@pushary/agent-hooks 0.60.0 → 0.62.0

package/dist/bin/pushary-daemon.js

@@ -4,14 +4,20 @@ import {
 } from "../chunk-XHKBHWLX.js";
 import {
   resolveGlobalBinary
-} from "../chunk-J7JWI3KU.js";
+} from "../chunk-MUEW424A.js";
+import {
+  exitOnHelpFlag
+} from "../chunk-IIZZYUWK.js";
+import {
+  EXIT
+} from "../chunk-SP7OZXCQ.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-NKXSILEW.js";
+} from "../chunk-2UMNXADU.js";
 
 // src/spawn-daemon.ts
 import { spawn } from "child_process";
@@ -26,6 +32,19 @@ var MAX_ERROR_STREAK = 6;
 var REQUEST_TIMEOUT_MS = 1e4;
 var MAX_SPAWNS_PER_WINDOW = 5;
 var SPAWN_WINDOW_MS = 6e4;
+var DrainError = class extends Error {
+  constructor(status) {
+    super(`drain ${status}`);
+    this.status = status;
+    this.name = "DrainError";
+  }
+};
+var isAuthFailure = (err) => {
+  if (typeof err !== "object" || err === null) return false;
+  const candidate = err;
+  if (candidate.name !== "DrainError") return false;
+  return candidate.status === 401 || candidate.status === 403;
+};
 var NATIVE_AGENT_BINARIES = { codex: "codex", gemini: "gemini" };
 var buildSpawnLaunch = (req, opts) => {
   const agent = req.agent === "codex" || req.agent === "gemini" ? req.agent : "claude";
@@ -64,6 +83,9 @@ var runSpawnDaemon = async () => {
   const spawnTimestamps = [];
   let timer;
   let inflight;
+  let fatalCode = null;
+  let finish = () => {
+  };
   const launch = (req) => {
     spawnTimestamps.push(Date.now());
     const cwd = req.cwd && existsSync(req.cwd) ? req.cwd : process.cwd();
@@ -94,7 +116,7 @@ var runSpawnDaemon = async () => {
       body: JSON.stringify({ machineId }),
       signal
     });
-    if (!res.ok) throw new Error(`drain ${res.status}`);
+    if (!res.ok) throw new DrainError(res.status);
     const data = await res.json();
     const spawn2 = data.spawn;
     return spawn2 && typeof spawn2.prompt === "string" && typeof spawn2.id === "string" ? spawn2 : null;
@@ -122,7 +144,16 @@ var runSpawnDaemon = async () => {
       } else {
         idleTicks++;
       }
-    } catch {
+    } catch (err) {
+      if (isAuthFailure(err)) {
+        const status = err.status;
+        fatalCode = EXIT.UNAUTHENTICATED;
+        stderr(
+          status === 401 ? "[pushary] daemon stopping: this machine's key was rejected. Run `pushary login` to sign in again.\n" : "[pushary] daemon stopping: this workspace has no active plan, so the queue is closed. Pick one at pushary.com/dashboard/settings?tab=billing\n"
+        );
+        finish();
+        return;
+      }
       errorStreak = Math.min(errorStreak + 1, MAX_ERROR_STREAK);
     } finally {
       clearTimeout(timeout);
@@ -148,11 +179,17 @@ var runSpawnDaemon = async () => {
       resolve();
     };
     for (const signal of signals) process.on(signal, onSignal);
+    finish = () => {
+      teardown();
+      for (const signal of signals) process.off(signal, onSignal);
+      resolve();
+    };
   });
-  return 0;
+  return fatalCode ?? 0;
 };
 
 // bin/pushary-daemon.ts
+exitOnHelpFlag("daemon");
 runSpawnDaemon().then((code) => process.exit(code)).catch((err) => {
   process.stderr.write(
     `[pushary] daemon error: ${err instanceof Error ? err.message : String(err)}

package/dist/bin/pushary-doctor.js

@@ -2,50 +2,162 @@
 import {
   describeWaitLadder
 } from "../chunk-IIENZE2J.js";
+import {
+  detectAllAgents
+} from "../chunk-UXXRRXUS.js";
+import {
+  hasInstructionBlock
+} from "../chunk-N7XJ4L2W.js";
 import {
   GEMINI_HOOK_BINARY,
-  hasCodexHooks,
   hasGeminiHooks,
-  hasInstructionBlock,
+  missingGeminiHookEvents
+} from "../chunk-E2U35RLD.js";
+import {
+  codexAgentsMd,
+  codexConfigToml,
+  codexHooksJson,
+  codexSkillDir,
+  hasCodexHooks,
   missingCodexHookEvents,
-  missingGeminiHookEvents,
   readCodexMcpAuth,
   untrustedCodexHookEvents
-} from "../chunk-BQLCELYC.js";
+} from "../chunk-ER657KRJ.js";
+import {
+  describeReach,
+  fetchChannels,
+  reachVerdict
+} from "../chunk-3O27ZSRE.js";
+import "../chunk-3EGEA4KH.js";
+import {
+  parseFlags
+} from "../chunk-N4DA4CJB.js";
+import {
+  keyPrefix,
+  readKeySource
+} from "../chunk-247C4RE5.js";
+import {
+  checkApiKey,
+  describeKeyCheck
+} from "../chunk-YJ7YZRVV.js";
+import {
+  createIo
+} from "../chunk-TX7KBKT7.js";
+import {
+  UsageError
+} from "../chunk-7QLSKOSU.js";
+import "../chunk-BC3VCZ3E.js";
 import {
   execNpm
-} from "../chunk-J7JWI3KU.js";
+} from "../chunk-MUEW424A.js";
+import {
+  exitOnHelpFlag
+} from "../chunk-IIZZYUWK.js";
+import {
+  EXIT,
+  getPackageVersion
+} from "../chunk-SP7OZXCQ.js";
 import {
   readLedgerSummary
 } from "../chunk-WLGEY4UX.js";
 import {
   callMcpTool,
   sendMcpRequest
-} from "../chunk-DWED7BS3.js";
+} from "../chunk-HNTKTK5B.js";
 import "../chunk-DQAN3JQP.js";
+import {
+  getMachineId
+} from "../chunk-RN3NOEJF.js";
 import {
   getBaseUrl
-} from "../chunk-NKXSILEW.js";
+} from "../chunk-2UMNXADU.js";
 
 // bin/pushary-doctor.ts
-import { existsSync, readFileSync } from "fs";
+import { existsSync, readFileSync, writeFileSync } from "fs";
 import { join } from "path";
-import { homedir } from "os";
+import { homedir as homedir2 } from "os";
 import { execSync } from "child_process";
 import { confirm } from "@inquirer/prompts";
 import { parse as parseTOML } from "smol-toml";
-var dim = (s) => `\x1B[2m${s}\x1B[0m`;
-var bold = (s) => `\x1B[1m${s}\x1B[0m`;
-var green = (s) => `\x1B[32m${s}\x1B[0m`;
-var red = (s) => `\x1B[31m${s}\x1B[0m`;
-var yellow = (s) => `\x1B[33m${s}\x1B[0m`;
-var cyan = (s) => `\x1B[36m${s}\x1B[0m`;
+
+// src/diagnostics/bundle.ts
+import { homedir, hostname } from "os";
+var globalVersion = () => {
+  try {
+    return execNpm("list -g --no-workspaces @pushary/agent-hooks --depth=0", { timeout: 1e4 }).toString().match(/@pushary\/agent-hooks@([\d.]+)/)?.[1] ?? null;
+  } catch {
+    return null;
+  }
+};
+var collectBundle = async (options2 = {}) => {
+  const now = options2.now ?? (() => /* @__PURE__ */ new Date());
+  const source = readKeySource();
+  const identity = options2.identity ?? null;
+  return {
+    generatedAt: now().toISOString(),
+    cliVersion: getPackageVersion(),
+    globalVersion: globalVersion(),
+    node: process.version,
+    platform: process.platform,
+    arch: process.arch,
+    shell: process.env.SHELL ?? null,
+    machineId: getMachineId(),
+    keySource: source.kind,
+    keyPrefix: source.key ? keyPrefix(source.key) : null,
+    // The value of the drift, not the keys: knowing two places disagree is the
+    // whole diagnostic, and the keys themselves are what must not travel.
+    keyDrift: source.drift !== null,
+    identity: identity ? stripWorkspace(identity) : null,
+    agents: detectAllAgents().map((entry) => ({ id: entry.agent, detected: entry.result })),
+    checks: options2.checks ?? []
+  };
+};
+var stripWorkspace = (identity) => {
+  const { workspaceId: _workspaceId, ...rest } = identity;
+  return rest;
+};
+var KEY_PATTERN = /pk_[A-Za-z0-9_]+\.[A-Za-z0-9_]+/g;
+var homePattern = () => new RegExp(homedir().replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g");
+var redactText = (text) => text.replace(KEY_PATTERN, (match) => `${match.split(".")[0]}.REDACTED`).replace(homePattern(), "~").replace(new RegExp(hostname().replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"), "HOST");
+var redact = (bundle) => JSON.parse(redactText(JSON.stringify(bundle)));
+var bundleFileName = (bundle) => `pushary-diagnostics-${bundle.generatedAt.replace(/[:.]/g, "-")}.json`;
+
+// bin/pushary-doctor.ts
+exitOnHelpFlag("doctor");
+var parseDoctorOptions = (argv) => {
+  const flags = parseFlags(argv, { bools: ["json", "roundtrip", "no-push", "bundle", "help", "h"], values: [] });
+  if (flags.command !== void 0 && flags.command !== "doctor") {
+    throw new UsageError(`doctor takes no positional arguments (got ${flags.command})`);
+  }
+  const roundtrip = flags.bools.has("roundtrip");
+  const noPush = flags.bools.has("no-push");
+  if (roundtrip && noPush) {
+    throw new UsageError("--roundtrip needs to send a push, so it cannot be combined with --no-push");
+  }
+  return { json: flags.bools.has("json"), roundtrip, noPush, bundle: flags.bools.has("bundle") };
+};
+var options;
+try {
+  options = parseDoctorOptions(process.argv.slice(2));
+} catch (err) {
+  process.stderr.write(`  ! ${err instanceof Error ? err.message : String(err)}
+`);
+  process.stderr.write("  Run `pushary doctor --help` for the full list.\n");
+  process.exit(EXIT.USAGE);
+}
+if (options.json) {
+  console.log = (...args) => {
+    process.stderr.write(`${args.map((a) => typeof a === "string" ? a : String(a)).join(" ")}
+`);
+  };
+}
+var { bold, dim, green, yellow, red, cyan } = createIo();
 var pass = green("\u2713");
 var fail = red("\u2717");
 var warn = yellow("!");
-var CLAUDE_SETTINGS = join(homedir(), ".claude", "settings.json");
-var SKILL_PATH = join(homedir(), ".claude", "skills", "pushary", "SKILL.md");
-var SHELL_FILES = [".zshrc", ".zprofile", ".bashrc", ".bash_profile"].map((f) => join(homedir(), f));
+var CLAUDE_SETTINGS = join(homedir2(), ".claude", "settings.json");
+var SKILL_PATH = join(homedir2(), ".claude", "skills", "pushary", "SKILL.md");
+var SHELL_FILES = [".zshrc", ".zprofile", ".bashrc", ".bash_profile"].map((f) => join(homedir2(), f));
 var readJson = (path) => {
   try {
     return JSON.parse(readFileSync(path, "utf-8"));
@@ -101,19 +213,9 @@ var main = async () => {
   console.log(`  ${bold("Pushary Doctor")}`);
   console.log();
   console.log(`  ${dim("Configuration")}`);
-  let apiKey = process.env.PUSHARY_API_KEY;
-  let keySource = apiKey ? "env" : null;
-  const PUSHARY_CONFIG_FILE = join(homedir(), ".pushary", "config.json");
-  if (!apiKey) {
-    try {
-      const parsed = JSON.parse(readFileSync(PUSHARY_CONFIG_FILE, "utf-8"));
-      if (typeof parsed.apiKey === "string" && parsed.apiKey) {
-        apiKey = parsed.apiKey;
-        keySource = "config-file";
-      }
-    } catch {
-    }
-  }
+  const source = readKeySource();
+  let apiKey = source.key ?? void 0;
+  let keySource = source.kind === "env" ? "env" : source.kind === "config" ? "config-file" : null;
   if (!apiKey) {
     for (const f of SHELL_FILES) {
       try {
@@ -130,14 +232,48 @@ var main = async () => {
   }
   const maskKey = (k) => `pk_${k.split(".")[0]?.slice(3, 7)}...`;
   if (keySource === "config-file") {
-    console.log(`  ${pass} API key in ${dim("~/.pushary/config.json")} ${dim(`(${maskKey(apiKey)})`)}`);
+    console.log(`  ${pass} API key in ${dim(source.origin ?? "the config file")} ${dim(`(${maskKey(apiKey)})`)}`);
   } else if (keySource === "profile") {
     console.log(`  ${pass} API key in shell profile ${dim(`(${maskKey(apiKey)})`)}`);
     console.log(`  ${warn} Re-run ${cyan("npx @pushary/agent-hooks setup")} so hooks read it from ${dim("~/.pushary/config.json")} without a shell reload`);
   } else {
     check(!!apiKey, "API key in environment", apiKey ? maskKey(apiKey) : "PUSHARY_API_KEY not set");
   }
-  const CLAUDE_JSON = join(homedir(), ".claude.json");
+  if (source.drift) {
+    check(
+      false,
+      "One key, not two",
+      `shell has ${source.drift.envPrefix}, ${source.drift.configPath} has ${source.drift.configPrefix} \u2014 the shell one wins. Re-run setup, or open a new terminal.`
+    );
+  }
+  let keyVerdict = null;
+  if (apiKey) {
+    keyVerdict = await checkApiKey(apiKey);
+    switch (keyVerdict.kind) {
+      case "ok":
+        check(
+          true,
+          "Key verified with pushary.com",
+          `${keyVerdict.identity.siteSlug || keyVerdict.identity.siteName} \xB7 plan ${keyVerdict.identity.plan} \xB7 ${keyVerdict.identity.subscriptionStatus}`
+        );
+        break;
+      case "locked":
+        check(false, "Plan active", describeKeyCheck(keyVerdict).message);
+        for (const line of describeKeyCheck(keyVerdict).next) console.log(`    ${dim(line)}`);
+        break;
+      case "rejected":
+        check(false, "Key accepted by pushary.com", describeKeyCheck(keyVerdict).message);
+        for (const line of describeKeyCheck(keyVerdict).next) console.log(`    ${dim(line)}`);
+        break;
+      case "malformed":
+        check(false, "Key format", "expected pk_xxx.xxx");
+        break;
+      case "unreachable":
+        console.log(`  ${warn} Could not verify the key with pushary.com ${dim(`(${keyVerdict.detail})`)}`);
+        break;
+    }
+  }
+  const CLAUDE_JSON = join(homedir2(), ".claude.json");
   const claudeJson = readJson(CLAUDE_JSON);
   const mcpServers = claudeJson?.mcpServers ?? {};
   const pusharyServer = mcpServers?.pushary;
@@ -179,10 +315,10 @@ var main = async () => {
   } else {
     check(false, "Claude Code: settings.json", "not found");
   }
-  const codexConfigPath = join(homedir(), ".codex", "config.toml");
-  const codexHooksPath = join(homedir(), ".codex", "hooks.json");
-  const codexHooksJson = readJson(codexHooksPath);
-  if (existsSync(codexConfigPath) || codexHooksJson) {
+  const codexConfigPath = codexConfigToml();
+  const codexHooksPath = codexHooksJson();
+  const codexHooksConfig = readJson(codexHooksPath);
+  if (existsSync(codexConfigPath) || codexHooksConfig) {
     const codexConfig = existsSync(codexConfigPath) ? readFileSync(codexConfigPath, "utf-8") : "";
     let codexParsed = {};
     try {
@@ -221,11 +357,11 @@ var main = async () => {
       }
     }
     const codexNotifyPath = codexConfig.match(/["']([^"']*pushary-codex[^"']*)["']/)?.[1] ?? null;
-    const hooksInstalled = !!codexHooksJson && hasCodexHooks(codexHooksJson);
+    const hooksInstalled = !!codexHooksConfig && hasCodexHooks(codexHooksConfig);
     if (hooksInstalled) {
-      const missingEvents = missingCodexHookEvents(codexHooksJson);
+      const missingEvents = missingCodexHookEvents(codexHooksConfig);
       check(missingEvents.length === 0, "Codex: native hooks installed", missingEvents.length === 0 ? "all 6 events" : `missing ${missingEvents.join(", ")}, re-run setup`);
-      const hookCommand = extractHookCommand(codexHooksJson.hooks?.PreToolUse, "pushary-codex-hook") ?? extractHookCommand(codexHooksJson.hooks?.PermissionRequest, "pushary-codex-hook");
+      const hookCommand = extractHookCommand(codexHooksConfig.hooks?.PreToolUse, "pushary-codex-hook") ?? extractHookCommand(codexHooksConfig.hooks?.PermissionRequest, "pushary-codex-hook");
       if (hookCommand) {
         const resolves = commandResolves(hookCommand);
         check(resolves, "Codex: hook command resolves", resolves ? hookCommand : `not on PATH: ${hookCommand}`);
@@ -247,13 +383,13 @@ var main = async () => {
         check(resolves, "Codex: notify handler resolves", resolves ? codexNotifyPath : `not found: ${codexNotifyPath}`);
       }
     }
-    const codexSkillPath = join(homedir(), ".codex", "skills", "pushary", "SKILL.md");
+    const codexSkillPath = join(codexSkillDir(), "SKILL.md");
     check(existsSync(codexSkillPath), "Codex: skill installed");
-    const codexAgentsMd = join(homedir(), ".codex", "AGENTS.md");
-    const hasCodexInstructions = hasInstructionBlock(codexAgentsMd);
-    check(hasCodexInstructions, "Codex: proactive instructions (AGENTS.md)", hasCodexInstructions ? codexAgentsMd : "missing \u2014 re-run setup so Codex asks via push, not the terminal");
+    const codexAgentsMd2 = codexAgentsMd();
+    const hasCodexInstructions = hasInstructionBlock(codexAgentsMd2);
+    check(hasCodexInstructions, "Codex: proactive instructions (AGENTS.md)", hasCodexInstructions ? codexAgentsMd2 : "missing \u2014 re-run setup so Codex asks via push, not the terminal");
   }
-  const geminiSettingsPath = join(homedir(), ".gemini", "settings.json");
+  const geminiSettingsPath = join(homedir2(), ".gemini", "settings.json");
   const geminiSettings = readJson(geminiSettingsPath);
   if (geminiSettings) {
     const geminiServers = geminiSettings.mcpServers ?? {};
@@ -291,13 +427,13 @@ var main = async () => {
     } else {
       check(false, "Gemini CLI: native hooks installed", "no Pushary hooks in ~/.gemini/settings.json \u2014 re-run setup");
     }
-    const geminiMd = join(homedir(), ".gemini", "GEMINI.md");
+    const geminiMd = join(homedir2(), ".gemini", "GEMINI.md");
     const hasGeminiInstructions = hasInstructionBlock(geminiMd);
     check(hasGeminiInstructions, "Gemini CLI: proactive instructions (GEMINI.md)", hasGeminiInstructions ? geminiMd : "missing \u2014 re-run setup so Gemini asks via push, not the terminal");
   }
-  const cursorPluginDir = join(homedir(), ".cursor", "plugins", "local", "pushary");
+  const cursorPluginDir = join(homedir2(), ".cursor", "plugins", "local", "pushary");
   if (existsSync(cursorPluginDir)) {
-    const cursorUserHooks = join(homedir(), ".cursor", "hooks.json");
+    const cursorUserHooks = join(homedir2(), ".cursor", "hooks.json");
     const userHooks = readJson(cursorUserHooks);
     const gateEntry = userHooks.hooks?.beforeShellExecution?.find(
       (h) => String(h.command ?? "").includes("pushary-gate")
@@ -321,22 +457,22 @@ var main = async () => {
     }
   }
   check(existsSync(SKILL_PATH), "Skill installed", existsSync(SKILL_PATH) ? SKILL_PATH : "not found");
-  let globalVersion = "";
+  let globalVersion2 = "";
   try {
-    globalVersion = execNpm("list -g --no-workspaces @pushary/agent-hooks --depth=0", { timeout: 1e4 }).toString().match(/@pushary\/agent-hooks@([\d.]+)/)?.[1] ?? "";
+    globalVersion2 = execNpm("list -g --no-workspaces @pushary/agent-hooks --depth=0", { timeout: 1e4 }).toString().match(/@pushary\/agent-hooks@([\d.]+)/)?.[1] ?? "";
   } catch {
-    globalVersion = "";
+    globalVersion2 = "";
   }
-  check(!!globalVersion, "Global package installed", globalVersion || "not found");
-  if (globalVersion) {
+  check(!!globalVersion2, "Global package installed", globalVersion2 || "not found");
+  if (globalVersion2) {
     try {
       const res = await fetch("https://registry.npmjs.org/@pushary/agent-hooks/latest", {
         signal: AbortSignal.timeout(5e3)
       });
       const latest = res.ok ? (await res.json()).version ?? "" : "";
       if (latest) {
-        const upToDate = latest === globalVersion;
-        check(upToDate, "Global package up to date", upToDate ? globalVersion : `${globalVersion} installed, ${latest} available \u2014 run npx @pushary/agent-hooks@latest upgrade`);
+        const upToDate = latest === globalVersion2;
+        check(upToDate, "Global package up to date", upToDate ? globalVersion2 : `${globalVersion2} installed, ${latest} available \u2014 run npx @pushary/agent-hooks@latest upgrade`);
       }
     } catch {
     }
@@ -351,7 +487,7 @@ var main = async () => {
     }
   });
   if (aliasRc) {
-    if (globalVersion) {
+    if (globalVersion2) {
       check(true, "claude alias \u2192 pushary claude", `set in ${aliasRc.split("/").pop()}`);
     } else {
       check(false, "claude alias \u2192 pushary claude", "alias is set but pushary is not installed \u2014 run `unalias claude` (this shell) or reinstall");
@@ -428,25 +564,29 @@ var main = async () => {
     }
     console.log();
     console.log(`  ${dim("Notification Delivery")}`);
-    try {
-      const notifRes = await fetch("https://pushary.com/api/v1/server/send", {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "Authorization": `Bearer ${apiKey}`
-        },
-        body: JSON.stringify({
-          title: "Pushary Doctor",
-          body: "If you see this, push notifications are working."
-        }),
-        signal: AbortSignal.timeout(1e4)
-      });
-      check(notifRes.ok, "Push notification sent", notifRes.ok ? "check your phone" : `${notifRes.status}`);
+    const probe = await fetchChannels(apiKey);
+    if (probe.kind !== "ok") {
+      check(false, "Phone reachable", probe.kind === "unreachable" ? `could not read your devices (${probe.detail})` : probe.kind === "locked" ? "no plan active, so nothing can be delivered" : "the server rejected this key");
+    } else if (probe.status.precise) {
+      const channels = probe.status;
+      const verdict = reachVerdict(channels);
+      check(verdict.kind === "yours", "Phone reachable", verdict.kind === "yours" ? describeReach(channels) : verdict.kind === "nobody" ? "nothing connected, run pushary connect or get the app at https://pushary.com/download" : `${describeReach(channels)}; run pushary connect to add your own`);
+    }
+    if (options.noPush) {
+      console.log(`  ${dim("\u2013")} Test push skipped ${dim("(--no-push)")}`);
+    } else try {
+      const result = await callMcpTool(apiKey, "send_notification", {
+        title: "Pushary Doctor",
+        body: "If you see this, push notifications are working.",
+        agentName: "Pushary Doctor"
+      }, { sessionId, timeoutMs: 2e4 });
+      const sent = typeof result.sent === "number" ? result.sent : (result.delivery?.mobile?.recipients ?? 0) + (result.delivery?.web?.recipients ?? 0);
+      check(sent > 0, "Push notification sent", sent > 0 ? `${sent} device${sent === 1 ? "" : "s"} \u2014 check your phone` : "reached 0 devices");
     } catch (err) {
       const msg = err instanceof Error ? err.message : "network error";
       check(false, "Push notification sent", msg);
     }
-    const testQuestion = process.stdin.isTTY ? await confirm({ message: "Test question roundtrip? (sends a push notification)", default: false }) : false;
+    const testQuestion = options.roundtrip ? true : options.noPush || options.json || !process.stdin.isTTY ? false : await confirm({ message: "Test question roundtrip? (sends a push notification)", default: false });
     if (testQuestion) {
       console.log();
       console.log(`  ${dim("Question Roundtrip")}`);
@@ -520,6 +660,41 @@ var main = async () => {
     console.log(`  ${dim("Run")} ${cyan("npx @pushary/agent-hooks@latest clean")} ${dim("then")} ${cyan("setup")} ${dim("to fix.")}`);
   }
   console.log();
+  const keyExit = keyVerdict && (keyVerdict.kind === "rejected" || keyVerdict.kind === "locked" || keyVerdict.kind === "malformed") ? describeKeyCheck(keyVerdict).exitCode : null;
+  const exitCode = keyExit ?? (failed.length > 0 ? EXIT.PROBLEMS_FOUND : EXIT.OK);
+  if (options.bundle) {
+    try {
+      const bundle = redact(
+        await collectBundle({
+          identity: keyVerdict?.kind === "ok" ? keyVerdict.identity : null,
+          checks: results.map((r) => ({ id: r.label, ok: r.passed, detail: r.detail ?? "" }))
+        })
+      );
+      const target = join(process.cwd(), bundleFileName(bundle));
+      writeFileSync(target, `${JSON.stringify(bundle, null, 2)}
+`, "utf-8");
+      const say = options.json ? process.stderr : process.stdout;
+      say.write(`
+  Diagnostics written to ${target}
+`);
+      say.write("  Keys, your home directory and this machine name are redacted. Read it before sharing.\n\n");
+    } catch (err) {
+      process.stderr.write(`  ! could not write the diagnostics file: ${err instanceof Error ? err.message : String(err)}
+`);
+    }
+  }
+  if (options.json) {
+    process.stdout.write(`${JSON.stringify({
+      ok: exitCode === EXIT.OK,
+      exitCode,
+      keyCheck: keyVerdict?.kind ?? null,
+      passed: results.filter((r) => r.passed).length,
+      failed: failed.length,
+      checks: results.map((r) => ({ label: r.label, passed: r.passed, detail: r.detail ?? null }))
+    }, null, 2)}
+`);
+  }
+  process.exit(exitCode);
 };
 main().catch((err) => {
   console.error(`  doctor failed: ${err instanceof Error ? err.message : String(err)}`);

package/dist/bin/pushary-gemini-hook.js

@@ -23,24 +23,24 @@ import {
   savePendingQuestion,
   sendNotification,
   waitForAnswer
-} from "../chunk-WNRYRN2R.js";
-import {
-  getMachineId
-} from "../chunk-RN3NOEJF.js";
+} from "../chunk-HIIBSYFJ.js";
 import {
   isGatingMoment,
   recordKeylessMoment
 } from "../chunk-WLGEY4UX.js";
-import "../chunk-DWED7BS3.js";
+import "../chunk-HNTKTK5B.js";
 import {
   DECISION_LINE_MAX,
   effectiveWaitSeconds,
   hookWaitClamped,
   hookWaitDeadline
 } from "../chunk-DQAN3JQP.js";
+import {
+  getMachineId
+} from "../chunk-RN3NOEJF.js";
 import {
   getApiKey
-} from "../chunk-NKXSILEW.js";
+} from "../chunk-2UMNXADU.js";
 
 // bin/pushary-gemini-hook.ts
 import { basename } from "path";

package/dist/bin/pushary-hook.js

@@ -1,17 +1,22 @@
 #!/usr/bin/env node
 import {
   handlePreToolUse
-} from "../chunk-BE5X3WXL.js";
+} from "../chunk-5SO3CEGJ.js";
 import "../chunk-CAJZAFVS.js";
+import {
+  exitOnHelpFlag
+} from "../chunk-IIZZYUWK.js";
+import "../chunk-SP7OZXCQ.js";
 import "../chunk-YHG74UFF.js";
-import "../chunk-WNRYRN2R.js";
-import "../chunk-RN3NOEJF.js";
+import "../chunk-HIIBSYFJ.js";
 import "../chunk-WLGEY4UX.js";
-import "../chunk-DWED7BS3.js";
+import "../chunk-HNTKTK5B.js";
 import "../chunk-DQAN3JQP.js";
-import "../chunk-NKXSILEW.js";
+import "../chunk-RN3NOEJF.js";
+import "../chunk-2UMNXADU.js";
 
 // bin/pushary-hook.ts
+exitOnHelpFlag("hook");
 var main = async () => {
   let rawInput = "";
   for await (const chunk of process.stdin) {

package/dist/bin/pushary-login.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node