@pushary/agent-hooks 0.60.0 → 0.61.0

package/dist/bin/pushary-doctor.js

@@ -4,6 +4,8 @@ import {
 } from "../chunk-IIENZE2J.js";
 import {
   GEMINI_HOOK_BINARY,
+  codexConfigToml,
+  codexHooksJson,
   hasCodexHooks,
   hasGeminiHooks,
   hasInstructionBlock,
@@ -11,21 +13,50 @@ import {
   missingGeminiHookEvents,
   readCodexMcpAuth,
   untrustedCodexHookEvents
-} from "../chunk-BQLCELYC.js";
+} from "../chunk-S4TFBJ5O.js";
+import {
+  describeReach,
+  fetchChannels,
+  reachVerdict
+} from "../chunk-GX64YGU3.js";
+import "../chunk-3EGEA4KH.js";
+import {
+  parseFlags
+} from "../chunk-N4DA4CJB.js";
+import {
+  readKeySource
+} from "../chunk-B26DNXCA.js";
+import {
+  checkApiKey,
+  describeKeyCheck
+} from "../chunk-UKNAAVEE.js";
+import {
+  createIo
+} from "../chunk-TX7KBKT7.js";
+import {
+  UsageError
+} from "../chunk-7QLSKOSU.js";
+import "../chunk-BC3VCZ3E.js";
 import {
   execNpm
-} from "../chunk-J7JWI3KU.js";
+} from "../chunk-MUEW424A.js";
+import {
+  exitOnHelpFlag
+} from "../chunk-HUJQSP4F.js";
+import {
+  EXIT
+} from "../chunk-SML23YOT.js";
 import {
   readLedgerSummary
 } from "../chunk-WLGEY4UX.js";
 import {
   callMcpTool,
   sendMcpRequest
-} from "../chunk-DWED7BS3.js";
+} from "../chunk-HNTKTK5B.js";
 import "../chunk-DQAN3JQP.js";
 import {
   getBaseUrl
-} from "../chunk-NKXSILEW.js";
+} from "../chunk-2UMNXADU.js";
 
 // bin/pushary-doctor.ts
 import { existsSync, readFileSync } from "fs";
@@ -34,12 +65,35 @@ import { homedir } from "os";
 import { execSync } from "child_process";
 import { confirm } from "@inquirer/prompts";
 import { parse as parseTOML } from "smol-toml";
-var dim = (s) => `\x1B[2m${s}\x1B[0m`;
-var bold = (s) => `\x1B[1m${s}\x1B[0m`;
-var green = (s) => `\x1B[32m${s}\x1B[0m`;
-var red = (s) => `\x1B[31m${s}\x1B[0m`;
-var yellow = (s) => `\x1B[33m${s}\x1B[0m`;
-var cyan = (s) => `\x1B[36m${s}\x1B[0m`;
+exitOnHelpFlag("doctor");
+var parseDoctorOptions = (argv) => {
+  const flags = parseFlags(argv, { bools: ["json", "roundtrip", "no-push", "help", "h"], values: [] });
+  if (flags.command !== void 0 && flags.command !== "doctor") {
+    throw new UsageError(`doctor takes no positional arguments (got ${flags.command})`);
+  }
+  const roundtrip = flags.bools.has("roundtrip");
+  const noPush = flags.bools.has("no-push");
+  if (roundtrip && noPush) {
+    throw new UsageError("--roundtrip needs to send a push, so it cannot be combined with --no-push");
+  }
+  return { json: flags.bools.has("json"), roundtrip, noPush };
+};
+var options;
+try {
+  options = parseDoctorOptions(process.argv.slice(2));
+} catch (err) {
+  process.stderr.write(`  ! ${err instanceof Error ? err.message : String(err)}
+`);
+  process.stderr.write("  Run `pushary doctor --help` for the full list.\n");
+  process.exit(EXIT.USAGE);
+}
+if (options.json) {
+  console.log = (...args) => {
+    process.stderr.write(`${args.map((a) => typeof a === "string" ? a : String(a)).join(" ")}
+`);
+  };
+}
+var { bold, dim, green, yellow, red, cyan } = createIo();
 var pass = green("\u2713");
 var fail = red("\u2717");
 var warn = yellow("!");
@@ -101,19 +155,9 @@ var main = async () => {
   console.log(`  ${bold("Pushary Doctor")}`);
   console.log();
   console.log(`  ${dim("Configuration")}`);
-  let apiKey = process.env.PUSHARY_API_KEY;
-  let keySource = apiKey ? "env" : null;
-  const PUSHARY_CONFIG_FILE = join(homedir(), ".pushary", "config.json");
-  if (!apiKey) {
-    try {
-      const parsed = JSON.parse(readFileSync(PUSHARY_CONFIG_FILE, "utf-8"));
-      if (typeof parsed.apiKey === "string" && parsed.apiKey) {
-        apiKey = parsed.apiKey;
-        keySource = "config-file";
-      }
-    } catch {
-    }
-  }
+  const source = readKeySource();
+  let apiKey = source.key ?? void 0;
+  let keySource = source.kind === "env" ? "env" : source.kind === "config" ? "config-file" : null;
   if (!apiKey) {
     for (const f of SHELL_FILES) {
       try {
@@ -130,13 +174,47 @@ var main = async () => {
   }
   const maskKey = (k) => `pk_${k.split(".")[0]?.slice(3, 7)}...`;
   if (keySource === "config-file") {
-    console.log(`  ${pass} API key in ${dim("~/.pushary/config.json")} ${dim(`(${maskKey(apiKey)})`)}`);
+    console.log(`  ${pass} API key in ${dim(source.origin ?? "the config file")} ${dim(`(${maskKey(apiKey)})`)}`);
   } else if (keySource === "profile") {
     console.log(`  ${pass} API key in shell profile ${dim(`(${maskKey(apiKey)})`)}`);
     console.log(`  ${warn} Re-run ${cyan("npx @pushary/agent-hooks setup")} so hooks read it from ${dim("~/.pushary/config.json")} without a shell reload`);
   } else {
     check(!!apiKey, "API key in environment", apiKey ? maskKey(apiKey) : "PUSHARY_API_KEY not set");
   }
+  if (source.drift) {
+    check(
+      false,
+      "One key, not two",
+      `shell has ${source.drift.envPrefix}, ${source.drift.configPath} has ${source.drift.configPrefix} \u2014 the shell one wins. Re-run setup, or open a new terminal.`
+    );
+  }
+  let keyVerdict = null;
+  if (apiKey) {
+    keyVerdict = await checkApiKey(apiKey);
+    switch (keyVerdict.kind) {
+      case "ok":
+        check(
+          true,
+          "Key verified with pushary.com",
+          `${keyVerdict.identity.siteSlug || keyVerdict.identity.siteName} \xB7 plan ${keyVerdict.identity.plan} \xB7 ${keyVerdict.identity.subscriptionStatus}`
+        );
+        break;
+      case "locked":
+        check(false, "Plan active", describeKeyCheck(keyVerdict).message);
+        for (const line of describeKeyCheck(keyVerdict).next) console.log(`    ${dim(line)}`);
+        break;
+      case "rejected":
+        check(false, "Key accepted by pushary.com", describeKeyCheck(keyVerdict).message);
+        for (const line of describeKeyCheck(keyVerdict).next) console.log(`    ${dim(line)}`);
+        break;
+      case "malformed":
+        check(false, "Key format", "expected pk_xxx.xxx");
+        break;
+      case "unreachable":
+        console.log(`  ${warn} Could not verify the key with pushary.com ${dim(`(${keyVerdict.detail})`)}`);
+        break;
+    }
+  }
   const CLAUDE_JSON = join(homedir(), ".claude.json");
   const claudeJson = readJson(CLAUDE_JSON);
   const mcpServers = claudeJson?.mcpServers ?? {};
@@ -179,10 +257,10 @@ var main = async () => {
   } else {
     check(false, "Claude Code: settings.json", "not found");
   }
-  const codexConfigPath = join(homedir(), ".codex", "config.toml");
-  const codexHooksPath = join(homedir(), ".codex", "hooks.json");
-  const codexHooksJson = readJson(codexHooksPath);
-  if (existsSync(codexConfigPath) || codexHooksJson) {
+  const codexConfigPath = codexConfigToml();
+  const codexHooksPath = codexHooksJson();
+  const codexHooksConfig = readJson(codexHooksPath);
+  if (existsSync(codexConfigPath) || codexHooksConfig) {
     const codexConfig = existsSync(codexConfigPath) ? readFileSync(codexConfigPath, "utf-8") : "";
     let codexParsed = {};
     try {
@@ -221,11 +299,11 @@ var main = async () => {
       }
     }
     const codexNotifyPath = codexConfig.match(/["']([^"']*pushary-codex[^"']*)["']/)?.[1] ?? null;
-    const hooksInstalled = !!codexHooksJson && hasCodexHooks(codexHooksJson);
+    const hooksInstalled = !!codexHooksConfig && hasCodexHooks(codexHooksConfig);
     if (hooksInstalled) {
-      const missingEvents = missingCodexHookEvents(codexHooksJson);
+      const missingEvents = missingCodexHookEvents(codexHooksConfig);
       check(missingEvents.length === 0, "Codex: native hooks installed", missingEvents.length === 0 ? "all 6 events" : `missing ${missingEvents.join(", ")}, re-run setup`);
-      const hookCommand = extractHookCommand(codexHooksJson.hooks?.PreToolUse, "pushary-codex-hook") ?? extractHookCommand(codexHooksJson.hooks?.PermissionRequest, "pushary-codex-hook");
+      const hookCommand = extractHookCommand(codexHooksConfig.hooks?.PreToolUse, "pushary-codex-hook") ?? extractHookCommand(codexHooksConfig.hooks?.PermissionRequest, "pushary-codex-hook");
       if (hookCommand) {
         const resolves = commandResolves(hookCommand);
         check(resolves, "Codex: hook command resolves", resolves ? hookCommand : `not on PATH: ${hookCommand}`);
@@ -428,25 +506,29 @@ var main = async () => {
     }
     console.log();
     console.log(`  ${dim("Notification Delivery")}`);
-    try {
-      const notifRes = await fetch("https://pushary.com/api/v1/server/send", {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "Authorization": `Bearer ${apiKey}`
-        },
-        body: JSON.stringify({
-          title: "Pushary Doctor",
-          body: "If you see this, push notifications are working."
-        }),
-        signal: AbortSignal.timeout(1e4)
-      });
-      check(notifRes.ok, "Push notification sent", notifRes.ok ? "check your phone" : `${notifRes.status}`);
+    const probe = await fetchChannels(apiKey);
+    if (probe.kind !== "ok") {
+      check(false, "Phone reachable", probe.kind === "unreachable" ? `could not read your devices (${probe.detail})` : probe.kind === "locked" ? "no plan active, so nothing can be delivered" : "the server rejected this key");
+    } else if (probe.status.precise) {
+      const channels = probe.status;
+      const verdict = reachVerdict(channels);
+      check(verdict.kind === "yours", "Phone reachable", verdict.kind === "yours" ? describeReach(channels) : verdict.kind === "nobody" ? "nothing connected, run pushary connect or get the app at https://pushary.com/download" : `${describeReach(channels)}; run pushary connect to add your own`);
+    }
+    if (options.noPush) {
+      console.log(`  ${dim("\u2013")} Test push skipped ${dim("(--no-push)")}`);
+    } else try {
+      const result = await callMcpTool(apiKey, "send_notification", {
+        title: "Pushary Doctor",
+        body: "If you see this, push notifications are working.",
+        agentName: "Pushary Doctor"
+      }, { sessionId, timeoutMs: 2e4 });
+      const sent = typeof result.sent === "number" ? result.sent : (result.delivery?.mobile?.recipients ?? 0) + (result.delivery?.web?.recipients ?? 0);
+      check(sent > 0, "Push notification sent", sent > 0 ? `${sent} device${sent === 1 ? "" : "s"} \u2014 check your phone` : "reached 0 devices");
     } catch (err) {
       const msg = err instanceof Error ? err.message : "network error";
       check(false, "Push notification sent", msg);
     }
-    const testQuestion = process.stdin.isTTY ? await confirm({ message: "Test question roundtrip? (sends a push notification)", default: false }) : false;
+    const testQuestion = options.roundtrip ? true : options.noPush || options.json || !process.stdin.isTTY ? false : await confirm({ message: "Test question roundtrip? (sends a push notification)", default: false });
     if (testQuestion) {
       console.log();
       console.log(`  ${dim("Question Roundtrip")}`);
@@ -520,6 +602,20 @@ var main = async () => {
     console.log(`  ${dim("Run")} ${cyan("npx @pushary/agent-hooks@latest clean")} ${dim("then")} ${cyan("setup")} ${dim("to fix.")}`);
   }
   console.log();
+  const keyExit = keyVerdict && (keyVerdict.kind === "rejected" || keyVerdict.kind === "locked" || keyVerdict.kind === "malformed") ? describeKeyCheck(keyVerdict).exitCode : null;
+  const exitCode = keyExit ?? (failed.length > 0 ? EXIT.PROBLEMS_FOUND : EXIT.OK);
+  if (options.json) {
+    process.stdout.write(`${JSON.stringify({
+      ok: exitCode === EXIT.OK,
+      exitCode,
+      keyCheck: keyVerdict?.kind ?? null,
+      passed: results.filter((r) => r.passed).length,
+      failed: failed.length,
+      checks: results.map((r) => ({ label: r.label, passed: r.passed, detail: r.detail ?? null }))
+    }, null, 2)}
+`);
+  }
+  process.exit(exitCode);
 };
 main().catch((err) => {
   console.error(`  doctor failed: ${err instanceof Error ? err.message : String(err)}`);

package/dist/bin/pushary-gemini-hook.js

@@ -23,7 +23,7 @@ import {
   savePendingQuestion,
   sendNotification,
   waitForAnswer
-} from "../chunk-WNRYRN2R.js";
+} from "../chunk-VFBYRR2N.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
@@ -31,7 +31,7 @@ import {
   isGatingMoment,
   recordKeylessMoment
 } from "../chunk-WLGEY4UX.js";
-import "../chunk-DWED7BS3.js";
+import "../chunk-HNTKTK5B.js";
 import {
   DECISION_LINE_MAX,
   effectiveWaitSeconds,
@@ -40,7 +40,7 @@ import {
 } from "../chunk-DQAN3JQP.js";
 import {
   getApiKey
-} from "../chunk-NKXSILEW.js";
+} from "../chunk-2UMNXADU.js";
 
 // bin/pushary-gemini-hook.ts
 import { basename } from "path";

package/dist/bin/pushary-hook.js

@@ -1,17 +1,22 @@
 #!/usr/bin/env node
 import {
   handlePreToolUse
-} from "../chunk-BE5X3WXL.js";
+} from "../chunk-HI4AGGE6.js";
 import "../chunk-CAJZAFVS.js";
+import {
+  exitOnHelpFlag
+} from "../chunk-HUJQSP4F.js";
+import "../chunk-SML23YOT.js";
 import "../chunk-YHG74UFF.js";
-import "../chunk-WNRYRN2R.js";
+import "../chunk-VFBYRR2N.js";
 import "../chunk-RN3NOEJF.js";
 import "../chunk-WLGEY4UX.js";
-import "../chunk-DWED7BS3.js";
+import "../chunk-HNTKTK5B.js";
 import "../chunk-DQAN3JQP.js";
-import "../chunk-NKXSILEW.js";
+import "../chunk-2UMNXADU.js";
 
 // bin/pushary-hook.ts
+exitOnHelpFlag("hook");
 var main = async () => {
   let rawInput = "";
   for await (const chunk of process.stdin) {

package/dist/bin/pushary-login.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/bin/pushary-login.js

@@ -0,0 +1,156 @@
+#!/usr/bin/env node
+import {
+  runBrowserLogin
+} from "../chunk-QHOVJXOT.js";
+import "../chunk-3EGEA4KH.js";
+import {
+  parseFlags
+} from "../chunk-N4DA4CJB.js";
+import {
+  readKeySource,
+  writeKey
+} from "../chunk-B26DNXCA.js";
+import {
+  checkApiKey,
+  describeKeyCheck
+} from "../chunk-UKNAAVEE.js";
+import {
+  createIo
+} from "../chunk-TX7KBKT7.js";
+import {
+  UsageError
+} from "../chunk-7QLSKOSU.js";
+import "../chunk-BC3VCZ3E.js";
+import {
+  exitOnHelpFlag
+} from "../chunk-HUJQSP4F.js";
+import {
+  EXIT,
+  getPackageVersion
+} from "../chunk-SML23YOT.js";
+import {
+  isValidApiKey
+} from "../chunk-DQAN3JQP.js";
+import "../chunk-2UMNXADU.js";
+
+// bin/pushary-login.ts
+exitOnHelpFlag("login");
+var parseLoginOptions = (argv) => {
+  const flags = parseFlags(argv, {
+    bools: ["with-token", "no-browser", "json", "force", "help", "h"],
+    values: []
+  });
+  if (flags.command !== void 0 && flags.command !== "login") {
+    throw new UsageError(`login takes no positional arguments (got ${flags.command})`);
+  }
+  return {
+    withToken: flags.bools.has("with-token"),
+    noBrowser: flags.bools.has("no-browser"),
+    json: flags.bools.has("json"),
+    force: flags.bools.has("force")
+  };
+};
+var options;
+try {
+  options = parseLoginOptions(process.argv.slice(2));
+} catch (err) {
+  process.stderr.write(`  ! ${err instanceof Error ? err.message : String(err)}
+`);
+  process.stderr.write("  Run `pushary login --help` for the full list.\n");
+  process.exit(EXIT.USAGE);
+}
+var { bold, dim, green, cyan, yellow } = createIo();
+var check = green("\u2713");
+var say = options.json ? (line) => process.stderr.write(`${line}
+`) : (line) => process.stdout.write(`${line}
+`);
+var emit = (payload) => {
+  if (options.json) process.stdout.write(`${JSON.stringify(payload, null, 2)}
+`);
+};
+var readStdin = async () => {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+  return Buffer.concat(chunks).toString("utf8").trim();
+};
+var store = (apiKey, siteSlug, keyName) => {
+  const result = writeKey(apiKey);
+  say("");
+  say(`  ${check} ${bold("Signed in.")}${siteSlug ? ` ${dim(`Site ${siteSlug}`)}` : ""}`);
+  say(`  ${dim(`Key saved to ${result.configPath}`)}`);
+  if (result.rc.kind === "written" || result.rc.kind === "updated") {
+    say(`  ${dim(`Shell export ${result.rc.kind} in ${result.rc.path}`)}`);
+  } else if (result.rc.kind === "declined") {
+    say(`  ${yellow("!")} ${dim(`Left ${result.rc.path} alone: line ${result.rc.declinedLine} already sets PUSHARY_API_KEY.`)}`);
+  }
+  emit({ ok: true, siteSlug, keyName, configPath: result.configPath, rc: result.rc.kind });
+};
+var loginWithToken = async () => {
+  const token = await readStdin();
+  if (!token) {
+    say(`  ${yellow("!")} Nothing arrived on stdin. Pipe the key in: pushary login --with-token < key.txt`);
+    emit({ ok: false, reason: "no_input" });
+    process.exit(EXIT.INPUT_REQUIRED);
+  }
+  if (!isValidApiKey(token)) {
+    say(`  ${yellow("!")} That does not look like a Pushary key. Expected pk_xxx.xxx`);
+    emit({ ok: false, reason: "malformed" });
+    process.exit(EXIT.USAGE);
+  }
+  const verdict = await checkApiKey(token);
+  if (verdict.kind !== "ok") {
+    const report = describeKeyCheck(verdict);
+    say(`  ${yellow("!")} ${report.message}`);
+    for (const line of report.next) say(`  ${dim(line)}`);
+    emit({ ok: false, reason: verdict.kind });
+    if (verdict.kind !== "unreachable") process.exit(report.exitCode);
+  }
+  store(token, verdict.kind === "ok" ? verdict.identity.siteSlug : "", "pasted key");
+  process.exit(EXIT.OK);
+};
+var main = async () => {
+  if (options.withToken) await loginWithToken();
+  if (!options.force) {
+    const existing = readKeySource();
+    if (existing.key) {
+      const verdict = await checkApiKey(existing.key);
+      if (verdict.kind === "ok") {
+        say("");
+        say(`  ${check} Already signed in ${dim(`(${verdict.identity.siteSlug})`)}`);
+        say(`  ${dim("Run")} ${cyan("pushary login --force")} ${dim("to replace this key.")}`);
+        emit({ ok: true, reused: true, siteSlug: verdict.identity.siteSlug });
+        process.exit(EXIT.OK);
+      }
+    }
+  }
+  const outcome = await runBrowserLogin(
+    { say, bold, dim, cyan, yellow },
+    { cliVersion: getPackageVersion(), noBrowser: options.noBrowser }
+  );
+  if (outcome.kind === "ok") {
+    store(outcome.apiKey, outcome.siteSlug, outcome.keyName);
+    process.exit(EXIT.OK);
+  }
+  if (outcome.kind === "unavailable") {
+    say(`  ${yellow("!")} Couldn't start a login ${dim(`(${outcome.detail})`)}`);
+    say(`  ${dim("Check your connection, or paste a key with")} ${cyan("pushary login --with-token < key.txt")}`);
+    emit({ ok: false, reason: "unreachable", detail: outcome.detail });
+    process.exit(EXIT.UNREACHABLE);
+  }
+  if (outcome.kind === "rejected") {
+    say("");
+    say(`  ${yellow("!")} That request was rejected in the browser. Nothing was written.`);
+    emit({ ok: false, reason: "rejected" });
+    process.exit(EXIT.NOT_CONFIGURED);
+  }
+  say("");
+  say(`  ${yellow("!")} The code expired before it was approved.`);
+  say(`  ${dim("Run")} ${cyan("pushary login")} ${dim("for a fresh one.")}`);
+  emit({ ok: false, reason: "expired" });
+  process.exit(EXIT.NOT_CONFIGURED);
+};
+main().catch((err) => {
+  process.stderr.write(`  ! login failed: ${err instanceof Error ? err.message : String(err)}
+`);
+  process.exit(EXIT.FAILED);
+});

package/dist/bin/pushary-logout.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/bin/pushary-logout.js

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+import {
+  parseFlags
+} from "../chunk-N4DA4CJB.js";
+import {
+  clearKey,
+  readKeySource
+} from "../chunk-B26DNXCA.js";
+import {
+  createIo
+} from "../chunk-TX7KBKT7.js";
+import {
+  UsageError
+} from "../chunk-7QLSKOSU.js";
+import "../chunk-BC3VCZ3E.js";
+import {
+  exitOnHelpFlag
+} from "../chunk-HUJQSP4F.js";
+import {
+  EXIT
+} from "../chunk-SML23YOT.js";
+import "../chunk-2UMNXADU.js";
+
+// bin/pushary-logout.ts
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+exitOnHelpFlag("logout");
+var parseLogoutOptions = (argv) => {
+  const flags = parseFlags(argv, { bools: ["json", "help", "h"], values: [] });
+  if (flags.command !== void 0 && flags.command !== "logout") {
+    throw new UsageError(`logout takes no positional arguments (got ${flags.command})`);
+  }
+  return { json: flags.bools.has("json") };
+};
+var options;
+try {
+  options = parseLogoutOptions(process.argv.slice(2));
+} catch (err) {
+  process.stderr.write(`  ! ${err instanceof Error ? err.message : String(err)}
+`);
+  process.exit(EXIT.USAGE);
+}
+var { bold, dim, green, cyan, yellow } = createIo();
+var say = options.json ? (line) => process.stderr.write(`${line}
+`) : (line) => process.stdout.write(`${line}
+`);
+var AGENT_CONFIGS = [
+  { label: "Claude Code", path: join(homedir(), ".claude.json") },
+  { label: "Codex", path: join(process.env.CODEX_HOME ?? join(homedir(), ".codex"), "config.toml") },
+  { label: "Gemini CLI", path: join(homedir(), ".gemini", "settings.json") },
+  { label: "Cursor", path: join(homedir(), ".cursor", "mcp.json") }
+];
+var main = () => {
+  const before = readKeySource();
+  const result = clearKey();
+  const remaining = AGENT_CONFIGS.filter((entry) => existsSync(entry.path));
+  say("");
+  if (!result.removedFromConfig && result.rcLinesDisabled === 0 && before.kind !== "env") {
+    say(`  ${dim("No key was stored on this machine. Nothing to remove.")}`);
+  } else {
+    say(`  ${green("\u2713")} ${bold("Signed out.")}`);
+    if (result.removedFromConfig) say(`  ${dim(`Key removed from ${result.configPath}`)}`);
+    if (result.rcLinesDisabled > 0) {
+      say(`  ${dim(`Commented out ${result.rcLinesDisabled} export line in ${result.rcPath}`)}`);
+    }
+  }
+  if (before.kind === "env") {
+    say("");
+    say(`  ${yellow("!")} PUSHARY_API_KEY is set in this shell, and a child process cannot unset it.`);
+    say(`  ${dim("Run")} ${cyan("unset PUSHARY_API_KEY")} ${dim("here, or open a new terminal.")}`);
+  }
+  if (remaining.length > 0) {
+    say("");
+    say(`  ${dim("Still holding a copy of the key, untouched by logout:")}`);
+    for (const entry of remaining) say(`  ${dim(`\u2022 ${entry.label}  ${entry.path}`)}`);
+    say(`  ${dim("Run")} ${cyan("pushary clean")} ${dim("to remove Pushary from those too.")}`);
+  }
+  say("");
+  say(`  ${dim("The key itself is still valid server-side. Revoke it at")} ${cyan("pushary.com/dashboard/agent/settings")}`);
+  say("");
+  if (options.json) {
+    process.stdout.write(
+      `${JSON.stringify(
+        {
+          ok: true,
+          removedFromConfig: result.removedFromConfig,
+          configPath: result.configPath,
+          rcPath: result.rcPath,
+          rcLinesDisabled: result.rcLinesDisabled,
+          envStillSet: before.kind === "env",
+          agentConfigsRetainingKey: remaining.map((entry) => entry.path)
+        },
+        null,
+        2
+      )}
+`
+    );
+  }
+  process.exit(EXIT.OK);
+};
+main();

package/dist/bin/pushary-mode.js

@@ -1,15 +1,28 @@
 #!/usr/bin/env node
+import {
+  exitOnFailedResponse
+} from "../chunk-R6C4USIV.js";
+import "../chunk-UKNAAVEE.js";
+import {
+  createIo
+} from "../chunk-TX7KBKT7.js";
+import "../chunk-7QLSKOSU.js";
+import {
+  exitOnHelpFlag
+} from "../chunk-HUJQSP4F.js";
+import {
+  EXIT
+} from "../chunk-SML23YOT.js";
+import "../chunk-DQAN3JQP.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-NKXSILEW.js";
+} from "../chunk-2UMNXADU.js";
 
 // bin/pushary-mode.ts
+exitOnHelpFlag("mode");
 var VALID_MODES = ["push_only", "push_first", "terminal_only", "notify_only"];
-var dim = (s) => `\x1B[2m${s}\x1B[0m`;
-var green = (s) => `\x1B[32m${s}\x1B[0m`;
-var cyan = (s) => `\x1B[36m${s}\x1B[0m`;
-var yellow = (s) => `\x1B[33m${s}\x1B[0m`;
+var { dim, green, cyan, yellow } = createIo();
 var parseDuration = (value) => {
   const match = value.match(/^(\d+)(m|h)$/);
   if (!match) return null;
@@ -30,6 +43,7 @@ var main = async () => {
   };
   if (!mode || mode === "status") {
     const res2 = await fetch(`${baseUrl}/api/mcp/mode`, { headers });
+    if (!res2.ok) await exitOnFailedResponse(res2, baseUrl);
     const data2 = await res2.json();
     if (!data2.override) {
       console.log(`  Mode: ${cyan("default")} ${dim("(using per-tool policies)")}`);
@@ -44,7 +58,8 @@ var main = async () => {
     return;
   }
   if (mode === "clear" || mode === "reset") {
-    await fetch(`${baseUrl}/api/mcp/mode`, { method: "DELETE", headers });
+    const res2 = await fetch(`${baseUrl}/api/mcp/mode`, { method: "DELETE", headers });
+    if (!res2.ok) await exitOnFailedResponse(res2, baseUrl);
     console.log(`  ${green("\u2713")} Mode override cleared \u2014 using per-tool policies`);
     return;
   }
@@ -53,14 +68,14 @@ var main = async () => {
     console.log(`  Valid modes: ${VALID_MODES.join(", ")}`);
     console.log(`  ${dim("Usage: pushary mode <mode> [--for <duration>]")}`);
     console.log(`  ${dim("Example: pushary mode push_only --for 30m")}`);
-    return;
+    process.exit(EXIT.USAGE);
   }
   let ttlSeconds;
   if (forFlag === "--for" && forValue) {
     const parsed = parseDuration(forValue);
     if (!parsed) {
       console.log(`  ${yellow("!")} Invalid duration: ${forValue} ${dim("(use e.g. 30m, 1h)")}`);
-      return;
+      process.exit(EXIT.USAGE);
     }
     ttlSeconds = parsed;
   }
@@ -69,11 +84,7 @@ var main = async () => {
     headers,
     body: JSON.stringify({ mode, ttlSeconds })
   });
-  if (!res.ok) {
-    const err = await res.json();
-    console.log(`  ${yellow("!")} Failed: ${err.error ?? res.statusText}`);
-    return;
-  }
+  if (!res.ok) await exitOnFailedResponse(res, baseUrl);
   const data = await res.json();
   console.log(`  ${green("\u2713")} Mode set to ${cyan(data.override.mode)}`);
   if (data.override.expiresAt) {