@pushary/agent-hooks 0.89.8 → 0.89.9

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.89.9
+
+### Setup proves managed control reaches the server
+
+The background daemon now records successful heartbeats separately from
+successful control-queue responses. Setup and upgrade wait for both before
+reporting managed control ready, and doctor reports either missing proof.
+
+An authenticated, once-per-minute challenge round trip gives the server the
+same readiness evidence without launching an agent or changing queued work.
+Machine status exposes that observation additively so current clients keep
+their existing fields while newer CLIs can verify capabilities end to end.
+
 ## 0.89.8
 
 ### Daemon upgrades keep a recoverable service

package/dist/bin/pushary-claude.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   ensureDaemonRunning
-} from "../chunk-R2AGKCXL.js";
+} from "../chunk-543KNJKC.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,

package/dist/bin/pushary-clean.js

@@ -24,7 +24,7 @@ import "../chunk-ATBKJNWS.js";
 import "../chunk-AIGDBRIJ.js";
 import {
   disableDaemonService
-} from "../chunk-R2AGKCXL.js";
+} from "../chunk-543KNJKC.js";
 import "../chunk-XHKBHWLX.js";
 import {
   execNpm
@@ -177,7 +177,7 @@ var guardedDaemonRemoval = async () => {
     wouldNote("stop and uninstall", "Pushary background service");
     return true;
   }
-  return (await disableDaemonService()).kind === "ok";
+  return (await disableDaemonService({ requireAbsenceProof: true })).kind === "ok";
 };
 var guardedInstructionBlockRemoval = (path) => {
   if (!dryRun) return removeInstructionBlock(path);

package/dist/bin/pushary-daemon.js

@@ -3,11 +3,11 @@ import {
   inspectConfiguredManagedProviders
 } from "../chunk-EA3E74P2.js";
 import "../chunk-J2JZJZKB.js";
+import "../chunk-BAE45YLP.js";
 import {
   HEARTBEAT_INTERVAL_MS,
   sendHeartbeat
-} from "../chunk-ZL7HEF2T.js";
-import "../chunk-BAE45YLP.js";
+} from "../chunk-U5TQCQ25.js";
 import "../chunk-VA7VUNRD.js";
 import "../chunk-ATBKJNWS.js";
 import "../chunk-AIGDBRIJ.js";
@@ -23,7 +23,7 @@ import {
   replaceDaemonService,
   requestDaemonHandoff,
   stopDaemonRunning
-} from "../chunk-R2AGKCXL.js";
+} from "../chunk-543KNJKC.js";
 import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
@@ -116,8 +116,15 @@ var STOP_PROTOCOL_VERSION = 2;
 var MAX_SPAWNS_PER_WINDOW = 5;
 var SPAWN_WINDOW_MS = 6e4;
 var VERSION_CHECK_INTERVAL_MS = 2e3;
+var CONTROL_PROBE_INTERVAL_MS = 6e4;
 var MAX_TRACKED_PROCESSES = 100;
 var MAX_COMPLETED_STOPS = 20;
+var controlProbeDue = (lastProbeAt, at = Date.now()) => lastProbeAt === 0 || at - lastProbeAt >= CONTROL_PROBE_INTERVAL_MS;
+var parseControlProbe = (value) => {
+  if (typeof value !== "object" || value === null) return null;
+  const id = value.id;
+  return typeof id === "string" && id.length > 0 && id.length <= 128 ? id : null;
+};
 var daemonSignals = (platform = process.platform) => platform === "win32" ? ["SIGINT", "SIGTERM"] : ["SIGINT", "SIGTERM", "SIGHUP"];
 var parseSpawnClaim = (value) => {
   if (typeof value !== "object" || value === null) return null;
@@ -294,6 +301,7 @@ var runSpawnDaemon = async () => {
   let stopped = false;
   let idleTicks = 0;
   let errorStreak = 0;
+  let lastControlProbeAt = 0;
   const spawnTimestamps = [];
   const launchedProcesses = /* @__PURE__ */ new Map();
   const completedStops = /* @__PURE__ */ new Map();
@@ -432,18 +440,41 @@ var runSpawnDaemon = async () => {
       });
     }
   };
+  const acknowledgeControlProbe = async (probeId) => {
+    const response = await fetch(`${baseUrl}${DRAIN_PATH}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify({ machineId, controlProbeAck: probeId }),
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    }).catch(() => null);
+    return response?.ok === true;
+  };
   const drain = async (signal) => {
+    const controlProbe = controlProbeDue(lastControlProbeAt);
+    if (controlProbe) lastControlProbeAt = Date.now();
     const res = await fetch(`${baseUrl}${DRAIN_PATH}`, {
       method: "POST",
       headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
-      body: JSON.stringify({ machineId, spawnProtocol: SPAWN_PROTOCOL_VERSION, stopProtocol: STOP_PROTOCOL_VERSION }),
+      body: JSON.stringify({
+        machineId,
+        spawnProtocol: SPAWN_PROTOCOL_VERSION,
+        stopProtocol: STOP_PROTOCOL_VERSION,
+        controlProbe
+      }),
       signal
     });
     if (!res.ok) throw new DrainError(res.status);
     const data = await res.json();
     const response = typeof data === "object" && data !== null ? data : {};
     await Promise.all(parseStopRequests(response.stops).map(runStop));
-    return parseSpawnClaim(response.spawn);
+    const controlProbeId = parseControlProbe(response.controlProbe);
+    return {
+      request: parseSpawnClaim(response.spawn),
+      controlProbeId,
+      // Released servers ignore the request field and omit the response field.
+      // Their successful authenticated drain remains the strongest proof they expose.
+      legacyControlProof: controlProbe && !Object.hasOwn(response, "controlProbe")
+    };
   };
   const acknowledge = async (body) => {
     if (!body) return;
@@ -507,18 +538,22 @@ var runSpawnDaemon = async () => {
     inflight = controller;
     const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
     try {
-      const req = await drain(controller.signal);
+      const drained = await drain(controller.signal);
       if (!daemonLease.isOwner()) {
         finish();
         return;
       }
       errorStreak = 0;
-      if (req) {
+      if (drained.request) {
         idleTicks = 0;
-        await launchClaim(req);
+        await launchClaim(drained.request);
       } else {
         idleTicks++;
       }
+      const controlProved = drained.legacyControlProof || drained.controlProbeId !== null && await acknowledgeControlProbe(drained.controlProbeId);
+      if (controlProved) {
+        daemonLease.recordSuccessfulControl();
+      }
     } catch (err) {
       if (isAuthFailure(err)) {
         const status = err.status;
@@ -582,7 +617,7 @@ var runSpawnDaemon = async () => {
   stderr(hasSpawnProvider(providerCapabilities) ? `[pushary] daemon online \u2014 this machine (${machineId}) can now be sent a new session from your phone. Ctrl-C to stop.
 ` : `[pushary] daemon online \u2014 no supported Claude, Codex, or Gemini CLI was found, so phone-start is unavailable. Ctrl-C to stop.
 `);
-  timer = setTimeout(tick, FAST_POLL_MS);
+  timer = setTimeout(tick, 0);
   const signals = daemonSignals();
   await new Promise((resolve) => {
     const onSignal = () => finish();

package/dist/bin/pushary-doctor.js

@@ -8,6 +8,9 @@ import {
   geminiWired,
   pusharyHookExecutable
 } from "../chunk-BAE45YLP.js";
+import {
+  readMachineReadiness
+} from "../chunk-U5TQCQ25.js";
 import {
   agentProbes,
   detectAgent,
@@ -31,10 +34,11 @@ import {
 import "../chunk-ATBKJNWS.js";
 import "../chunk-AIGDBRIJ.js";
 import {
+  daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   hasDaemonServiceDefinition,
   readDaemonStatus
-} from "../chunk-R2AGKCXL.js";
+} from "../chunk-543KNJKC.js";
 import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
@@ -558,7 +562,8 @@ var main = async () => {
     ...codexInPlay ? ["codex"] : [],
     ...geminiInPlay ? ["gemini"] : []
   ];
-  const controlSupported = hasSpawnProvider(detectProviderLiveCapabilities(configuredManagedProviders));
+  const controlCapabilities = detectProviderLiveCapabilities(configuredManagedProviders);
+  const controlSupported = hasSpawnProvider(controlCapabilities);
   const controlMode = readControlMode();
   const daemon = readDaemonStatus();
   const serviceDefined = hasDaemonServiceDefinition();
@@ -571,8 +576,8 @@ var main = async () => {
   });
   const controlRequired = controlPolicy === "enabled";
   const controlUnsupported = controlMode === "on" && controlPolicy !== "enabled";
-  const daemonOk = controlUnsupported ? false : controlPolicy === "disabled" ? daemon.kind === "absent" && !serviceDefined : controlPolicy === "enabled" ? daemon.kind === "running" : controlPolicy === "legacy" ? false : daemon.kind === "absent" && !serviceDefined;
-  const daemonFailure = daemonOk ? null : controlUnsupported ? "control is required but no usable provider/service-manager pair is available" : controlPolicy === "disabled" ? `control is disabled but ${serviceDefined ? "the service definition remains" : `local state is ${daemon.kind}`}` : controlPolicy === "legacy" ? "a legacy service exists without a usable provider/service-manager pair" : `local state is ${daemon.kind}`;
+  const daemonOk = controlUnsupported ? false : controlPolicy === "disabled" ? daemon.kind === "absent" && !serviceDefined : controlPolicy === "enabled" ? daemonHasRemoteProof(daemon) : controlPolicy === "legacy" ? false : daemon.kind === "absent" && !serviceDefined;
+  const daemonFailure = daemonOk ? null : controlUnsupported ? "control is required but no usable provider/service-manager pair is available" : controlPolicy === "enabled" && daemon.kind === "running" ? "the daemon has not completed an authenticated heartbeat and control poll" : controlPolicy === "disabled" ? `control is disabled but ${serviceDefined ? "the service definition remains" : `local state is ${daemon.kind}`}` : controlPolicy === "legacy" ? "a legacy service exists without a usable provider/service-manager pair" : `local state is ${daemon.kind}`;
   const daemonDetail = daemonFailure ? controlUnsupported ? `${daemonFailure}; re-run setup with \`--control off\`, or restore both requirements` : controlPolicy === "disabled" ? `${daemonFailure}; re-run setup with \`--control off\`` : controlPolicy === "legacy" ? `${daemonFailure}; run setup with \`--control off\`, or restore both requirements` : `${daemonFailure}; run \`pushary daemon install\` to install or repair the background service` : controlPolicy === "disabled" ? "disabled by setup" : controlPolicy === "preserve-absent" ? "legacy absence preserved" : !controlRequired && daemon.kind === "absent" ? "managed control is unsupported on this provider or operating-system session" : null;
   check(
     daemonOk,
@@ -584,9 +589,25 @@ var main = async () => {
       `daemon ${daemon.daemonVersion ?? "none"}`,
       `installed ${daemon.installedVersion}`,
       `machine ${daemon.machineId ?? "none"}`,
-      `heartbeat ${daemon.lastSuccessfulHeartbeatAt ?? "none yet"}`
+      `heartbeat ${daemon.lastSuccessfulHeartbeatAt ?? "none yet"}`,
+      `control ${daemon.lastSuccessfulControlAt ?? "none yet"}`
     ].filter((value) => value !== null).join(" \xB7 ")
   );
+  if (controlPolicy === "enabled" && apiKey && daemon.machineId) {
+    const serverProof = await readMachineReadiness(apiKey, ["spawn", ...controlCapabilities], {
+      machineId: daemon.machineId
+    });
+    if (serverProof.kind === "unsupported") {
+      console.log(`  ${warn} Remote-control server proof unavailable ${dim(`(${serverProof.detail})`)}`);
+    } else {
+      check(
+        serverProof.kind === "ready",
+        "Remote-control server proof",
+        serverProof.kind === "ready" ? "heartbeat \xB7 capabilities \xB7 control queue" : serverProof.detail,
+        serverProof.kind === "failed" ? "unreachable" : void 0
+      );
+    }
+  }
   const cursorPluginDir2 = cursorPluginDir();
   if (existsSync(cursorPluginDir2)) {
     checking("Cursor");

package/dist/bin/pushary-setup.js

@@ -7,6 +7,9 @@ import {
   codexWired,
   geminiWired
 } from "../chunk-BAE45YLP.js";
+import {
+  waitForMachineReadiness
+} from "../chunk-U5TQCQ25.js";
 import {
   runBrowserLogin
 } from "../chunk-Z3Z4VK5F.js";
@@ -50,14 +53,16 @@ import {
   guardedArgv
 } from "../chunk-AIGDBRIJ.js";
 import {
+  daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   disableDaemonService,
   ensureDaemonRunning,
   hasDaemonServiceDefinition,
   readDaemonStatus,
   replaceDaemonService,
-  stopDaemonService
-} from "../chunk-R2AGKCXL.js";
+  stopDaemonService,
+  waitForDaemonRemoteProof
+} from "../chunk-543KNJKC.js";
 import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
@@ -2125,6 +2130,14 @@ var main = async () => {
       return { kind: "unavailable", detail: formatError(err) };
     }
   })() : controlMode === "on" || controlPolicy === "legacy" ? { kind: "unavailable", detail: "Managed control is required but no usable provider/service-manager pair is available" } : null;
+  const localControlProof = daemon?.kind === "running" || daemon?.kind === "started" ? await waitForDaemonRemoteProof() : null;
+  const serverControlProof = localControlProof && daemonHasRemoteProof(localControlProof) ? await waitForMachineReadiness(trimmedKey, ["spawn", ...controlCapabilities]) : null;
+  const daemonReady = daemon === null ? null : localControlProof !== null && daemonHasRemoteProof(localControlProof) && (serverControlProof?.kind === "ready" || serverControlProof?.kind === "unsupported");
+  if (serverControlProof?.kind === "unsupported") {
+    console.log(`  ${yellow("!")} This server predates control-readiness reporting; local heartbeat and queue checks passed.`);
+  } else if (serverControlProof && serverControlProof.kind !== "ready") {
+    console.log(`  ${yellow("!")} Managed control could not be verified by the server: ${serverControlProof.detail}`);
+  }
   const closing = describeClosing({
     agentsOk,
     configuredNothing,
@@ -2132,7 +2145,7 @@ var main = async () => {
     failed,
     reachChecked,
     reachesYou,
-    daemonReady: controlLifecycleFailure ? false : daemon === null ? null : daemon.kind === "running" || daemon.kind === "started",
+    daemonReady: controlLifecycleFailure ? false : daemonReady,
     // null when the check did not run, so it changes nothing. Only an outright
     // `false` is allowed to hold back "Setup complete.".
     roundTripAnswered: roundTrip === null ? null : roundTrip.kind === "answered" ? true : roundTrip.kind === "unanswered" ? false : null

package/dist/bin/pushary-status.js

@@ -2,7 +2,7 @@
 import {
   describeLastSeen,
   listMachines
-} from "../chunk-ZL7HEF2T.js";
+} from "../chunk-U5TQCQ25.js";
 import "../chunk-DKDDLF5P.js";
 import "../chunk-GMI5QZLG.js";
 import {

package/dist/bin/pushary-upgrade.js

@@ -4,18 +4,23 @@ import {
 } from "../chunk-EA3E74P2.js";
 import "../chunk-J2JZJZKB.js";
 import "../chunk-BAE45YLP.js";
+import {
+  waitForMachineReadiness
+} from "../chunk-U5TQCQ25.js";
 import "../chunk-VA7VUNRD.js";
 import "../chunk-ATBKJNWS.js";
 import "../chunk-AIGDBRIJ.js";
 import {
+  daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   disableDaemonService,
   ensureDaemonRunning,
   hasDaemonServiceDefinition,
   readDaemonStatus,
   replaceDaemonService,
-  stopDaemonService
-} from "../chunk-R2AGKCXL.js";
+  stopDaemonService,
+  waitForDaemonRemoteProof
+} from "../chunk-543KNJKC.js";
 import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
@@ -129,9 +134,10 @@ var finishUpgrade = async () => {
   const controlMode = readControlMode();
   const daemonStatus = readDaemonStatus();
   const serviceWasPresent = daemonStatus.kind !== "absent" || hasDaemonServiceDefinition();
+  const controlCapabilities = detectProviderLiveCapabilities(configuredControlProviders);
   const controlPolicy = resolveControlPolicy({
     mode: controlMode,
-    providerAvailable: hasSpawnProvider(detectProviderLiveCapabilities(configuredControlProviders)),
+    providerAvailable: hasSpawnProvider(controlCapabilities),
     managerAvailable: daemonServiceManagerAvailable(),
     servicePresent: serviceWasPresent
   });
@@ -150,7 +156,9 @@ var finishUpgrade = async () => {
       const service = await replaceDaemonService();
       const daemon = service.kind === "ok" ? await ensureDaemonRunning({ spawnDaemon: () => {
       } }) : null;
-      daemonReady = service.kind === "ok" && (daemon?.kind === "running" || daemon?.kind === "started");
+      const localProof = daemon?.kind === "running" || daemon?.kind === "started" ? await waitForDaemonRemoteProof() : null;
+      const serverProof = localProof && daemonHasRemoteProof(localProof) ? await waitForMachineReadiness(apiKey, ["spawn", ...controlCapabilities]) : null;
+      daemonReady = service.kind === "ok" && localProof !== null && daemonHasRemoteProof(localProof) && (serverProof?.kind === "ready" || serverProof?.kind === "unsupported");
     }
   } else if (controlMode === "on" && controlPolicy === "unsupported") {
     daemonReady = false;

package/dist/{chunk-R2AGKCXL.js → chunk-543KNJKC.js}

@@ -31,6 +31,14 @@ import { createHash, randomUUID } from "crypto";
 import { homedir } from "os";
 import { execFileSync } from "child_process";
 var daemonNeedsHandoff = (status) => status.kind === "version-mismatch" || status.kind === "configuration-mismatch" || status.kind === "unresponsive" && status.processAlive === true;
+var DAEMON_REMOTE_PROOF_MAX_AGE_MS = 18e4;
+var DAEMON_REMOTE_PROOF_CLOCK_SKEW_MS = 3e4;
+var remoteProofIsFresh = (timestamp, now) => {
+  if (timestamp === null) return false;
+  const age = now - Date.parse(timestamp);
+  return Number.isFinite(age) && age >= -DAEMON_REMOTE_PROOF_CLOCK_SKEW_MS && age < DAEMON_REMOTE_PROOF_MAX_AGE_MS;
+};
+var daemonHasRemoteProof = (status, now = Date.now()) => status.kind === "running" && remoteProofIsFresh(status.lastSuccessfulHeartbeatAt, now) && remoteProofIsFresh(status.lastSuccessfulControlAt, now);
 var runDaemonServiceCommand = (command, args) => execFileSync(command, [...args], {
   encoding: "utf-8",
   stdio: ["ignore", "pipe", "ignore"],
@@ -241,7 +249,7 @@ WantedBy=default.target
           "-NoProfile",
           "-NonInteractive",
           "-Command",
-          "$task = @(Get-ScheduledTask -ErrorAction Stop) | Where-Object { $_.TaskName -eq 'Pushary Daemon' -and $_.TaskPath -eq '\\' } | Select-Object -First 1; if ($null -eq $task) { exit 3 }; if ($task.State -eq 'Disabled') { exit 4 }"
+          "$task = @(Get-ScheduledTask -ErrorAction Stop) | Where-Object { $_.TaskName -eq 'Pushary Daemon' -and $_.TaskPath -eq '\\' } | Select-Object -First 1; if ($null -eq $task) { exit 3 }; if ($null -eq $task.Settings -or $null -eq $task.Settings.Enabled) { exit 5 }; if (-not $task.Settings.Enabled) { exit 4 }"
         ],
         negativeExitCodes: [3, 4]
       },
@@ -313,16 +321,10 @@ var applyDaemonService = (action, definition, options = {}) => {
     const steps = action === "uninstall" ? [...definition.stop, ...definition.uninstall] : definition[action];
     runDaemonServiceSteps(steps, run);
     if (action === "uninstall") {
-      let registered = true;
-      try {
-        run(definition.registrationProbe.command, definition.registrationProbe.args);
-      } catch (err) {
-        if (!isExpectedProbeFailure(definition.registrationProbe, err)) {
-          throw new Error(`Could not verify native background service is absent: ${commandFailureOutput(err) || String(err)}`);
-        }
-        registered = false;
-      }
-      if (registered) throw new Error("Native background service remains registered");
+      const state = probeDaemonServiceState(definition, run);
+      if (state.kind !== "ok") throw new Error(`Could not verify native background service is absent: ${state.detail}`);
+      if (state.registered) throw new Error("Native background service remains registered");
+      if (state.running) throw new Error("Native background service remains active");
       safeUnlink(definition.definitionPath);
       const reload = definition.reloadAfterUninstall;
       if (reload) run(reload.command, reload.args);
@@ -412,7 +414,7 @@ var currentConfigurationId = () => {
 var parseDaemonState = (value) => {
   if (typeof value !== "object" || value === null) return null;
   const state = value;
-  if (!isString(state.instanceId) || !Number.isInteger(state.pid) || state.pid <= 0 || !isString(state.version) || !(state.configurationId === void 0 || state.configurationId === null || isString(state.configurationId)) || !isString(state.machineId) || !isTimestamp(state.startedAt) || !isTimestamp(state.updatedAt) || !(state.lastSuccessfulHeartbeatAt === null || isTimestamp(state.lastSuccessfulHeartbeatAt))) return null;
+  if (!isString(state.instanceId) || !Number.isInteger(state.pid) || state.pid <= 0 || !isString(state.version) || !(state.configurationId === void 0 || state.configurationId === null || isString(state.configurationId)) || !isString(state.machineId) || !isTimestamp(state.startedAt) || !isTimestamp(state.updatedAt) || !(state.lastSuccessfulHeartbeatAt === null || isTimestamp(state.lastSuccessfulHeartbeatAt)) || !(state.lastSuccessfulControlAt === void 0 || state.lastSuccessfulControlAt === null || isTimestamp(state.lastSuccessfulControlAt))) return null;
   return {
     instanceId: state.instanceId,
     pid: state.pid,
@@ -421,7 +423,8 @@ var parseDaemonState = (value) => {
     machineId: state.machineId,
     startedAt: state.startedAt,
     updatedAt: state.updatedAt,
-    lastSuccessfulHeartbeatAt: state.lastSuccessfulHeartbeatAt
+    lastSuccessfulHeartbeatAt: state.lastSuccessfulHeartbeatAt,
+    lastSuccessfulControlAt: state.lastSuccessfulControlAt ?? null
   };
 };
 var parseLockOwner = (value) => {
@@ -443,7 +446,8 @@ var readDaemonStatus = (options = {}) => {
       daemonVersion: null,
       startedAt: null,
       updatedAt: null,
-      lastSuccessfulHeartbeatAt: null
+      lastSuccessfulHeartbeatAt: null,
+      lastSuccessfulControlAt: null
     };
   }
   const value = state.kind === "ok" ? parseDaemonState(state.value) : null;
@@ -460,7 +464,8 @@ var readDaemonStatus = (options = {}) => {
       daemonVersion: value.version,
       startedAt: value.startedAt,
       updatedAt: value.updatedAt,
-      lastSuccessfulHeartbeatAt: value.lastSuccessfulHeartbeatAt
+      lastSuccessfulHeartbeatAt: value.lastSuccessfulHeartbeatAt,
+      lastSuccessfulControlAt: value.lastSuccessfulControlAt
     };
   }
   return {
@@ -472,7 +477,8 @@ var readDaemonStatus = (options = {}) => {
     daemonVersion: null,
     startedAt: null,
     updatedAt: null,
-    lastSuccessfulHeartbeatAt: null
+    lastSuccessfulHeartbeatAt: null,
+    lastSuccessfulControlAt: null
   };
 };
 var safeUnlink = (path) => {
@@ -540,7 +546,8 @@ var acquireDaemonLease = (options = {}) => {
     machineId,
     startedAt,
     updatedAt: startedAt,
-    lastSuccessfulHeartbeatAt: null
+    lastSuccessfulHeartbeatAt: null,
+    lastSuccessfulControlAt: null
   };
   try {
     writeJsonAtomic(statePath(dir), state, 384);
@@ -576,6 +583,14 @@ var acquireDaemonLease = (options = {}) => {
           lastSuccessfulHeartbeatAt: timestamp
         });
       },
+      recordSuccessfulControl: (at = now()) => {
+        const timestamp = new Date(at).toISOString();
+        updateState({
+          ...currentState,
+          updatedAt: timestamp,
+          lastSuccessfulControlAt: timestamp
+        });
+      },
       shouldYield: () => {
         if (!isOwner()) return true;
         const target = readJsonSafe(targetPath(dir));
@@ -645,7 +660,8 @@ var deactivateDaemonService = async (action, options) => {
   const platform = options.platform ?? process.platform;
   const supported = ["darwin", "linux", "win32"].includes(platform);
   const managerAvailable = supported && daemonServiceManagerAvailable(options);
-  const service = supported && !managerAvailable ? { kind: "failed", detail: "Native background-service manager is unavailable" } : managerAvailable ? manageDaemonService(action, options) : { kind: "ok" };
+  const absenceMustBeProven = options.requireAbsenceProof || hasDaemonServiceDefinition(options);
+  const service = supported && !managerAvailable && absenceMustBeProven ? { kind: "failed", detail: "Native background-service manager is unavailable" } : managerAvailable ? manageDaemonService(action, options) : { kind: "ok" };
   const stopped = await stopDaemonRunning(options);
   const failures = [
     service.kind === "ok" ? null : service.detail,
@@ -956,8 +972,21 @@ var ensureDaemonRunning = async (options = {}) => {
   }
   return { kind: "unavailable", status, detail: `daemon did not become healthy (${status.kind})` };
 };
+var waitForDaemonRemoteProof = async (options = {}) => {
+  const sleep = options.sleep ?? wait;
+  const pollIntervalMs = options.pollIntervalMs ?? 250;
+  const attempts = Math.max(1, Math.ceil((options.waitTimeoutMs ?? 5e3) / pollIntervalMs));
+  let status = readDaemonStatus(options);
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    status = readDaemonStatus(options);
+    if (daemonHasRemoteProof(status)) return status;
+    if (attempt + 1 < attempts) await sleep(pollIntervalMs);
+  }
+  return status;
+};
 
 export {
+  daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   DAEMON_LEASE_RENEW_INTERVAL_MS,
   parseDaemonAction,
@@ -970,5 +999,6 @@ export {
   stopDaemonService,
   disableDaemonService,
   replaceDaemonService,
-  ensureDaemonRunning
+  ensureDaemonRunning,
+  waitForDaemonRemoteProof
 };

package/dist/{chunk-ZL7HEF2T.js → chunk-U5TQCQ25.js}

@@ -46,9 +46,38 @@ var parseMachine = (value) => {
     repoKey: typeof raw.repoKey === "string" ? raw.repoKey : null,
     capabilities: Array.isArray(raw.capabilities) ? raw.capabilities.filter((c) => typeof c === "string") : [],
     lastSeenAt: typeof raw.lastSeenAt === "string" ? raw.lastSeenAt : "",
+    lastControlAt: typeof raw.lastControlAt === "string" ? raw.lastControlAt : raw.lastControlAt === null ? null : void 0,
     online: raw.online === true
   };
 };
+var machineReadiness = (machines, machineId, expectedCapabilities) => {
+  const machine = machines.find((item) => item.machineId === machineId);
+  if (!machine) return { kind: "not-ready", detail: "this machine has not heartbeated to the server" };
+  if (!machine.online) return { kind: "not-ready", detail: "the server reports this machine offline" };
+  if (machine.lastControlAt === void 0) {
+    return { kind: "unsupported", detail: "the server does not report control readiness yet" };
+  }
+  if (machine.lastControlAt === null || !Number.isFinite(Date.parse(machine.lastControlAt))) {
+    return { kind: "not-ready", detail: "the server has not observed this machine polling the control queue" };
+  }
+  const missing = expectedCapabilities.filter((capability) => !machine.capabilities.includes(capability));
+  return missing.length === 0 ? { kind: "ready", machine } : { kind: "not-ready", detail: `the server is missing capabilities: ${missing.join(", ")}` };
+};
+var readMachineReadiness = async (apiKey, expectedCapabilities, deps = {}) => {
+  const listed = await listMachines(apiKey, deps);
+  return listed.kind === "ok" ? machineReadiness(listed.machines, deps.machineId ?? getMachineId(), expectedCapabilities) : listed.kind === "unsupported" ? { kind: "unsupported", detail: "the server does not report machine readiness yet" } : listed;
+};
+var waitForMachineReadiness = async (apiKey, expectedCapabilities, deps = {}) => {
+  const attempts = deps.attempts ?? 21;
+  const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  let result = { kind: "not-ready", detail: "this machine has not heartbeated to the server" };
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    result = await readMachineReadiness(apiKey, expectedCapabilities, deps);
+    if (result.kind === "ready" || result.kind === "unsupported" || result.kind === "failed" && /^HTTP (?:401|403)$/.test(result.detail)) return result;
+    if (attempt + 1 < attempts) await sleep(250);
+  }
+  return result;
+};
 var listMachines = async (apiKey, deps = {}) => {
   const fetchImpl = deps.fetchImpl ?? fetch;
   const baseUrl = deps.baseUrl ?? getBaseUrl();
@@ -81,6 +110,8 @@ var describeLastSeen = (iso, now = Date.now()) => {
 export {
   HEARTBEAT_INTERVAL_MS,
   sendHeartbeat,
+  readMachineReadiness,
+  waitForMachineReadiness,
   listMachines,
   describeLastSeen
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.89.8",
+  "version": "0.89.9",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",