch } = options;
   const binding = createHash3("sha256").update(JSON.stringify([options.baseUrl, options.apiKey, options.machineId, options.sessionId, source, path])).digest("hex");
-  const journalPath = join3(options.keyDirectory, "snapshots", binding + ".json");
+  const journalPath = join4(options.keyDirectory, "snapshots", binding + ".json");
   const epochStart = epoch?.startedAtMs ?? 0;
   const backfill = epoch ? epoch.backfill : SESSION_HISTORY_BACKFILL;
   let journal;
@@ -866,11 +928,11 @@ var transcriptHealthReporter = (target) => {
 };
 
 // src/transcript-sync.ts
-import { join as join4, resolve } from "path";
+import { join as join5, resolve } from "path";
 var claudeTranscriptPath = (cwd, sessionId) => {
   const projectId = resolve(cwd).replace(/[^a-zA-Z0-9-]/g, "-");
   const configDir = claudeConfigDir();
-  return join4(configDir, "projects", projectId, `${sessionId}.jsonl`);
+  return join5(configDir, "projects", projectId, `${sessionId}.jsonl`);
 };
 var createSyncState = () => ({
   sessionKey: null,
@@ -977,6 +1039,8 @@ var chunkRecords = (records) => {
 };
 var IDLE_CEILING_MS = 6e4;
 var RECIPIENT_REFRESH_MS = 6e4;
+var MAXIMUM_READS_PASSED_OVER_PER_TICK = 16;
+var LONGEST_SESSION_HISTORY_RETENTION_DAYS = Math.max(...Object.values(SESSION_HISTORY_RETENTION_DAYS));
 var CATCH_UP_DELAY_MS = 50;
 var STALLED_BACKOFF_FACTOR = 4;
 var nothingLeftToUpload = (state) => state.sessionKey !== null && !state.keyRejected && state.unsettled === 0;
@@ -1039,6 +1103,15 @@ var startTranscriptSync = (opts) => {
     persistedKey = state.sessionKey;
     persistedUploaded = state.keyUploaded;
   };
+  const passOverConversationWhileHistoryIsOff = () => {
+    try {
+      for (let read2 = 0; read2 < MAXIMUM_READS_PASSED_OVER_PER_TICK; read2++) {
+        if (reader.read(LONGEST_SESSION_HISTORY_RETENTION_DAYS, Date.now()).acknowledge() !== "more") return;
+      }
+    } catch {
+      return;
+    }
+  };
   let running = true;
   let inFlight = false;
   let stalled = false;
@@ -1059,6 +1132,7 @@ var startTranscriptSync = (opts) => {
       const recipients = await fetchPinnedRecipients();
       if (!recipients) {
         waitingForRecipients = true;
+        if (recipientFailure === "off_for_workspace") passOverConversationWhileHistoryIsOff();
         await reportHealth(recipientFailure);
         return;
       }
@@ -1125,7 +1199,7 @@ var startTranscriptSync = (opts) => {
 };
 
 // src/transcript-registration.ts
-import { homedir as homedir2 } from "os";
+import { homedir as homedir3 } from "os";
 var storedRegistrationSchema = external_exports.object({
   sessionId: external_exports.string().min(1).max(128),
   cwd: external_exports.string(),
@@ -1140,18 +1214,41 @@ var storedRegistrationSchema = external_exports.object({
   endedAt: external_exports.number().positive().optional(),
   drained: external_exports.boolean().optional()
 });
-var defaultRegistryDirectory = () => process.env.PUSHARY_TRANSCRIPT_REGISTRY_DIR || join5(pusharyDir(), "transcript-capture");
+var defaultRegistryDirectory = () => process.env.PUSHARY_TRANSCRIPT_REGISTRY_DIR || join6(pusharyDir(), "transcript-capture");
 var cliRegistry = (apiKey = getApiKey()) => ({ apiKey, baseUrl: getBaseUrl(), directory: defaultRegistryDirectory() });
 var accountFor = (registry) => createHash4("sha256").update(`${registry.baseUrl}\0${registry.apiKey}`).digest("hex");
 var TTL = 48 * 60 * 60 * 1e3;
+var registeredReadPositionsFile = (registry) => join6(registry.directory, "read-positions", `${accountFor(registry)}.json`);
+var SNAPSHOT_KEYS_DIRECTORY_NAME = "snapshot-keys";
+var SNAPSHOT_RECIPIENT_PIN_FILE_NAME = "recipients.json";
+var snapshotKeyDirectory = (registry) => join6(registry.directory, SNAPSHOT_KEYS_DIRECTORY_NAME, accountFor(registry));
+var snapshotRecipientPinFile = (registry) => join6(snapshotKeyDirectory(registry), SNAPSHOT_RECIPIENT_PIN_FILE_NAME);
+var entryAt = (path) => {
+  try {
+    return lstatSync3(path);
+  } catch {
+    return null;
+  }
+};
+var removedPinFile = (path) => {
+  const entry = entryAt(path);
+  if (!entry || !(entry.isFile() || entry.isSymbolicLink())) return false;
+  unlinkSync2(path);
+  return true;
+};
+var clearSnapshotRecipientPins = (registryDirectory = defaultRegistryDirectory()) => {
+  const accounts = join6(registryDirectory, SNAPSHOT_KEYS_DIRECTORY_NAME);
+  if (!entryAt(accounts)?.isDirectory()) return false;
+  return readdirSync2(accounts, { withFileTypes: true }).filter((account) => account.isDirectory()).map((account) => removedPinFile(join6(accounts, account.name, SNAPSHOT_RECIPIENT_PIN_FILE_NAME))).includes(true);
+};
 var read = (path) => {
   if (statSync3(path).size > 16384) throw new Error("History registration exceeds its size limit");
-  return storedRegistrationSchema.parse(JSON.parse(readFileSync6(path, "utf8")));
+  return storedRegistrationSchema.parse(JSON.parse(readFileSync7(path, "utf8")));
 };
 var consent = (record) => record.consentOverride ?? readTranscriptPreference() ?? true;
 var withoutTrailingSlash = (url) => url.replace(/\/+$/, "");
 var sameServer = (url, registry) => withoutTrailingSlash(url) === withoutTrailingSlash(registry.baseUrl);
-var fileFor3 = (registry, sessionId) => join5(registry.directory, `${createHash4("sha256").update(accountFor(registry) + sessionId).digest("hex")}.json`);
+var fileFor3 = (registry, sessionId) => join6(registry.directory, `${createHash4("sha256").update(accountFor(registry) + sessionId).digest("hex")}.json`);
 var permitted = (registry, raw) => raw.account === accountFor(registry) && consent(raw) && !raw.drained && (raw.source !== "claude" || !!raw.expectedSiteId || !macOwnsClaudeHooks(raw.cwd)) && (!raw.expectedSiteId || raw.expectedSiteId === raw.verifiedSiteId && !!raw.expectedBaseUrl && sameServer(raw.expectedBaseUrl, registry));
 var registeredTranscriptEnabled = (apiKey, sessionId, registry = cliRegistry(apiKey)) => {
   try {
@@ -1161,25 +1258,25 @@ var registeredTranscriptEnabled = (apiKey, sessionId, registry = cliRegistry(api
   }
 };
 var macOwnsClaudeHooks = (cwd) => [
-  join5(claudeConfigDir(), "settings.json"),
-  join5(cwd, ".claude", "settings.json"),
-  join5(cwd, ".claude", "settings.local.json")
+  join6(claudeConfigDir(), "settings.json"),
+  join6(cwd, ".claude", "settings.json"),
+  join6(cwd, ".claude", "settings.local.json")
 ].some((path) => {
   try {
-    return hookOwnerOf(JSON.parse(readFileSync6(path, "utf8"))) === "app";
+    return hookOwnerOf(JSON.parse(readFileSync7(path, "utf8"))) === "app";
   } catch {
     return false;
   }
 });
 var TRANSCRIPT_ROOT_NAME = { claude: "projects", codex: "sessions", gemini: "tmp", cursor: "projects", hermes: "hermes-history" };
 var transcriptRoots = (source) => {
-  const home = homedir2();
-  if (source === "codex") return [join5(codexHome(), TRANSCRIPT_ROOT_NAME.codex)];
-  if (source === "cursor") return [join5(home, ".cursor", TRANSCRIPT_ROOT_NAME.cursor)];
-  if (source === "hermes") return [join5(home, ".pushary", TRANSCRIPT_ROOT_NAME.hermes)];
-  if (source === "gemini") return [join5(process.env.GEMINI_CLI_HOME || home, ".gemini", "tmp"), join5(home, ".cache", ".gemini", "tmp")];
+  const home = homedir3();
+  if (source === "codex") return [join6(codexHome(), TRANSCRIPT_ROOT_NAME.codex)];
+  if (source === "cursor") return [join6(home, ".cursor", TRANSCRIPT_ROOT_NAME.cursor)];
+  if (source === "hermes") return [join6(home, ".pushary", TRANSCRIPT_ROOT_NAME.hermes)];
+  if (source === "gemini") return [join6(process.env.GEMINI_CLI_HOME || home, ".gemini", "tmp"), join6(home, ".cache", ".gemini", "tmp")];
   const configured = process.env.CLAUDE_CONFIG_DIR;
-  return [join5(configured || join5(home, ".claude"), TRANSCRIPT_ROOT_NAME.claude), join5(home, ".claude", TRANSCRIPT_ROOT_NAME.claude)];
+  return [join6(configured || join6(home, ".claude"), TRANSCRIPT_ROOT_NAME.claude), join6(home, ".claude", TRANSCRIPT_ROOT_NAME.claude)];
 };
 var isAgentTranscriptRoot = (root, source) => isAbsolute(root) && resolve2(root) === root && basename(root) === TRANSCRIPT_ROOT_NAME[source];
 var acceptedTranscriptRoots = (source, registeredRoot) => typeof registeredRoot === "string" && isAgentTranscriptRoot(registeredRoot, source) ? [...transcriptRoots(source), registeredRoot] : transcriptRoots(source);
@@ -1188,8 +1285,8 @@ var resolvedSourcePath = (path) => {
   try {
     return realpathSync(absolute);
   } catch {
-    const parent = dirname2(absolute);
-    return parent === absolute ? absolute : join5(resolvedSourcePath(parent), basename(absolute));
+    const parent = dirname3(absolute);
+    return parent === absolute ? absolute : join6(resolvedSourcePath(parent), basename(absolute));
   }
 };
 var transcriptRootContaining = (candidate, roots) => {
@@ -1209,9 +1306,15 @@ var captureRegistration = (source, value, registeredRoot) => {
   const segments = relative(root, path).split(sep);
   if (source === "hermes" && (segments.length !== 2 || !/^[a-f0-9]{64}$/.test(segments[0] ?? "") || basename(path) !== `${sessionId}.json`)) return null;
   if (source === "gemini" && (segments.length !== 3 || segments[1] !== "chats" || !basename(path).startsWith("session-"))) return null;
-  if (source === "cursor" && (segments[1] !== "agent-transcripts" || basename(path) !== `${sessionId}.jsonl` || !(segments.length === 3 || segments.length === 4 && basename(dirname2(path)) === sessionId))) return null;
+  if (source === "cursor" && (segments[1] !== "agent-transcripts" || basename(path) !== `${sessionId}.jsonl` || !(segments.length === 3 || segments.length === 4 && basename(dirname3(path)) === sessionId))) return null;
   return { sessionId, cwd: input.cwd, path, source, root };
 };
+var SESSION_END_EVENT = "SessionEnd";
+var closesSession = (source, input) => {
+  const event = input.hook_event_name;
+  if (typeof event !== "string") return false;
+  return event === SESSION_END_EVENT || isHookSource(source) && hookMeaning(source, event)?.kind === "session_closed";
+};
 var registerTranscript = (source, input, startDaemon = () => {
   void ensureDaemonRunning({ waitTimeoutMs: 0 }).catch(() => {
   });
@@ -1232,7 +1335,7 @@ var registerTranscript = (source, input, startDaemon = () => {
       return;
     }
     if (source === "claude" && !options.siteId && !previous?.expectedSiteId && macOwnsClaudeHooks(registration.cwd)) return;
-    const ending = options.ended || input.hook_event_name === "SessionEnd" && process.env.PUSHARY_WRAPPER_ACTIVE !== "1";
+    const ending = options.ended || closesSession(source, input) && process.env.PUSHARY_WRAPPER_ACTIVE !== "1";
     const stored = {
       ...registration,
       path: previous?.account === account ? previous.path : registration.path,
@@ -1263,8 +1366,8 @@ var sightRegisteredTranscripts = (epoch, registry, listing) => {
 };
 var startRegisteredTranscripts = (apiKey, machineId, options = {}) => {
   const { intervalMs = 3e3, enabled = () => true, storage } = options;
-  const epoch = options.epoch ?? startTranscriptCaptureEpoch(Date.now(), void 0, SESSION_HISTORY_BACKFILL);
   const registry = { apiKey, baseUrl: options.baseUrl ?? getBaseUrl(), directory: options.registryDirectory ?? defaultRegistryDirectory() };
+  const epoch = options.epoch ?? startTranscriptCaptureEpoch(Date.now(), savedTranscriptReadPositions(registeredReadPositionsFile(registry)), SESSION_HISTORY_BACKFILL);
   const active = /* @__PURE__ */ new Map();
   let stopped = false;
   let scanning = false;
@@ -1277,7 +1380,7 @@ var startRegisteredTranscripts = (apiKey, machineId, options = {}) => {
     try {
       let unreadable = 0;
       const files = readdirSync2(registry.directory).filter((name) => name.endsWith(".json")).flatMap((name) => {
-        const path = join5(registry.directory, name);
+        const path = join6(registry.directory, name);
         try {
           const time = statSync3(path).mtimeMs;
           if (Date.now() - time > TTL) {
@@ -1326,10 +1429,9 @@ var startRegisteredTranscripts = (apiKey, machineId, options = {}) => {
       for (const [id, registration] of wanted) {
         if (active.has(id)) continue;
         const current = () => read(registration.registrationPath);
-        const snapshotKeys = join5(registry.directory, "snapshot-keys", accountFor(registry));
         const keyStorage = storage ?? (registration.source === "claude" || registration.source === "codex" ? void 0 : {
-          sessionKeyDirectory: snapshotKeys,
-          recipientPinFile: join5(snapshotKeys, "recipients.json")
+          sessionKeyDirectory: snapshotKeyDirectory(registry),
+          recipientPinFile: snapshotRecipientPinFile(registry)
         });
         active.set(id, { path: registration.path, stop: startTranscriptSync({
           apiKey,
@@ -1381,7 +1483,11 @@ export {
   sessionKeyDirectory,
   loadSessionKey,
   startDraftPublisher,
+  loadPin,
+  clearPin,
+  fingerprint,
   claudeTranscriptPath,
+  clearSnapshotRecipientPins,
   registeredTranscriptEnabled,
   captureRegistration,
   registerTranscript,

package/dist/{chunk-QPJQAE2L.js → chunk-ZWKF7WE4.js}

@@ -1,17 +1,17 @@
 import {
   keyCheckFromResponse
-} from "./chunk-VCMDY6YL.js";
+} from "./chunk-BUS7MXEE.js";
 import {
   installNetworkDefaults
-} from "./chunk-NDLOWIYO.js";
+} from "./chunk-JJCMQRBF.js";
 import {
   getBaseUrl
-} from "./chunk-TBU4WXA4.js";
+} from "./chunk-JSZT4Q23.js";
 import {
   isRecord,
   isToolErrorResult,
   toolFailureCodeOfResult
-} from "./chunk-L4THAI7Q.js";
+} from "./chunk-JHWOM55B.js";
 
 // src/retry.ts
 var isRetryable = (err) => {

package/dist/{codex-app-cards-switch-CTAOTOCH.js → codex-app-cards-switch-26N5XSSZ.js}

@@ -22,22 +22,22 @@ import {
   turnCodexAppCardsOff,
   turnCodexAppCardsOn,
   whyLaunchctlFailed
-} from "./chunk-XHHX63PY.js";
-import "./chunk-TMBLBDPB.js";
+} from "./chunk-OSEGZLCO.js";
+import "./chunk-FNC4SPOD.js";
 import "./chunk-XCEN33UP.js";
 import "./chunk-QCGNGEGE.js";
-import "./chunk-6CJ4MSZU.js";
+import "./chunk-SAPRO7FI.js";
 import "./chunk-XHKBHWLX.js";
-import "./chunk-IBULUTHA.js";
+import "./chunk-FRPR4OTH.js";
 import "./chunk-E46NE7FB.js";
-import "./chunk-JIC5PGNI.js";
-import "./chunk-FEF3ILT6.js";
-import "./chunk-B2RDWRKR.js";
-import "./chunk-YIAJOV2X.js";
-import "./chunk-TBU4WXA4.js";
-import "./chunk-2KVELJZX.js";
+import "./chunk-V4JZHAOY.js";
+import "./chunk-UGELL4RB.js";
+import "./chunk-PHBZK4SC.js";
+import "./chunk-64XK7DLE.js";
+import "./chunk-JSZT4Q23.js";
+import "./chunk-GGGOFJBL.js";
 import "./chunk-ZVU6WMMU.js";
-import "./chunk-L4THAI7Q.js";
+import "./chunk-JHWOM55B.js";
 import "./chunk-MLKGABMK.js";
 export {
   CODEX_APP_CARDS_DIRECTORY,

package/dist/{codex-desktop-launch-2DZVA5C7.js → codex-desktop-launch-UU6CPB2I.js}

@@ -11,7 +11,7 @@ import {
   installedCodexApp,
   shellQuoted,
   writeDesktopProxy
-} from "./chunk-TMBLBDPB.js";
+} from "./chunk-FNC4SPOD.js";
 import "./chunk-XCEN33UP.js";
 import {
   CODEX_APP_LAUNCH_VARIABLE