@pushary/agent-hooks 0.90.1 → 0.90.2

package/dist/bin/pushary-logout.js

@@ -4,7 +4,7 @@ import {
   codexConfigToml,
   cursorUserMcp,
   geminiSettings
-} from "../chunk-KUZWXPUS.js";
+} from "../chunk-BVNYTQ5I.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";

package/dist/bin/pushary-mode.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   exitOnFailedResponse
-} from "../chunk-DYP6SMOR.js";
-import "../chunk-AJYV3VGU.js";
+} from "../chunk-Z6RFZKY4.js";
+import "../chunk-BXTJVM7O.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";

package/dist/bin/pushary-notification-hook.js

@@ -4,11 +4,11 @@ import {
 } from "../chunk-6CUUA7HO.js";
 import {
   handleNotification
-} from "../chunk-4LOPSGLP.js";
+} from "../chunk-TVZQMPB7.js";
 import "../chunk-F7OURW3C.js";
 import "../chunk-L4E2BIJ2.js";
-import "../chunk-54ELC7D7.js";
-import "../chunk-KUZWXPUS.js";
+import "../chunk-AWHCZOZO.js";
+import "../chunk-BVNYTQ5I.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-opencode-hook.js

@@ -19,7 +19,7 @@ import {
   policyRequestFor,
   readLastPrompt,
   repoKeyFor
-} from "../chunk-4LOPSGLP.js";
+} from "../chunk-TVZQMPB7.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -40,8 +40,8 @@ import {
 } from "../chunk-L4E2BIJ2.js";
 import {
   getMachineId
-} from "../chunk-54ELC7D7.js";
-import "../chunk-KUZWXPUS.js";
+} from "../chunk-AWHCZOZO.js";
+import "../chunk-BVNYTQ5I.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-permission-denied-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handlePermissionDenied
-} from "../chunk-B6H2KAQC.js";
+} from "../chunk-4IEW4ZRF.js";
 import "../chunk-2LAHXHBR.js";
 import "../chunk-I463AEG3.js";
 import "../chunk-VHWCVD42.js";
@@ -9,11 +9,11 @@ import {
   readHookInput
 } from "../chunk-6CUUA7HO.js";
 import "../chunk-YHG74UFF.js";
-import "../chunk-4LOPSGLP.js";
+import "../chunk-TVZQMPB7.js";
 import "../chunk-F7OURW3C.js";
 import "../chunk-L4E2BIJ2.js";
-import "../chunk-54ELC7D7.js";
-import "../chunk-KUZWXPUS.js";
+import "../chunk-AWHCZOZO.js";
+import "../chunk-BVNYTQ5I.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-permission-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handlePermissionRequest
-} from "../chunk-B6H2KAQC.js";
+} from "../chunk-4IEW4ZRF.js";
 import "../chunk-2LAHXHBR.js";
 import "../chunk-I463AEG3.js";
 import "../chunk-VHWCVD42.js";
@@ -9,11 +9,11 @@ import {
   readHookInput
 } from "../chunk-6CUUA7HO.js";
 import "../chunk-YHG74UFF.js";
-import "../chunk-4LOPSGLP.js";
+import "../chunk-TVZQMPB7.js";
 import "../chunk-F7OURW3C.js";
 import "../chunk-L4E2BIJ2.js";
-import "../chunk-54ELC7D7.js";
-import "../chunk-KUZWXPUS.js";
+import "../chunk-AWHCZOZO.js";
+import "../chunk-BVNYTQ5I.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-post-hook.js

@@ -6,11 +6,11 @@ import {
   handleCompaction,
   handlePostToolUse,
   isCompactionEvent
-} from "../chunk-4LOPSGLP.js";
+} from "../chunk-TVZQMPB7.js";
 import "../chunk-F7OURW3C.js";
 import "../chunk-L4E2BIJ2.js";
-import "../chunk-54ELC7D7.js";
-import "../chunk-KUZWXPUS.js";
+import "../chunk-AWHCZOZO.js";
+import "../chunk-BVNYTQ5I.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-prompt-hook.js

@@ -4,11 +4,11 @@ import {
 } from "../chunk-6CUUA7HO.js";
 import {
   handleUserPrompt
-} from "../chunk-4LOPSGLP.js";
+} from "../chunk-TVZQMPB7.js";
 import "../chunk-F7OURW3C.js";
 import "../chunk-L4E2BIJ2.js";
-import "../chunk-54ELC7D7.js";
-import "../chunk-KUZWXPUS.js";
+import "../chunk-AWHCZOZO.js";
+import "../chunk-BVNYTQ5I.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-session-end-hook.js

@@ -4,11 +4,11 @@ import {
 } from "../chunk-6CUUA7HO.js";
 import {
   handleSessionEnd
-} from "../chunk-4LOPSGLP.js";
+} from "../chunk-TVZQMPB7.js";
 import "../chunk-F7OURW3C.js";
 import "../chunk-L4E2BIJ2.js";
-import "../chunk-54ELC7D7.js";
-import "../chunk-KUZWXPUS.js";
+import "../chunk-AWHCZOZO.js";
+import "../chunk-BVNYTQ5I.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-session-start-hook.js

@@ -4,11 +4,11 @@ import {
 } from "../chunk-6CUUA7HO.js";
 import {
   handleSessionStart
-} from "../chunk-4LOPSGLP.js";
+} from "../chunk-TVZQMPB7.js";
 import "../chunk-F7OURW3C.js";
 import "../chunk-L4E2BIJ2.js";
-import "../chunk-54ELC7D7.js";
-import "../chunk-KUZWXPUS.js";
+import "../chunk-AWHCZOZO.js";
+import "../chunk-BVNYTQ5I.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-setup.js

@@ -4,40 +4,52 @@ import {
 } from "../chunk-Z3Z4VK5F.js";
 import {
   detectClaudeVersion
-} from "../chunk-H2QZRQR2.js";
+} from "../chunk-YTDH3XCE.js";
 import {
   describeVersionManagerPin,
-  isBridgeLocator,
   versionManagerOf
-} from "../chunk-S6LYP7QA.js";
+} from "../chunk-GU3EJCVV.js";
 import {
   waitForMachineReadiness
-} from "../chunk-7TPQEWUZ.js";
+} from "../chunk-YTD6PJM7.js";
 import {
   HERMES_CONFIG_SCRIPT,
+  KEEP_HINT,
+  captureHookTakeover,
+  captureMcpServer,
+  describeAppOwnership,
+  describeHookOwnership,
   describeSetupSideEffects,
+  effectiveControlMode,
+  effectiveVerify,
+  hookOwnerOf,
   isHermesConfigReceipt,
+  mcpBearerKey,
+  parseSetupOptions,
+  planHooks,
   resolveHermesPython,
   runHermesPythonScript
-} from "../chunk-AZPIQG4G.js";
+} from "../chunk-ATUUQFDH.js";
 import {
   describeDetection,
   detectAllAgents,
   isDetected,
+  liveBridgeProbe,
   pluginLocationSnippet,
   registerPluginLocation,
   renderAgentInstructions,
   renderProjectAgentInstructions,
+  resolveBridgeStub,
   shortenHome,
   vscodeSettingsTargets,
   writeInstructionBlock
-} from "../chunk-FQL5E6NG.js";
+} from "../chunk-CRVJCKIN.js";
 import {
   claudeWired,
   codexWired,
   geminiWired,
   pusharyHookExecutable
-} from "../chunk-DZDI62LY.js";
+} from "../chunk-WGKC6PU2.js";
 import {
   OPENCODE_HOOK_BINARY,
   addOpenCodeMcpServer,
@@ -61,8 +73,9 @@ import {
   isClaudeMcpSnapshot,
   parseVersion,
   updateClaudeMcpSnapshot
-} from "../chunk-GL3FFM7A.js";
+} from "../chunk-ELHCIEMM.js";
 import "../chunk-2LAHXHBR.js";
+import "../chunk-DSTLA2TC.js";
 import {
   guardBinary,
   guardCursorGate,
@@ -80,7 +93,7 @@ import {
   replaceDaemonService,
   stopDaemonService,
   waitForDaemonRemoteProof
-} from "../chunk-F2ICEWZL.js";
+} from "../chunk-Z4XCN2HH.js";
 import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
@@ -98,14 +111,15 @@ import {
 } from "../chunk-L4ZCFMWW.js";
 import {
   reportEvent
-} from "../chunk-4LOPSGLP.js";
+} from "../chunk-TVZQMPB7.js";
 import "../chunk-F7OURW3C.js";
 import "../chunk-L4E2BIJ2.js";
-import "../chunk-54ELC7D7.js";
+import "../chunk-AWHCZOZO.js";
 import {
   addCodexHookTrust,
   addCodexHooks,
   addCodexMcpServer,
+  captureCodexHookTrust,
   claudeJson,
   claudeMcpReceipt,
   claudeSettings,
@@ -118,12 +132,17 @@ import {
   codexTrustSchemeAgrees,
   cursorPluginDir,
   cursorUserHooks,
+  cursorUserMcp,
   geminiMd,
   geminiSettings,
   hermesConfigReceipt,
+  hookTakeoverReceipt,
   pusharyConfigFile,
-  vscodePluginDir
-} from "../chunk-KUZWXPUS.js";
+  pusharyDir,
+  readCodexMcpAuth,
+  vscodePluginDir,
+  vscodePluginMcp
+} from "../chunk-BVNYTQ5I.js";
 import {
   confirmAppConnection,
   connectDevice,
@@ -136,17 +155,16 @@ import {
 import "../chunk-3EGEA4KH.js";
 import {
   checkApiKey,
-  describeKeyCheck
-} from "../chunk-AJYV3VGU.js";
+  describeKeyCheck,
+  samePusharyAccount
+} from "../chunk-BXTJVM7O.js";
 import {
   setHumanStream
 } from "../chunk-QCGNGEGE.js";
 import {
   useColor
 } from "../chunk-5RUIFDTP.js";
-import {
-  parseFlags
-} from "../chunk-GMXKITVA.js";
+import "../chunk-GMXKITVA.js";
 import {
   renderCommandHelp
 } from "../chunk-43GMYSS4.js";
@@ -185,6 +203,7 @@ import {
 import "../chunk-2UMNXADU.js";
 import {
   CURSOR_GATE_EVENTS,
+  HOOK_LOCATOR_BINARY,
   isValidApiKey
 } from "../chunk-VNMKIJZB.js";
 
@@ -534,154 +553,6 @@ var reportSetupAbortWith = async (deps, reason, exitCode, keyCheck = "unknown")
 });
 var reportSetupAbort = (reason, exitCode, keyCheck) => reportSetupAbortWith(defaultDeps, reason, exitCode, keyCheck);
 
-// src/setup/options.ts
-var AGENT_CHOICES = ["claude_code", "codex", "gemini_cli", "hermes", "cursor", "vscode", "opencode", "custom"];
-var CONNECT_MODES = ["app", "browser", "web", "none"];
-var CONNECT_ALIASES = { auto: "app", pwa: "web" };
-var parseConnectMode = (raw) => {
-  const value = raw.trim().toLowerCase();
-  if (Object.hasOwn(CONNECT_ALIASES, value)) return CONNECT_ALIASES[value];
-  if (CONNECT_MODES.includes(value)) return value;
-  throw new UsageError(`--connect must be one of: ${CONNECT_MODES.join(", ")} (got ${raw})`);
-};
-var VERIFY_MODES = ["roundtrip", "push", "none"];
-var parseVerifyMode = (raw) => {
-  const value = raw.trim().toLowerCase();
-  if (VERIFY_MODES.includes(value)) return value;
-  throw new UsageError(`--verify must be one of: ${VERIFY_MODES.join(", ")} (got ${raw})`);
-};
-var CONTROL_MODES = ["auto", "on", "off"];
-var parseControlMode = (raw) => {
-  const value = raw.trim().toLowerCase();
-  if (CONTROL_MODES.includes(value)) return value;
-  throw new UsageError(`--control must be one of: ${CONTROL_MODES.join(", ")} (got ${raw})`);
-};
-var effectiveVerify = (options, context) => {
-  if (options.verifyExplicit) return options.verify;
-  if (options.verify === "roundtrip") return "roundtrip";
-  return context.paired ? "roundtrip" : options.verify;
-};
-var SETUP_FLAGS = {
-  bools: ["key-stdin", "skip-phone", "yes", "y", "json", "dry-run", "take-over-hooks", "help", "h"],
-  values: ["key", "connect", "agents", "verify", "control", "transcripts"]
-};
-var effectiveControlMode = (options, stored, configPresent) => options.controlExplicit ? options.control : stored ?? (configPresent ? null : options.control);
-var isAgentChoice = (value) => AGENT_CHOICES.includes(value);
-var parseAgentSelection = (raw, yes) => {
-  if (raw === void 0) {
-    return yes ? { kind: "auto" } : { kind: "ask" };
-  }
-  const value = raw.trim().toLowerCase();
-  if (value === "auto") return { kind: "auto" };
-  if (value === "none") return { kind: "none" };
-  const parts = value.split(",").map((part) => part.trim()).filter((part) => part !== "");
-  if (parts.length === 0) throw new UsageError("--agents needs a value");
-  const unknown = parts.filter((part) => !isAgentChoice(part));
-  if (unknown.length > 0) {
-    throw new UsageError(
-      `--agents does not know: ${unknown.join(", ")}. Use auto, none, or any of: ${AGENT_CHOICES.join(", ")}`
-    );
-  }
-  return { kind: "explicit", agents: [...new Set(parts)] };
-};
-var parseSetupOptions = (input2) => {
-  const flags = parseFlags(input2.argv, SETUP_FLAGS);
-  const stray = [
-    ...flags.command !== void 0 && flags.command !== "setup" ? [flags.command] : [],
-    ...flags.rest
-  ];
-  if (stray.length > 0) {
-    throw new UsageError(
-      `setup takes no positional arguments (got ${stray.join(", ")}). Did you mean --agents ${stray[0]}?`
-    );
-  }
-  const yes = flags.bools.has("yes") || flags.bools.has("y");
-  const help = flags.bools.has("help") || flags.bools.has("h");
-  const agentsFlag = flags.values.get("agents");
-  const agents = parseAgentSelection(agentsFlag, yes);
-  const connectRaw = flags.values.get("connect");
-  const connectMode = connectRaw === void 0 ? "app" : parseConnectMode(connectRaw);
-  const verifyRaw = flags.values.get("verify");
-  const controlRaw = flags.values.get("control");
-  const transcriptsRaw = flags.values.get("transcripts")?.trim().toLowerCase();
-  if (transcriptsRaw !== void 0 && transcriptsRaw !== "on" && transcriptsRaw !== "off") {
-    throw new UsageError(`--transcripts must be one of: on, off (got ${transcriptsRaw})`);
-  }
-  const nonInteractive = yes || agentsFlag !== void 0 || flags.bools.has("json") || !input2.stdinIsTty;
-  const verify = verifyRaw !== void 0 ? parseVerifyMode(verifyRaw) : nonInteractive ? "push" : "roundtrip";
-  const key = flags.values.get("key")?.trim() || null;
-  const keyStdin = flags.bools.has("key-stdin");
-  if (key && keyStdin) {
-    throw new UsageError("Pass either --key or --key-stdin, not both");
-  }
-  if (key && !isValidApiKey(key)) {
-    throw new UsageError("--key is not a valid API key. Expected the pk_xxx.xxx shape from pushary.com/dashboard/agent/settings");
-  }
-  return {
-    connectMode,
-    connectExplicit: connectRaw !== void 0,
-    // `--connect none` and `--skip-phone` are the same instruction, so they
-    // resolve to the same field rather than being checked separately at the two
-    // call sites that would inevitably drift apart.
-    skipPhone: flags.bools.has("skip-phone") || connectMode === "none",
-    // Anything that means "there is nobody to answer a prompt". A non-TTY stdin
-    // is included because that is the case that used to hang: it is better to
-    // take the defaults and say so than to wait forever for a keypress.
-    //
-    // --json counts. Under it stdout carries exactly one object and every human
-    // line is redirected to stderr, so a prompt has nowhere to render: the
-    // question goes to stderr while the run blocks on a keypress the caller
-    // cannot see it is waiting for, and whatever is reading stdout waits forever
-    // for an object that never arrives. Asking for machine-readable output is
-    // itself a statement that no human is watching.
-    nonInteractive,
-    json: flags.bools.has("json"),
-    dryRun: flags.bools.has("dry-run"),
-    help,
-    agents,
-    key,
-    keyStdin,
-    verify,
-    verifyExplicit: verifyRaw !== void 0,
-    control: controlRaw === void 0 ? "auto" : parseControlMode(controlRaw),
-    controlExplicit: controlRaw !== void 0,
-    transcripts: transcriptsRaw === void 0 ? null : transcriptsRaw === "on",
-    takeOverHooks: flags.bools.has("take-over-hooks")
-  };
-};
-
-// src/setup/hook-ownership.ts
-var commandsIn = (value) => {
-  if (Array.isArray(value)) return value.flatMap(commandsIn);
-  if (!value || typeof value !== "object") return [];
-  return Object.entries(value).flatMap(([key, item]) => key === "command" && typeof item === "string" ? [item] : commandsIn(item));
-};
-var hookOwnerOf = (document) => {
-  const hooks = document && typeof document === "object" ? document.hooks : void 0;
-  const executables = commandsIn(hooks).map(pusharyHookExecutable).filter((executable) => executable !== null);
-  if (executables.some(isBridgeLocator)) return "app";
-  if (executables.length > 0) return "cli";
-  return "none";
-};
-var planHooks = (context) => {
-  if (context.owner !== "app") return "install";
-  if (context.takeOverHooks) return "install";
-  return context.nonInteractive ? "keep" : "ask";
-};
-var describeAppOwnership = (agentName) => `The Pushary Mac app owns ${agentName}'s hooks.`;
-var takeoverQuestion = (agentName) => `Replace them with the CLI's? The app stops answering for ${agentName} and the notch loses its terminal jump there.`;
-var KEEP_HINT = "Left as they are. Pass --take-over-hooks to have the CLI own them instead.";
-var OWNER_LABELS = {
-  app: "the Pushary Mac app",
-  cli: "the CLI"
-};
-var describeHookOwnership = (entries, names) => {
-  const owned = entries.filter((entry) => entry.owner !== "none");
-  if (owned.length === 0) return null;
-  const parts = owned.map((entry) => `${names[entry.agent]} by ${OWNER_LABELS[entry.owner]}${entry.kept ? " (kept)" : ""}`);
-  return `Hooks: ${parts.join(", ")}.`;
-};
-
 // bin/pushary-setup.ts
 var CLAUDE_SETTINGS = claudeSettings();
 var CLAUDE_JSON = claudeJson();
@@ -690,6 +561,7 @@ var HERMES_CONFIG_RECEIPT = hermesConfigReceipt();
 var CURSOR_PLUGIN_DIR = cursorPluginDir();
 var CURSOR_USER_HOOKS = cursorUserHooks();
 var VSCODE_PLUGIN_DIR = vscodePluginDir();
+var VSCODE_PLUGIN_MCP = vscodePluginMcp();
 var CLAUDE_SKILL_DIR = claudeSkillDir();
 var CODEX_HOME = codexHome();
 var CODEX_SKILL_DIR = codexSkillDir();
@@ -1410,7 +1282,7 @@ var setupVsCode = async (apiKey) => {
     }
   });
   await spinner("Linking your API key", async () => {
-    const mcpPath = join3(VSCODE_PLUGIN_DIR, ".mcp.json");
+    const mcpPath = VSCODE_PLUGIN_MCP;
     const mcp = readAgentJson(mcpPath);
     const servers = mcp.mcpServers ?? {};
     if (servers.pushary) {
@@ -1585,16 +1457,36 @@ var HOOK_FILES = {
   cursor: () => CURSOR_USER_HOOKS,
   vscode: () => join3(VSCODE_PLUGIN_DIR, "hooks", "hooks.json")
 };
-var hookOwnerFor = (agent) => {
+var hookOwnerFor = (agent, appAvailable = true) => {
   const file = HOOK_FILES[agent]?.();
   if (!file) return "none";
   const document = readJsonSafe(file);
-  return hookOwnerOf(document.kind === "ok" ? document.value : null);
-};
-var confirmTakeover = async (agent) => {
-  console.log();
-  console.log(`  ${yellow("!")} ${describeAppOwnership(AGENT_NAMES[agent])}`);
-  return confirm({ message: takeoverQuestion(AGENT_NAMES[agent]), default: false });
+  return hookOwnerOf(document.kind === "ok" ? document.value : null, appAvailable);
+};
+var appMcpKeyFor = (agent) => {
+  if (agent === "codex") {
+    const auth = readCodexMcpAuth(readAgentToml(codexConfigToml()));
+    return auth?.method === "embedded" ? auth.key : null;
+  }
+  const file = agent === "claude_code" ? CLAUDE_JSON : agent === "gemini_cli" ? GEMINI_SETTINGS : agent === "cursor" ? cursorUserMcp() : agent === "vscode" ? VSCODE_PLUGIN_MCP : null;
+  return file ? mcpBearerKey(readAgentJson(file), "mcpServers", "headers") : null;
+};
+var captureTakeoverReceipt = (agent) => {
+  const hookFile = HOOK_FILES[agent]?.();
+  if (!hookFile) return;
+  const document = readAgentJson(hookFile);
+  const captured = captureHookTakeover(agent, document);
+  if (!captured) throw new Error(`Cannot safely take over ${AGENT_NAMES[agent]}'s hooks: no Mac app wiring was found.`);
+  const codexConfig = agent === "codex" ? readAgentToml(codexConfigToml()) : null;
+  const mcp = agent === "claude_code" ? [readAgentJson(CLAUDE_JSON), "mcpServers"] : agent === "codex" ? [codexConfig, "mcp_servers"] : agent === "gemini_cli" ? [document, "mcpServers"] : agent === "vscode" ? [readAgentJson(VSCODE_PLUGIN_MCP), "mcpServers"] : null;
+  const receipt = {
+    ...captured,
+    ...codexConfig ? {
+      codexTrust: captureCodexHookTrust(codexConfig, hookFile, codexHookPositions(document))
+    } : {},
+    ...mcp ? { mcpServer: captureMcpServer(mcp[0], mcp[1]) } : {}
+  };
+  writeJsonAtomic(hookTakeoverReceipt(agent), receipt, 384);
 };
 var agentIsWired = (agent) => {
   const readJson2 = (path) => {
@@ -1629,7 +1521,7 @@ var agentIsWired = (agent) => {
     case "cursor":
       return existsSync(join3(CURSOR_PLUGIN_DIR, "mcp.json"));
     case "vscode":
-      return existsSync(join3(VSCODE_PLUGIN_DIR, ".mcp.json"));
+      return existsSync(VSCODE_PLUGIN_MCP);
     case "opencode":
       return openCodeWired();
     default:
@@ -1820,7 +1712,7 @@ var AGENT_TARGETS = {
   gemini_cli: [GEMINI_SETTINGS, GEMINI_MD],
   hermes: ["the Hermes virtualenv (pip install pushary-hermes)"],
   cursor: [join3(CURSOR_PLUGIN_DIR, "mcp.json"), CURSOR_USER_HOOKS],
-  vscode: [join3(VSCODE_PLUGIN_DIR, ".mcp.json"), ...vscodeSettingsTargets(existsSync)],
+  vscode: [VSCODE_PLUGIN_MCP, ...vscodeSettingsTargets(existsSync)],
   opencode: [
     openCodePluginFile(),
     join3(openCodePluginDir(), "package.json"),
@@ -2044,6 +1936,29 @@ var main = async () => {
   }
   const rc = await saveApiKey(trimmedKey, controlMode, transcriptSync);
   const context = { rc };
+  const appBridgeAvailable = resolveBridgeStub(
+    join3(pusharyDir(), "bin", HOOK_LOCATOR_BINARY),
+    liveBridgeProbe()
+  ).kind === "bundle";
+  const accountChecks = /* @__PURE__ */ new Map();
+  if (keyCheck) accountChecks.set(trimmedKey, Promise.resolve(keyCheck));
+  const accountCheckFor = (key) => {
+    const existing = accountChecks.get(key);
+    if (existing) return existing;
+    const pending = checkApiKey(key);
+    accountChecks.set(key, pending);
+    return pending;
+  };
+  const appAccountMatches = async (agent) => {
+    const appKey = appMcpKeyFor(agent);
+    if (!appKey) return false;
+    if (appKey === trimmedKey) return true;
+    const [cliAccount, appAccount] = await Promise.all([
+      accountCheckFor(trimmedKey),
+      accountCheckFor(appKey)
+    ]);
+    return samePusharyAccount(cliAccount, appAccount);
+  };
   if (envKey && envKey !== trimmedKey) {
     noteManual(
       `This shell still exports the previous key (${keyPrefix(envKey)}), and it wins over the one just saved. Open a new terminal before starting an agent here, or re-export PUSHARY_API_KEY.`
@@ -2062,22 +1977,32 @@ var main = async () => {
     for (const agent of agents) {
       markStep(`configure:${agent}`);
       try {
-        const ownerBefore = hookOwnerFor(agent);
+        const ownerBefore = hookOwnerFor(agent, appBridgeAvailable);
         const plan = planHooks({ owner: ownerBefore, takeOverHooks: options.takeOverHooks, nonInteractive: options.nonInteractive });
-        const keepAppWiring = plan === "keep" || plan === "ask" && !await confirmTakeover(agent);
+        const keepAppWiring = plan === "keep";
         if (keepAppWiring) {
+          if (!await appAccountMatches(agent)) {
+            hookOwners.push({ agent, owner: "app", kept: true });
+            failed.push(agent.replace("_", " "));
+            console.log(`
+  ${yellow("!")} ${AGENT_NAMES[agent]}: Mac app hooks kept, but their Pushary account could not be matched to this setup.`);
+            console.log(`  ${dim("Sign the Mac app into the same account and repair this agent, then re-run setup.")}`);
+            console.log(`  ${dim("Or pass --take-over-hooks if you intentionally want the CLI to own these hooks.")}`);
+            continue;
+          }
           console.log(`
   ${check} ${AGENT_NAMES[agent]}: ${describeAppOwnership(AGENT_NAMES[agent])} ${dim(KEEP_HINT)}`);
           hookOwners.push({ agent, owner: "app", kept: true });
           completed.push(agent);
           continue;
         }
+        if (ownerBefore === "app") captureTakeoverReceipt(agent);
         const outcome = await AGENT_SETUP[agent](trimmedKey, context);
         if (outcome === "skipped") {
           skipped.push(agent);
         } else if (agentIsWired(agent)) {
           completed.push(agent);
-          hookOwners.push({ agent, owner: hookOwnerFor(agent), kept: false });
+          hookOwners.push({ agent, owner: hookOwnerFor(agent, appBridgeAvailable), kept: false });
         } else {
           failed.push(agent.replace("_", " "));
           console.log(`  ${yellow("!")} ${agent.replace("_", " ")} reported success but its config is not there.`);

package/dist/bin/pushary-status.js

@@ -2,9 +2,9 @@
 import {
   describeLastSeen,
   listMachines
-} from "../chunk-7TPQEWUZ.js";
-import "../chunk-54ELC7D7.js";
-import "../chunk-KUZWXPUS.js";
+} from "../chunk-YTD6PJM7.js";
+import "../chunk-AWHCZOZO.js";
+import "../chunk-BVNYTQ5I.js";
 import {
   describeReach,
   fetchChannels,
@@ -14,7 +14,7 @@ import "../chunk-3EGEA4KH.js";
 import {
   checkApiKey,
   describeKeyCheck
-} from "../chunk-AJYV3VGU.js";
+} from "../chunk-BXTJVM7O.js";
 import "../chunk-QCGNGEGE.js";
 import {
   createIo

package/dist/bin/pushary-stop-hook.js

@@ -6,11 +6,11 @@ import {
   handleStop,
   handleSubagentStop,
   isSubagentStop
-} from "../chunk-4LOPSGLP.js";
+} from "../chunk-TVZQMPB7.js";
 import "../chunk-F7OURW3C.js";
 import "../chunk-L4E2BIJ2.js";
-import "../chunk-54ELC7D7.js";
-import "../chunk-KUZWXPUS.js";
+import "../chunk-AWHCZOZO.js";
+import "../chunk-BVNYTQ5I.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-stopfailure-hook.js

@@ -4,11 +4,11 @@ import {
 } from "../chunk-6CUUA7HO.js";
 import {
   handleStopFailure
-} from "../chunk-4LOPSGLP.js";
+} from "../chunk-TVZQMPB7.js";
 import "../chunk-F7OURW3C.js";
 import "../chunk-L4E2BIJ2.js";
-import "../chunk-54ELC7D7.js";
-import "../chunk-KUZWXPUS.js";
+import "../chunk-AWHCZOZO.js";
+import "../chunk-BVNYTQ5I.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";