@pushary/agent-hooks 0.89.4 → 0.89.6

package/dist/bin/pushary-setup.js

@@ -50,9 +50,19 @@ import {
   guardedArgv
 } from "../chunk-AIGDBRIJ.js";
 import {
+  daemonServiceManagerAvailable,
+  disableDaemonService,
   ensureDaemonRunning,
-  replaceDaemonService
-} from "../chunk-NLMSSKES.js";
+  hasDaemonServiceDefinition,
+  readDaemonStatus,
+  replaceDaemonService,
+  stopDaemonService
+} from "../chunk-NQNCSPEH.js";
+import {
+  detectProviderLiveCapabilities,
+  hasSpawnProvider,
+  resolveControlPolicy
+} from "../chunk-NKHEHEUM.js";
 import "../chunk-XHKBHWLX.js";
 import {
   installGlobally,
@@ -108,15 +118,16 @@ import {
   exportLine,
   keyPrefix,
   readConfigFileKey,
+  readControlMode,
   readKeySource,
   writeKey
-} from "../chunk-W6NPWHBJ.js";
+} from "../chunk-L3YUHEB6.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
 import {
   renderCommandHelp
-} from "../chunk-GPNOHKFO.js";
+} from "../chunk-3XTFX4CL.js";
 import {
   installClaudeAlias,
   resolveShellRc
@@ -487,6 +498,12 @@ var parseVerifyMode = (raw) => {
   if (VERIFY_MODES.includes(value)) return value;
   throw new UsageError(`--verify must be one of: ${VERIFY_MODES.join(", ")} (got ${raw})`);
 };
+var CONTROL_MODES = ["auto", "on", "off"];
+var parseControlMode = (raw) => {
+  const value = raw.trim().toLowerCase();
+  if (CONTROL_MODES.includes(value)) return value;
+  throw new UsageError(`--control must be one of: ${CONTROL_MODES.join(", ")} (got ${raw})`);
+};
 var effectiveVerify = (options, context) => {
   if (options.verifyExplicit) return options.verify;
   if (options.verify === "roundtrip") return "roundtrip";
@@ -494,8 +511,9 @@ var effectiveVerify = (options, context) => {
 };
 var SETUP_FLAGS = {
   bools: ["key-stdin", "skip-phone", "yes", "y", "json", "dry-run", "help", "h"],
-  values: ["key", "connect", "agents", "verify"]
+  values: ["key", "connect", "agents", "verify", "control"]
 };
+var effectiveControlMode = (options, stored, configPresent) => options.controlExplicit ? options.control : stored ?? (configPresent ? null : options.control);
 var isAgentChoice = (value) => AGENT_CHOICES.includes(value);
 var parseAgentSelection = (raw, yes) => {
   if (raw === void 0) {
@@ -532,6 +550,7 @@ var parseSetupOptions = (input2) => {
   const connectRaw = flags.values.get("connect");
   const connectMode = connectRaw === void 0 ? "app" : parseConnectMode(connectRaw);
   const verifyRaw = flags.values.get("verify");
+  const controlRaw = flags.values.get("control");
   const nonInteractive = yes || agentsFlag !== void 0 || flags.bools.has("json") || !input2.stdinIsTty;
   const verify = verifyRaw !== void 0 ? parseVerifyMode(verifyRaw) : nonInteractive ? "push" : "roundtrip";
   const key = flags.values.get("key")?.trim() || null;
@@ -567,7 +586,9 @@ var parseSetupOptions = (input2) => {
     key,
     keyStdin,
     verify,
-    verifyExplicit: verifyRaw !== void 0
+    verifyExplicit: verifyRaw !== void 0,
+    control: controlRaw === void 0 ? "auto" : parseControlMode(controlRaw),
+    controlExplicit: controlRaw !== void 0
   };
 };
 
@@ -719,7 +740,9 @@ var checkForUpdates = async (current) => {
   } catch {
   }
 };
+var globalInstallReady = false;
 var installGlobally2 = async () => {
+  if (globalInstallReady) return;
   const version = getPackageVersion();
   await spinner(`Installing pushary-hook globally (${version})`, async () => {
     try {
@@ -728,6 +751,7 @@ var installGlobally2 = async () => {
       throw new Error(npmErrorMessage(err));
     }
   });
+  globalInstallReady = true;
 };
 var _cachedSkillContent = null;
 var fetchSkillContent = async () => {
@@ -1346,10 +1370,10 @@ ${pluginLocationSnippet(VSCODE_PLUGIN_DIR)}`
   console.log(`  ${dim("\u2022")} Fully quit and reopen VS Code to load the plugin`);
   noteManual("Fully quit and reopen VS Code. A Reload Window may not pick up a new plugin location.");
 };
-var saveApiKey = async (apiKey) => {
+var saveApiKey = async (apiKey, controlMode) => {
   let result;
   await spinner("Saving your API key", async () => {
-    result = writeKey(apiKey);
+    result = writeKey(apiKey, controlMode === null ? {} : { controlMode });
   });
   if (!result) throw new Error("Could not save the API key");
   if (result.configBackupPath) {
@@ -1702,7 +1726,7 @@ var AGENT_TARGETS = {
   ],
   custom: ["nothing (prints connection details only)"]
 };
-var reportDryRun = (apiKey, agents, keyCheck) => {
+var reportDryRun = (apiKey, agents, keyCheck, controlMode) => {
   console.log();
   console.log(`  ${bold("Dry run")} ${dim("\u2014 nothing below has been written")}`);
   console.log();
@@ -1710,6 +1734,7 @@ var reportDryRun = (apiKey, agents, keyCheck) => {
     apiKey ? `  ${dim("Key:")}        ${dim(`${apiKey.slice(0, 8)}...${apiKey.slice(-4)}`)} ${dim(`(${keyCheck?.kind ?? "not verified"})`)}` : `  ${dim("Key:")}        ${dim("none on this machine \u2014 a real run would acquire one")}`
   );
   console.log(`  ${dim("Key store:")}  ${PUSHARY_CONFIG_FILE}`);
+  console.log(`  ${dim("Control:")}    ${controlMode ?? "unchanged (legacy install)"}`);
   const rc = resolveShellRc();
   console.log(`  ${dim("Shell rc:")}   ${rc ? rc.path : dim("none for this shell; the export line would be printed instead")}`);
   console.log();
@@ -1748,6 +1773,7 @@ var main = async () => {
 `);
     process.exit(EXIT.OK);
   }
+  const controlMode = effectiveControlMode(options, readControlMode(), existsSync(PUSHARY_CONFIG_FILE));
   recordSetupOptions(options);
   if (options.json) {
     jsonMode = true;
@@ -1806,8 +1832,8 @@ var main = async () => {
     console.log();
     markStep("resolve-agents");
     const plannedAgents = await resolveAgents(options);
-    reportDryRun(null, plannedAgents, null);
-    emitJson(options, { ok: true, dryRun: true, agents: plannedAgents, keyCheck: "skipped", key: "none" });
+    reportDryRun(null, plannedAgents, null, controlMode);
+    emitJson(options, { ok: true, dryRun: true, agents: plannedAgents, control: controlMode, keyCheck: "skipped", key: "none" });
     process.exit(EXIT.OK);
   } else if (connectMode === "app" && canShowPairingQr() && !options.skipPhone) {
     console.log(`  ${dim("Pairing with your Pushary app.")}`);
@@ -1894,12 +1920,12 @@ var main = async () => {
   markStep("resolve-agents");
   const agents = await resolveAgents(options);
   if (options.dryRun) {
-    reportDryRun(trimmedKey, agents, keyCheck);
-    emitJson(options, { ok: true, dryRun: true, agents, keyCheck: keyCheck?.kind ?? "skipped" });
+    reportDryRun(trimmedKey, agents, keyCheck, controlMode);
+    emitJson(options, { ok: true, dryRun: true, agents, control: controlMode, keyCheck: keyCheck?.kind ?? "skipped" });
     process.exit(EXIT.OK);
   }
   markStep("save-key");
-  const rc = await saveApiKey(trimmedKey);
+  const rc = await saveApiKey(trimmedKey, controlMode);
   const context = { rc };
   if (envKey && envKey !== trimmedKey) {
     noteManual(
@@ -1909,6 +1935,7 @@ var main = async () => {
   const failed = [];
   const completed = [];
   const skipped = [];
+  let controlLifecycleFailure = null;
   if (agents.length === 0) {
     console.log(`
   ${check} API key saved. No agents configured.`);
@@ -1947,6 +1974,16 @@ var main = async () => {
       await offerClaudeAlias(options);
     }
   }
+  if (controlMode === "off") {
+    markStep("control:disable");
+    const disabled = await disableDaemonService();
+    if (disabled.kind !== "ok") {
+      controlLifecycleFailure = disabled.detail;
+      console.log(`  ${yellow("!")} Could not fully disable phone-start: ${controlLifecycleFailure}`);
+    } else {
+      console.log(`  ${check} Phone-start background service disabled.`);
+    }
+  }
   markStep("connect-phone");
   const skipPhone = options.skipPhone;
   let phone = null;
@@ -2008,6 +2045,8 @@ var main = async () => {
       failed,
       keyCheck: "locked",
       rc: rc.kind,
+      control: controlMode,
+      daemon: controlLifecycleFailure ? "unavailable" : "skipped",
       exitCode: report.exitCode
     });
     await reportSetupOutcome({
@@ -2028,11 +2067,64 @@ var main = async () => {
   const reachesYou = phone?.reachesYou ?? true;
   markStep("closing");
   const keyIsTrusted = keyFromPairing || keyCheck?.kind === "ok";
-  const daemon = keyIsTrusted && completed.length > 0 ? await (async () => {
-    const service = await replaceDaemonService();
-    return service.kind === "ok" ? ensureDaemonRunning({ spawnDaemon: () => {
-    } }) : { kind: "unavailable", detail: service.detail };
-  })() : null;
+  const managedControlAgents = ["claude_code", "codex", "gemini_cli"];
+  const configuredControlAgents = managedControlAgents.filter((agent) => agentIsWired(agent));
+  const controlCapabilities = detectProviderLiveCapabilities(configuredControlAgents.map(
+    (agent) => agent === "claude_code" ? "claude" : agent === "gemini_cli" ? "gemini" : agent
+  ));
+  const providerAvailable = hasSpawnProvider(controlCapabilities);
+  const managerAvailable = daemonServiceManagerAvailable();
+  const servicePresent = readDaemonStatus().kind !== "absent" || hasDaemonServiceDefinition();
+  let controlPolicy = resolveControlPolicy({
+    mode: controlMode,
+    providerAvailable,
+    managerAvailable,
+    servicePresent
+  });
+  if (controlPolicy === "legacy") {
+    let legacyRuntimeFailure = null;
+    try {
+      await installGlobally2();
+      const replaced = await replaceDaemonService();
+      if (replaced.kind !== "ok") throw new Error(replaced.detail);
+    } catch (err) {
+      legacyRuntimeFailure = formatError(err);
+    }
+    let retired = legacyRuntimeFailure !== null;
+    let stopped = retired ? await disableDaemonService() : await stopDaemonService();
+    if (!retired && stopped.kind !== "ok") {
+      legacyRuntimeFailure = stopped.detail;
+      retired = true;
+      stopped = await disableDaemonService();
+    }
+    if (stopped.kind !== "ok") {
+      controlLifecycleFailure = [legacyRuntimeFailure, stopped.detail].filter(Boolean).join("; ");
+      console.log(`  ${yellow("!")} Could not make the legacy phone-start service safe: ${controlLifecycleFailure}`);
+    } else if (retired) {
+      controlPolicy = resolveControlPolicy({
+        mode: controlMode,
+        providerAvailable,
+        managerAvailable,
+        servicePresent: false
+      });
+      console.log(`  ${yellow("!")} Retired the legacy phone-start service because it could not be safely repinned: ${legacyRuntimeFailure}`);
+    }
+  }
+  if (controlMode === "on" && controlPolicy !== "enabled") {
+    console.log(`  ${yellow("!")} Phone-start was required, but this machine has no supported provider or native background-service manager.`);
+  } else if (controlPolicy === "legacy") {
+    console.log(`  ${yellow("!")} A legacy phone-start service cannot be safely adopted in this session. Disable it with --control off or restore its provider and native service manager.`);
+  }
+  const daemon = keyIsTrusted && controlPolicy === "enabled" ? await (async () => {
+    try {
+      await installGlobally2();
+      const service = await replaceDaemonService();
+      return service.kind === "ok" ? ensureDaemonRunning({ spawnDaemon: () => {
+      } }) : { kind: "unavailable", detail: service.detail };
+    } catch (err) {
+      return { kind: "unavailable", detail: formatError(err) };
+    }
+  })() : controlMode === "on" || controlPolicy === "legacy" ? { kind: "unavailable", detail: "Managed control is required but no usable provider/service-manager pair is available" } : null;
   const closing = describeClosing({
     agentsOk,
     configuredNothing,
@@ -2040,7 +2132,7 @@ var main = async () => {
     failed,
     reachChecked,
     reachesYou,
-    daemonReady: daemon === null ? null : daemon.kind === "running" || daemon.kind === "started",
+    daemonReady: controlLifecycleFailure ? false : daemon === null ? null : daemon.kind === "running" || daemon.kind === "started",
     // null when the check did not run, so it changes nothing. Only an outright
     // `false` is allowed to hold back "Setup complete.".
     roundTripAnswered: roundTrip === null ? null : roundTrip.kind === "answered" ? true : roundTrip.kind === "unanswered" ? false : null
@@ -2085,7 +2177,10 @@ var main = async () => {
     roundTrip: roundTrip === null ? "skipped" : roundTrip.kind,
     rc: rc.kind,
     rcPath: rc.path,
-    daemon: daemon?.kind ?? "skipped",
+    daemon: controlLifecycleFailure ? "unavailable" : daemon?.kind ?? "skipped",
+    control: controlMode,
+    controlPolicy,
+    controlCapabilities,
     exitCode
   });
   if (exitCode !== EXIT.OK) {

package/dist/bin/pushary-stats.js

@@ -4,8 +4,8 @@ import {
 } from "../chunk-VZKXBFUA.js";
 import {
   exitOnHelpFlag
-} from "../chunk-KJ57OPCC.js";
-import "../chunk-GPNOHKFO.js";
+} from "../chunk-LURY4WNF.js";
+import "../chunk-3XTFX4CL.js";
 import "../chunk-DINDL2CF.js";
 import "../chunk-KZERVKTD.js";
 import {

package/dist/bin/pushary-status.js

@@ -20,14 +20,14 @@ import {
 } from "../chunk-5RUIFDTP.js";
 import {
   readKeySource
-} from "../chunk-W6NPWHBJ.js";
+} from "../chunk-L3YUHEB6.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
 import {
   exitOnHelpFlag
-} from "../chunk-KJ57OPCC.js";
-import "../chunk-GPNOHKFO.js";
+} from "../chunk-LURY4WNF.js";
+import "../chunk-3XTFX4CL.js";
 import "../chunk-BC3VCZ3E.js";
 import "../chunk-DINDL2CF.js";
 import "../chunk-BSZYIAZL.js";

package/dist/bin/pushary-suggestions.js

@@ -7,8 +7,8 @@ import {
 } from "../chunk-GMXKITVA.js";
 import {
   exitOnHelpFlag
-} from "../chunk-KJ57OPCC.js";
-import "../chunk-GPNOHKFO.js";
+} from "../chunk-LURY4WNF.js";
+import "../chunk-3XTFX4CL.js";
 import "../chunk-DINDL2CF.js";
 import {
   UsageError

package/dist/bin/pushary-upgrade.js

@@ -1,253 +1,98 @@
 #!/usr/bin/env node
 import {
-  detectClaudeVersion
-} from "../chunk-475T3XIO.js";
-import {
-  GEMINI_HOOK_BINARY,
-  addClaudeMcpServer,
-  addGeminiHooks,
-  addGeminiMcpServer,
-  addPusharyHooks,
-  addPusharyToolPermissions,
-  hasGeminiHooks
-} from "../chunk-7TS2G4QG.js";
+  reapplyAllAgents
+} from "../chunk-5TASNKRX.js";
+import "../chunk-475T3XIO.js";
+import "../chunk-OBI4YMCT.js";
+import "../chunk-7TS2G4QG.js";
 import "../chunk-ATBKJNWS.js";
+import "../chunk-AIGDBRIJ.js";
 import {
-  guardBinary
-} from "../chunk-AIGDBRIJ.js";
-import {
+  daemonServiceManagerAvailable,
+  disableDaemonService,
   ensureDaemonRunning,
-  replaceDaemonService
-} from "../chunk-NLMSSKES.js";
+  hasDaemonServiceDefinition,
+  readDaemonStatus,
+  replaceDaemonService,
+  stopDaemonService
+} from "../chunk-NQNCSPEH.js";
+import {
+  detectProviderLiveCapabilities,
+  hasSpawnProvider,
+  resolveControlPolicy
+} from "../chunk-NKHEHEUM.js";
 import {
   needsShell
 } from "../chunk-XHKBHWLX.js";
 import {
   execNpm,
   npmErrorMessage,
-  resolveGlobalBinDir,
   resolveGlobalBinary
 } from "../chunk-PZA7G4CN.js";
 import "../chunk-2HYPZLYY.js";
 import {
-  CODEX_HOOK_BINARY,
-  addCodexHookTrust,
-  addCodexHooks,
-  addCodexMcpServer,
   claudeJson,
   codexConfigToml,
-  codexHookPositions,
-  codexHooksJson,
   cursorPluginDir,
   geminiSettings,
-  hasCodexHooks,
-  vscodePluginDir,
-  vscodePluginMcp
+  vscodePluginDir
 } from "../chunk-V37ZXMH3.js";
+import {
+  readControlMode
+} from "../chunk-L3YUHEB6.js";
 import {
   exitOnHelpFlag
-} from "../chunk-KJ57OPCC.js";
-import "../chunk-GPNOHKFO.js";
+} from "../chunk-LURY4WNF.js";
+import "../chunk-3XTFX4CL.js";
+import "../chunk-BC3VCZ3E.js";
 import {
   isNewerVersion
 } from "../chunk-DINDL2CF.js";
+import "../chunk-OFRNZWC4.js";
 import "../chunk-KZERVKTD.js";
-import {
-  readJsonSafe
-} from "../chunk-6MTNS63X.js";
+import "../chunk-6MTNS63X.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
 import "../chunk-L4C2JXJS.js";
 
 // bin/pushary-upgrade.ts
-import { existsSync as existsSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
-import { execFileSync } from "child_process";
-
-// src/reapply.ts
-import { join, dirname } from "path";
+import { existsSync } from "fs";
 import { homedir } from "os";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { parse as parseTOML, stringify as stringifyTOML } from "smol-toml";
-var CLAUDE_SETTINGS = join(homedir(), ".claude", "settings.json");
-var CLAUDE_JSON = join(homedir(), ".claude.json");
-var readJson = (filePath) => {
-  const result = readJsonSafe(filePath);
-  if (result.kind === "ok") return result.value;
-  if (result.kind === "missing") return {};
-  return null;
-};
-var writeJson = (filePath, data) => {
-  const dir = dirname(filePath);
-  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-  writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n", "utf-8");
-};
-var hasPusharyClaudeHooks = (settings) => JSON.stringify(settings.hooks ?? {}).includes("pushary-hook");
-var hasPusharyMcp = (claudeJson2) => !!claudeJson2.mcpServers?.pushary;
-var reapplyClaudeSettings = (apiKey, paths = {}) => {
-  const settingsPath = paths.settingsPath ?? CLAUDE_SETTINGS;
-  const claudeJsonPath = paths.claudeJsonPath ?? CLAUDE_JSON;
-  const settings = readJson(settingsPath);
-  const claudeJson2 = readJson(claudeJsonPath);
-  const configured = settings != null && hasPusharyClaudeHooks(settings) || claudeJson2 != null && hasPusharyMcp(claudeJson2);
-  if (!configured) return { reapplied: false, hooks: false, mcp: false };
-  const settingsWritable = settings != null;
-  const claudeJsonWritable = claudeJson2 != null;
-  let hooks = false;
-  let mcp = false;
-  try {
-    if (!settingsWritable) throw new Error("settings.json could not be parsed");
-    const s = settings;
-    addPusharyToolPermissions(s);
-    addPusharyHooks(s, resolveGlobalBinDir("pushary-hook"), detectClaudeVersion());
-    writeJson(settingsPath, s);
-    hooks = true;
-  } catch {
-  }
-  if (apiKey) {
-    try {
-      if (!claudeJsonWritable) throw new Error(".claude.json could not be parsed");
-      const cj = claudeJson2;
-      addClaudeMcpServer(cj, apiKey);
-      writeJson(claudeJsonPath, cj);
-      mcp = true;
-    } catch {
-    }
-  }
-  return { reapplied: hooks || mcp, hooks, mcp };
-};
-var readToml = (filePath) => {
-  try {
-    const raw = readFileSync(filePath, "utf-8");
-    return raw.trim() === "" ? {} : parseTOML(raw);
-  } catch {
-    return null;
-  }
-};
-var reapplyCodexSettings = (apiKey, paths = {}) => {
-  const configPath = paths.configPath ?? codexConfigToml();
-  const hooksPath = paths.hooksPath ?? codexHooksJson();
-  const config = readToml(configPath);
-  const hooksConfig = readJson(hooksPath);
-  const configured = config != null && !!config.mcp_servers?.pushary || hooksConfig != null && hasCodexHooks(hooksConfig);
-  if (!configured) return { reapplied: false, hooks: false, mcp: false };
-  const command = guardBinary(resolveGlobalBinary(CODEX_HOOK_BINARY) ?? CODEX_HOOK_BINARY);
-  let hooks = false;
-  let mcp = false;
-  if (hooksConfig != null) {
-    try {
-      addCodexHooks(hooksConfig, command);
-      writeJson(hooksPath, hooksConfig);
-      hooks = true;
-    } catch {
-    }
-  }
-  if (config != null) {
-    try {
-      if (hooks) addCodexHookTrust(config, hooksPath, command, codexHookPositions(hooksConfig ?? void 0));
-      if (apiKey) {
-        addCodexMcpServer(config, apiKey);
-        mcp = true;
-      }
-      if (hooks || apiKey) writeFileSync(configPath, stringifyTOML(config), "utf-8");
-    } catch {
-    }
-  }
-  return { reapplied: hooks || mcp, hooks, mcp };
-};
-var reapplyGeminiSettings = (apiKey, paths = {}) => {
-  const settingsPath = paths.settingsPath ?? join(homedir(), ".gemini", "settings.json");
-  const settings = readJson(settingsPath);
-  if (settings == null) return { reapplied: false, hooks: false, mcp: false };
-  const configured = hasGeminiHooks(settings) || !!settings.mcpServers?.pushary;
-  if (!configured) return { reapplied: false, hooks: false, mcp: false };
-  let hooks = false;
-  let mcp = false;
-  try {
-    addGeminiHooks(settings, guardBinary(resolveGlobalBinary(GEMINI_HOOK_BINARY) ?? GEMINI_HOOK_BINARY));
-    hooks = true;
-    if (apiKey) {
-      addGeminiMcpServer(settings, apiKey);
-      mcp = true;
-    }
-    writeJson(settingsPath, settings);
-  } catch {
-  }
-  return { reapplied: hooks || mcp, hooks, mcp };
-};
-var reapplyPluginMcp = (mcpPath, apiKey) => {
-  if (!apiKey) return { reapplied: false, hooks: false, mcp: false };
-  const mcpConfig = readJson(mcpPath);
-  if (mcpConfig == null) return { reapplied: false, hooks: false, mcp: false };
-  const servers = mcpConfig.mcpServers;
-  if (!servers?.pushary) return { reapplied: false, hooks: false, mcp: false };
-  try {
-    addClaudeMcpServer(mcpConfig, apiKey);
-    writeJson(mcpPath, mcpConfig);
-    return { reapplied: true, hooks: false, mcp: true };
-  } catch {
-    return { reapplied: false, hooks: false, mcp: false };
-  }
-};
-var reapplyCursorPlugin = (apiKey, paths = {}) => reapplyPluginMcp(
-  paths.pluginMcpPath ?? join(homedir(), ".cursor", "plugins", "local", "pushary", "mcp.json"),
-  apiKey
-);
-var reapplyVsCodePlugin = (apiKey, paths = {}) => reapplyPluginMcp(paths.pluginMcpPath ?? vscodePluginMcp(), apiKey);
-var reapplyAllAgents = (apiKey) => {
-  const runners = [
-    { label: "Claude Code", run: () => reapplyClaudeSettings(apiKey) },
-    { label: "Codex", run: () => reapplyCodexSettings(apiKey) },
-    { label: "Gemini CLI", run: () => reapplyGeminiSettings(apiKey) },
-    { label: "Cursor", run: () => reapplyCursorPlugin(apiKey) },
-    { label: "VS Code", run: () => reapplyVsCodePlugin(apiKey) }
-  ];
-  const done = [];
-  for (const runner of runners) {
-    try {
-      const result = runner.run();
-      if (result.reapplied) done.push({ label: runner.label, result });
-    } catch {
-    }
-  }
-  return done;
-};
-
-// bin/pushary-upgrade.ts
+import { join } from "path";
+import { execFileSync } from "child_process";
 exitOnHelpFlag("upgrade");
 var detectInstallModes = () => {
   const candidates = [
     {
       label: "Cursor plugin",
       upgrade: "updates itself through Cursor",
-      present: existsSync2(cursorPluginDir())
+      present: existsSync(cursorPluginDir())
     },
     {
       label: "VS Code plugin",
       upgrade: "npx @pushary/agent-hooks@latest setup --agents vscode",
-      present: existsSync2(vscodePluginDir())
+      present: existsSync(vscodePluginDir())
     },
     {
       label: "Codex config",
       upgrade: "npx @pushary/agent-hooks@latest setup --agents codex",
-      present: existsSync2(codexConfigToml())
+      present: existsSync(codexConfigToml())
     },
     {
       label: "Claude Code config",
       upgrade: "npx @pushary/agent-hooks@latest setup --agents claude_code",
-      present: existsSync2(claudeJson())
+      present: existsSync(claudeJson())
     },
     {
       label: "Gemini config",
       upgrade: "npx @pushary/agent-hooks@latest setup --agents gemini_cli",
-      present: existsSync2(geminiSettings())
+      present: existsSync(geminiSettings())
     },
     {
       label: "Hermes plugin (pip)",
       upgrade: "npx @pushary/agent-hooks@latest setup --agents hermes",
-      present: existsSync2(join2(homedir2(), ".hermes"))
+      present: existsSync(join(homedir(), ".hermes"))
     }
   ];
   return candidates.filter((candidate) => candidate.present).map(({ label, upgrade }) => ({ label, upgrade }));
@@ -278,13 +123,37 @@ var finishUpgrade = async () => {
   } catch {
     apiKey = void 0;
   }
-  const refreshed = reapplyAllAgents(apiKey);
+  const inspectedAgents = reapplyAllAgents(apiKey);
+  const refreshed = inspectedAgents.filter((agent) => agent.result.reapplied);
+  const configuredControlProviders = inspectedAgents.filter((agent) => agent.result.configured && (agent.id === "claude" || agent.id === "codex" || agent.id === "gemini")).map((agent) => agent.id);
+  const controlMode = readControlMode();
+  const daemonStatus = readDaemonStatus();
+  const serviceWasPresent = daemonStatus.kind !== "absent" || hasDaemonServiceDefinition();
+  const controlPolicy = resolveControlPolicy({
+    mode: controlMode,
+    providerAvailable: hasSpawnProvider(detectProviderLiveCapabilities(configuredControlProviders)),
+    managerAvailable: daemonServiceManagerAvailable(),
+    servicePresent: serviceWasPresent
+  });
   let daemonReady = true;
-  if (apiKey) {
-    const service = await replaceDaemonService();
-    const daemon = service.kind === "ok" ? await ensureDaemonRunning({ spawnDaemon: () => {
-    } }) : null;
-    daemonReady = service.kind === "ok" && (daemon?.kind === "running" || daemon?.kind === "started");
+  let legacyStopFailure = null;
+  if (controlPolicy === "disabled" && serviceWasPresent) {
+    daemonReady = (await disableDaemonService()).kind === "ok";
+  } else if (controlPolicy === "legacy") {
+    const stopped = await stopDaemonService();
+    legacyStopFailure = stopped.kind === "ok" ? null : stopped.detail;
+    daemonReady = false;
+  } else if (controlPolicy === "enabled") {
+    if (!apiKey) {
+      daemonReady = false;
+    } else {
+      const service = await replaceDaemonService();
+      const daemon = service.kind === "ok" ? await ensureDaemonRunning({ spawnDaemon: () => {
+      } }) : null;
+      daemonReady = service.kind === "ok" && (daemon?.kind === "running" || daemon?.kind === "started");
+    }
+  } else if (controlMode === "on" && controlPolicy === "unsupported") {
+    daemonReady = false;
   }
   console.log();
   if (refreshed.length > 0) {
@@ -302,11 +171,11 @@ var finishUpgrade = async () => {
   }
   console.log();
   if (!daemonReady) {
-    console.error("Upgrade installed, but the background service did not start. Run: pushary daemon install");
+    console.error(controlPolicy === "disabled" ? "Upgrade installed, but the disabled background service could not be fully removed. Re-run setup with --control off." : controlPolicy === "legacy" ? legacyStopFailure ? `Upgrade installed, but the legacy background service could not be stopped: ${legacyStopFailure}. Run setup with --control off.` : "Upgrade installed and the legacy background service was stopped, but it cannot be safely adopted. Run setup with --control off, or restore its provider and native service manager." : controlPolicy === "enabled" && !apiKey ? "Upgrade installed, but phone-start could not be reconciled because no API key was readable. Re-run setup." : "Upgrade installed, but the background service did not start. Run: pushary daemon install");
     process.exitCode = 1;
     return;
   }
-  console.log("Done. Your hooks and background service use the new global install.");
+  console.log(controlPolicy === "disabled" ? "Done. Your hooks use the new global install; phone-start remains disabled." : controlPolicy === "unsupported" || controlPolicy === "preserve-absent" ? "Done. Your hooks use the new global install; no background service was added." : "Done. Your hooks and background service use the new global install.");
   console.log("Verify with: pushary doctor");
 };
 var main = async () => {