pushary 1.9.94 → 1.9.96

package/dist/{chunk-X5DCL36E.js → chunk-JU3JYEUG.js}

@@ -1,19 +1,19 @@
 import {
   notificationAnswerStep
-} from "./chunk-OSDL6OND.js";
+} from "./chunk-3QS2RCCZ.js";
 import {
   canChangeApprovalSettings
-} from "./chunk-HZQIC3DG.js";
+} from "./chunk-EMVK57K7.js";
 import {
   matchMacAccountStep,
   retryAgentCommand
-} from "./chunk-3GZCHFYV.js";
+} from "./chunk-IVYKPYMH.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-FQZSKWWL.js";
+} from "./chunk-6YG5PZZS.js";
 
 // src/setup/closing.ts
 var ACTIVITY_URL = "pushary.com/dashboard/agent/activity";

package/dist/{chunk-Z4JULPCS.js → chunk-KG7GT7UW.js}

@@ -2,7 +2,7 @@ import {
   localRepoKey,
   normalizeRepoRemote,
   parseGitBranch
-} from "./chunk-XERTD7VZ.js";
+} from "./chunk-OS32P4RZ.js";
 
 // src/repo.ts
 import { existsSync, readFileSync, statSync } from "fs";

package/dist/{chunk-SSXMA23D.js → chunk-KHGW7THQ.js}

@@ -1,9 +1,9 @@
 import {
   realpath
-} from "./chunk-AUIRBCYE.js";
+} from "./chunk-UFWRBHTV.js";
 import {
   findNativeClaudeInstall
-} from "./chunk-QVCDU4NT.js";
+} from "./chunk-J3W32P43.js";
 import {
   readGlobalPrefixAsync,
   resolveGlobalBinary,
@@ -13,10 +13,10 @@ import {
   resolvePackageVersionFromBinary,
   resolvePathBinary,
   resolvePathBinaryAsync
-} from "./chunk-GPGLRSGY.js";
+} from "./chunk-77HBRZJI.js";
 import {
   MANAGED_PROVIDERS
-} from "./chunk-XERTD7VZ.js";
+} from "./chunk-OS32P4RZ.js";
 
 // src/live-capabilities.ts
 import { homedir } from "os";

package/dist/{chunk-6YX4VASU.js → chunk-LGJPT33C.js}

@@ -7,10 +7,10 @@ import {
   codexHome,
   codexHooksJsonIn,
   isPusharyCodexCommand
-} from "./chunk-LFIFIIMK.js";
+} from "./chunk-YCYFREHD.js";
 import {
   resolvePathBinary
-} from "./chunk-GPGLRSGY.js";
+} from "./chunk-77HBRZJI.js";
 import {
   getPackageVersion
 } from "./chunk-ZVU6WMMU.js";

package/dist/{chunk-CS2C7S5L.js → chunk-M52UDSMQ.js}

@@ -1,19 +1,19 @@
 import {
   macAppBridgeAvailable
-} from "./chunk-K3E3NFTT.js";
+} from "./chunk-BDCFB4NV.js";
 import {
   keyPrefix
-} from "./chunk-REV2QMUD.js";
+} from "./chunk-TVGOSEWS.js";
 import {
   bridgeAgentKey
-} from "./chunk-LFIFIIMK.js";
+} from "./chunk-YCYFREHD.js";
 import {
   readJsonSafe
-} from "./chunk-GPGLRSGY.js";
+} from "./chunk-77HBRZJI.js";
 import {
   isRecord,
   isValidApiKey
-} from "./chunk-XERTD7VZ.js";
+} from "./chunk-OS32P4RZ.js";
 
 // src/shared-mcp-key.ts
 var asRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;

package/dist/{chunk-ERQD5UVH.js → chunk-M7ZV5IPA.js}

@@ -1,25 +1,25 @@
 import {
   registerTranscript
-} from "./chunk-6SN6L5YT.js";
+} from "./chunk-QDS55ODM.js";
 import {
   namedEvent
-} from "./chunk-X7GKDLW7.js";
+} from "./chunk-7CW3K3B5.js";
 import {
   isBridgeLocator,
   liveBridgeProbe,
   pusharyHookExecutable,
   resolveBridgeStub
-} from "./chunk-K56A3LSA.js";
+} from "./chunk-SISYAMDC.js";
 import {
   writeDegraded
-} from "./chunk-SKYDYDGX.js";
+} from "./chunk-CRJDKGEF.js";
 import {
   cursorUserHooks
-} from "./chunk-LFIFIIMK.js";
+} from "./chunk-YCYFREHD.js";
 import {
   atLeast,
   parseVersion
-} from "./chunk-GPGLRSGY.js";
+} from "./chunk-77HBRZJI.js";
 import {
   CURSOR_GATE_COVERAGE,
   CURSOR_GATE_SCRIPT,
@@ -33,7 +33,7 @@ import {
   isGrokSessionEndStop,
   isRecord,
   toolsCoveredByGateEntry
-} from "./chunk-XERTD7VZ.js";
+} from "./chunk-OS32P4RZ.js";
 
 // src/tool-hook-input.ts
 var OPTIONAL_TEXT_FIELDS = ["hook_event_name", "session_id", "cwd", "transcript_path", "tool_use_id", "permission_mode", "cursor_version"];

package/dist/{chunk-TYHOBIDF.js → chunk-MSPHJNUL.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   renderCommandHelp
-} from "./chunk-FQZSKWWL.js";
+} from "./chunk-6YG5PZZS.js";
 import {
   getPackageVersion
 } from "./chunk-ZVU6WMMU.js";

package/dist/{chunk-IMNXYNBJ.js → chunk-N2KK2NSY.js}

@@ -1,9 +1,9 @@
 import {
   pusharyDir
-} from "./chunk-LFIFIIMK.js";
+} from "./chunk-YCYFREHD.js";
 import {
   writeFileAtomic
-} from "./chunk-GPGLRSGY.js";
+} from "./chunk-77HBRZJI.js";
 
 // src/identity.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-EFCHGKAD.js → chunk-NGSJHUQN.js}

@@ -7,7 +7,7 @@ import {
   recordSealerFor,
   uploadTranscriptRecords,
   wrapSessionKey
-} from "./chunk-CDIVGMBR.js";
+} from "./chunk-PDRPVVZX.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;

package/dist/{chunk-VDBRLNW7.js → chunk-OP2WJEPY.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-XMSDA5WA.js";
 import {
   writeJsonAtomic
-} from "./chunk-GPGLRSGY.js";
+} from "./chunk-77HBRZJI.js";
 
 // src/transcript-read-positions.ts
 import { lstatSync, readFileSync } from "fs";

package/dist/{chunk-ZZ5QZ24I.js → chunk-OQY4G7FS.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-LFIFIIMK.js";
+} from "./chunk-YCYFREHD.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-XERTD7VZ.js → chunk-OS32P4RZ.js}

@@ -4538,12 +4538,14 @@ var sqlClientChangesData = (invocation) => {
 var PULL_REQUEST_CLIS = /* @__PURE__ */ new Set(["gh", "glab"]);
 var PULL_REQUEST_NOUNS = /* @__PURE__ */ new Set(["pr", "mr"]);
 var MERGE_SUBCOMMAND = "merge";
-var PULL_REQUEST_MERGE_PATH = /(?:^|\/)pulls\/[^/\s]+\/merge(?:[?#]|$)/;
+var PULL_REQUEST_MERGE_PATH = /(?:^|\/)pulls\/\d+\/merge$/;
+var PULL_REQUEST_MERGE_PATH_SPELLED_ANY_WAY = /(?:^|\/)pulls\/[^/\s]+\/merge(?:[?#]|$)/;
 var mergesAPullRequest = ({ program, args }) => {
   if (program === void 0 || !PULL_REQUEST_CLIS.has(basenameOf(program.text))) return false;
   const words = args.filter((arg) => !arg.text.startsWith("-"));
   return words.some((word, index) => PULL_REQUEST_NOUNS.has(word.text) && words[index + 1]?.text === MERGE_SUBCOMMAND) || args.some((arg) => PULL_REQUEST_MERGE_PATH.test(arg.text));
 };
+var mergesAPullRequestByAnyPath = ({ program, args }) => program !== void 0 && PULL_REQUEST_CLIS.has(basenameOf(program.text)) && args.some((arg) => PULL_REQUEST_MERGE_PATH_SPELLED_ANY_WAY.test(arg.text));
 var DEPLOY_AND_SCHEMA_COMMAND_PATTERNS = [
   "Bash(kubectl apply:*)",
   "Bash(kubectl replace:*)",
@@ -4659,8 +4661,11 @@ var pathNeedsAPersonToChange = (path) => {
 };
 var REDIRECTS_INTO_A_SECRET_FILE = />>?\s*(?:[^\s;|&<>]*\/)?\.env(?:\.[\w-]+)?(?=$|[\s;|&)])/;
 var COPIES_ONTO_ITS_LAST_OPERAND = /* @__PURE__ */ new Set(["cp", "install", "ln", "rsync", "scp"]);
-var WRITES_EVERY_OPERAND = /* @__PURE__ */ new Set(["mv", "tee", "rm", "unlink", "shred", "truncate", "sponge"]);
-var EDITS_IN_PLACE = /* @__PURE__ */ new Set(["sed", "gsed", "perl", "yq"]);
+var WRITES_EVERY_OPERAND = /* @__PURE__ */ new Set(["mv", "tee", "rm", "unlink", "shred", "truncate"]);
+var EDITS_IN_PLACE = /* @__PURE__ */ new Set(["sed", "gsed", "perl"]);
+var IN_PLACE_FLAG = /^(?:-[A-Za-z]*i|--in-place(?:=.*)?)$/;
+var PERMISSIONS_OFF_WRITES_EVERY_OPERAND = /* @__PURE__ */ new Set([...WRITES_EVERY_OPERAND, "sponge"]);
+var PERMISSIONS_OFF_EDITS_IN_PLACE = /* @__PURE__ */ new Set([...EDITS_IN_PLACE, "yq"]);
 var IN_PLACE_LONG_FLAG = /^--in-?place(?:=|$)/;
 var IN_PLACE_LETTER = "i";
 var SED_FLAGS_THAT_TAKE_THE_REST = /* @__PURE__ */ new Set(["e", "f", "l"]);
@@ -4698,6 +4703,7 @@ var spellingsOfAWord = (word) => {
   }
   return spellings.map((text3) => ({ ...word, text: text3 }));
 };
+var namesASecretFile = (word) => word !== void 0 && SECRET_FILE_NAME.test(basenameOf(word.text));
 var namesAFileThatNeedsAPerson = (word) => word !== void 0 && pathNeedsAPersonToChange(word.text);
 var RECURSIVE_COPY_FLAG = /^(?:-[A-Za-z]*[rRa][A-Za-z]*|--recursive|--archive)$/;
 var FOLDER_THAT_NEEDS_A_PERSON = new RegExp(String.raw`(?:^|/)(?:${[
@@ -4732,6 +4738,17 @@ var NETWORK_SENDERS = /* @__PURE__ */ new Set([
   "rclone"
 ]);
 var FILE_REFERENCE_PREFIX = /^(?:[\w.-]+=)?@|^[\w.-]+:/;
+var namesASecretFileReference = (word) => SECRET_FILE_NAME.test(basenameOf(word.text.replace(FILE_REFERENCE_PREFIX, "")));
+var sendsASecretFile = ({ program, args }) => program !== void 0 && NETWORK_SENDERS.has(basenameOf(program.text)) && args.some(namesASecretFileReference);
+var writesASecretFile = ({ program, args }) => {
+  if (program === void 0) return false;
+  if (sendsASecretFile({ program, args })) return true;
+  const name = basenameOf(program.text);
+  const operands = args.filter((arg) => !FLAG.test(arg.text));
+  if (COPIES_ONTO_ITS_LAST_OPERAND.has(name)) return namesASecretFile(operands.at(-1));
+  if (WRITES_EVERY_OPERAND.has(name)) return operands.some(namesASecretFile);
+  return EDITS_IN_PLACE.has(name) && args.some((arg) => IN_PLACE_FLAG.test(arg.text)) && operands.some(namesASecretFile);
+};
 var referencesAFileThatNeedsAPerson = (word) => pathNeedsAPersonToChange(word.text.replace(FILE_REFERENCE_PREFIX, ""));
 var sendsAFileThatNeedsAPerson = ({ program, args }) => program !== void 0 && NETWORK_SENDERS.has(basenameOf(program.text)) && args.some(referencesAFileThatNeedsAPerson);
 var targetDirectoryOf = (args) => {
@@ -4762,13 +4779,13 @@ var writesAFileThatNeedsAPerson = ({ program, args }) => {
   if (program === void 0) return false;
   if (sendsAFileThatNeedsAPerson({ program, args })) return true;
   const name = basenameOf(program.text);
-  const editsInPlace = EDITS_IN_PLACE.has(name) && args.some((arg) => flagEditsInPlace(name, arg.text));
-  if (!COPIES_ONTO_ITS_LAST_OPERAND.has(name) && !WRITES_EVERY_OPERAND.has(name) && !editsInPlace) return false;
+  const editsInPlace = PERMISSIONS_OFF_EDITS_IN_PLACE.has(name) && args.some((arg) => flagEditsInPlace(name, arg.text));
+  if (!COPIES_ONTO_ITS_LAST_OPERAND.has(name) && !PERMISSIONS_OFF_WRITES_EVERY_OPERAND.has(name) && !editsInPlace) return false;
   const spelled = args.filter((arg) => !FLAG.test(arg.text)).map(spellingsOfAWord);
   if (spelled.includes(null)) return true;
   const operands = spelled.flatMap((words) => words ?? []);
   if (COPIES_ONTO_ITS_LAST_OPERAND.has(name)) return copiesOntoAFileThatNeedsAPerson(args, operands);
-  if (WRITES_EVERY_OPERAND.has(name)) {
+  if (PERMISSIONS_OFF_WRITES_EVERY_OPERAND.has(name)) {
     return operands.some((operand) => namesAFileThatNeedsAPerson(operand) || folderNeedsAPersonToChange(operand.text)) || name === MOVE && copiesOntoAFileThatNeedsAPerson(args, operands);
   }
   return operands.some(namesAFileThatNeedsAPerson);
@@ -4877,7 +4894,8 @@ var AWS_OPTIONS_WITH_VALUES = /* @__PURE__ */ new Set([
   "--cli-binary-format"
 ]);
 var AWS_LOCAL_COMMANDS = /* @__PURE__ */ new Set(["configure", "help", "history", "sso", "login", "logout"]);
-var AWS_READ_OPERATION = /^(?:describe|list|get|head|batch-get|lookup|search|filter|scan|query|select|wait|validate|estimate|simulate|tail|ls|presign|help|login|update-kubeconfig|start-query|stop-query|assume-role)(?:-|$)/;
+var AWS_READ_OPERATION = /^(?:describe|list|get|head|batch-get|lookup|search|filter|scan|query|select|wait|validate|estimate|simulate|tail|ls|presign|help)(?:-|$)/;
+var AWS_SIGN_IN_OR_QUERY_OPERATION = /^(?:login|update-kubeconfig|start-query|stop-query|assume-role)(?:-|$)/;
 var AWS_S3_SERVICE = "s3";
 var AWS_S3_COPIES = /* @__PURE__ */ new Set(["cp", "sync"]);
 var S3_URL_PREFIX = "s3://";
@@ -4976,10 +4994,15 @@ var twilioCliWrites = (args) => {
   return !TWILIO_READ_ACTIONS.has(topic.text.split(TWILIO_TOPIC_SEPARATOR).at(-1) ?? "");
 };
 var GITHUB_CLI = "gh";
+var AWS_CLI = "aws";
+var awsOnlySignsInOrQueries = (args) => {
+  const [service, operation] = positionalWordsOf(args, AWS_OPTIONS_WITH_VALUES);
+  return service !== void 0 && service.text !== AWS_S3_SERVICE && operation !== void 0 && AWS_SIGN_IN_OR_QUERY_OPERATION.test(operation.text);
+};
 var REMOTE_API_CLI_WRITES = /* @__PURE__ */ new Map([
   [GITHUB_CLI, githubCliWrites],
   ["stripe", stripeCliWrites],
-  ["aws", awsCliWrites],
+  [AWS_CLI, awsCliWrites],
   ["twilio", twilioCliWrites]
 ]);
 var invocationWritesThroughARemoteApi = ({ program, args }) => {
@@ -5062,6 +5085,7 @@ var writesThroughAServiceApi = (invocation) => {
   const name = basenameOf(innermost.program?.text ?? "");
   if (name === GITHUB_CLI) return false;
   if (name === STRIPE_CLI && !stripeMayUseLiveData(wordsOfInvocation(invocation))) return false;
+  if (name === AWS_CLI && awsOnlySignsInOrQueries(innermost.args)) return false;
   return invocationWritesThroughARemoteApi(innermost);
 };
 var NO_SHORT_OPTIONS = /* @__PURE__ */ new Set();
@@ -5188,7 +5212,6 @@ var commandNeedsAPerson = (toolName, command) => {
   const segments = readableCommandSegments(command);
   return segments === null || classifyDecisionRisk(readingTool, command) !== "standard" || segments.some((segment) => segmentNeedsAPerson(readingTool, segment)) || pipesIntoASqlClient(command) || shellDialectOf(toolName) === "powershell" && powerShellCommandHasAVisibleConsequence(command, posixShellJudgeFor(toolName));
 };
-var sessionGrantMustAskAbout = (toolName, command) => commandNeedsAPerson(toolName, command) || SHELL_DIALECT_BY_TOOL.has(toolName) && commandHasAVisibleConsequence(toolName, command);
 var VISIBLE_DATA_LOSS_PATTERNS = [
   "Bash(git branch -D:*)",
   "Bash(git branch --delete:*)",
@@ -5300,12 +5323,12 @@ var FIND_RUNNERS = /* @__PURE__ */ new Set(["-exec", "-execdir", "-ok", "-okdir"
 var FIND_RUNNER_END = /* @__PURE__ */ new Set([";", "+"]);
 var FIND = "find";
 var commandsRunByFind = ({ program, args }) => program === void 0 || basenameOf(program.text) !== FIND ? [] : args.flatMap((arg, index) => FIND_RUNNERS.has(arg.text) ? [{ program: args[index + 1], args: args.slice(index + 2, findRunnerEnd(args, index + 2)) }] : []);
-var losesDataVisibly = (toolName, invocation, normalized, depth) => {
+var losesDataVisibly = (toolName, invocation, normalized, depth, line) => {
   const { program, args } = invocation;
   if (program === void 0) return false;
   const name = basenameOf(program.text);
   if (name === FIND) {
-    return args.some((arg) => arg.text === FIND_DELETE) || commandsRunByFind(invocation).some((run) => invocationHasAVisibleConsequence(toolName, run, depth + 1));
+    return args.some((arg) => arg.text === FIND_DELETE) || commandsRunByFind(invocation).some((run) => invocationHasAVisibleConsequence(toolName, run, depth + 1, line));
   }
   const destructiveArguments = destructiveArgumentsOf(name, args);
   return destructiveArguments !== void 0 && args.some((arg) => namesDestructiveArgument(arg.text, destructiveArguments)) || namesDestructiveWordInAnyCase(name, args.map((arg) => arg.text)) || gitDiscardsWork(invocation) || changesAService(invocation) || replacesTheCrontab(invocation) || isCoveredByPolicy(VISIBLE_DATA_LOSS_PATTERNS, toolName, normalized);
@@ -5471,13 +5494,14 @@ var honoursPreviewFlags = ({ program, args }) => {
 var onlyPreviews = (invocation) => invocation.program !== void 0 && honoursPreviewFlags(invocation) && invocation.args.some((arg) => !arg.expands && PREVIEW_FLAG.test(arg.text));
 var changesWhatIsDeployed = (toolName, invocation, normalized) => !onlyPreviews(invocation) && (changesProduction(invocation) || mergesAPullRequest(invocation) || isCoveredByPolicy(DEPLOY_AND_SCHEMA_COMMAND_PATTERNS, toolName, normalized));
 var releasesOrChangesACluster = (toolName, invocation, normalized) => !onlyPreviews(invocation) && (pushesATag(invocation) || publishesAnAppBuild(invocation) || RELEASE_AND_CLUSTER_PROGRAMS.has(basenameOf(invocation.program?.text ?? "")) && isCoveredByPolicy(RELEASE_AND_CLUSTER_COMMAND_PATTERNS, toolName, normalized));
-var invocationHasAVisibleConsequence = (toolName, invocation, depth) => {
+var invocationHasAConsequenceOnlyPermissionsOffAsksAbout = (toolName, invocation, normalized) => releasesOrChangesACluster(toolName, invocation, normalized) || mergesAPullRequestByAnyPath(invocation) || writesAFileThatNeedsAPerson(invocation) || changesWhereGitLooksForHooks(invocation) || changesSomethingHostedElsewhere(invocation);
+var invocationHasAVisibleConsequence = (toolName, invocation, depth, line) => {
   if (depth > MAX_CONSEQUENCE_DEPTH) return true;
   if (invocation.program === void 0) return false;
   const normalized = quotedInvocation(invocation);
   const innermost = innermostInvocation(invocation);
   const script = shellScriptOf(invocation);
-  return classifyDecisionRisk(toolName, normalized) === "destructive" || changesWhatIsDeployed(toolName, invocation, normalized) || releasesOrChangesACluster(toolName, invocation, normalized) || writesAFileThatNeedsAPerson(invocation) || changesWhereGitLooksForHooks(invocation) || changesSomethingHostedElsewhere(invocation) || losesDataVisibly(toolName, invocation, normalized, depth) || subcommandDestroysVisibly(invocation) || sqlClientChangesData(invocation) || innermost !== invocation && invocationHasAVisibleConsequence(toolName, innermost, depth) || script === null && passesAnInlineScript(invocation) || script !== null && commandHasAVisibleConsequenceAt(toolName, script, depth + 1) || readingsPastGlobalFlags(invocation).some((reading) => invocationHasAVisibleConsequence(toolName, reading, depth + 1));
+  return classifyDecisionRisk(toolName, normalized) === "destructive" || changesWhatIsDeployed(toolName, invocation, normalized) || writesASecretFile(invocation) || line === "permissions_off" && invocationHasAConsequenceOnlyPermissionsOffAsksAbout(toolName, invocation, normalized) || losesDataVisibly(toolName, invocation, normalized, depth, line) || subcommandDestroysVisibly(invocation) || sqlClientChangesData(invocation) || innermost !== invocation && invocationHasAVisibleConsequence(toolName, innermost, depth, line) || script === null && passesAnInlineScript(invocation) || script !== null && commandHasAVisibleConsequenceAt(toolName, script, depth + 1, line) || readingsPastGlobalFlags(invocation).some((reading) => invocationHasAVisibleConsequence(toolName, reading, depth + 1, line));
 };
 var RUNS_FETCHED_CODE = /(?:\$\(|`|<\()\s*(?:curl|wget)\b/;
 var RUNS_DECODED_CODE = /(?:^|[;&|(\s])(?:bash|sh|zsh|source|\.|python3?|node|ruby|perl)\s+(?:-[A-Za-z]+\s+)*["']?(?:<\(|\$\()[^)]*\b(?:base64|xxd|openssl)\b/;
@@ -5511,7 +5535,7 @@ var decodes = (invocation) => {
   return decodingFlags !== void 0 && args.some((arg) => decodingFlags.test(arg.text));
 };
 var producesCodeTheCommandDoesNotShow = (invocation) => fetches(invocation) || decodes(invocation);
-var pipesHiddenCodeIntoAnInterpreter = (command, invocations) => invocations.some(producesCodeTheCommandDoesNotShow) && pipedSegmentsOf(command).some(runsWhatItReads);
+var pipesCodeIntoAnInterpreter = (command, invocations, producesCode) => invocations.some(producesCode) && pipedSegmentsOf(command).some(runsWhatItReads);
 var CODE_THAT_DELETES_RECURSIVELY = /\b(?:rmtree|rimraf|rm_rf|rm_r|removedirs)\b|\b(?:rm|rmSync|remove|rmdir|rmdirSync)\s*\([^)]*recursive/;
 var CODE_THAT_DECODES = /\b(?:b64decode|atob|base64)\b/;
 var CODE_THAT_RUNS_CODE_IT_BUILDS = /(?<![.\w])(?:eval|exec)\s*\(/;
@@ -5571,7 +5595,7 @@ var interpreterCodeIn = (command, invocations) => {
   const heredocs = interpreters.some(runsWhatItReads) ? withHeredocBodiesSetAside(command).bodies : [];
   return [...interpreters.flatMap(inlineCodeOf), ...heredocs];
 };
-var codeNeedsAPerson = (code, depth) => CODE_THAT_DELETES_RECURSIVELY.test(code) || CODE_THAT_RUNS_CODE_IT_BUILDS.test(code) && CODE_THAT_DECODES.test(code) || CODE_THAT_WRITES_A_FILE.test(code) && pathsSpelledIn(code).some(pathNeedsAPersonToChange) || CODE_THAT_RUNS_COMMANDS.test(code) && commandsSpelledIn(code).some((command) => commandHasAVisibleConsequenceAt(SHELL_TOOL, command, depth + 1));
+var codeNeedsAPerson = (code, depth) => CODE_THAT_DELETES_RECURSIVELY.test(code) || CODE_THAT_RUNS_CODE_IT_BUILDS.test(code) && CODE_THAT_DECODES.test(code) || CODE_THAT_WRITES_A_FILE.test(code) && pathsSpelledIn(code).some(pathNeedsAPersonToChange) || CODE_THAT_RUNS_COMMANDS.test(code) && commandsSpelledIn(code).some((command) => commandHasAVisibleConsequenceAt(SHELL_TOOL, command, depth + 1, "permissions_off"));
 var runsInterpreterCodeThatNeedsAPerson = (command, invocations, depth) => interpreterCodeIn(command, invocations).some((code) => codeNeedsAPerson(code, depth));
 var WORDS_THAT_OPEN_A_COMMAND = String.raw`if|then|elif|else|do|while|until|!`;
 var SHELL_GROUPING_PREFIX = new RegExp(String.raw`^\s*(?:(?:${WORDS_THAT_OPEN_A_COMMAND})\s+|[({]\s*)+`);
@@ -5717,26 +5741,29 @@ var evalRunsOneEnvironmentSetup = (pieces, index) => {
   const next = pieces[index + 3];
   return opening !== void 0 && EVAL_BEFORE_ITS_ARGUMENT.test(opening.text) && substitution !== void 0 && SUBSTITUTION_OPENERS.has(substitution.before) && SETS_UP_THE_ENVIRONMENT.test(substitution.text) && closing !== void 0 && SUBSTITUTION_CLOSERS.has(closing.before) && EVAL_AFTER_ITS_ARGUMENT.test(closing.text) && (next === void 0 || WHAT_MAY_FOLLOW_AN_EVAL.has(next.before));
 };
-var roughSegmentHasAVisibleConsequence = (toolName, segment, producesHiddenCode, depth) => {
+var evalRunsHiddenCode = (segment, innermost) => segment.substitution !== null && basenameOf(innermost.program?.text ?? "") === EVAL && !segment.evalRunsOneEnvironmentSetup;
+var roughSegmentHasAVisibleConsequence = (toolName, segment, producesHiddenCode, depth, line) => {
   const innermost = innermostInvocation(segment.invocation);
   const runsAHeredocScript = innermost.program !== void 0 && POSIX_SHELL_PROGRAMS.has(basenameOf(innermost.program.text));
-  return invocationHasAVisibleConsequence(toolName, segment.invocation, depth) || sqlClientSyntaxOf(innermost) !== void 0 && (segment.readsInput || segment.feedsASubstitution) || segment.substitution !== null && basenameOf(innermost.program?.text ?? "") === EVAL && !segment.evalRunsOneEnvironmentSetup || segment.readsAPipe && producesHiddenCode && runsWhatItReads(innermost) || runsAHeredocScript && segment.heredocs.some((body) => commandHasAVisibleConsequenceAt(toolName, body, depth + 1));
+  return invocationHasAVisibleConsequence(toolName, segment.invocation, depth, line) || sqlClientSyntaxOf(innermost) !== void 0 && (segment.readsInput || segment.feedsASubstitution) || line === "permissions_off" && evalRunsHiddenCode(segment, innermost) || segment.readsAPipe && producesHiddenCode && runsWhatItReads(innermost) || runsAHeredocScript && segment.heredocs.some((body) => commandHasAVisibleConsequenceAt(toolName, body, depth + 1, line));
 };
-var roughReadingHasAVisibleConsequence = (toolName, command, depth) => {
+var producesCodeTheLineCannotSee = (line) => line === "permissions_off" ? producesCodeTheCommandDoesNotShow : fetches;
+var roughReadingHasAVisibleConsequence = (toolName, command, depth, line) => {
   const segments = roughSegmentsOf(command);
   const invocations = segments.map((segment) => segment.invocation);
-  const producesHiddenCode = invocations.some(producesCodeTheCommandDoesNotShow);
-  return segments.some((segment) => roughSegmentHasAVisibleConsequence(toolName, segment, producesHiddenCode, depth)) || runsADownloadedScript(invocations) || runsInterpreterCodeThatNeedsAPerson(command, invocations, depth);
+  const producesHiddenCode = invocations.some(producesCodeTheLineCannotSee(line));
+  return segments.some((segment) => roughSegmentHasAVisibleConsequence(toolName, segment, producesHiddenCode, depth, line)) || runsADownloadedScript(invocations) || line === "permissions_off" && runsInterpreterCodeThatNeedsAPerson(command, invocations, depth);
 };
-var commandHasAVisibleConsequenceAt = (toolName, command, depth) => {
+var commandHidesWhatItWritesOrRuns = (command, readable) => RUNS_DECODED_CODE.test(readable) || redirectsIntoAFileThatNeedsAPerson(command);
+var commandHasAVisibleConsequenceAt = (toolName, command, depth, line) => {
   if (toolName === "Bash" && isSafeReadOnlyCommand(command)) return false;
   const readable = withHeredocSubstitutionsAsQuotedText(command);
   if (classifyDecisionRisk(toolName, readable) === "destructive" || RUNS_FETCHED_CODE.test(readable) || REDIRECTS_INTO_A_SECRET_FILE.test(readable)) return true;
-  if (RUNS_DECODED_CODE.test(readable) || redirectsIntoAFileThatNeedsAPerson(command)) return true;
+  if (line === "permissions_off" && commandHidesWhatItWritesOrRuns(command, readable)) return true;
   const segments = readableCommandSegments(command);
-  if (segments === null) return roughReadingHasAVisibleConsequence(toolName, command, depth);
+  if (segments === null) return roughReadingHasAVisibleConsequence(toolName, command, depth, line);
   const invocations = segments.map((segment) => invocationOf(withoutShellGrouping(segment)));
-  return invocations.some((invocation) => invocationHasAVisibleConsequence(toolName, invocation, depth)) || pipesIntoASqlClient(command) || pipesHiddenCodeIntoAnInterpreter(command, invocations) || runsADownloadedScript(invocations) || runsInterpreterCodeThatNeedsAPerson(command, invocations, depth);
+  return invocations.some((invocation) => invocationHasAVisibleConsequence(toolName, invocation, depth, line)) || pipesIntoASqlClient(command) || pipesCodeIntoAnInterpreter(command, invocations, producesCodeTheLineCannotSee(line)) || runsADownloadedScript(invocations) || line === "permissions_off" && runsInterpreterCodeThatNeedsAPerson(command, invocations, depth);
 };
 var REDIRECTION_OPERATOR_CHARACTER = /[<>]/;
 var redirectsIntoAFileThatNeedsAPerson = (command) => {
@@ -5749,18 +5776,21 @@ var redirectsIntoAFileThatNeedsAPerson = (command) => {
   });
 };
 var posixCommandOf = (words) => words.map(asOneShellWord).join(" ");
-var posixShellJudgeFor = (toolName) => ({
+var namesASecretPowerShellPath = (path) => SECRET_FILE_NAME.test(fileNameOf(path));
+var posixShellJudgeFor = (toolName, line = "standing_allow") => ({
   namesADestructiveAction: (text3) => classifyDecisionRisk(toolName, text3) === "destructive",
-  invocationShowsAConsequence: (invocation) => invocationHasAVisibleConsequence(SHELL_TOOL, invocation, 0),
-  commandShowsAConsequence: (words) => commandHasAVisibleConsequenceAt(SHELL_TOOL, posixCommandOf(words), 1),
+  invocationShowsAConsequence: (invocation) => invocationHasAVisibleConsequence(SHELL_TOOL, invocation, 0, line),
+  commandShowsAConsequence: (words) => commandHasAVisibleConsequenceAt(SHELL_TOOL, posixCommandOf(words), 1, line),
   onlyReads: (words) => isSafeReadOnlyCommand(posixCommandOf(words)),
   fetches,
   runsWhatItReads,
   runsScripts,
-  namesAFileThatNeedsAPerson: pathNeedsAPersonToChange
+  namesAFileThatNeedsAPerson: line === "permissions_off" ? pathNeedsAPersonToChange : namesASecretPowerShellPath
 });
 var commandIsDestructive = (toolName, command) => shellDialectOf(toolName) === "powershell" ? powerShellCommandIsDestructive(command, posixShellJudgeFor(toolName)) : readingsThatCanAct(command).some((reading) => classifyDecisionRisk(toolNameForAPosixReading(toolName), reading) === "destructive");
-var commandHasAVisibleConsequence = (toolName, command) => shellDialectOf(toolName) === "powershell" ? powerShellCommandHasAVisibleConsequence(command, posixShellJudgeFor(toolName)) : commandHasAVisibleConsequenceAt(toolNameForAPosixReading(toolName), command, 0);
+var commandHasAConsequenceOnTheLine = (toolName, command, line) => shellDialectOf(toolName) === "powershell" ? powerShellCommandHasAVisibleConsequence(command, posixShellJudgeFor(toolName, line)) : commandHasAVisibleConsequenceAt(toolNameForAPosixReading(toolName), command, 0, line);
+var commandHasAVisibleConsequence = (toolName, command) => commandHasAConsequenceOnTheLine(toolName, command, "standing_allow");
+var commandHasAConsequenceWithPermissionsOff = (toolName, command) => commandHasAConsequenceOnTheLine(toolName, command, "permissions_off");
 var MAX_SPELLING_DEPTH = 3;
 var GIT_GLOBAL_OPTIONS_WITH_A_VALUE = /* @__PURE__ */ new Set([
   "-C",
@@ -6961,7 +6991,7 @@ var unmatchedPolicyOf = (config, toolName) => ({
   mode: config.defaultMode ?? "push_first",
   pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
 });
-var sessionToolGrantCannotCover = (toolName, arg, toolInput) => typeof arg === "string" && sessionGrantMustAskAbout(toolName, arg) || parseMcpToolName(toolName) !== void 0 && (toolInput === void 0 || !mcpToolInputOnlyReads(toolName, toolInput));
+var sessionToolGrantCannotCover = (toolName, arg, toolInput) => typeof arg === "string" && commandNeedsAPerson(toolName, arg) || parseMcpToolName(toolName) !== void 0 && (toolInput === void 0 || !mcpToolInputOnlyReads(toolName, toolInput));
 var stricterOfTheReadings = (asWritten, asSpelled, unmatched) => comparePolicyStrictness(asWritten?.policy ?? unmatched, asSpelled?.policy ?? unmatched) > 0 ? asWritten : asSpelled;
 var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
   const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
@@ -7038,6 +7068,10 @@ var strictestScopeVerdict = (scope, paths) => {
 var survivesDegraded = (config, toolName, toolInputs, cwd, repoKey, sessionId) => toolInputs.length === 1 && resolveAutoResolveOrigin(config, toolName, toolInputs[0], cwd, repoKey, sessionId) === "safe_readonly";
 var FULL_DEFER_MODES = /* @__PURE__ */ new Set(["plan", "auto", "dontAsk"]);
 var BYPASS_PERMISSION_MODE = "bypassPermissions";
+var BYPASS_STOPS = ["consequences", "nothing"];
+var DEFAULT_BYPASS_STOPS = "consequences";
+var isBypassStops = (value) => typeof value === "string" && BYPASS_STOPS.includes(value);
+var bypassStopsOf = (config) => isBypassStops(config.bypassStops) ? config.bypassStops : DEFAULT_BYPASS_STOPS;
 var isBypassPermissionMode = (permissionMode) => permissionMode === BYPASS_PERMISSION_MODE;
 var FILE_EDIT_TOOLS = /* @__PURE__ */ new Set([
   "Write",
@@ -7134,13 +7168,18 @@ var LINE_BREAK = /[\r\n]/;
 var bypassModeCovers = (toolName, toolInput) => {
   const arg = extractPolicyArg(toolName, toolInput);
   if (SHELL_DIALECT_BY_TOOL.has(toolName)) {
-    return arg !== void 0 && !commandIsDestructive(toolName, arg) && !commandHasAVisibleConsequence(toolName, arg);
+    return arg !== void 0 && !commandIsDestructive(toolName, arg) && !commandHasAConsequenceWithPermissionsOff(toolName, arg);
   }
-  if (FILE_EDIT_TOOLS.has(toolName)) return arg !== void 0 && !LINE_BREAK.test(arg) && !fileEditNeedsAPerson(toolName, arg);
+  if (FILE_EDIT_TOOLS.has(toolName)) return arg !== void 0 && !LINE_BREAK.test(arg) && !fileEditNeedsAPersonWithPermissionsOff(toolName, arg);
   return mcpToolOnlyReads(toolName) && mcpToolInputOnlyReads(toolName, toolInput);
 };
-var aChosenRuleGovernsInEitherRepository = (input) => aChosenRuleGoverns(input) || input.sharedRepoKey !== void 0 && input.sharedRepoKey !== input.repoKey && aChosenRuleGoverns({ ...input, repoKey: input.sharedRepoKey });
-var bypassModeAllows = (input) => isBypassPermissionMode(input.permissionMode) && !isModeStateDegraded(input.modeState) && noModeOverrideIsActive(input) && input.deletesFiles !== true && input.toolInputs.length > 0 && input.toolInputs.every((toolInput) => bypassModeCovers(input.toolName, toolInput)) && !aChosenRuleGovernsInEitherRepository(input);
+var aChosenRuleGovernsInEitherRepository = (input, counts = everyRule) => aChosenRuleGoverns(input, counts) || input.sharedRepoKey !== void 0 && input.sharedRepoKey !== input.repoKey && aChosenRuleGoverns({ ...input, repoKey: input.sharedRepoKey }, counts);
+var ruleAsksOrRefuses = (rule) => !isAutoApprove(rule);
+var bypassModeCoversEveryInput = (input) => input.deletesFiles !== true && input.toolInputs.every((toolInput) => bypassModeCovers(input.toolName, toolInput)) && !aChosenRuleGovernsInEitherRepository(input);
+var bypassModeApplies = (input) => isBypassPermissionMode(input.permissionMode) && !isModeStateDegraded(input.modeState) && noModeOverrideIsActive(input) && input.toolInputs.length > 0;
+var bypassModeAllows = (input) => bypassModeApplies(input) && (bypassStopsOf(input.config) === "nothing" ? !aChosenRuleGovernsInEitherRepository(input, ruleAsksOrRefuses) : bypassModeCoversEveryInput(input));
+var PERMISSIONS_OFF_ASK_REASON = "Permissions are off in your agent, so Pushary only stops for risky steps like this one. You can change this in Settings on pushary.com.";
+var permissionsOffAskReason = (input, verdict) => verdict.kind === "gate" && !verdict.scopeReason && !isAskedInEveryMode(input.toolName) && bypassModeApplies(input) && bypassStopsOf(input.config) === "consequences" && !aChosenRuleGovernsInEitherRepository(input) ? PERMISSIONS_OFF_ASK_REASON : void 0;
 var resolveGate = (input) => {
   const { modeState, config, toolName, toolInputs, cwd, sessionId } = input;
   const repoKey = input.sharedRepoKey ?? input.repoKey;
@@ -7225,7 +7264,9 @@ var runsACommandThatNeedsAPerson = ({ toolName, toolInputs }) => SHELL_DIALECT_B
   const command = extractPolicyArg(toolName, toolInput);
   return command !== void 0 && (commandNeedsAPerson(toolName, command) || commandWritesThroughARemoteApi(command));
 });
-var fileEditNeedsAPerson = (toolName, path) => FILE_EDIT_TOOLS.has(toolName) && pathNeedsAPersonToChange(path);
+var namesASecretOrWorkflowFile = (path) => SECRET_FILE_NAME.test(basenameOf(path)) || CI_WORKFLOW_FILE.test(normalizeSeparators(path));
+var fileEditNeedsAPerson = (toolName, path) => FILE_EDIT_TOOLS.has(toolName) && namesASecretOrWorkflowFile(path);
+var fileEditNeedsAPersonWithPermissionsOff = (toolName, path) => FILE_EDIT_TOOLS.has(toolName) && pathNeedsAPersonToChange(path);
 var editsAFileThatNeedsAPerson = ({ toolName, toolInputs }) => toolInputs.some((toolInput) => {
   const path = extractPolicyArg(toolName, toolInput);
   return path !== void 0 && fileEditNeedsAPerson(toolName, path);
@@ -7294,14 +7335,16 @@ var approvalRoutesOf = (config) => {
   const routes = config.approvalRoutes ?? [];
   return Array.isArray(routes) && routes.every(isApprovalRoutePattern) ? routes : null;
 };
-var aChosenRuleGoverns = (input) => {
+var everyRule = () => true;
+var aChosenRuleGoverns = (input, counts = everyRule) => {
   const chosen = input.config.policies.filter((policy) => !isDefaultRule(policy));
   const routes = approvalRoutesOf(input.config);
   if (routes === null) return true;
   return input.toolInputs.some((toolInput) => {
     const args = policyArgForms(input.toolName, toolInput, input.cwd);
     const reading = policyReadingOf(chosen, input.toolName, args);
-    return governingRuleForReading(chosen, input.toolName, args, reading, input.repoKey, input.sessionId) !== void 0 || findBestRoute(routes, input.toolName, args, input.repoKey) !== void 0;
+    const governing = governingRuleForReading(chosen, input.toolName, args, reading, input.repoKey, input.sessionId);
+    return governing !== void 0 && counts(governing.policy) || findBestRoute(routes, input.toolName, args, input.repoKey) !== void 0;
   });
 };
 var claudeAllowlistOwnsCall = (input, verdict, permissionMode, rules) => rules !== null && verdict.kind === "gate" && !verdict.scopeReason && !aChosenRuleGoverns(input) && !isAskedInEveryMode(input.toolName) && claudeConsultsItsAllowlist(permissionMode) && agentRulesAllowEveryInput(rules, input.toolName, input.toolInputs, input.cwd);
@@ -7840,6 +7883,7 @@ export {
   PRETOOLUSE_HANDLED_TOOLS,
   isPermissionRequestOwnedByPreToolUse,
   CLAUDE_PRETOOLUSE_MATCHER,
+  permissionsOffAskReason,
   resolveGate,
   editGoesToTheAgentsPrompt,
   SCOPE_BATCH_REASON,

package/dist/{chunk-4N6MND55.js → chunk-PD2DWO4X.js}

@@ -1,9 +1,9 @@
 import {
   findNativeClaudeInstall
-} from "./chunk-QVCDU4NT.js";
+} from "./chunk-J3W32P43.js";
 import {
   isFile
-} from "./chunk-GPGLRSGY.js";
+} from "./chunk-77HBRZJI.js";
 
 // src/wrapper/claudeBinary.ts
 import { homedir } from "os";

package/dist/{chunk-CDIVGMBR.js → chunk-PDRPVVZX.js}

@@ -3,12 +3,12 @@ import {
 } from "./chunk-XMSDA5WA.js";
 import {
   getBaseUrl
-} from "./chunk-IB5MLSE3.js";
+} from "./chunk-TXDFQD2I.js";
 import {
   compressTranscriptRecord,
   redactSecretsFromContent,
   transcriptRecordPlaintext
-} from "./chunk-XERTD7VZ.js";
+} from "./chunk-OS32P4RZ.js";
 
 // src/transcript-api.ts
 var providerRecipientSchema = external_exports.object({

package/dist/{chunk-6SN6L5YT.js → chunk-QDS55ODM.js}

@@ -2,13 +2,13 @@ import {
   SESSION_HISTORY_RETENTION_DAYS,
   readOwnerOnlyJson,
   savedTranscriptReadPositions
-} from "./chunk-VDBRLNW7.js";
+} from "./chunk-OP2WJEPY.js";
 import {
   ensureDaemonRunning
-} from "./chunk-CA2V7TKX.js";
+} from "./chunk-TZWK2BVY.js";
 import {
   hookOwnerOf
-} from "./chunk-K56A3LSA.js";
+} from "./chunk-SISYAMDC.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
@@ -19,33 +19,33 @@ import {
   recordSealerFor,
   uploadTranscriptRecords,
   wrapSessionKey
-} from "./chunk-CDIVGMBR.js";
+} from "./chunk-PDRPVVZX.js";
 import {
   external_exports
 } from "./chunk-XMSDA5WA.js";
 import {
   transcriptEnvironmentPreference,
   transcriptsEnabled
-} from "./chunk-JLWI2HZF.js";
+} from "./chunk-SARU6WNW.js";
 import {
   readTranscriptPreference
-} from "./chunk-REV2QMUD.js";
+} from "./chunk-TVGOSEWS.js";
 import {
   hookMeaning
-} from "./chunk-QNFDU72D.js";
+} from "./chunk-XLM2JZBE.js";
 import {
   claudeConfigDir,
   codexHome,
   pusharyDir
-} from "./chunk-LFIFIIMK.js";
+} from "./chunk-YCYFREHD.js";
 import {
   writeJsonAtomic,
   writeJsonAtomicDurable
-} from "./chunk-GPGLRSGY.js";
+} from "./chunk-77HBRZJI.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-IB5MLSE3.js";
+} from "./chunk-TXDFQD2I.js";
 import {
   PENDING_COMMAND_PREFIX,
   SESSION_HISTORY_BACKFILL_LIMIT_BYTES,
@@ -53,7 +53,7 @@ import {
   isHookSource,
   isRecord,
   redactSecretsFromContent
-} from "./chunk-XERTD7VZ.js";
+} from "./chunk-OS32P4RZ.js";
 
 // src/transcript-recipient-pin.ts
 import { createHash } from "crypto";