@pushary/agent-hooks 0.95.2 → 0.95.5

package/dist/bin/pushary-elicitation-hook.js

@@ -1,47 +1,43 @@
 #!/usr/bin/env node
 import {
   readHookInput
-} from "../chunk-VX3BWMC5.js";
+} from "../chunk-OEKFD5BC.js";
 import {
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
-import "../chunk-UW4LWAWY.js";
-import "../chunk-YKLCWWEI.js";
-import "../chunk-WM5XMCID.js";
-import "../chunk-3ZUTNTZA.js";
-import "../chunk-2XUPP4WM.js";
-import "../chunk-CH6DTGQR.js";
-import "../chunk-RVSEGFPD.js";
-import "../chunk-7LUFYRH4.js";
-import "../chunk-DSTLA2TC.js";
-import "../chunk-EZIEXHYM.js";
-import "../chunk-IPHOUBTU.js";
+import "../chunk-4RF52LSU.js";
+import "../chunk-BMANRGJQ.js";
+import "../chunk-VOSGZ6PH.js";
+import "../chunk-2ZTL3PGN.js";
+import "../chunk-CUEZMPLJ.js";
+import "../chunk-HBHEX3JQ.js";
+import "../chunk-XLOELLAS.js";
+import "../chunk-2D7BAOMY.js";
+import "../chunk-GOPIMNVC.js";
+import "../chunk-3AJIK5AO.js";
+import "../chunk-4PX4QK2Z.js";
 import "../chunk-EQRS3SGM.js";
-import "../chunk-QF4RI5CD.js";
+import "../chunk-OI3DJA7N.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-L4ZCFMWW.js";
 import {
-  DEFAULT_SESSION,
   askUser,
-  cancelQuestion,
-  pollForAnswer,
-  savePendingQuestion
-} from "../chunk-RER3FRTD.js";
-import "../chunk-V27AHID3.js";
+  isDecisionStopped,
+  waitForQuestion
+} from "../chunk-XS33QBJA.js";
+import "../chunk-IVQMNLSA.js";
 import {
   getMachineId
-} from "../chunk-IAEXPTXA.js";
-import "../chunk-WB2C7VPF.js";
+} from "../chunk-N4VNLISN.js";
+import "../chunk-OW6AZDY2.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-GUVCYYDK.js";
-import "../chunk-BC3VCZ3E.js";
+import "../chunk-S5CMLR35.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-X7YWD6IS.js";
-import "../chunk-4LL6LG5X.js";
+import "../chunk-KAVDAZ7A.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
@@ -55,7 +51,7 @@ import {
   planElicitationAsk,
   readElicitationFields,
   renderElicitationOutput
-} from "../chunk-6FAHPGCZ.js";
+} from "../chunk-WDKHZRAS.js";
 
 // bin/pushary-elicitation-hook.ts
 import { basename } from "path";
@@ -109,20 +105,23 @@ var main = async () => {
     try {
       created = await askUser(apiKey, { ...common, ...prompt });
     } catch {
+      process.stdout.write(renderElicitationOutput(input.hook_event_name ?? "Elicitation", "cancel") ?? "");
       return;
     }
-    if (created.suppressed || created.noDevices) {
-      await cancelQuestion(apiKey, created.correlationId).catch(() => {
-      });
+    if (isDecisionStopped(created)) {
+      process.stdout.write(renderElicitationOutput(input.hook_event_name ?? "Elicitation", "cancel") ?? "");
+      return;
+    }
+    const answer = await waitForQuestion(apiKey, created, deadline);
+    if (isDecisionStopped(answer)) {
+      process.stdout.write(renderElicitationOutput(input.hook_event_name ?? "Elicitation", "cancel") ?? "");
       return;
     }
-    const answer = await pollForAnswer(apiKey, created.correlationId, deadline);
     if (ask.kind === "questions") {
       const question = "questions" in prompt ? prompt.questions[0] : void 0;
       const parsed = question && answer.answered && answer.value ? parseAgentQuestionAnswers([question], answer.value) : null;
       if (parsed) Object.assign(questionAnswers, parsed);
       else {
-        savePendingQuestion(input.session_id || DEFAULT_SESSION, created.correlationId);
         return;
       }
     } else {

package/dist/bin/pushary-gemini-bridge.js

@@ -5,19 +5,19 @@ import {
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-4XXUHWIK.js";
+} from "../chunk-QHWXUNMN.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
   describeIdleWindow,
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-M7WWEFG6.js";
-import "../chunk-IPHOUBTU.js";
+} from "../chunk-QQGNFHIK.js";
+import "../chunk-4PX4QK2Z.js";
 import "../chunk-EQRS3SGM.js";
 import {
   transcriptsEnabled
-} from "../chunk-QF4RI5CD.js";
+} from "../chunk-OI3DJA7N.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
@@ -26,17 +26,15 @@ import {
 } from "../chunk-L4ZCFMWW.js";
 import {
   getMachineId
-} from "../chunk-IAEXPTXA.js";
-import "../chunk-WB2C7VPF.js";
-import "../chunk-GUVCYYDK.js";
-import "../chunk-BC3VCZ3E.js";
-import "../chunk-X7YWD6IS.js";
-import "../chunk-4LL6LG5X.js";
+} from "../chunk-N4VNLISN.js";
+import "../chunk-OW6AZDY2.js";
+import "../chunk-S5CMLR35.js";
+import "../chunk-KAVDAZ7A.js";
 import {
   getApiKey,
   getBaseUrl
 } from "../chunk-2UMNXADU.js";
-import "../chunk-6FAHPGCZ.js";
+import "../chunk-WDKHZRAS.js";
 
 // bin/pushary-gemini-bridge.ts
 import { existsSync } from "fs";

package/dist/bin/pushary-gemini-hook.js

@@ -2,30 +2,31 @@
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-EUAQ4YAN.js";
+} from "../chunk-UCS65VVR.js";
 import {
   readHookInput
-} from "../chunk-VX3BWMC5.js";
+} from "../chunk-OEKFD5BC.js";
 import {
   denyReasonFrom,
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
-import "../chunk-UW4LWAWY.js";
-import "../chunk-YKLCWWEI.js";
-import "../chunk-WM5XMCID.js";
-import "../chunk-3ZUTNTZA.js";
-import "../chunk-2XUPP4WM.js";
-import "../chunk-CH6DTGQR.js";
-import "../chunk-RVSEGFPD.js";
-import "../chunk-7LUFYRH4.js";
-import "../chunk-DSTLA2TC.js";
-import "../chunk-EZIEXHYM.js";
-import "../chunk-IPHOUBTU.js";
+import "../chunk-4RF52LSU.js";
+import "../chunk-BMANRGJQ.js";
+import "../chunk-VOSGZ6PH.js";
+import "../chunk-2ZTL3PGN.js";
+import "../chunk-CUEZMPLJ.js";
+import "../chunk-HBHEX3JQ.js";
+import "../chunk-XLOELLAS.js";
+import "../chunk-2D7BAOMY.js";
+import "../chunk-GOPIMNVC.js";
+import "../chunk-3AJIK5AO.js";
+import "../chunk-4PX4QK2Z.js";
 import "../chunk-EQRS3SGM.js";
-import "../chunk-QF4RI5CD.js";
+import "../chunk-OI3DJA7N.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-L4ZCFMWW.js";
 import {
+  DEFAULT_SESSION,
   fetchModeState,
   getPolicy,
   handlePostToolUse,
@@ -37,15 +38,15 @@ import {
   readLastUserPrompt,
   repoKeyFor,
   reportEvent
-} from "../chunk-DNVDKHQD.js";
+} from "../chunk-HCMM3BOW.js";
 import {
-  DEFAULT_SESSION,
+  DECISION_STOP_REASON,
   askUser,
-  cancelQuestion,
-  savePendingQuestion,
+  isDecisionStopped,
+  isLocalQuestionHandoff,
   sendNotification,
-  waitForAnswer
-} from "../chunk-RER3FRTD.js";
+  waitForQuestion
+} from "../chunk-XS33QBJA.js";
 import {
   UNNAMED_ACTION,
   deriveActionBody,
@@ -53,22 +54,20 @@ import {
   deriveToolTarget,
   describeToolCall,
   scopePathFor
-} from "../chunk-CKOLDI47.js";
-import "../chunk-V27AHID3.js";
+} from "../chunk-BDI2MXTT.js";
+import "../chunk-IVQMNLSA.js";
 import {
   getMachineId
-} from "../chunk-IAEXPTXA.js";
-import "../chunk-WB2C7VPF.js";
+} from "../chunk-N4VNLISN.js";
+import "../chunk-OW6AZDY2.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-GUVCYYDK.js";
-import "../chunk-BC3VCZ3E.js";
+import "../chunk-S5CMLR35.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-X7YWD6IS.js";
-import "../chunk-4LL6LG5X.js";
+import "../chunk-KAVDAZ7A.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
@@ -80,7 +79,7 @@ import {
   hookWaitClamped,
   hookWaitDeadline,
   resolveGate
-} from "../chunk-6FAHPGCZ.js";
+} from "../chunk-WDKHZRAS.js";
 
 // bin/pushary-gemini-hook.ts
 import { basename } from "path";
@@ -96,7 +95,10 @@ var GEMINI_TOOL_MAP = {
   read_file: "Read"
 };
 var firstString = (...values) => values.find((v) => typeof v === "string" && v.length > 0);
-var toGeminiPolicyLookup = (toolName, toolInput, cwd) => {
+var toGeminiPolicyLookup = (toolName, toolInput, cwd, mcpContext) => {
+  if (mcpContext?.server_name && mcpContext.tool_name) {
+    return { tool: `mcp__${mcpContext.server_name}__${mcpContext.tool_name}`, input: toolInput };
+  }
   const canonical = GEMINI_TOOL_MAP[toolName];
   if (!canonical) return { tool: toolName, input: toolInput };
   if (canonical === "Bash") {
@@ -130,24 +132,6 @@ var geminiTimeoutDecision = (timeoutAction, denyReason = "No response within tim
 
 // bin/pushary-gemini-hook.ts
 var START_MS = Date.now();
-var sleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
-var pollForAnswer = async (apiKey, correlationId, deadlineMs, pollInterval = 2e3) => {
-  while (Date.now() < deadlineMs) {
-    const remaining = Math.min(Math.max(deadlineMs - Date.now(), 1e3), 3e4);
-    let answer;
-    try {
-      answer = await waitForAnswer(apiKey, correlationId, remaining);
-    } catch {
-      if (Date.now() + pollInterval >= deadlineMs) break;
-      await sleep(pollInterval);
-      continue;
-    }
-    if (answer.answered) return answer;
-    if (Date.now() + pollInterval >= deadlineMs) break;
-    await sleep(pollInterval);
-  }
-  return { answered: false };
-};
 var agentNameFor = (input) => `${GEMINI_AGENT.label} - ${basename(input.cwd ?? process.cwd())}`;
 var pushQuestion = async (apiKey, input, lookup, waitSeconds, mode, pollInterval = 2e3) => {
   const projectName = basename(input.cwd ?? process.cwd());
@@ -166,21 +150,12 @@ var pushQuestion = async (apiKey, input, lookup, waitSeconds, mode, pollInterval
     blocker: deriveBlocker(mode),
     actionBody: deriveActionBody(input.tool_name ?? "", input.tool_input ?? {}),
     repoKey: repoKeyFor(input.cwd)
-  });
-  if (result.suppressed || result.noDevices) {
-    return {
-      answer: { answered: false },
-      correlationId: result.correlationId,
-      suppressed: !!result.suppressed,
-      noDevices: !!result.noDevices,
-      clampCut: false
-    };
-  }
+  }).catch(() => ({ correlationId: "", status: "unavailable" }));
   const now = Date.now();
   const deadline = hookWaitDeadline(START_MS, waitSeconds, "gemini", now);
   const clampCut = hookWaitClamped(START_MS, waitSeconds, "gemini", now);
-  const answer = await pollForAnswer(apiKey, result.correlationId, deadline, pollInterval);
-  return { answer, correlationId: result.correlationId, suppressed: false, noDevices: false, clampCut };
+  const answer = await waitForQuestion(apiKey, result, deadline, pollInterval);
+  return { answer, localHandoff: !answer.answered && isLocalQuestionHandoff(result), clampCut };
 };
 var notifyApprovalNeeded = async (apiKey, input, lookup) => {
   try {
@@ -199,19 +174,15 @@ var handlePushOnly = async (apiKey, input, lookup, timeoutSeconds, timeoutAction
   try {
     pushed = await pushQuestion(apiKey, input, lookup, effectiveWaitSeconds(timeoutAction, timeoutSeconds, "gemini"), "push_only");
   } catch {
-    return geminiTimeoutDecision(timeoutAction, "Push notification failed, denying per policy");
-  }
-  const { answer, correlationId, suppressed, clampCut } = pushed;
-  if (suppressed) {
-    await cancelQuestion(apiKey, correlationId).catch(() => {
-    });
-    return geminiPass();
+    return geminiDeny("Pushary could not create a verifiable approval. Retry the action.");
   }
+  const { answer, localHandoff, clampCut } = pushed;
+  if (isDecisionStopped(answer)) return geminiDeny(DECISION_STOP_REASON);
+  if (localHandoff) return geminiPass();
   if (answer.answered) {
     if (isDeferAnswer(answer.value)) return geminiPass();
     return answer.value === "yes" ? geminiAllow() : geminiDeny(denyReasonFrom(answer.value, answer.note));
   }
-  savePendingQuestion(input.session_id || DEFAULT_SESSION, correlationId);
   if (clampCut) return geminiPass();
   return geminiTimeoutDecision(timeoutAction);
 };
@@ -222,18 +193,13 @@ var handlePushFirst = async (apiKey, input, lookup, pushFirstSeconds) => {
   } catch {
     return geminiPass();
   }
-  const { answer, correlationId, suppressed, noDevices } = pushed;
-  if (suppressed) {
-    await cancelQuestion(apiKey, correlationId).catch(() => {
-    });
-    return geminiPass();
-  }
-  if (noDevices) return geminiPass();
+  const { answer, localHandoff } = pushed;
+  if (isDecisionStopped(answer)) return geminiDeny(DECISION_STOP_REASON);
+  if (localHandoff) return geminiPass();
   if (answer.answered) {
     if (isDeferAnswer(answer.value)) return geminiPass();
     return answer.value === "yes" ? geminiAllow() : geminiDeny(denyReasonFrom(answer.value, answer.note));
   }
-  savePendingQuestion(input.session_id || DEFAULT_SESSION, correlationId);
   return geminiPass();
 };
 var decideBeforeTool = async (input) => {
@@ -242,7 +208,7 @@ var decideBeforeTool = async (input) => {
     apiKey = getApiKey();
   } catch {
     try {
-      const lookup = toGeminiPolicyLookup(input.tool_name ?? "", input.tool_input ?? {});
+      const lookup = toGeminiPolicyLookup(input.tool_name ?? "", input.tool_input ?? {}, input.cwd, input.mcp_context);
       if (isGatingMoment(lookup.tool, lookup.input)) {
         recordKeylessMoment({
           ts: Date.now(),
@@ -258,7 +224,7 @@ var decideBeforeTool = async (input) => {
   try {
     const modeState = await fetchModeState(apiKey, input.session_id);
     const policyRequest = policyRequestFor("gemini_cli");
-    const lookup = toGeminiPolicyLookup(input.tool_name ?? "", input.tool_input ?? {}, input.cwd);
+    const lookup = toGeminiPolicyLookup(input.tool_name ?? "", input.tool_input ?? {}, input.cwd, input.mcp_context);
     const config = await getPolicy(apiKey, modeState.policyVersion, policyRequest.agent, policyRequest.repoAware, input.session_id);
     const scopePath = modeState.scope ? scopePathFor(lookup.tool, lookup.input, input.cwd) : void 0;
     const verdict = resolveGate({
@@ -330,7 +296,7 @@ var main = async () => {
         emit(toGeminiWire(await decideBeforeTool(input)));
         break;
       case "AfterTool": {
-        const lookup = toGeminiPolicyLookup(input.tool_name ?? "", input.tool_input ?? {});
+        const lookup = toGeminiPolicyLookup(input.tool_name ?? "", input.tool_input ?? {}, input.cwd, input.mcp_context);
         emitContext("AfterTool", await handlePostToolUse({
           tool_name: lookup.tool,
           tool_input: lookup.input,

package/dist/bin/pushary-hook.js

@@ -1,50 +1,48 @@
 #!/usr/bin/env node
 import {
   handlePreToolUse
-} from "../chunk-UOTSWS5N.js";
-import "../chunk-A4R6BZCK.js";
-import "../chunk-EUAQ4YAN.js";
+} from "../chunk-67YNQ3QA.js";
+import "../chunk-D62EONG3.js";
+import "../chunk-UCS65VVR.js";
 import {
   readHookInput
-} from "../chunk-VX3BWMC5.js";
+} from "../chunk-OEKFD5BC.js";
 import "../chunk-YHG74UFF.js";
-import "../chunk-UW4LWAWY.js";
-import "../chunk-YKLCWWEI.js";
-import "../chunk-WM5XMCID.js";
-import "../chunk-3ZUTNTZA.js";
-import "../chunk-2XUPP4WM.js";
-import "../chunk-CH6DTGQR.js";
-import "../chunk-RVSEGFPD.js";
-import "../chunk-7LUFYRH4.js";
-import "../chunk-DSTLA2TC.js";
-import "../chunk-EZIEXHYM.js";
-import "../chunk-IPHOUBTU.js";
+import "../chunk-4RF52LSU.js";
+import "../chunk-BMANRGJQ.js";
+import "../chunk-VOSGZ6PH.js";
+import "../chunk-2ZTL3PGN.js";
+import "../chunk-CUEZMPLJ.js";
+import "../chunk-HBHEX3JQ.js";
+import "../chunk-XLOELLAS.js";
+import "../chunk-2D7BAOMY.js";
+import "../chunk-GOPIMNVC.js";
+import "../chunk-3AJIK5AO.js";
+import "../chunk-4PX4QK2Z.js";
 import "../chunk-EQRS3SGM.js";
-import "../chunk-QF4RI5CD.js";
+import "../chunk-OI3DJA7N.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-L4ZCFMWW.js";
-import "../chunk-DNVDKHQD.js";
-import "../chunk-RER3FRTD.js";
-import "../chunk-CKOLDI47.js";
-import "../chunk-V27AHID3.js";
-import "../chunk-IAEXPTXA.js";
-import "../chunk-WB2C7VPF.js";
+import "../chunk-HCMM3BOW.js";
+import "../chunk-XS33QBJA.js";
+import "../chunk-BDI2MXTT.js";
+import "../chunk-IVQMNLSA.js";
+import "../chunk-N4VNLISN.js";
+import "../chunk-OW6AZDY2.js";
 import {
   exitOnHelpFlag
-} from "../chunk-MOY5X6HJ.js";
-import "../chunk-ZDAT5KMU.js";
+} from "../chunk-DLLAWCQB.js";
+import "../chunk-D6PRC3YQ.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-GUVCYYDK.js";
-import "../chunk-BC3VCZ3E.js";
+import "../chunk-S5CMLR35.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-X7YWD6IS.js";
-import "../chunk-4LL6LG5X.js";
+import "../chunk-KAVDAZ7A.js";
 import "../chunk-2UMNXADU.js";
-import "../chunk-6FAHPGCZ.js";
+import "../chunk-WDKHZRAS.js";
 
 // bin/pushary-hook.ts
 exitOnHelpFlag("hook");

package/dist/bin/pushary-login.js

@@ -5,23 +5,23 @@ import {
 import "../chunk-PUZZELE6.js";
 import {
   recoverDaemonAfterLogin
-} from "../chunk-RVSEGFPD.js";
+} from "../chunk-XLOELLAS.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-L4ZCFMWW.js";
-import "../chunk-IAEXPTXA.js";
-import "../chunk-WB2C7VPF.js";
+import "../chunk-N4VNLISN.js";
+import "../chunk-OW6AZDY2.js";
 import "../chunk-3EGEA4KH.js";
 import {
   checkApiKey,
   describeKeyCheck
-} from "../chunk-JDFB3YKG.js";
+} from "../chunk-I6GZX3FT.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
 import {
   exitOnHelpFlag
-} from "../chunk-MOY5X6HJ.js";
-import "../chunk-ZDAT5KMU.js";
+} from "../chunk-DLLAWCQB.js";
+import "../chunk-D6PRC3YQ.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
@@ -29,10 +29,11 @@ import {
   getPackageVersion
 } from "../chunk-DINDL2CF.js";
 import {
+  readConfigFileKey,
+  readControlMode,
   readKeySource,
   writeKey
-} from "../chunk-GUVCYYDK.js";
-import "../chunk-BC3VCZ3E.js";
+} from "../chunk-S5CMLR35.js";
 import "../chunk-SAF6HGAA.js";
 import {
   UsageError
@@ -40,12 +41,11 @@ import {
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-X7YWD6IS.js";
-import "../chunk-4LL6LG5X.js";
+import "../chunk-KAVDAZ7A.js";
 import "../chunk-2UMNXADU.js";
 import {
   isValidApiKey
-} from "../chunk-6FAHPGCZ.js";
+} from "../chunk-WDKHZRAS.js";
 
 // bin/pushary-login.ts
 exitOnHelpFlag("login");
@@ -87,21 +87,47 @@ var readStdin = async () => {
   for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
   return Buffer.concat(chunks).toString("utf8").trim();
 };
-var store = (apiKey, siteSlug, keyName) => {
+var recoverControl = () => {
+  const daemon = recoverDaemonAfterLogin();
+  if (daemon?.cleared) {
+    say(readControlMode() === "off" ? `  ${check} ${dim("Account verified. Phone-start remains off.")}` : daemon.restarted ? `  ${check} ${dim("Background daemon restarted with the verified key.")}` : `  ${yellow("!")} ${dim(`Background daemon may start again${daemon.detail ? ` (${daemon.detail})` : ""}`)}`);
+  }
+  return daemon;
+};
+var store = async (apiKey, siteSlug, keyName) => {
+  const verdict = await checkApiKey(apiKey);
+  const report = describeKeyCheck(verdict);
+  if (verdict.kind !== "ok") {
+    say(`  ${yellow("!")} ${report.message}`);
+    for (const line of report.next) say(`  ${dim(line)}`);
+    if (report.fatal) {
+      emit({ ok: false, reason: verdict.kind, keyCheck: verdict.kind, exitCode: report.exitCode });
+      return report.exitCode;
+    }
+  }
+  if (verdict.kind === "ok") siteSlug = verdict.identity.siteSlug;
   const result = writeKey(apiKey);
   say("");
-  say(`  ${check} ${bold("Signed in.")}${siteSlug ? ` ${dim(`Site ${siteSlug}`)}` : ""}`);
+  say(verdict.kind === "ok" ? `  ${check} ${bold("Signed in.")}${siteSlug ? ` ${dim(`Site ${siteSlug}`)}` : ""}` : `  ${yellow("!")} ${verdict.kind === "locked" ? "Key saved, approvals inactive." : "Key saved, account readiness unverified."}`);
   say(`  ${dim(`Key saved to ${result.configPath}`)}`);
   if (result.rc.kind === "written" || result.rc.kind === "updated") {
     say(`  ${dim(`Shell export ${result.rc.kind} in ${result.rc.path}`)}`);
   } else if (result.rc.kind === "declined") {
     say(`  ${yellow("!")} ${dim(`Left ${result.rc.path} alone: line ${result.rc.declinedLine} already sets PUSHARY_API_KEY.`)}`);
   }
-  const daemon = recoverDaemonAfterLogin();
-  if (daemon.cleared) {
-    say(daemon.restarted ? `  ${check} ${dim("Background daemon restarted with the new key.")}` : `  ${yellow("!")} ${dim(`Background daemon may start again${daemon.detail ? ` (${daemon.detail})` : ""}`)}`);
-  }
-  emit({ ok: true, siteSlug, keyName, configPath: result.configPath, rc: result.rc.kind, daemon });
+  const daemon = verdict.kind === "ok" ? recoverControl() : null;
+  emit({
+    ok: verdict.kind === "ok",
+    siteSlug,
+    keyName,
+    configPath: result.configPath,
+    rc: result.rc.kind,
+    daemon,
+    keyCheck: verdict.kind,
+    ...verdict.kind !== "ok" ? { reason: verdict.kind } : {},
+    exitCode: report.exitCode
+  });
+  return report.exitCode;
 };
 var loginWithToken = async () => {
   const token = await readStdin();
@@ -115,16 +141,7 @@ var loginWithToken = async () => {
     emit({ ok: false, reason: "malformed" });
     process.exit(EXIT.USAGE);
   }
-  const verdict = await checkApiKey(token);
-  if (verdict.kind !== "ok") {
-    const report = describeKeyCheck(verdict);
-    say(`  ${yellow("!")} ${report.message}`);
-    for (const line of report.next) say(`  ${dim(line)}`);
-    emit({ ok: false, reason: verdict.kind });
-    if (verdict.kind !== "unreachable") process.exit(report.exitCode);
-  }
-  store(token, verdict.kind === "ok" ? verdict.identity.siteSlug : "", "pasted key");
-  process.exit(EXIT.OK);
+  process.exit(await store(token, "", "pasted key"));
 };
 var main = async () => {
   if (options.withToken) await loginWithToken();
@@ -136,9 +153,19 @@ var main = async () => {
         say("");
         say(`  ${check} Already signed in ${dim(`(${verdict.identity.siteSlug})`)}`);
         say(`  ${dim("Run")} ${cyan("pushary login --force")} ${dim("to replace this key.")}`);
-        emit({ ok: true, reused: true, siteSlug: verdict.identity.siteSlug });
+        const daemon = existing.key === readConfigFileKey() ? recoverControl() : null;
+        if (daemon === null) say("  The saved service key differs from this shell. Run pushary setup with the intended key before starting managed control.");
+        emit({ ok: true, reused: true, siteSlug: verdict.identity.siteSlug, keyCheck: "ok", daemon, exitCode: EXIT.OK });
         process.exit(EXIT.OK);
       }
+      if (verdict.kind === "locked" || verdict.kind === "unreachable") {
+        const report = describeKeyCheck(verdict);
+        say(`  ${yellow("!")} ${report.message}`);
+        for (const line of report.next) say(`  ${dim(line)}`);
+        say("  Existing key kept. Re-run pushary login to recheck readiness without replacing it.");
+        emit({ ok: false, reused: true, reason: verdict.kind, keyCheck: verdict.kind, exitCode: report.exitCode });
+        process.exit(report.exitCode);
+      }
     }
   }
   const outcome = await runBrowserLogin(
@@ -146,8 +173,7 @@ var main = async () => {
     { cliVersion: getPackageVersion(), noBrowser: options.noBrowser }
   );
   if (outcome.kind === "ok") {
-    store(outcome.apiKey, outcome.siteSlug, outcome.keyName);
-    process.exit(EXIT.OK);
+    process.exit(await store(outcome.apiKey, outcome.siteSlug, outcome.keyName));
   }
   if (outcome.kind === "unavailable") {
     say(`  ${yellow("!")} Couldn't start a login ${dim(`(${outcome.detail})`)}`);