@pushary/agent-hooks 0.60.0 → 0.61.0

package/dist/bin/pushary-setup.js

@@ -1,8 +1,12 @@
 #!/usr/bin/env node
 import {
-  installClaudeAlias,
-  resolveShellRc
-} from "../chunk-BC3VCZ3E.js";
+  runBrowserLogin
+} from "../chunk-QHOVJXOT.js";
+import {
+  addClaudeMcpServer,
+  addPusharyHooks,
+  addPusharyToolPermissions
+} from "../chunk-CAJZAFVS.js";
 import {
   GEMINI_HOOK_BINARY,
   addCodexHookTrust,
@@ -13,365 +17,351 @@ import {
   renderAgentInstructions,
   renderProjectAgentInstructions,
   writeInstructionBlock
-} from "../chunk-BQLCELYC.js";
+} from "../chunk-S4TFBJ5O.js";
+import {
+  confirmAppConnection,
+  connectDevice,
+  connectViaAppPairing,
+  printConnectInstructions,
+  setHumanStream
+} from "../chunk-GX64YGU3.js";
+import "../chunk-3EGEA4KH.js";
+import {
+  parseFlags
+} from "../chunk-N4DA4CJB.js";
+import {
+  KEY_FILE_MODE,
+  backupFile,
+  exportLine,
+  readJsonSafe,
+  writeFileAtomic,
+  writeJsonAtomic,
+  writeKey
+} from "../chunk-B26DNXCA.js";
+import {
+  checkApiKey,
+  describeKeyCheck
+} from "../chunk-UKNAAVEE.js";
+import {
+  UsageError
+} from "../chunk-7QLSKOSU.js";
+import {
+  installClaudeAlias,
+  resolveShellRc
+} from "../chunk-BC3VCZ3E.js";
 import {
-  execNpm,
+  installGlobally,
   npmErrorMessage,
   quoteIfNeeded,
   resolveGlobalBinDir,
   resolveGlobalBinary
-} from "../chunk-J7JWI3KU.js";
+} from "../chunk-MUEW424A.js";
 import {
-  addClaudeMcpServer,
-  addPusharyHooks,
-  addPusharyToolPermissions
-} from "../chunk-CAJZAFVS.js";
+  EXIT,
+  getPackageVersion,
+  renderCommandHelp
+} from "../chunk-SML23YOT.js";
 import {
   reportEvent
-} from "../chunk-WNRYRN2R.js";
+} from "../chunk-VFBYRR2N.js";
 import "../chunk-RN3NOEJF.js";
-import "../chunk-DWED7BS3.js";
+import "../chunk-HNTKTK5B.js";
 import {
   isValidApiKey
 } from "../chunk-DQAN3JQP.js";
-import "../chunk-NKXSILEW.js";
+import "../chunk-2UMNXADU.js";
 
 // bin/pushary-setup.ts
-import { existsSync, readFileSync, writeFileSync, appendFileSync, mkdirSync, cpSync, rmSync, chmodSync } from "fs";
-import { join, dirname, basename } from "path";
-import { homedir } from "os";
-import { execSync as execSync2 } from "child_process";
+import { existsSync as existsSync2, readFileSync, writeFileSync, mkdirSync, cpSync, rmSync, renameSync } from "fs";
+import { join as join2, dirname, basename } from "path";
+import { homedir as homedir2, tmpdir } from "os";
+import { execSync as execSync3 } from "child_process";
 import { checkbox, input, confirm } from "@inquirer/prompts";
 import { fileURLToPath } from "url";
 import { parse as parseTOML, stringify as stringifyTOML } from "smol-toml";
 
-// src/onboarding.ts
-import qrcodeTerminal from "qrcode-terminal";
-
-// src/pairing.ts
-import crypto from "crypto";
-var X25519_SPKI_PREFIX = Buffer.from("302a300506032b656e032100", "hex");
-var HKDF_INFO = Buffer.from("pushary-pair-v1");
-var HEADER_BYTES = 32 + 12 + 16;
-var rawToPublicKey = (raw) => crypto.createPublicKey({
-  key: Buffer.concat([X25519_SPKI_PREFIX, raw]),
-  format: "der",
-  type: "spki"
-});
-var publicKeyToRaw = (key) => key.export({ format: "der", type: "spki" }).subarray(-32);
-var generateKeypair = () => {
-  const { publicKey, privateKey } = crypto.generateKeyPairSync("x25519");
-  const publicKeyRaw = publicKeyToRaw(publicKey);
-  return { publicKeyB64: publicKeyRaw.toString("base64"), publicKeyRaw, privateKey };
-};
-var publicKeyFingerprint = (b64) => {
-  const raw = Buffer.from(b64, "base64");
-  const digest = crypto.createHash("sha256").update(raw).digest("hex");
-  return (digest.slice(0, 8).match(/.{2}/g) ?? []).join(" ").toUpperCase();
-};
-var openSealedKey = (blobB64, keypair) => {
-  const blob = Buffer.from(blobB64, "base64");
-  if (blob.length <= HEADER_BYTES) throw new Error("sealed payload too short");
-  const ephemeralRaw = blob.subarray(0, 32);
-  const nonce = blob.subarray(32, 44);
-  const tag = blob.subarray(44, 60);
-  const ciphertext = blob.subarray(60);
-  const shared = crypto.diffieHellman({
-    privateKey: keypair.privateKey,
-    publicKey: rawToPublicKey(ephemeralRaw)
-  });
-  const salt = Buffer.concat([ephemeralRaw, keypair.publicKeyRaw]);
-  const key = Buffer.from(crypto.hkdfSync("sha256", shared, salt, HKDF_INFO, 32));
-  const decipher = crypto.createDecipheriv("aes-256-gcm", key, nonce);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
-};
-
-// src/onboarding.ts
-var dim = (s) => `\x1B[2m${s}\x1B[0m`;
-var bold = (s) => `\x1B[1m${s}\x1B[0m`;
-var green = (s) => `\x1B[32m${s}\x1B[0m`;
-var cyan = (s) => `\x1B[36m${s}\x1B[0m`;
-var yellow = (s) => `\x1B[33m${s}\x1B[0m`;
-var check = green("\u2713");
-var API_BASE = process.env.PUSHARY_API_URL?.trim() || "https://pushary.com";
-var CONNECT_POLL_INTERVAL_MS = 2500;
-var CONNECT_TIMEOUT_MS = 18e4;
-var DELIVERY_POLL_INTERVAL_MS = 1500;
-var DELIVERY_TIMEOUT_MS = 2e4;
-var authHeaders = (apiKey) => ({
-  "Content-Type": "application/json",
-  Authorization: `Bearer ${apiKey}`
-});
-var getJson = async (url, apiKey) => {
-  try {
-    const res = await fetch(url, { headers: authHeaders(apiKey), signal: AbortSignal.timeout(1e4) });
-    if (!res.ok) return null;
-    return await res.json().catch(() => null);
-  } catch {
-    return null;
-  }
-};
-var fetchSite = async (apiKey) => {
-  const data = await getJson(`${API_BASE}/api/v1/server/site`, apiKey);
-  if (!data || typeof data.slug !== "string" || typeof data.subscribeUrl !== "string") return null;
-  return { slug: data.slug, name: typeof data.name === "string" ? data.name : data.slug, subscribeUrl: data.subscribeUrl };
-};
-var activeSubscriberCount = async (apiKey) => {
-  const data = await getJson(`${API_BASE}/api/v1/server/subscribers/count`, apiKey);
-  return data && typeof data.active === "number" ? data.active : 0;
-};
-var sendTestNotification = async (apiKey) => {
-  const res = await fetch(`${API_BASE}/api/v1/server/send`, {
-    method: "POST",
-    headers: authHeaders(apiKey),
-    body: JSON.stringify({
-      title: "Pushary is connected",
-      body: "Your AI agent can now reach you right here.",
-      metadata: { source: "cli-onboarding" }
-    }),
-    signal: AbortSignal.timeout(15e3)
-  });
-  const data = await res.json().catch(() => ({}));
-  if (!res.ok) throw new Error(typeof data.error === "string" ? data.error : res.statusText);
-  return Array.isArray(data.notificationIds) ? data.notificationIds : [];
-};
-var isDelivered = async (apiKey, id) => {
-  const data = await getJson(`${API_BASE}/api/v1/server/notifications/${id}`, apiKey);
-  return !!data && (data.status === "delivered" || data.deliveredAt != null);
-};
-var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-var startSpinner = (getLabel) => {
-  const frames = ["   ", ".  ", ".. ", "..."];
-  let i = 0;
-  const interval = setInterval(() => {
-    process.stdout.write(`\r  ${dim(frames[i++ % frames.length])} ${getLabel()}`);
-  }, 200);
-  return (finalGlyph, finalLabel) => {
-    clearInterval(interval);
-    process.stdout.write(`\r  ${finalGlyph} ${finalLabel}\x1B[K
-`);
-  };
-};
-var printQr = (url) => new Promise((resolve, reject) => {
-  try {
-    qrcodeTerminal.generate(url, { small: true }, (qr) => {
-      process.stdout.write("\n" + qr.split("\n").map((line) => "    " + line).join("\n") + "\n");
-      resolve();
-    });
-  } catch (err) {
-    reject(err);
+// src/setup/closing.ts
+var ACTIVITY_URL = "pushary.com/dashboard/agent/activity";
+var nextSteps = (facts, reachable) => {
+  const lines = [];
+  if (facts.completed.includes("claude_code")) {
+    lines.push("pushary claude          run Claude Code so your phone can start and steer it");
   }
-});
-var waitForDevice = async (apiKey) => {
-  const deadline = Date.now() + CONNECT_TIMEOUT_MS;
-  const stop = startSpinner(() => {
-    const left = Math.max(0, Math.ceil((deadline - Date.now()) / 1e3));
-    return `Waiting for your phone ${dim(`(${left}s)`)}`;
-  });
-  try {
-    while (Date.now() < deadline) {
-      if (await activeSubscriberCount(apiKey) > 0) {
-        stop(check, "Phone connected");
-        return true;
-      }
-      await sleep(CONNECT_POLL_INTERVAL_MS);
-    }
-    stop(yellow("!"), "Didn't detect a connection yet");
-    return false;
-  } catch (err) {
-    stop(yellow("!"), `Couldn't check connection ${dim(`(${err instanceof Error ? err.message : "network error"})`)}`);
-    return false;
+  if (reachable) {
+    lines.push("pushary daemon          keep this machine reachable with nothing running");
+  } else {
+    lines.push("pushary connect         connect a phone without re-running setup");
   }
+  lines.push("pushary doctor          re-check everything");
+  return lines;
 };
-var sendAndConfirm = async (apiKey) => {
-  let notificationIds = [];
-  const stopSend = startSpinner(() => "Sending a test notification");
-  try {
-    notificationIds = await sendTestNotification(apiKey);
-    stopSend(check, "Test notification sent");
-  } catch (err) {
-    stopSend(yellow("!"), `Couldn't send test notification ${dim(`(${err instanceof Error ? err.message : "error"})`)}`);
-    return;
+var describeClosing = (facts) => {
+  const reachable = facts.reachChecked && facts.reachesYou;
+  if (facts.configuredNothing) {
+    return {
+      ok: false,
+      headline: "Setup failed.",
+      next: ["Nothing was configured. Run pushary doctor to see why."],
+      exitCode: EXIT.FAILED
+    };
   }
-  if (notificationIds.length === 0) return;
-  const deadline = Date.now() + DELIVERY_TIMEOUT_MS;
-  const stop = startSpinner(() => "Confirming it reached your phone");
-  while (Date.now() < deadline) {
-    const results = await Promise.all(notificationIds.map((id) => isDelivered(apiKey, id)));
-    if (results.some(Boolean)) {
-      stop(check, "Received on your phone");
-      return;
-    }
-    await sleep(DELIVERY_POLL_INTERVAL_MS);
+  if (facts.failed.length > 0) {
+    const count = facts.failed.length;
+    return {
+      ok: false,
+      headline: `Setup finished with ${count} problem${count === 1 ? "" : "s"}.`,
+      next: [
+        ...nextSteps(facts, reachable),
+        "",
+        `Approvals: ${ACTIVITY_URL}`
+      ],
+      exitCode: EXIT.PROBLEMS_FOUND
+    };
   }
-  stop(yellow("!"), "Sent \u2014 couldn't confirm receipt; check your phone");
-};
-var connectDevice = async (apiKey) => {
-  const site = await fetchSite(apiKey);
-  if (!site) {
-    console.log(`  ${yellow("!")} Couldn't load your subscribe link. Connect your phone later at ${cyan("pushary.com")}.`);
-    return false;
+  if (facts.reachChecked && !facts.reachesYou) {
+    return {
+      ok: false,
+      headline: "Agents configured. Your phone is not connected yet.",
+      next: [
+        "Approvals fall back to the terminal until a device of yours can answer.",
+        "",
+        ...nextSteps(facts, false)
+      ],
+      exitCode: EXIT.NO_DEVICE
+    };
   }
-  if (await activeSubscriberCount(apiKey) > 0) {
-    console.log(`  ${check} Phone already connected`);
-    await sendAndConfirm(apiKey);
-    return true;
+  if (!facts.reachChecked) {
+    return {
+      ok: true,
+      headline: "Setup complete.",
+      next: [
+        "The phone check was skipped, so nothing here proves an approval reaches you.",
+        "",
+        ...nextSteps(facts, false)
+      ],
+      exitCode: EXIT.OK
+    };
   }
-  console.log();
-  console.log(`  ${bold("Connect your phone")}`);
-  console.log(`  ${dim("Scan this with your phone camera to get push notifications:")}`);
-  await printQr(site.subscribeUrl);
-  console.log(`  ${dim("or open")} ${cyan(site.subscribeUrl)}`);
-  console.log();
-  const connected = await waitForDevice(apiKey);
-  if (!connected) {
-    console.log(`  ${dim("No rush \u2014 open")} ${cyan(site.subscribeUrl)} ${dim("on your phone whenever you're ready.")}`);
-    return false;
-  }
-  await sendAndConfirm(apiKey);
-  return true;
-};
-var printConnectInstructions = async (apiKey) => {
-  const site = await fetchSite(apiKey);
-  const target = site?.subscribeUrl ?? "https://pushary.com";
-  console.log(`  ${dim("Connect your phone for push notifications at")} ${cyan(target)}`);
+  return {
+    ok: true,
+    headline: "Setup complete.",
+    next: [...nextSteps(facts, true), "", `Approvals: ${ACTIVITY_URL}`],
+    exitCode: EXIT.OK
+  };
 };
-var PAIR_POLL_INTERVAL_MS = 2e3;
-var PAIR_TIMEOUT_MS = 18e4;
-var startPairing = async (cliPublicKey) => {
+
+// src/skills-cli.ts
+import { execSync } from "child_process";
+var installSkillViaSkillsCli = (agent) => {
   try {
-    const res = await fetch(`${API_BASE}/api/mobile/pair/start`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ cliPublicKey }),
-      signal: AbortSignal.timeout(1e4)
+    execSync(`npx -y skills@latest add Pushary/pushary-skill@pushary -y -g --agent ${agent}`, {
+      stdio: "pipe",
+      timeout: 9e4
     });
-    if (!res.ok) return null;
-    const data = await res.json().catch(() => null);
-    return data && typeof data.pairId === "string" ? data.pairId : null;
+    return true;
   } catch {
-    return null;
+    return false;
   }
 };
-var claimPairing = async (pairId) => {
-  try {
-    const res = await fetch(`${API_BASE}/api/mobile/pair/claim?id=${encodeURIComponent(pairId)}`, {
-      signal: AbortSignal.timeout(1e4)
-    });
-    if (!res.ok) return null;
-    return await res.json().catch(() => null);
-  } catch {
-    return null;
+
+// src/setup/options.ts
+var AGENT_CHOICES = ["claude_code", "codex", "gemini_cli", "hermes", "cursor", "custom"];
+var SETUP_FLAGS = {
+  bools: ["key-stdin", "skip-phone", "yes", "y", "json", "dry-run", "help", "h"],
+  values: ["key", "connect", "agents"]
+};
+var isAgentChoice = (value) => AGENT_CHOICES.includes(value);
+var parseAgentSelection = (raw, yes) => {
+  if (raw === void 0) {
+    return yes ? { kind: "auto" } : { kind: "ask" };
   }
+  const value = raw.trim().toLowerCase();
+  if (value === "auto") return { kind: "auto" };
+  if (value === "none") return { kind: "none" };
+  const parts = value.split(",").map((part) => part.trim()).filter((part) => part !== "");
+  if (parts.length === 0) throw new UsageError("--agents needs a value");
+  const unknown = parts.filter((part) => !isAgentChoice(part));
+  if (unknown.length > 0) {
+    throw new UsageError(
+      `--agents does not know: ${unknown.join(", ")}. Use auto, none, or any of: ${AGENT_CHOICES.join(", ")}`
+    );
+  }
+  return { kind: "explicit", agents: [...new Set(parts)] };
 };
-var connectViaAppPairing = async () => {
-  const keypair = generateKeypair();
-  const pairId = await startPairing(keypair.publicKeyB64);
-  if (!pairId) {
-    console.log(`  ${yellow("!")} Couldn't start pairing. Check your connection and try again.`);
-    return null;
+var parseSetupOptions = (input2) => {
+  const flags = parseFlags(input2.argv, SETUP_FLAGS);
+  const stray = [
+    ...flags.command !== void 0 && flags.command !== "setup" ? [flags.command] : [],
+    ...flags.rest
+  ];
+  if (stray.length > 0) {
+    throw new UsageError(
+      `setup takes no positional arguments (got ${stray.join(", ")}). Did you mean --agents ${stray[0]}?`
+    );
   }
-  const deepLink = `pushary://pair?pk=${encodeURIComponent(keypair.publicKeyB64)}&id=${encodeURIComponent(pairId)}`;
-  console.log();
-  console.log(`  ${bold("Connect your Pushary app")}`);
-  console.log(`  ${dim("Open the Pushary app, tap Connect agent, and scan this:")}`);
-  await printQr(deepLink);
-  console.log(`  ${dim("No camera handy? Open this link on the phone instead:")}`);
-  console.log(`  ${cyan(deepLink)}`);
-  console.log(`  ${dim("Confirm the app shows fingerprint")} ${cyan(publicKeyFingerprint(keypair.publicKeyB64))}`);
-  console.log();
-  const deadline = Date.now() + PAIR_TIMEOUT_MS;
-  const stop = startSpinner(() => {
-    const left = Math.max(0, Math.ceil((deadline - Date.now()) / 1e3));
-    return `Waiting for the app to authorize ${dim(`(${left}s)`)}`;
-  });
-  try {
-    while (Date.now() < deadline) {
-      const claim = await claimPairing(pairId);
-      if (claim?.status === "authorized") {
-        let apiKey;
-        try {
-          apiKey = openSealedKey(claim.sealed, keypair);
-        } catch {
-          stop(yellow("!"), "Pairing failed to decrypt \u2014 re-run setup to try again");
-          return null;
-        }
-        stop(check, "App connected");
-        return { apiKey, handle: claim.siteSlug };
-      }
-      if (claim?.status === "expired") {
-        stop(yellow("!"), "Pairing expired \u2014 re-run setup to try again");
-        return null;
-      }
-      await sleep(PAIR_POLL_INTERVAL_MS);
-    }
-    stop(yellow("!"), "Timed out waiting for the app");
-    return null;
-  } catch (err) {
-    stop(yellow("!"), `Pairing error ${dim(`(${err instanceof Error ? err.message : "network"})`)}`);
-    return null;
+  const yes = flags.bools.has("yes") || flags.bools.has("y");
+  const help = flags.bools.has("help") || flags.bools.has("h");
+  const agentsFlag = flags.values.get("agents");
+  const agents = parseAgentSelection(agentsFlag, yes);
+  const connectRaw = flags.values.get("connect");
+  if (connectRaw !== void 0 && connectRaw !== "web" && connectRaw !== "app") {
+    throw new UsageError(`--connect must be one of: web, app (got ${connectRaw})`);
+  }
+  const key = flags.values.get("key")?.trim() || null;
+  const keyStdin = flags.bools.has("key-stdin");
+  if (key && keyStdin) {
+    throw new UsageError("Pass either --key or --key-stdin, not both");
   }
+  return {
+    connectMode: connectRaw === "app" ? "app" : "web",
+    connectExplicit: connectRaw !== void 0,
+    skipPhone: flags.bools.has("skip-phone"),
+    // Anything that means "there is nobody to answer a prompt". A non-TTY stdin
+    // is included because that is the case that used to hang: it is better to
+    // take the defaults and say so than to wait forever for a keypress.
+    nonInteractive: yes || agentsFlag !== void 0 || !input2.stdinIsTty,
+    json: flags.bools.has("json"),
+    dryRun: flags.bools.has("dry-run"),
+    help,
+    agents,
+    key,
+    keyStdin
+  };
 };
 
-// src/skills-cli.ts
-import { execSync } from "child_process";
-var installSkillViaSkillsCli = (agent) => {
+// src/setup/detect.ts
+import { execSync as execSync2 } from "child_process";
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var whichCommand = () => process.platform === "win32" ? "where" : "which";
+var binaryOnPath = (binary) => {
   try {
-    execSync(`npx -y skills@latest add Pushary/pushary-skill@pushary -y -g --agent ${agent}`, {
-      stdio: "pipe",
-      timeout: 9e4
-    });
+    execSync2(`${whichCommand()} ${binary}`, { stdio: "ignore", timeout: 5e3 });
     return true;
   } catch {
     return false;
   }
 };
+var defaultDeps = { onPath: binaryOnPath, exists: existsSync };
+var detectAgent = (probe, deps = defaultDeps) => {
+  const checked = [];
+  if (probe.binary) {
+    checked.push(`${whichCommand()} ${probe.binary}`);
+    if (deps.onPath(probe.binary)) {
+      return { kind: "installed", evidence: `${probe.binary} on PATH`, strong: true };
+    }
+  }
+  for (const path of probe.paths) {
+    checked.push(path);
+    if (deps.exists(path)) return { kind: "installed", evidence: path, strong: true };
+  }
+  for (const marker of probe.configMarkers) {
+    checked.push(marker);
+    if (deps.exists(marker)) return { kind: "installed", evidence: marker, strong: false };
+  }
+  if (probe.binary === null && probe.paths.length === 0 && probe.configMarkers.length === 0) {
+    return { kind: "unknown" };
+  }
+  return { kind: "not-found", checked };
+};
+var agentProbes = (home = homedir()) => ({
+  claude_code: {
+    binary: "claude",
+    // The native installer puts it here, outside a default non-login PATH.
+    paths: [join(home, ".local", "bin", "claude")],
+    configMarkers: [join(home, ".claude")]
+  },
+  codex: {
+    binary: "codex",
+    paths: [],
+    configMarkers: [process.env.CODEX_HOME?.trim() || join(home, ".codex")]
+  },
+  gemini_cli: {
+    binary: "gemini",
+    paths: [],
+    configMarkers: [join(home, ".gemini")]
+  },
+  hermes: {
+    binary: "hermes",
+    paths: [],
+    configMarkers: [join(home, ".hermes")]
+  },
+  cursor: {
+    // GUI editor. `cursor` on PATH only exists if the user ran "Install 'cursor'
+    // command in PATH" from the command palette, which most never do.
+    binary: "cursor",
+    paths: process.platform === "darwin" ? ["/Applications/Cursor.app"] : process.platform === "win32" ? [join(process.env.LOCALAPPDATA ?? join(home, "AppData", "Local"), "Programs", "cursor")] : ["/usr/share/cursor", join(home, ".local", "share", "cursor")],
+    configMarkers: [join(home, ".cursor")]
+  },
+  // "Other" is a set of printed instructions for any MCP or HTTP client. There is
+  // nothing to detect, and it must never be auto-selected.
+  custom: { binary: null, paths: [], configMarkers: [] }
+});
+var detectAllAgents = (deps = defaultDeps, home) => {
+  const probes = agentProbes(home);
+  return Object.keys(probes).map((agent) => ({
+    agent,
+    result: detectAgent(probes[agent], deps)
+  }));
+};
+var isDetected = (result) => result.kind === "installed";
+var shortenHome = (path, home = homedir()) => home && path.startsWith(home) ? `~${path.slice(home.length)}` : path;
+var describeDetection = (result, home) => {
+  if (result.kind !== "installed") return null;
+  const evidence = shortenHome(result.evidence, home);
+  return result.strong ? evidence : `${evidence}, config only`;
+};
 
 // bin/pushary-setup.ts
-var CLAUDE_SETTINGS = join(homedir(), ".claude", "settings.json");
-var CLAUDE_JSON = join(homedir(), ".claude.json");
-var CURSOR_PLUGIN_DIR = join(homedir(), ".cursor", "plugins", "local", "pushary");
-var CURSOR_USER_HOOKS = join(homedir(), ".cursor", "hooks.json");
-var CLAUDE_SKILL_DIR = join(homedir(), ".claude", "skills", "pushary");
-var CODEX_HOME = process.env.CODEX_HOME?.trim() || join(homedir(), ".codex");
-var CODEX_SKILL_DIR = join(CODEX_HOME, "skills", "pushary");
-var CODEX_AGENTS_MD = join(CODEX_HOME, "AGENTS.md");
-var GEMINI_SETTINGS = join(homedir(), ".gemini", "settings.json");
-var GEMINI_MD = join(homedir(), ".gemini", "GEMINI.md");
-var PUSHARY_CONFIG_DIR = join(homedir(), ".pushary");
-var PUSHARY_CONFIG_FILE = join(PUSHARY_CONFIG_DIR, "config.json");
-var SHELL_FILES = [".zshrc", ".zprofile", ".bashrc", ".bash_profile"].map((f) => join(homedir(), f));
-var dim2 = (s) => `\x1B[2m${s}\x1B[0m`;
-var bold2 = (s) => `\x1B[1m${s}\x1B[0m`;
-var green2 = (s) => `\x1B[32m${s}\x1B[0m`;
-var cyan2 = (s) => `\x1B[36m${s}\x1B[0m`;
-var yellow2 = (s) => `\x1B[33m${s}\x1B[0m`;
-var check2 = green2("\u2713");
-var parseKeyFlag = () => {
-  const args = process.argv.slice(2);
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--key" && args[i + 1]) return args[i + 1].trim();
-    if (args[i].startsWith("--key=")) return args[i].slice(6).trim();
-  }
-  return void 0;
+var CLAUDE_SETTINGS = join2(homedir2(), ".claude", "settings.json");
+var CLAUDE_JSON = join2(homedir2(), ".claude.json");
+var CURSOR_PLUGIN_DIR = join2(homedir2(), ".cursor", "plugins", "local", "pushary");
+var CURSOR_USER_HOOKS = join2(homedir2(), ".cursor", "hooks.json");
+var CLAUDE_SKILL_DIR = join2(homedir2(), ".claude", "skills", "pushary");
+var CODEX_HOME = process.env.CODEX_HOME?.trim() || join2(homedir2(), ".codex");
+var CODEX_SKILL_DIR = join2(CODEX_HOME, "skills", "pushary");
+var CODEX_AGENTS_MD = join2(CODEX_HOME, "AGENTS.md");
+var GEMINI_SETTINGS = join2(homedir2(), ".gemini", "settings.json");
+var GEMINI_MD = join2(homedir2(), ".gemini", "GEMINI.md");
+var PUSHARY_CONFIG_FILE = join2(homedir2(), ".pushary", "config.json");
+var manualSteps = [];
+var noteManual = (step) => {
+  manualSteps.push(step);
 };
-var parseConnectFlag = () => {
-  const args = process.argv.slice(2);
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--connect" && args[i + 1]) {
-      return args[i + 1].trim() === "app" ? "app" : "web";
-    }
-    if (args[i].startsWith("--connect=")) {
-      return args[i].slice(10).trim() === "app" ? "app" : "web";
-    }
+var humanStream = process.stdout;
+var writeHuman = (text) => {
+  humanStream.write(text);
+};
+var dim = (s) => `\x1B[2m${s}\x1B[0m`;
+var bold = (s) => `\x1B[1m${s}\x1B[0m`;
+var green = (s) => `\x1B[32m${s}\x1B[0m`;
+var cyan = (s) => `\x1B[36m${s}\x1B[0m`;
+var yellow = (s) => `\x1B[33m${s}\x1B[0m`;
+var check = green("\u2713");
+var readKeyFromStdin = async (options) => {
+  if (!options.keyStdin) return void 0;
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  const first = Buffer.concat(chunks).toString("utf-8").split("\n", 1)[0]?.trim();
+  if (!first) {
+    console.log(`
+  ${yellow("!")} --key-stdin was passed but stdin was empty.`);
+    process.exit(2);
   }
-  return "web";
+  if (!isValidApiKey(first)) {
+    console.log(`
+  ${yellow("!")} The key on stdin is not a valid Pushary key. Expected: ${dim("pk_xxx.xxx")}`);
+    console.log(`  ${dim("Copy your key from")} ${cyan("https://pushary.com/dashboard/agent/settings")}
+`);
+    process.exit(2);
+  }
+  return first;
 };
 var isInstalled = (command) => {
   const whichCmd = process.platform === "win32" ? "where" : "which";
   try {
-    execSync2(`${whichCmd} ${command}`, { stdio: "ignore", timeout: 5e3 });
+    execSync3(`${whichCmd} ${command}`, { stdio: "ignore", timeout: 5e3 });
     return true;
   } catch {
     return false;
@@ -384,11 +374,40 @@ var readJson = (filePath) => {
     return {};
   }
 };
+var readAgentJson = (filePath) => {
+  const result = readJsonSafe(filePath);
+  if (result.kind === "ok") return result.value;
+  if (result.kind === "missing") return {};
+  const backup = backupFile(filePath);
+  const reason = result.kind === "unparseable" ? "is not valid JSON" : "could not be read";
+  throw new Error(
+    `${filePath} ${reason}, so it was left untouched. A copy is at ${backup}. Fix or remove the original, then re-run setup.`
+  );
+};
 var writeJson = (filePath, data) => {
   const dir = dirname(filePath);
-  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  if (!existsSync2(dir)) mkdirSync(dir, { recursive: true });
   writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n", "utf-8");
 };
+var readAgentToml = (filePath) => {
+  let raw;
+  try {
+    raw = readFileSync(filePath, "utf-8");
+  } catch (err) {
+    if (err.code === "ENOENT") return {};
+    throw new Error(`${filePath} could not be read, so it was left untouched.`);
+  }
+  if (raw.trim() === "") return {};
+  try {
+    return parseTOML(raw);
+  } catch {
+    const backup = backupFile(filePath);
+    throw new Error(
+      `${filePath} is not valid TOML, so it was left untouched. A copy is at ${backup}. Fix or remove the original, then re-run setup.`
+    );
+  }
+};
+var isCancellation = (err) => err instanceof Error && (err.name === "ExitPromptError" || /force closed the prompt/i.test(err.message));
 var formatError = (err) => {
   if (err instanceof Error) {
     const errWithSignal = err;
@@ -403,29 +422,20 @@ var spinner = async (label, fn, options = {}) => {
   const frames = ["   ", ".  ", ".. ", "..."];
   let i = 0;
   const interval = setInterval(() => {
-    process.stdout.write(`\r  ${dim2(frames[i++ % frames.length])} ${label}`);
+    writeHuman(`\r  ${dim(frames[i++ % frames.length])} ${label}`);
   }, 200);
   try {
     await fn();
     clearInterval(interval);
-    process.stdout.write(`\r  ${check2} ${label}
+    writeHuman(`\r  ${check} ${label}
 `);
   } catch (err) {
     clearInterval(interval);
-    process.stdout.write(`\r  ${yellow2("!")} ${label} ${dim2(`(${formatError(err)})`)}
+    writeHuman(`\r  ${yellow("!")} ${label} ${dim(`(${formatError(err)})`)}
 `);
     if (!options.optional) throw err;
   }
 };
-var getPackageVersion = () => {
-  try {
-    const __dirname = dirname(fileURLToPath(import.meta.url));
-    const pkg = JSON.parse(readFileSync(join(__dirname, "..", "..", "package.json"), "utf-8"));
-    return pkg.version ?? "0.0.0";
-  } catch {
-    return "0.0.0";
-  }
-};
 var checkForUpdates = async (current) => {
   try {
     const res = await fetch("https://registry.npmjs.org/@pushary/agent-hooks/latest", {
@@ -434,17 +444,18 @@ var checkForUpdates = async (current) => {
     const data = await res.json();
     const latest = data.version;
     if (latest && latest !== current) {
-      console.log(`  ${yellow2("!")} Update available: ${dim2(current)} \u2192 ${green2(latest)}`);
-      console.log(`  ${dim2("Run:")} npx @pushary/agent-hooks@latest upgrade`);
+      console.log(`  ${yellow("!")} Update available: ${dim(current)} \u2192 ${green(latest)}`);
+      console.log(`  ${dim("Run:")} npx @pushary/agent-hooks@latest upgrade`);
       console.log();
     }
   } catch {
   }
 };
-var installGlobally = async () => {
-  await spinner("Installing pushary-hook globally", async () => {
+var installGlobally2 = async () => {
+  const version = getPackageVersion();
+  await spinner(`Installing pushary-hook globally (${version})`, async () => {
     try {
-      execNpm("install -g --no-workspaces @pushary/agent-hooks@latest", { timeout: 12e4 });
+      await installGlobally({ version });
     } catch (err) {
       throw new Error(npmErrorMessage(err));
     }
@@ -455,118 +466,129 @@ var fetchSkillContent = async () => {
   if (_cachedSkillContent) return _cachedSkillContent;
   const __dirname = dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    join(__dirname, "..", "..", "data", "SKILL.md"),
-    join(__dirname, "..", "data", "SKILL.md")
+    join2(__dirname, "..", "..", "data", "SKILL.md"),
+    join2(__dirname, "..", "data", "SKILL.md")
   ];
-  const source = candidates.find((path) => existsSync(path));
+  const source = candidates.find((path) => existsSync2(path));
   if (!source) throw new Error("packaged skill not found");
   _cachedSkillContent = readFileSync(source, "utf-8");
   return _cachedSkillContent;
 };
-var skillsCliInUse = () => isInstalled("skills") || existsSync(join(homedir(), ".agents", "skills"));
+var skillsCliInUse = () => isInstalled("skills") || existsSync2(join2(homedir2(), ".agents", "skills"));
 var installSkill = async (agent, fallbackDir) => {
   await spinner("Installing Pushary skill", async () => {
     if (skillsCliInUse() && installSkillViaSkillsCli(agent)) return;
     const content = await fetchSkillContent();
-    if (!existsSync(fallbackDir)) mkdirSync(fallbackDir, { recursive: true });
-    writeFileSync(join(fallbackDir, "SKILL.md"), content, "utf-8");
+    if (!existsSync2(fallbackDir)) mkdirSync(fallbackDir, { recursive: true });
+    writeFileSync(join2(fallbackDir, "SKILL.md"), content, "utf-8");
   });
 };
 var setupClaudeCode = async (apiKey) => {
   console.log(`
-  ${bold2("Setting up Claude Code")}
+  ${bold("Setting up Claude Code")}
 `);
-  const settings = readJson(CLAUDE_SETTINGS);
+  await installGlobally2();
+  const claudeJson = readAgentJson(CLAUDE_JSON);
+  const settings = readAgentJson(CLAUDE_SETTINGS);
   await spinner("Adding MCP server (type: http)", async () => {
-    const data = readJson(CLAUDE_JSON);
-    addClaudeMcpServer(data, apiKey);
-    writeJson(CLAUDE_JSON, data);
+    addClaudeMcpServer(claudeJson, apiKey);
   });
   await spinner("Auto-allowing Pushary tools", async () => {
     addPusharyToolPermissions(settings);
   });
-  await installGlobally();
   await spinner("Adding hooks (approvals, activity, presence, and lifecycle events)", async () => {
     addPusharyHooks(settings, resolveGlobalBinDir("pushary-hook"));
   });
+  await spinner(`Writing ${CLAUDE_JSON}`, async () => {
+    writeJsonAtomic(CLAUDE_JSON, claudeJson, 384);
+  });
   await spinner(`Writing ${CLAUDE_SETTINGS}`, async () => {
-    writeJson(CLAUDE_SETTINGS, settings);
+    writeJsonAtomic(CLAUDE_SETTINGS, settings);
   });
   await installSkill("claude-code", CLAUDE_SKILL_DIR);
   console.log();
-  console.log(`  ${dim2("What this configured:")}`);
-  console.log(`  ${dim2("\u2022")} MCP server: your agent can send notifications and ask questions`);
-  console.log(`  ${dim2("\u2022")} Skill: teaches your agent when and how to use Pushary`);
-  console.log(`  ${dim2("\u2022")} Hooks: route permission approvals through push notifications`);
-  console.log(`  ${dim2("\u2022")} Auto-allowed tools: no permission prompts for Pushary MCP calls`);
+  console.log(`  ${dim("What this configured:")}`);
+  console.log(`  ${dim("\u2022")} MCP server: your agent can send notifications and ask questions`);
+  console.log(`  ${dim("\u2022")} Skill: teaches your agent when and how to use Pushary`);
+  console.log(`  ${dim("\u2022")} Hooks: route permission approvals through push notifications`);
+  console.log(`  ${dim("\u2022")} Auto-allowed tools: no permission prompts for Pushary MCP calls`);
 };
+var IS_WINDOWS = process.platform === "win32";
 var resolveHermesPython = () => {
   try {
-    const launcher = execSync2("command -v hermes", { encoding: "utf-8", stdio: "pipe", timeout: 5e3 }).trim();
-    if (launcher) {
+    const probe = IS_WINDOWS ? "where hermes" : "command -v hermes";
+    const launcher = execSync3(probe, { encoding: "utf-8", stdio: "pipe", timeout: 5e3 }).split("\n")[0].trim();
+    if (launcher && !IS_WINDOWS) {
       const shebang = readFileSync(launcher, "utf-8").split("\n", 1)[0];
       if (shebang.startsWith("#!")) {
         const interpreter = shebang.slice(2).trim().split(/\s+/)[0];
-        if (interpreter && /python/i.test(interpreter) && existsSync(interpreter)) return interpreter;
+        if (interpreter && /python/i.test(interpreter) && existsSync2(interpreter)) return interpreter;
       }
     }
   } catch {
   }
-  const venvPython = join(homedir(), ".hermes", "hermes-agent", "venv", "bin", "python3");
-  if (existsSync(venvPython)) return venvPython;
-  return null;
+  const venvRoot = join2(homedir2(), ".hermes", "hermes-agent", "venv");
+  const candidates = IS_WINDOWS ? [join2(venvRoot, "Scripts", "python.exe"), join2(venvRoot, "Scripts", "python3.exe")] : [join2(venvRoot, "bin", "python3"), join2(venvRoot, "bin", "python")];
+  return candidates.find(existsSync2) ?? null;
 };
 var ensurePip = (python) => {
   try {
-    execSync2(`"${python}" -m pip --version`, { stdio: "ignore", timeout: 15e3 });
+    execSync3(`"${python}" -m pip --version`, { stdio: "ignore", timeout: 15e3 });
     return;
   } catch {
   }
   try {
-    execSync2(`"${python}" -m ensurepip --upgrade`, { stdio: "pipe", timeout: 6e4 });
+    execSync3(`"${python}" -m ensurepip --upgrade`, { stdio: "pipe", timeout: 6e4 });
   } catch {
   }
 };
 var enablePusharyPlugin = (python) => {
   const snippet = 'from hermes_cli.config import load_config, save_config; c = load_config(); p = c.get("plugins") if isinstance(c.get("plugins"), dict) else {}; e = p.get("enabled") if isinstance(p.get("enabled"), list) else []; p["enabled"] = (e + ["pushary"]) if "pushary" not in e else e; c["plugins"] = p; a = c.get("agent") if isinstance(c.get("agent"), dict) else {}; d = a.get("disabled_toolsets") if isinstance(a.get("disabled_toolsets"), list) else []; a["disabled_toolsets"] = (d + ["clarify"]) if "clarify" not in d else d; c["agent"] = a; save_config(c)';
+  const scriptPath = join2(tmpdir(), `pushary-hermes-${process.pid}.py`);
   try {
-    execSync2(`"${python}" -c '${snippet}'`, { stdio: "pipe", timeout: 15e3 });
+    writeFileSync(scriptPath, snippet.split("; ").join("\n"), "utf-8");
+    execSync3(`"${python}" "${scriptPath}"`, { stdio: "pipe", timeout: 15e3 });
     return;
   } catch {
+    execSync3("hermes plugins enable pushary", { stdio: "ignore", timeout: 1e4 });
+  } finally {
+    try {
+      rmSync(scriptPath, { force: true });
+    } catch {
+    }
   }
-  execSync2("hermes plugins enable pushary", { stdio: "ignore", timeout: 1e4 });
 };
 var setupHermes = async (_apiKey) => {
   console.log(`
-  ${bold2("Setting up Hermes Agent")}
+  ${bold("Setting up Hermes Agent")}
 `);
   if (!isInstalled("hermes")) {
-    console.log(`  ${yellow2("!")} Hermes CLI not found. Skipping.`);
-    console.log(`  ${dim2("Install Hermes and re-run setup to configure.")}`);
-    return;
+    console.log(`  ${yellow("!")} Hermes CLI not found. Skipping.`);
+    console.log(`  ${dim("Install Hermes and re-run setup to configure.")}`);
+    return "skipped";
   }
   const python = resolveHermesPython();
   if (!python) {
-    console.log(`  ${yellow2("!")} Could not locate the Python that Hermes runs in. Skipping.`);
-    console.log(`  ${dim2("Install manually: <hermes-python> -m pip install hermes-plugin-pushary")}`);
-    return;
+    console.log(`  ${yellow("!")} Could not locate the Python that Hermes runs in. Skipping.`);
+    noteManual("Install the Hermes plugin by hand: <hermes-python> -m pip install hermes-plugin-pushary");
+    return "skipped";
   }
   await spinner("Installing hermes-plugin-pushary into Hermes\u2019 environment", async () => {
     ensurePip(python);
-    execSync2(`"${python}" -m pip install --upgrade hermes-plugin-pushary`, { stdio: "pipe", timeout: 18e4 });
+    execSync3(`"${python}" -m pip install --upgrade hermes-plugin-pushary`, { stdio: "pipe", timeout: 18e4 });
   });
   await spinner("Enabling plugin + routing questions to push", async () => {
     enablePusharyPlugin(python);
   });
   console.log();
-  console.log(`  ${dim2("What this configured:")}`);
-  console.log(`  ${dim2("\u2022")} Native tools: pushary_notify, pushary_ask, pushary_wait, pushary_cancel`);
-  console.log(`  ${dim2("\u2022")} Questions go to your phone: Hermes' terminal ${bold2("clarify")} tool is disabled, so pushary_ask handles every question`);
-  console.log(`  ${dim2("\u2022")} Auto-notifications: push alert when tools return errors`);
-  console.log(`  ${dim2("\u2022")} Permission gating: set ${bold2("PUSHARY_GATE_TOOLS")} to require lock-screen approval for risky tools`);
-  console.log(`  ${dim2("To re-enable terminal prompts:")} remove ${bold2("clarify")} from ${dim2("agent.disabled_toolsets")} in ~/.hermes/config.yaml`);
+  console.log(`  ${dim("What this configured:")}`);
+  console.log(`  ${dim("\u2022")} Native tools: pushary_notify, pushary_ask, pushary_wait, pushary_cancel`);
+  console.log(`  ${dim("\u2022")} Questions go to your phone: Hermes' terminal ${bold("clarify")} tool is disabled, so pushary_ask handles every question`);
+  console.log(`  ${dim("\u2022")} Auto-notifications: push alert when tools return errors`);
+  console.log(`  ${dim("\u2022")} Permission gating: set ${bold("PUSHARY_GATE_TOOLS")} to require lock-screen approval for risky tools`);
+  console.log(`  ${dim("To re-enable terminal prompts:")} remove ${bold("clarify")} from ${dim("agent.disabled_toolsets")} in ~/.hermes/config.yaml`);
 };
-var CODEX_HOOKS_JSON = join(CODEX_HOME, "hooks.json");
+var CODEX_HOOKS_JSON = join2(CODEX_HOME, "hooks.json");
 var CODEX_HOOKS_MIN_VERSION = [0, 122, 0];
 var CODEX_TRUST_VERIFIED_MAX = [0, 142, 2];
 var parseCodexVersion = (raw) => {
@@ -582,7 +604,7 @@ var compareCodexVersion = (a, b) => {
 };
 var readCodexVersion = () => {
   try {
-    return parseCodexVersion(execSync2("codex --version", { encoding: "utf-8", stdio: "pipe", timeout: 1e4 }));
+    return parseCodexVersion(execSync3("codex --version", { encoding: "utf-8", stdio: "pipe", timeout: 1e4 }));
   } catch {
     return null;
   }
@@ -625,24 +647,19 @@ var addCodexNotifyEntry = (codexConfig) => {
 };
 var setupCodex = async (apiKey) => {
   console.log(`
-  ${bold2("Setting up Codex")}
+  ${bold("Setting up Codex")}
 `);
   if (!isInstalled("codex")) {
-    console.log(`  ${yellow2("!")} Codex CLI not found. Skipping.`);
-    console.log(`  ${dim2("Install Codex and re-run setup to configure.")}`);
-    return;
+    console.log(`  ${yellow("!")} Codex CLI not found. Skipping.`);
+    console.log(`  ${dim("Install Codex and re-run setup to configure.")}`);
+    return "skipped";
   }
-  await installGlobally();
-  const codexConfig = join(homedir(), ".codex", "config.toml");
+  await installGlobally2();
+  const codexConfig = join2(homedir2(), ".codex", "config.toml");
   await spinner("Adding Pushary MCP server (key embedded, auto-allowed)", async () => {
-    let raw = "";
-    try {
-      raw = readFileSync(codexConfig, "utf-8");
-    } catch {
-    }
-    const config = raw ? parseTOML(raw) : {};
+    const config = readAgentToml(codexConfig);
     addCodexMcpServer(config, apiKey);
-    writeFileSync(codexConfig, stringifyTOML(config), "utf-8");
+    writeFileAtomic(codexConfig, stringifyTOML(config), KEY_FILE_MODE);
   });
   const codexVersion = readCodexVersion();
   const hooksSupported = codexSupportsHooks(codexVersion);
@@ -651,7 +668,7 @@ var setupCodex = async (apiKey) => {
   if (hooksSupported) {
     const hookCommand = quoteIfNeeded(resolveGlobalBinary("pushary-codex-hook") ?? "pushary-codex-hook");
     await spinner("Adding native hooks (~/.codex/hooks.json)", async () => {
-      const hooksConfig = readJson(CODEX_HOOKS_JSON);
+      const hooksConfig = readAgentJson(CODEX_HOOKS_JSON);
       addCodexHooks(hooksConfig, hookCommand);
       writeJson(CODEX_HOOKS_JSON, hooksConfig);
     });
@@ -672,9 +689,9 @@ var setupCodex = async (apiKey) => {
       removeCodexNotifyEntry(codexConfig);
     });
   } else {
-    console.log(`  ${yellow2("!")} This Codex version predates native hooks (needs ${CODEX_HOOKS_MIN_VERSION.join(".")}+).`);
-    console.log(`  ${dim2("Installing the deprecated notify handler instead. Upgrade Codex and re-run setup")}`);
-    console.log(`  ${dim2("to get policy enforcement, phone approvals, and session tracking.")}`);
+    console.log(`  ${yellow("!")} This Codex version predates native hooks (needs ${CODEX_HOOKS_MIN_VERSION.join(".")}+).`);
+    console.log(`  ${dim("Installing the deprecated notify handler instead. Upgrade Codex and re-run setup")}`);
+    console.log(`  ${dim("to get policy enforcement, phone approvals, and session tracking.")}`);
     await spinner("Adding notify handler for Codex events (deprecated)", async () => {
       addCodexNotifyEntry(codexConfig);
     });
@@ -684,48 +701,49 @@ var setupCodex = async (apiKey) => {
     writeInstructionBlock(CODEX_AGENTS_MD, renderAgentInstructions("Codex"));
   });
   console.log();
-  console.log(`  ${dim2("What this configured:")}`);
-  console.log(`  ${dim2("\u2022")} MCP server: Codex can send notifications and ask questions`);
-  console.log(`  ${dim2("\u2022")} API key embedded in config.toml: works without a shell reload or export`);
-  console.log(`  ${dim2("\u2022")} Proactive instructions: ~/.codex/AGENTS.md tells Codex to ask via push, not the terminal`);
-  console.log(`  ${dim2("\u2022")} Auto-allowed tools: no permission prompts for Pushary MCP calls`);
+  console.log(`  ${dim("What this configured:")}`);
+  console.log(`  ${dim("\u2022")} MCP server: Codex can send notifications and ask questions`);
+  console.log(`  ${dim("\u2022")} API key embedded in config.toml: works without a shell reload or export`);
+  console.log(`  ${dim("\u2022")} Proactive instructions: ~/.codex/AGENTS.md tells Codex to ask via push, not the terminal`);
+  console.log(`  ${dim("\u2022")} Auto-allowed tools: no permission prompts for Pushary MCP calls`);
   if (hooksSupported) {
-    console.log(`  ${dim2("\u2022")} Native hooks: phone approvals, policy enforcement, kill switch, session tracking`);
+    console.log(`  ${dim("\u2022")} Native hooks: phone approvals, policy enforcement, kill switch, session tracking`);
     if (trusted) {
-      console.log(`  ${dim2("\u2022")} Hook pre-trusted: no ${cyan2("/hooks")} step, phone approvals work right away`);
+      console.log(`  ${dim("\u2022")} Hook pre-trusted: no ${cyan("/hooks")} step, phone approvals work right away`);
     } else {
       console.log();
-      console.log(`  ${bold2("One step left, and it happens inside Codex")}`);
-      console.log(`  ${dim2("Codex makes you trust any hook before it runs. This is Codex's own")}`);
-      console.log(`  ${dim2("security check, not a Pushary thing, and you only do it once.")}`);
+      console.log(`  ${bold("One step left, and it happens inside Codex")}`);
+      console.log(`  ${dim("Codex makes you trust any hook before it runs. This is Codex's own")}`);
+      console.log(`  ${dim("security check, not a Pushary thing, and you only do it once.")}`);
       console.log();
-      console.log(`  ${cyan2("1.")} Open Codex and type ${cyan2("/hooks")}`);
-      console.log(`  ${cyan2("2.")} You will see the Pushary hook commands. Trust them.`);
+      console.log(`  ${cyan("1.")} Open Codex and type ${cyan("/hooks")}`);
+      console.log(`  ${cyan("2.")} You will see the Pushary hook commands. Trust them.`);
       console.log();
-      console.log(`  ${dim2("Until you do, Codex just runs as usual without the phone approvals.")}`);
-      console.log(`  ${dim2("To confirm:")} run a command that needs approval and watch your phone.`);
-      console.log(`  ${dim2("Pushary updates keep the same trust, so Codex will not ask again.")}`);
+      console.log(`  ${dim("Until you do, Codex just runs as usual without the phone approvals.")}`);
+      console.log(`  ${dim("To confirm:")} run a command that needs approval and watch your phone.`);
+      console.log(`  ${dim("Pushary updates keep the same trust, so Codex will not ask again.")}`);
+      noteManual("Open Codex, type /hooks, and trust the Pushary hook. Until then Codex runs without phone approvals.");
     }
   } else {
-    console.log(`  ${dim2("\u2022")} Notify handler (deprecated): captures turn completions and approval requests`);
+    console.log(`  ${dim("\u2022")} Notify handler (deprecated): captures turn completions and approval requests`);
   }
 };
 var resolveBundledPlugin = () => {
   const dir = dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    join(dir, "..", "..", "data", "cursor-plugin"),
-    join(dir, "..", "data", "cursor-plugin"),
-    join(dir, "..", "..", "..", "cursor-plugin"),
-    join(dir, "..", "..", "cursor-plugin")
+    join2(dir, "..", "..", "data", "cursor-plugin"),
+    join2(dir, "..", "data", "cursor-plugin"),
+    join2(dir, "..", "..", "..", "cursor-plugin"),
+    join2(dir, "..", "..", "cursor-plugin")
   ];
-  return candidates.find((p) => existsSync(join(p, ".cursor-plugin", "plugin.json"))) ?? null;
+  return candidates.find((p) => existsSync2(join2(p, ".cursor-plugin", "plugin.json"))) ?? null;
 };
 var installCursorUserHooks = (gateScript) => {
-  const template = readJson(join(CURSOR_PLUGIN_DIR, "hooks", "hooks.json")).hooks?.beforeShellExecution?.[0];
+  const template = readJson(join2(CURSOR_PLUGIN_DIR, "hooks", "hooks.json")).hooks?.beforeShellExecution?.[0];
   if (!template) throw new Error("bundled Cursor hooks.json missing a beforeShellExecution entry");
   const entry = { ...template, command: `node "${gateScript}"` };
   let userHooks = {};
-  if (existsSync(CURSOR_USER_HOOKS)) {
+  if (existsSync2(CURSOR_USER_HOOKS)) {
     try {
       userHooks = JSON.parse(readFileSync(CURSOR_USER_HOOKS, "utf-8"));
     } catch {
@@ -743,8 +761,8 @@ var installCursorUserHooks = (gateScript) => {
   writeJson(CURSOR_USER_HOOKS, { ...userHooks, version: userHooks.version ?? 1, hooks });
 };
 var neutralizePluginGate = () => {
-  const path = join(CURSOR_PLUGIN_DIR, "hooks", "hooks.json");
-  if (!existsSync(path)) return;
+  const path = join2(CURSOR_PLUGIN_DIR, "hooks", "hooks.json");
+  if (!existsSync2(path)) return;
   const data = readJson(path);
   if (data.hooks && "beforeShellExecution" in data.hooks) {
     delete data.hooks.beforeShellExecution;
@@ -753,85 +771,122 @@ var neutralizePluginGate = () => {
 };
 var setupCursor = async (apiKey) => {
   console.log(`
-  ${bold2("Setting up Cursor")}
+  ${bold("Setting up Cursor")}
 `);
   const source = resolveBundledPlugin();
   if (!source) throw new Error("bundled Cursor plugin not found in this package");
   await spinner("Installing Pushary plugin", async () => {
-    rmSync(CURSOR_PLUGIN_DIR, { recursive: true, force: true });
-    cpSync(source, CURSOR_PLUGIN_DIR, {
-      recursive: true,
-      filter: (p) => !["tools", "node_modules", ".git", ".DS_Store"].includes(basename(p))
-    });
+    const staging = join2(dirname(CURSOR_PLUGIN_DIR), `.pushary-staging-${process.pid}`);
+    const backup = `${CURSOR_PLUGIN_DIR}.pushary-backup-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+    rmSync(staging, { recursive: true, force: true });
+    try {
+      cpSync(source, staging, {
+        recursive: true,
+        filter: (p) => !["tools", "node_modules", ".git", ".DS_Store"].includes(basename(p))
+      });
+      const staged = readJsonSafe(join2(staging, ".cursor-plugin", "plugin.json"));
+      if (staged.kind !== "ok") {
+        throw new Error("staged Cursor plugin is missing or has an unreadable plugin.json");
+      }
+      const hadExisting = existsSync2(CURSOR_PLUGIN_DIR);
+      if (hadExisting) renameSync(CURSOR_PLUGIN_DIR, backup);
+      try {
+        renameSync(staging, CURSOR_PLUGIN_DIR);
+      } catch (err) {
+        if (hadExisting) renameSync(backup, CURSOR_PLUGIN_DIR);
+        throw err;
+      }
+      if (hadExisting) rmSync(backup, { recursive: true, force: true });
+    } finally {
+      rmSync(staging, { recursive: true, force: true });
+    }
   });
   await spinner("Linking your API key", async () => {
-    const mcpPath = join(CURSOR_PLUGIN_DIR, "mcp.json");
-    const mcp = readJson(mcpPath);
+    const mcpPath = join2(CURSOR_PLUGIN_DIR, "mcp.json");
+    const mcp = readAgentJson(mcpPath);
     const servers = mcp.mcpServers ?? {};
     if (servers.pushary) {
       servers.pushary.headers = { ...servers.pushary.headers, Authorization: `Bearer ${apiKey}` };
       mcp.mcpServers = servers;
-      writeJson(mcpPath, mcp);
+      writeJsonAtomic(mcpPath, mcp, KEY_FILE_MODE);
     }
   });
   await spinner("Registering permission gate (~/.cursor/hooks.json)", async () => {
-    installCursorUserHooks(join(CURSOR_PLUGIN_DIR, "scripts", "pushary-gate.mjs"));
+    installCursorUserHooks(join2(CURSOR_PLUGIN_DIR, "scripts", "pushary-gate.mjs"));
     neutralizePluginGate();
   });
   console.log();
-  console.log(`  ${dim2("What this configured:")}`);
-  console.log(`  ${dim2("\u2022")} Plugin installed to ~/.cursor/plugins/local/pushary (MCP tools, rule, skill)`);
-  console.log(`  ${dim2("\u2022")} Permission gate registered once in ~/.cursor/hooks.json`);
-  console.log(`  ${dim2("\u2022")} Risky shell commands route to push approval before they run`);
-  console.log(`  ${dim2("\u2022")} Fully quit and reopen Cursor to load it (a Reload Window may not be enough)`);
+  console.log(`  ${dim("What this configured:")}`);
+  console.log(`  ${dim("\u2022")} Plugin installed to ~/.cursor/plugins/local/pushary (MCP tools, rule, skill)`);
+  console.log(`  ${dim("\u2022")} Permission gate registered once in ~/.cursor/hooks.json`);
+  console.log(`  ${dim("\u2022")} Risky shell commands route to push approval before they run`);
+  console.log(`  ${dim("\u2022")} Fully quit and reopen Cursor to load it (a Reload Window may not be enough)`);
+  noteManual("Fully quit and reopen Cursor. A Reload Window may not be enough.");
 };
 var saveApiKey = async (apiKey) => {
+  let result;
   await spinner("Saving your API key", async () => {
-    if (!existsSync(PUSHARY_CONFIG_DIR)) mkdirSync(PUSHARY_CONFIG_DIR, { recursive: true });
-    const config = readJson(PUSHARY_CONFIG_FILE);
-    writeFileSync(PUSHARY_CONFIG_FILE, JSON.stringify({ ...config, apiKey }, null, 2) + "\n", "utf-8");
-    try {
-      chmodSync(PUSHARY_CONFIG_FILE, 384);
-    } catch {
-    }
-    const exportLine = `
-export PUSHARY_API_KEY='${apiKey}'
-`;
-    const shellFile = SHELL_FILES.find((f) => existsSync(f));
-    if (shellFile) {
-      const content = readFileSync(shellFile, "utf-8");
-      if (!content.includes("PUSHARY_API_KEY")) {
-        appendFileSync(shellFile, exportLine, "utf-8");
-      }
-    }
-    process.env.PUSHARY_API_KEY = apiKey;
+    result = writeKey(apiKey);
   });
+  if (!result) throw new Error("Could not save the API key");
+  if (result.configBackupPath) {
+    console.log(`  ${yellow("!")} ${PUSHARY_CONFIG_FILE} did not parse. Saved a copy at ${dim(result.configBackupPath)}`);
+  }
+  const rc = result.rc;
+  switch (rc.kind) {
+    case "updated":
+      console.log(`  ${check} Replaced the old key in ${dim(rc.path ?? "")}${rc.previousKeyPrefix ? dim(` (was ${rc.previousKeyPrefix})`) : ""}`);
+      break;
+    case "declined":
+      console.log(`  ${yellow("!")} ${rc.path}:${rc.declinedLine} already sets ${cyan("PUSHARY_API_KEY")} in a form Pushary did not write.`);
+      console.log(`  ${dim("It was left alone, and it will shadow the new key in new shells. Update it to:")}`);
+      console.log(`  ${cyan(exportLine(apiKey))}`);
+      break;
+    case "unavailable":
+      console.log(`  ${yellow("!")} Could not update ${rc.path}${rc.detail ? dim(` (${rc.detail})`) : ""}. Add this line yourself:`);
+      console.log(`  ${cyan(exportLine(apiKey))}`);
+      break;
+    case "no-rc":
+      console.log(`  ${yellow("!")} No shell profile found for this shell. Add this line yourself:`);
+      console.log(`  ${cyan(exportLine(apiKey))}`);
+      break;
+    case "written":
+    case "unchanged":
+      break;
+  }
+  return rc;
 };
-var setupCustom = async (_apiKey) => {
+var setupCustom = async (apiKey, context) => {
   console.log(`
-  ${bold2("Connect any other agent (MCP or HTTP)")}
+  ${bold("Connect any other agent (MCP or HTTP)")}
 `);
-  console.log(`  ${dim2("Your key is saved as")} ${cyan2("$PUSHARY_API_KEY")} ${dim2("in your shell profile.")}`);
+  const wroteExport = context ? ["written", "updated", "unchanged"].includes(context.rc.kind) : true;
+  if (wroteExport) {
+    console.log(`  ${dim("Your key is saved as")} ${cyan("$PUSHARY_API_KEY")} ${dim("in your shell profile.")}`);
+  } else {
+    console.log(`  ${dim("Add this to your shell profile so")} ${cyan("$PUSHARY_API_KEY")} ${dim("resolves:")}`);
+    console.log(`  ${cyan(exportLine(apiKey))}`);
+  }
   console.log();
-  console.log(`  ${dim2("MCP clients (Windsurf, LangChain, custom) \u2014 add this server:")}`);
-  console.log(`  ${cyan2("https://pushary.com/api/mcp/mcp")} ${dim2("with header")} ${cyan2("Authorization: Bearer $PUSHARY_API_KEY")}`);
+  console.log(`  ${dim("MCP clients (Windsurf, LangChain, custom) \u2014 add this server:")}`);
+  console.log(`  ${cyan("https://pushary.com/api/mcp/mcp")} ${dim("with header")} ${cyan("Authorization: Bearer $PUSHARY_API_KEY")}`);
   console.log();
-  console.log(`  ${dim2("No-code / HTTP (n8n, Zapier, scripts) \u2014 ask a human and wait:")}`);
-  console.log(`  ${dim2("POST")} ${cyan2("https://pushary.com/api/v1/server/ask")} ${dim2("body")} ${cyan2('{"question":"Approve?","type":"confirm","wait":true}')}`);
+  console.log(`  ${dim("No-code / HTTP (n8n, Zapier, scripts) \u2014 ask a human and wait:")}`);
+  console.log(`  ${dim("POST")} ${cyan("https://pushary.com/api/v1/server/ask")} ${dim("body")} ${cyan('{"question":"Approve?","type":"confirm","wait":true}')}`);
   console.log();
-  console.log(`  ${dim2("Full guide:")} ${cyan2("https://pushary.com/docs/agents/connect-any-agent")}`);
+  console.log(`  ${dim("Full guide:")} ${cyan("https://pushary.com/docs/agents/connect-any-agent")}`);
 };
 var setupGemini = async (apiKey) => {
   console.log(`
-  ${bold2("Setting up Gemini CLI")}
+  ${bold("Setting up Gemini CLI")}
 `);
   if (!isInstalled("gemini")) {
-    console.log(`  ${yellow2("!")} Gemini CLI not found. Skipping.`);
-    console.log(`  ${dim2("Install Gemini CLI and re-run setup to configure.")}`);
-    return;
+    console.log(`  ${yellow("!")} Gemini CLI not found. Skipping.`);
+    console.log(`  ${dim("Install Gemini CLI and re-run setup to configure.")}`);
+    return "skipped";
   }
-  await installGlobally();
-  const settings = readJson(GEMINI_SETTINGS);
+  await installGlobally2();
+  const settings = readAgentJson(GEMINI_SETTINGS);
   await spinner("Adding MCP server (~/.gemini/settings.json)", async () => {
     addGeminiMcpServer(settings, apiKey);
   });
@@ -839,19 +894,20 @@ var setupGemini = async (apiKey) => {
     addGeminiHooks(settings, quoteIfNeeded(resolveGlobalBinary(GEMINI_HOOK_BINARY) ?? GEMINI_HOOK_BINARY));
   });
   await spinner(`Writing ${GEMINI_SETTINGS}`, async () => {
-    writeJson(GEMINI_SETTINGS, settings);
+    writeJsonAtomic(GEMINI_SETTINGS, settings, KEY_FILE_MODE);
   });
   await spinner("Teaching Gemini to ask via push (~/.gemini/GEMINI.md)", async () => {
     writeInstructionBlock(GEMINI_MD, renderAgentInstructions("Gemini"));
   });
   console.log();
-  console.log(`  ${dim2("What this configured:")}`);
-  console.log(`  ${dim2("\u2022")} MCP server: Gemini can send notifications and ask questions`);
-  console.log(`  ${dim2("\u2022")} Proactive instructions: ~/.gemini/GEMINI.md tells Gemini to ask via push, not the terminal`);
-  console.log(`  ${dim2("\u2022")} Hooks: phone approvals, policy enforcement, kill switch, session tracking`);
-  console.log(`  ${dim2("\u2022")} Gate covers ${bold2("run_shell_command")}, ${bold2("write_file")}, and ${bold2("replace")}`);
-  console.log(`  ${dim2("\u2022")} Auto-allowed tools: Pushary MCP calls run without a confirmation prompt`);
-  console.log(`  ${dim2("Restart Gemini CLI to load the new config.")}`);
+  console.log(`  ${dim("What this configured:")}`);
+  console.log(`  ${dim("\u2022")} MCP server: Gemini can send notifications and ask questions`);
+  console.log(`  ${dim("\u2022")} Proactive instructions: ~/.gemini/GEMINI.md tells Gemini to ask via push, not the terminal`);
+  console.log(`  ${dim("\u2022")} Hooks: phone approvals, policy enforcement, kill switch, session tracking`);
+  console.log(`  ${dim("\u2022")} Gate covers ${bold("run_shell_command")}, ${bold("write_file")}, and ${bold("replace")}`);
+  console.log(`  ${dim("\u2022")} Auto-allowed tools: Pushary MCP calls run without a confirmation prompt`);
+  console.log(`  ${dim("Restart Gemini CLI to load the new config.")}`);
+  noteManual("Restart Gemini CLI to load the new config.");
 };
 var AGENT_SETUP = {
   claude_code: setupClaudeCode,
@@ -865,9 +921,9 @@ var PROJECT_INSTRUCTION_TARGETS = {
   claude_code: { file: "CLAUDE.md", label: "Claude Code" },
   codex: { file: "AGENTS.md", label: "Codex" }
 };
-var offerProjectInstructions = async (agents) => {
+var offerProjectInstructions = async (agents, options) => {
   const targets = agents.map((agent) => PROJECT_INSTRUCTION_TARGETS[agent]).filter((target) => target !== void 0);
-  if (targets.length === 0 || !process.stdout.isTTY) return;
+  if (targets.length === 0 || !process.stdout.isTTY || options.nonInteractive) return;
   console.log();
   const wanted = await confirm({
     message: "Add Pushary instructions to this project's CLAUDE.md/AGENTS.md so your whole team's agents can use phone approvals?",
@@ -875,133 +931,310 @@ var offerProjectInstructions = async (agents) => {
   });
   if (!wanted) return;
   for (const target of targets) {
-    await spinner(`Writing managed block to ${join(process.cwd(), target.file)}`, async () => {
-      writeInstructionBlock(join(process.cwd(), target.file), renderProjectAgentInstructions(target.label));
+    await spinner(`Writing managed block to ${join2(process.cwd(), target.file)}`, async () => {
+      writeInstructionBlock(join2(process.cwd(), target.file), renderProjectAgentInstructions(target.label));
     }, { optional: true });
   }
-  console.log(`  ${dim2("Commit the file to share it. Teammates without a key fall back to the terminal.")}`);
+  console.log(`  ${dim("Commit the file to share it. Teammates without a key fall back to the terminal.")}`);
 };
-var offerClaudeAlias = async () => {
-  if (!process.stdout.isTTY) return;
+var offerClaudeAlias = async (options) => {
+  if (!process.stdout.isTTY || options.nonInteractive) return;
   const rc = resolveShellRc();
   console.log();
   if (!rc) {
-    console.log(`  ${dim2("Tip: alias")} ${cyan2("claude='pushary claude'")} ${dim2("in your shell to make plain")} ${cyan2("claude")} ${dim2("reachable from your phone.")}`);
+    console.log(`  ${dim("Tip: alias")} ${cyan("claude='pushary claude'")} ${dim("in your shell to make plain")} ${cyan("claude")} ${dim("reachable from your phone.")}`);
     return;
   }
   const wanted = await confirm({
-    message: `Make plain ${bold2("claude")} reachable from your phone by default? (adds an alias to ${basename(rc.path)}, reversible)`,
+    message: `Make plain ${bold("claude")} reachable from your phone by default? (adds an alias to ${basename(rc.path)}, reversible)`,
     default: false
   });
   if (!wanted) return;
   const result = installClaudeAlias();
   if (result.installed) {
-    console.log(`  ${check2} Aliased ${cyan2("claude")} \u2192 ${cyan2("pushary claude")} in ${dim2(result.path ?? rc.path)}`);
-    console.log(`  ${dim2("Open a new terminal (or")} ${cyan2(`source ${rc.path}`)}${dim2(") to use it. Undo any time with")} ${cyan2("pushary clean")}${dim2(".")}`);
+    console.log(`  ${check} Aliased ${cyan("claude")} \u2192 ${cyan("pushary claude")} in ${dim(result.path ?? rc.path)}`);
+    console.log(`  ${dim("Open a new terminal (or")} ${cyan(`source ${rc.path}`)}${dim(") to use it. Undo any time with")} ${cyan("pushary clean")}${dim(".")}`);
   } else if (result.reason === "exists") {
-    console.log(`  ${check2} ${dim2("The")} ${cyan2("claude")} ${dim2("alias is already set.")}`);
+    console.log(`  ${check} ${dim("The")} ${cyan("claude")} ${dim("alias is already set.")}`);
   }
 };
+var verifyKeyOrExit = async (apiKey, options) => {
+  const live = process.stdout.isTTY === true && !options.json;
+  if (live) writeHuman(`  ${dim("...")} Verifying your key with pushary.com`);
+  let result;
+  try {
+    result = await checkApiKey(apiKey);
+  } catch (err) {
+    result = { kind: "unreachable", detail: formatError(err) };
+  }
+  if (live) writeHuman("\r\x1B[2K");
+  const report = describeKeyCheck(result);
+  if (report.fatal) {
+    console.log(`  ${yellow("!")} ${report.message}`);
+    for (const line of report.next) console.log(`  ${dim(line)}`);
+    console.log();
+    process.exit(report.exitCode);
+  }
+  if (result.kind === "ok") {
+    const { siteSlug, siteName, plan } = result.identity;
+    console.log(`  ${check} Key verified ${dim(`(${siteSlug || siteName} \xB7 plan ${plan})`)}`);
+  } else {
+    console.log(`  ${yellow("!")} ${report.message}`);
+    for (const line of report.next) console.log(`  ${dim(line)}`);
+  }
+  return result;
+};
+var AGENT_NAMES = {
+  claude_code: "Claude Code",
+  codex: "Codex",
+  gemini_cli: "Gemini CLI",
+  hermes: "Hermes",
+  cursor: "Cursor",
+  custom: "Other"
+};
+var AGENT_CAPABILITIES = {
+  claude_code: "MCP + hooks + auto-allowed tools",
+  codex: "MCP + native hooks + auto-allowed tools",
+  gemini_cli: "MCP + native hooks + auto-allowed tools",
+  hermes: "native plugin + auto-error notifications",
+  cursor: "plugin + permission gate",
+  custom: "any MCP or HTTP agent (Windsurf, n8n, custom)"
+};
+var NAME_COLUMN = Math.max(...Object.values(AGENT_NAMES).map((name) => name.length)) + 2;
+var AGENT_LABELS = Object.fromEntries(
+  Object.keys(AGENT_NAMES).map((agent) => [
+    agent,
+    `${AGENT_NAMES[agent].padEnd(NAME_COLUMN)}${dim(AGENT_CAPABILITIES[agent])}`
+  ])
+);
+var detectAgents = () => {
+  const map = {};
+  for (const entry of detectAllAgents()) {
+    map[entry.agent] = { found: isDetected(entry.result), evidence: describeDetection(entry.result) };
+  }
+  return map;
+};
+var canRunBrowserLogin = () => process.stdout.isTTY === true && !process.env.CI;
+var resolveAgents = async (options) => {
+  if (options.agents.kind === "none") return [];
+  if (options.agents.kind === "explicit") {
+    const detected2 = detectAgents();
+    for (const agent of options.agents.agents) {
+      if (agent !== "custom" && !detected2[agent].found) {
+        console.log(`  ${yellow("!")} ${AGENT_NAMES[agent]} was not detected on this machine.`);
+        console.log(`  ${dim("Continuing anyway. The steps below say what was configured.")}`);
+      }
+    }
+    return options.agents.agents;
+  }
+  const detected = detectAgents();
+  if (options.agents.kind === "auto") {
+    const picked = Object.keys(detected).filter((agent) => detected[agent].found);
+    if (picked.length === 0) {
+      console.log(`  ${yellow("!")} No agents detected, so nothing was configured. Your key is saved.`);
+      console.log(`  ${dim("Install an agent and re-run, name one with --agents <id>, or pass --agents none to accept this.")}`);
+      console.log();
+      process.exit(EXIT.PROBLEMS_FOUND);
+    }
+    console.log(`  ${check} Selected automatically: ${picked.map((a) => AGENT_NAMES[a]).join(", ")} ${dim("(--agents to choose)")}`);
+    return picked;
+  }
+  const hint = Object.values(detected).some((entry) => entry.found) ? "(detected agents pre-selected)" : "(space = toggle, enter = confirm)";
+  return checkbox({
+    message: "Which agents do you use? " + dim(hint),
+    choices: Object.keys(AGENT_LABELS).map((agent) => ({
+      // The evidence rides along so a detection the user disagrees with is
+      // visible and correctable, rather than an unexplained pre-tick.
+      name: detected[agent].evidence ? `${AGENT_LABELS[agent]} ${dim(`[${detected[agent].evidence}]`)}` : AGENT_LABELS[agent],
+      value: agent,
+      checked: detected[agent].found
+    })),
+    // Today an empty selection skips the loop and still prints "Setup complete."
+    validate: (picked) => picked.length > 0 || "Select at least one agent, or re-run with --agents none."
+  });
+};
+var AGENT_TARGETS = {
+  claude_code: [CLAUDE_JSON, CLAUDE_SETTINGS, join2(CLAUDE_SKILL_DIR, "SKILL.md")],
+  codex: [join2(CODEX_HOME, "config.toml"), CODEX_HOOKS_JSON, join2(CODEX_SKILL_DIR, "SKILL.md"), CODEX_AGENTS_MD],
+  gemini_cli: [GEMINI_SETTINGS, GEMINI_MD],
+  hermes: ["the Hermes virtualenv (pip install pushary-hermes)"],
+  cursor: [join2(CURSOR_PLUGIN_DIR, "mcp.json"), CURSOR_USER_HOOKS],
+  custom: ["nothing (prints connection details only)"]
+};
+var reportDryRun = (apiKey, agents, keyCheck) => {
+  console.log();
+  console.log(`  ${bold("Dry run")} ${dim("\u2014 nothing below has been written")}`);
+  console.log();
+  console.log(`  ${dim("Key:")}        ${dim(`${apiKey.slice(0, 8)}...${apiKey.slice(-4)}`)} ${dim(`(${keyCheck?.kind ?? "not verified"})`)}`);
+  console.log(`  ${dim("Key store:")}  ${PUSHARY_CONFIG_FILE}`);
+  const rc = resolveShellRc();
+  console.log(`  ${dim("Shell rc:")}   ${rc ? rc.path : dim("none for this shell; the export line would be printed instead")}`);
+  console.log();
+  if (agents.length === 0) {
+    console.log(`  ${dim("Agents:")}     ${dim("none")}`);
+  } else {
+    console.log(`  ${dim("Agents:")}     ${agents.map((a) => a.replace("_", " ")).join(", ")}`);
+    for (const agent of agents) {
+      console.log();
+      console.log(`  ${bold(agent.replace("_", " "))}`);
+      for (const target of AGENT_TARGETS[agent]) console.log(`    ${dim("would write")} ${target}`);
+    }
+  }
+  console.log();
+  console.log(`  ${dim("Re-run without --dry-run to apply.")}`);
+  console.log();
+};
+var printManualSteps = () => {
+  if (manualSteps.length === 0) return;
+  console.log(`  ${bold("Still to do")}`);
+  for (const step of manualSteps) console.log(`  ${dim("\u2022")} ${step}`);
+  console.log();
+};
+var emitJson = (options, payload) => {
+  if (!options.json) return;
+  process.stdout.write(`${JSON.stringify(payload, null, 2)}
+`);
+};
 var main = async () => {
+  const options = parseSetupOptions({
+    argv: process.argv.slice(2),
+    stdinIsTty: process.stdin.isTTY === true
+  });
+  if (options.help) {
+    process.stdout.write(`${renderCommandHelp("setup", getPackageVersion())}
+`);
+    process.exit(EXIT.OK);
+  }
+  if (options.json) {
+    humanStream = process.stderr;
+    setHumanStream(process.stderr);
+    console.log = (...args) => {
+      process.stderr.write(`${args.map((a) => typeof a === "string" ? a : String(a)).join(" ")}
+`);
+    };
+  }
   const version = getPackageVersion();
   console.log();
-  console.log(`  ${bold2("Pushary")} ${dim2("v" + version)}`);
-  console.log(`  ${dim2("Push notifications for AI coding agents")}`);
+  console.log(`  ${bold("Pushary")} ${dim("v" + version)}`);
+  console.log(`  ${dim("Push notifications for AI agents")}`);
   console.log();
   await checkForUpdates(version);
-  const connectMode = parseConnectFlag();
-  const flagKey = parseKeyFlag();
+  const connectMode = options.connectMode;
+  const flagKey = await readKeyFromStdin(options) ?? options.key ?? void 0;
   const envKey = process.env.PUSHARY_API_KEY?.trim();
   let trimmedKey;
   if (connectMode === "app") {
-    console.log(`  ${dim2("Pairing with your Pushary app.")}`);
+    console.log(`  ${dim("Pairing with your Pushary app.")}`);
     const paired = await connectViaAppPairing();
     if (!paired) {
       console.log();
-      console.log(`  ${yellow2("!")} Pairing didn't complete. Re-run setup when you're ready to scan.`);
-      console.log(`  ${dim2("No app yet? Get it at")} ${cyan2("https://pushary.com/app")}`);
+      console.log(`  ${yellow("!")} Pairing didn't complete. Re-run setup when you're ready to scan.`);
+      console.log(`  ${dim("No app yet? Get it at")} ${cyan("https://pushary.com/download")}`);
       process.exit(1);
     }
     trimmedKey = paired.apiKey;
     if (paired.handle) {
-      console.log(`  ${check2} Connected to ${cyan2("@" + paired.handle)}`);
+      console.log(`  ${check} Connected to ${cyan("@" + paired.handle)}`);
     }
     console.log();
   } else if (flagKey && isValidApiKey(flagKey)) {
     const masked = `${flagKey.slice(0, 8)}...${flagKey.slice(-4)}`;
-    console.log(`  ${check2} Using API key: ${dim2(masked)}`);
+    console.log(`  ${check} Using API key: ${dim(masked)}`);
     console.log();
     trimmedKey = flagKey;
   } else if (envKey && isValidApiKey(envKey)) {
     const masked = `${envKey.slice(0, 8)}...${envKey.slice(-4)}`;
-    console.log(`  ${check2} Found API key in environment: ${dim2(masked)}`);
+    console.log(`  ${check} Found API key in environment: ${dim(masked)}`);
     console.log();
-    const useExisting = await confirm({ message: "Use this key?", default: true });
+    const useExisting = options.nonInteractive ? true : await confirm({ message: "Use this key?", default: true });
     if (useExisting) {
       trimmedKey = envKey;
     } else {
       const apiKey = await input({ message: "API key:" });
       trimmedKey = apiKey.trim();
     }
-  } else {
-    console.log(`  ${dim2("Paste your API key from the onboarding page.")}`);
-    console.log(`  ${dim2("Can't find it? Copy it from:")} ${cyan2("pushary.com/dashboard/agent/settings")}`);
+  } else if (!canRunBrowserLogin()) {
+    console.log(`  ${yellow("!")} No API key, and no terminal to sign in from.`);
+    console.log(`  ${dim("Pass --key <pk_xxx.xxx>, or --key-stdin, or export PUSHARY_API_KEY.")}`);
+    console.log(`  ${dim("On a machine with a terminal, run")} ${cyan("pushary login")} ${dim("once and re-run this.")}`);
     console.log();
-    const apiKey = await input({ message: "API key:" });
-    trimmedKey = apiKey.trim();
+    process.exit(EXIT.NOT_CONFIGURED);
+  } else {
+    const outcome = await runBrowserLogin(
+      { say: (line) => console.log(line), bold, dim, cyan, yellow },
+      { cliVersion: version }
+    );
+    if (outcome.kind === "ok") {
+      trimmedKey = outcome.apiKey;
+      console.log();
+      console.log(`  ${check} Signed in${outcome.siteSlug ? ` ${dim(`(${outcome.siteSlug})`)}` : ""}`);
+      console.log();
+    } else if (outcome.kind === "rejected") {
+      console.log();
+      console.log(`  ${yellow("!")} That request was rejected in the browser. Nothing was written.`);
+      console.log();
+      process.exit(EXIT.NOT_CONFIGURED);
+    } else {
+      console.log();
+      if (outcome.kind === "unavailable") {
+        console.log(`  ${yellow("!")} Couldn't reach the login service ${dim(`(${outcome.detail})`)}`);
+      } else {
+        console.log(`  ${yellow("!")} The code expired before it was approved.`);
+      }
+      console.log(`  ${dim("Paste a key instead, or press Ctrl-C and re-run setup for a fresh code.")}`);
+      console.log(`  ${dim("Keys live at")} ${cyan("pushary.com/dashboard/agent/settings")}`);
+      console.log();
+      const apiKey = await input({ message: "API key:" });
+      trimmedKey = apiKey.trim();
+    }
   }
   if (!trimmedKey || !isValidApiKey(trimmedKey)) {
     console.log(`
-  ${yellow2("!")} Invalid key format. Expected: ${dim2("pk_xxx.xxx")}`);
-    console.log(`  ${dim2("Copy your key from")} ${cyan2("https://pushary.com/dashboard/agent/settings")}`);
-    console.log(`  ${dim2("Or sign up at")} ${cyan2("https://pushary.com/sign-up?from=ai-coding")}
+  ${yellow("!")} Invalid key format. Expected: ${dim("pk_xxx.xxx")}`);
+    console.log(`  ${dim("Copy your key from")} ${cyan("https://pushary.com/dashboard/agent/settings")}`);
+    console.log(`  ${dim("Or sign up at")} ${cyan("https://pushary.com/sign-up?from=ai-coding")}
 `);
-    process.exit(1);
-  }
-  const detected = {
-    claude_code: isInstalled("claude"),
-    codex: isInstalled("codex"),
-    gemini_cli: isInstalled("gemini"),
-    hermes: isInstalled("hermes"),
-    cursor: isInstalled("cursor"),
-    custom: false
-  };
-  const hint = Object.values(detected).some(Boolean) ? "(detected agents pre-selected)" : "(space = toggle, enter = confirm)";
-  const agents = await checkbox({
-    message: "Which agents do you use? " + dim2(hint),
-    choices: [
-      { name: `Claude Code  ${dim2("MCP + hooks + auto-allowed tools")}`, value: "claude_code", checked: detected.claude_code },
-      { name: `Codex        ${dim2("MCP + native hooks + auto-allowed tools")}`, value: "codex", checked: detected.codex },
-      { name: `Gemini CLI   ${dim2("MCP + native hooks + auto-allowed tools")}`, value: "gemini_cli", checked: detected.gemini_cli },
-      { name: `Hermes       ${dim2("native plugin + auto-error notifications")}`, value: "hermes", checked: detected.hermes },
-      { name: `Cursor       ${dim2("plugin + permission gate")}`, value: "cursor", checked: detected.cursor },
-      { name: `Other        ${dim2("any MCP or HTTP agent (Windsurf, n8n, custom)")}`, value: "custom", checked: false }
-    ]
-  });
-  await saveApiKey(trimmedKey);
+    process.exit(EXIT.USAGE);
+  }
+  const keyCheck = connectMode === "app" ? null : await verifyKeyOrExit(trimmedKey, options);
+  const agents = await resolveAgents(options);
+  if (options.dryRun) {
+    reportDryRun(trimmedKey, agents, keyCheck);
+    emitJson(options, { ok: true, dryRun: true, agents, keyCheck: keyCheck?.kind ?? "skipped" });
+    process.exit(EXIT.OK);
+  }
+  const rc = await saveApiKey(trimmedKey);
+  const context = { rc };
+  const failed = [];
+  const completed = [];
+  const skipped = [];
   if (agents.length === 0) {
     console.log(`
-  ${dim2("No agents selected. API key saved.")}`);
+  ${check} API key saved. No agents configured.`);
+    console.log(`  ${dim("Run setup again with --agents <id> when you want one wired up.")}`);
   } else {
-    const failed = [];
-    const completed = [];
     for (const agent of agents) {
       try {
-        await AGENT_SETUP[agent](trimmedKey);
-        completed.push(agent);
+        const outcome = await AGENT_SETUP[agent](trimmedKey, context);
+        if (outcome === "skipped") skipped.push(agent);
+        else completed.push(agent);
       } catch (err) {
         failed.push(agent.replace("_", " "));
-        console.log(`  ${yellow2("!")} ${agent.replace("_", " ")} setup failed: ${formatError(err)}`);
-        console.log(`  ${dim2("Other agents will continue. Re-run setup to retry.")}`);
+        console.log(`  ${yellow("!")} ${agent.replace("_", " ")} setup failed: ${formatError(err)}`);
+        console.log(`  ${dim("Other agents will continue. Re-run setup to retry.")}`);
       }
     }
+    if (skipped.length > 0) {
+      console.log();
+      console.log(`  ${yellow("!")} Not configured: ${skipped.map((a) => a.replace("_", " ")).join(", ")} ${dim("(not installed on this machine)")}`);
+    }
     if (failed.length > 0) {
       console.log();
-      console.log(`  ${yellow2("!")} Failed: ${failed.join(", ")} ${dim2("(others completed successfully)")}`);
+      console.log(`  ${yellow("!")} Failed: ${failed.join(", ")} ${dim("(others completed successfully)")}`);
     }
-    await offerProjectInstructions(agents);
+    await offerProjectInstructions(agents, options);
     if (completed.includes("claude_code")) {
-      await offerClaudeAlias();
+      await offerClaudeAlias(options);
     }
     if (completed.length > 0) {
       try {
@@ -1013,26 +1246,104 @@ var main = async () => {
       }
     }
   }
-  if (connectMode !== "app") {
-    const skipPhone = process.argv.includes("--skip-phone");
-    if (skipPhone || !process.stdout.isTTY) {
-      await printConnectInstructions(trimmedKey);
-    } else {
-      await connectDevice(trimmedKey);
-    }
+  const skipPhone = options.skipPhone;
+  let phone = null;
+  if (keyCheck?.kind === "locked") {
+    console.log();
+    console.log(`  ${dim("Skipping the delivery check: no approval can be delivered until the plan is active.")}`);
+  } else if (skipPhone) {
+    console.log();
+    console.log(`  ${dim("Skipping the phone check (--skip-phone).")}`);
+  } else if (!process.stdout.isTTY) {
+    phone = await printConnectInstructions(trimmedKey);
+  } else if (connectMode === "app") {
+    phone = await confirmAppConnection(trimmedKey);
+  } else {
+    phone = await connectDevice(trimmedKey, { showCapabilities: !options.connectExplicit });
   }
   console.log();
-  console.log(`  ${green2(bold2("Setup complete."))}`);
+  if (keyCheck?.kind === "locked") {
+    const report = describeKeyCheck(keyCheck);
+    printManualSteps();
+    console.log(`  ${yellow(bold("Agents configured, approvals inactive."))}`);
+    console.log();
+    console.log(`  ${report.message}`);
+    for (const line of report.next) console.log(`  ${dim(line)}`);
+    console.log();
+    emitJson(options, {
+      ok: false,
+      reason: "plan_inactive",
+      configured: completed,
+      skipped,
+      manualSteps,
+      failed,
+      keyCheck: "locked",
+      rc: rc.kind,
+      exitCode: report.exitCode
+    });
+    process.exit(report.exitCode);
+  }
+  printManualSteps();
+  const configuredNothing = agents.length > 0 && completed.length === 0;
+  const agentsOk = failed.length === 0 && !configuredNothing;
+  const reachChecked = phone !== null;
+  const reachesYou = phone?.reachesYou ?? true;
+  const closing = describeClosing({
+    agentsOk,
+    configuredNothing,
+    completed,
+    failed,
+    reachChecked,
+    reachesYou
+  });
+  console.log(`  ${closing.ok ? green(bold(closing.headline)) : yellow(bold(closing.headline))}`);
+  if (failed.length > 0) {
+    console.log();
+    for (const agent of completed) console.log(`  ${check} ${AGENT_NAMES[agent] ?? agent}`);
+    for (const item of failed) console.log(`  ${yellow("!")} ${item}`);
+  }
   console.log();
-  console.log(`  ${dim2("Next:")}`);
-  console.log(`  ${dim2("1.")} Restart your agent to load the new config`);
-  console.log(`  ${dim2("2.")} Run ${cyan2("npx @pushary/agent-hooks doctor")} to verify`);
+  for (const line of closing.next) console.log(`  ${line}`);
   console.log();
+  const exitCode = closing.exitCode;
+  emitJson(options, {
+    ok: closing.ok,
+    configured: completed,
+    skipped,
+    manualSteps,
+    failed,
+    keyCheck: keyCheck?.kind ?? "skipped",
+    reach: phone === null ? "skipped" : phone.reachesYou ? "yours" : phone.outcome?.kind ?? phone.detail ?? "unreachable",
+    rc: rc.kind,
+    rcPath: rc.path,
+    exitCode
+  });
+  if (exitCode !== EXIT.OK) {
+    if (configuredNothing && failed.length === 0) {
+      console.log(`  ${yellow("!")} Nothing was configured: none of the agents you asked for are installed here.`);
+      console.log(`  ${dim("Your key is saved. Install one and re-run, or pass --agents none to accept this.")}`);
+      console.log();
+    }
+    process.exit(exitCode);
+  }
 };
 main().catch((err) => {
+  if (err instanceof UsageError) {
+    console.log();
+    console.log(`  ${yellow("!")} ${err.message}`);
+    console.log(`  ${dim("Run")} ${cyan("pushary setup --help")} ${dim("for the full list.")}`);
+    console.log();
+    process.exit(EXIT.USAGE);
+  }
+  if (isCancellation(err)) {
+    console.log();
+    console.log(`  ${dim("Cancelled. Nothing further was changed.")}`);
+    console.log();
+    process.exit(130);
+  }
   console.log();
-  console.log(`  ${yellow2("!")} Setup failed: ${formatError(err)}`);
-  console.log(`  ${dim2("Run")} ${cyan2("npx @pushary/agent-hooks doctor")} ${dim2("after fixing the issue, then rerun setup.")}`);
+  console.log(`  ${yellow("!")} Setup failed: ${formatError(err)}`);
+  console.log(`  ${dim("Run")} ${cyan("npx @pushary/agent-hooks doctor")} ${dim("after fixing the issue, then rerun setup.")}`);
   console.log();
   process.exit(1);
 });