@pushary/agent-hooks 1.5.0 → 1.5.1

package/dist/bin/pushary-setup.js

@@ -1,4 +1,8 @@
 #!/usr/bin/env node
+import {
+  codexTrustOutcome,
+  describeCodexTrustConfirmation
+} from "../chunk-BY2CRWBO.js";
 import {
   runBrowserLogin
 } from "../chunk-YQMFGWBD.js";
@@ -9,15 +13,18 @@ import {
 import "../chunk-PUZZELE6.js";
 import {
   detectClaudeVersion
-} from "../chunk-3NBODGQS.js";
+} from "../chunk-HUAOMX4U.js";
 import {
   describeVersionManagerPin,
   versionManagerOf
 } from "../chunk-GU3EJCVV.js";
+import {
+  ensureCodexTrustsPusharyHooks
+} from "../chunk-6EEANS74.js";
 import {
   readManagedControlEvidence,
   waitForMachineReadiness
-} from "../chunk-F57RGL7K.js";
+} from "../chunk-IV3RHICU.js";
 import {
   HERMES_CONFIG_SCRIPT,
   HERMES_PIP_PACKAGE,
@@ -27,7 +34,7 @@ import {
   isHermesConfigReceipt,
   resolveHermesPython,
   runHermesPythonScript
-} from "../chunk-H5LHTC5X.js";
+} from "../chunk-YAWXKL2X.js";
 import {
   describeDetection,
   detectAllAgents,
@@ -39,7 +46,7 @@ import {
   shortenHome,
   vscodeSettingsTargets,
   writeInstructionBlock
-} from "../chunk-DLJN5XEU.js";
+} from "../chunk-KHXVTWYS.js";
 import {
   OPENCODE_HOOK_BINARY,
   addOpenCodeMcpServer,
@@ -61,7 +68,7 @@ import {
   compatibleMcpFile,
   compatiblePermissionRuleFile,
   hasCompatibleHooks
-} from "../chunk-JF736N4C.js";
+} from "../chunk-R5KY3PBN.js";
 import {
   addClaudeMcpServer,
   addPusharyHooks,
@@ -69,16 +76,16 @@ import {
   captureClaudeMcpServer,
   isClaudeMcpSnapshot,
   updateClaudeMcpSnapshot
-} from "../chunk-J4J45VPZ.js";
+} from "../chunk-4ERLRNOK.js";
 import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "../chunk-KEOLNHR3.js";
+} from "../chunk-5ZZG76S2.js";
 import {
   describeAutoUpdateAnnouncement,
   takeAutoUpdateAnnouncement
-} from "../chunk-OSSDK5RS.js";
+} from "../chunk-MU3WU2FO.js";
 import {
   KEEP_HINT,
   captureHookTakeover,
@@ -88,7 +95,7 @@ import {
   hookOwnerOf,
   mcpBearerKey,
   planHooks
-} from "../chunk-PCGZXWGQ.js";
+} from "../chunk-WNJSGZY7.js";
 import {
   AGENT_CHOICES,
   effectiveControlMode,
@@ -104,7 +111,7 @@ import {
   codexWired,
   geminiWired,
   pusharyHookExecutable
-} from "../chunk-NTQSICPJ.js";
+} from "../chunk-Z4VGIBJ7.js";
 import {
   clearDaemonNeedsLogin,
   daemonHasRemoteProof,
@@ -117,26 +124,25 @@ import {
   replaceDaemonService,
   stopDaemonService,
   waitForDaemonRemoteProof
-} from "../chunk-7XT76LWT.js";
+} from "../chunk-X7FESZTD.js";
 import {
   GEMINI_HOOK_BINARY,
   addGeminiHooks,
   addGeminiMcpServer,
   compareVersion,
-  formatVersion,
   parseVersion
-} from "../chunk-EADZPVYW.js";
-import "../chunk-SOCEY746.js";
+} from "../chunk-2AUIEZYS.js";
+import "../chunk-5UQ5ATIE.js";
 import {
   transcriptPreferenceForSetup
 } from "../chunk-2QT3GCU4.js";
 import "../chunk-XHKBHWLX.js";
 import {
   reportEvent
-} from "../chunk-FDHMNT24.js";
+} from "../chunk-D573TLP6.js";
 import "../chunk-UYDTFCHW.js";
 import "../chunk-PYCQXCI5.js";
-import "../chunk-UQHUUZ5H.js";
+import "../chunk-WOLPADR6.js";
 import {
   addCodexHookTrust,
   addCodexHooks,
@@ -152,7 +158,6 @@ import {
   codexHome,
   codexHookPositions,
   codexSkillDir2 as codexSkillDir,
-  codexTrustSchemeAgrees,
   codexVacatedIndexes,
   cursorPluginDir,
   cursorUserHooks,
@@ -176,7 +181,7 @@ import {
   resolveGlobalBinary,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-DYHXOXUF.js";
+} from "../chunk-6IU45EHE.js";
 import {
   BROWSER_CONNECT_COMMAND,
   confirmAppConnection,
@@ -446,15 +451,6 @@ var readCodexVersion = (probe) => {
   return bundled ? parseCodexVersion(bundled) : null;
 };
 
-// src/setup/codex-trust.ts
-var CODEX_TRUST_VERIFIED_MAX = [0, 155, 1];
-var planCodexTrust = (installed, hashingProvenOnThisMachine) => hashingProvenOnThisMachine || compareCodexVersion(installed, CODEX_TRUST_VERIFIED_MAX) <= 0 ? { kind: "pretrust" } : { kind: "manual", installed, verifiedMax: CODEX_TRUST_VERIFIED_MAX };
-var codexTrustOutcome = (pretrusted) => pretrusted ? "pretrusted" : "manual";
-var describeUnverifiedCodexTrust = (plan, surface) => {
-  const where = surface === "chatgpt" ? "Open ChatGPT, then Settings and Hooks," : "Open Codex";
-  return `Codex ${formatVersion(plan.installed)} is newer than the last version Pushary verified (${formatVersion(plan.verifiedMax)}), so its hooks are not trusted yet. ${where} and choose Trust for the Pushary hooks.`;
-};
-
 // src/setup/codex-install.ts
 var NATIVE_BINARY_MIN_BYTES = 20 * 1024 * 1024;
 var packageRootFor = (probe, binPath) => {
@@ -1036,6 +1032,13 @@ var addCodexNotifyEntry = (codexConfig) => {
     writeFileSync(codexConfig, stringifyTOML(config), "utf-8");
   }
 };
+var confirmCodexTrust = async () => {
+  let confirmation = { kind: "unavailable", reason: "setup could not ask Codex" };
+  await spinner("Checking the Pushary hook's trust with Codex", async () => {
+    confirmation = await ensureCodexTrustsPusharyHooks();
+  }, { optional: true });
+  return confirmation;
+};
 var setupCodex = async (apiKey) => {
   console.log(`
   ${bold("Setting up Codex")}
@@ -1071,12 +1074,7 @@ var setupCodex = async (apiKey) => {
   });
   const codexVersion = detectCodexVersion();
   const hooksSupported = codexSupportsHooks(codexVersion);
-  const trustPlan = hooksSupported && codexVersion !== null ? planCodexTrust(
-    codexVersion,
-    codexTrustSchemeAgrees(readAgentJson(CODEX_HOOKS_JSON), readAgentToml(codexConfig), CODEX_HOOKS_JSON)
-  ) : null;
-  const trustAuto = trustPlan?.kind === "pretrust";
-  let trusted = false;
+  let portedTrustWritten = false;
   if (hooksSupported) {
     const hookCommand = guardBinary(resolveGlobalBinary("pushary-codex-hook") ?? "pushary-codex-hook");
     let hookPositions = {};
@@ -1088,24 +1086,21 @@ var setupCodex = async (apiKey) => {
       writeJson(CODEX_HOOKS_JSON, hooksConfig);
       hookPositions = codexHookPositions(hooksConfig);
     });
-    if (trustAuto) {
-      await spinner("Trusting the Pushary hook (skips the /hooks step)", async () => {
-        let raw = "";
-        try {
-          raw = readFileSync(codexConfig, "utf-8");
-        } catch {
-        }
-        const config = raw ? parseTOML(raw) : {};
-        dropVacatedCodexHookTrust(config, CODEX_HOOKS_JSON, vacated);
-        addCodexHookTrust(config, CODEX_HOOKS_JSON, hookCommand, hookPositions);
-        writeFileSync(codexConfig, stringifyTOML(config), "utf-8");
-        trusted = true;
-      }, { optional: true });
-    }
+    await spinner("Writing trust entries for the Pushary hook", async () => {
+      let raw = "";
+      try {
+        raw = readFileSync(codexConfig, "utf-8");
+      } catch {
+      }
+      const config = raw ? parseTOML(raw) : {};
+      dropVacatedCodexHookTrust(config, CODEX_HOOKS_JSON, vacated);
+      addCodexHookTrust(config, CODEX_HOOKS_JSON, hookCommand, hookPositions);
+      writeFileSync(codexConfig, stringifyTOML(config), "utf-8");
+      portedTrustWritten = true;
+    }, { optional: true });
     await spinner("Removing legacy notify handler", async () => {
       removeCodexNotifyEntry(codexConfig);
     });
-    recordCodexTrust(codexTrustOutcome(trusted));
   } else {
     if (codexVersion !== null) {
       console.log(`  ${yellow("!")} This Codex version predates native hooks (needs ${CODEX_HOOKS_MIN_VERSION.join(".")}+).`);
@@ -1125,6 +1120,9 @@ var setupCodex = async (apiKey) => {
   await spinner("Teaching Codex to ask via push (~/.codex/AGENTS.md)", async () => {
     writeInstructionBlock(CODEX_AGENTS_MD, renderAgentInstructions("Codex"));
   });
+  const confirmation = hooksSupported ? await confirmCodexTrust() : null;
+  const trustOutcome = confirmation === null ? null : codexTrustOutcome(confirmation, portedTrustWritten);
+  if (trustOutcome !== null) recordCodexTrust(trustOutcome);
   console.log();
   console.log(`  ${dim("What this configured:")}`);
   console.log(`  ${dim("\u2022")} MCP server: Codex can send notifications and ask questions`);
@@ -1133,11 +1131,14 @@ var setupCodex = async (apiKey) => {
   console.log(`  ${dim("\u2022")} Auto-allowed tools: no permission prompts for Pushary MCP calls`);
   if (hooksSupported) {
     console.log(`  ${dim("\u2022")} Native hooks: phone approvals, policy enforcement, kill switch, session tracking`);
-    if (trusted) {
+    if (trustOutcome === "verified") {
+      console.log(`  ${dim("\u2022")} Hook trusted, and Codex confirmed it: no ${cyan("/hooks")} step`);
+    } else if (trustOutcome === "unverified" && confirmation) {
       console.log(`  ${dim("\u2022")} Hook pre-trusted: no ${cyan("/hooks")} step. If approvals never arrive, ${cyan("/hooks")} re-trusts it`);
+      console.log(`    ${dim(describeCodexTrustConfirmation(confirmation))}`);
     } else {
-      if (trustPlan?.kind === "manual") {
-        console.log(`  ${yellow("!")} ${describeUnverifiedCodexTrust(trustPlan, bundled ? "chatgpt" : "codex")}`);
+      if (confirmation) {
+        console.log(`  ${yellow("!")} ${describeCodexTrustConfirmation(confirmation)}`);
       }
       console.log();
       console.log(`  ${bold("One step left, and it happens inside Codex")}`);

package/dist/bin/pushary-status.js

@@ -2,12 +2,12 @@
 import {
   describeLastSeen,
   listMachines
-} from "../chunk-F57RGL7K.js";
-import "../chunk-KEOLNHR3.js";
-import "../chunk-7XT76LWT.js";
+} from "../chunk-IV3RHICU.js";
+import "../chunk-5ZZG76S2.js";
+import "../chunk-X7FESZTD.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-UQHUUZ5H.js";
-import "../chunk-DYHXOXUF.js";
+import "../chunk-WOLPADR6.js";
+import "../chunk-6IU45EHE.js";
 import {
   describeReach,
   fetchChannels,

package/dist/bin/pushary-stop-hook.js

@@ -2,20 +2,20 @@
 import {
   activeHookSource,
   activeIdentity
-} from "../chunk-JF736N4C.js";
-import "../chunk-J4J45VPZ.js";
+} from "../chunk-R5KY3PBN.js";
+import "../chunk-4ERLRNOK.js";
 import {
   readHookInput
-} from "../chunk-ORLJNJEO.js";
-import "../chunk-NFKVRMTM.js";
+} from "../chunk-6QFEQIPM.js";
+import "../chunk-TZGCUNOX.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-PCGZXWGQ.js";
+import "../chunk-WNJSGZY7.js";
 import "../chunk-TFKBFQCE.js";
 import "../chunk-K3QVDAZW.js";
-import "../chunk-NTQSICPJ.js";
-import "../chunk-7XT76LWT.js";
-import "../chunk-EADZPVYW.js";
-import "../chunk-SOCEY746.js";
+import "../chunk-Z4VGIBJ7.js";
+import "../chunk-X7FESZTD.js";
+import "../chunk-2AUIEZYS.js";
+import "../chunk-5UQ5ATIE.js";
 import "../chunk-TIWURSLS.js";
 import "../chunk-66H2QQAK.js";
 import "../chunk-2QT3GCU4.js";
@@ -24,11 +24,11 @@ import {
   handleStop,
   handleSubagentStop,
   isSubagentStop
-} from "../chunk-FDHMNT24.js";
+} from "../chunk-D573TLP6.js";
 import "../chunk-UYDTFCHW.js";
 import "../chunk-PYCQXCI5.js";
-import "../chunk-UQHUUZ5H.js";
-import "../chunk-DYHXOXUF.js";
+import "../chunk-WOLPADR6.js";
+import "../chunk-6IU45EHE.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-USQDVBEV.js";
 import "../chunk-HETOKNIL.js";

package/dist/bin/pushary-stopfailure-hook.js

@@ -2,31 +2,31 @@
 import {
   activeHookSource,
   activeIdentity
-} from "../chunk-JF736N4C.js";
-import "../chunk-J4J45VPZ.js";
+} from "../chunk-R5KY3PBN.js";
+import "../chunk-4ERLRNOK.js";
 import {
   readHookInput
-} from "../chunk-ORLJNJEO.js";
-import "../chunk-NFKVRMTM.js";
+} from "../chunk-6QFEQIPM.js";
+import "../chunk-TZGCUNOX.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-PCGZXWGQ.js";
+import "../chunk-WNJSGZY7.js";
 import "../chunk-TFKBFQCE.js";
 import "../chunk-K3QVDAZW.js";
-import "../chunk-NTQSICPJ.js";
-import "../chunk-7XT76LWT.js";
-import "../chunk-EADZPVYW.js";
-import "../chunk-SOCEY746.js";
+import "../chunk-Z4VGIBJ7.js";
+import "../chunk-X7FESZTD.js";
+import "../chunk-2AUIEZYS.js";
+import "../chunk-5UQ5ATIE.js";
 import "../chunk-TIWURSLS.js";
 import "../chunk-66H2QQAK.js";
 import "../chunk-2QT3GCU4.js";
 import "../chunk-XHKBHWLX.js";
 import {
   handleStopFailure
-} from "../chunk-FDHMNT24.js";
+} from "../chunk-D573TLP6.js";
 import "../chunk-UYDTFCHW.js";
 import "../chunk-PYCQXCI5.js";
-import "../chunk-UQHUUZ5H.js";
-import "../chunk-DYHXOXUF.js";
+import "../chunk-WOLPADR6.js";
+import "../chunk-6IU45EHE.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-USQDVBEV.js";
 import "../chunk-HETOKNIL.js";

package/dist/bin/pushary-transcript-register.js

@@ -1,22 +1,22 @@
 #!/usr/bin/env node
 import {
   registerTranscript
-} from "../chunk-NFKVRMTM.js";
+} from "../chunk-TZGCUNOX.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-PCGZXWGQ.js";
+import "../chunk-WNJSGZY7.js";
 import "../chunk-TFKBFQCE.js";
 import "../chunk-K3QVDAZW.js";
-import "../chunk-NTQSICPJ.js";
-import "../chunk-7XT76LWT.js";
-import "../chunk-EADZPVYW.js";
-import "../chunk-SOCEY746.js";
+import "../chunk-Z4VGIBJ7.js";
+import "../chunk-X7FESZTD.js";
+import "../chunk-2AUIEZYS.js";
+import "../chunk-5UQ5ATIE.js";
 import "../chunk-TIWURSLS.js";
 import "../chunk-66H2QQAK.js";
 import "../chunk-2QT3GCU4.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-UYDTFCHW.js";
-import "../chunk-UQHUUZ5H.js";
-import "../chunk-DYHXOXUF.js";
+import "../chunk-WOLPADR6.js";
+import "../chunk-6IU45EHE.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-USQDVBEV.js";
 import "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-upgrade.js

@@ -1,27 +1,34 @@
 #!/usr/bin/env node
 import {
+  describeCodexTrustConfirmation
+} from "../chunk-BY2CRWBO.js";
+import {
+  ensureCodexTrustAfterReapply,
   reapplyAllAgents
-} from "../chunk-PNNBMH4E.js";
-import "../chunk-3NBODGQS.js";
+} from "../chunk-JKBDGZFL.js";
+import "../chunk-HUAOMX4U.js";
+import "../chunk-6EEANS74.js";
 import {
   waitForMachineReadiness
-} from "../chunk-F57RGL7K.js";
-import "../chunk-J4J45VPZ.js";
+} from "../chunk-IV3RHICU.js";
+import "../chunk-4ERLRNOK.js";
 import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "../chunk-KEOLNHR3.js";
+} from "../chunk-5ZZG76S2.js";
 import {
   AUTO_UPDATE_DISABLE_ENV,
   describeAutoUpdateCheck,
   globalInstallPrefix,
+  hasPendingUpgradeFinish,
   isAutoUpdateDisabledByEnv,
   parseAutoUpdateFlag,
+  readAutoUpdateState,
   updateAutoUpdateState,
   upgradeEntryFor
-} from "../chunk-OSSDK5RS.js";
-import "../chunk-NTQSICPJ.js";
+} from "../chunk-MU3WU2FO.js";
+import "../chunk-Z4VGIBJ7.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
@@ -32,13 +39,13 @@ import {
   replaceDaemonService,
   stopDaemonService,
   waitForDaemonRemoteProof
-} from "../chunk-7XT76LWT.js";
-import "../chunk-EADZPVYW.js";
+} from "../chunk-X7FESZTD.js";
+import "../chunk-2AUIEZYS.js";
 import {
   needsShell
 } from "../chunk-XHKBHWLX.js";
 import "../chunk-UYDTFCHW.js";
-import "../chunk-UQHUUZ5H.js";
+import "../chunk-WOLPADR6.js";
 import {
   LATEST_TAG,
   autoUpdateLock,
@@ -54,7 +61,7 @@ import {
   npmErrorMessage,
   resolveGlobalBinary,
   vscodePluginDir
-} from "../chunk-DYHXOXUF.js";
+} from "../chunk-6IU45EHE.js";
 import {
   exitOnHelpFlag
 } from "../chunk-P4BNYJ5Q.js";
@@ -172,11 +179,23 @@ var finishInNewInstall = (request) => {
 };
 var incompleteFinishDetail = (logPath) => `installed, but refreshing the agent configs did not finish cleanly; see ${logPath}`;
 var newMajorDetail = (latest) => `${latest} is a new major version; run ${MANUAL_UPGRADE_COMMAND}`;
+var finishInstalledUpgrade = (context, from, to) => {
+  const pending = { result: "finish_pending", from, to, detail: incompleteFinishDetail(context.logPath) };
+  recordAutoUpdateCheck(context.statePath, pending, new Date(context.now()).toISOString());
+  try {
+    context.finish({ entry: upgradeEntryFor(context.prefix), prefix: context.prefix, logPath: context.logPath });
+    return { result: "updated", from, to };
+  } catch {
+    return pending;
+  }
+};
 var checkAndInstall = async (context) => {
   const installed = packageVersionAt(context.packageRoot);
   if (installed === void 0 || !isReleaseVersion(installed)) {
     return { result: "failed", from: installed, detail: UNREADABLE_INSTALLED_VERSION };
   }
+  const previous = readAutoUpdateState(context.statePath);
+  if (hasPendingUpgradeFinish(previous, installed)) return finishInstalledUpgrade(context, previous.from, installed);
   const latest = await fetchLatestPublishedVersion({ fetchImpl: context.fetchImpl });
   if (latest === void 0) return { result: "failed", from: installed, detail: UNREACHABLE_REGISTRY };
   if (!isNewerVersion(latest, installed)) return { result: "current", from: installed };
@@ -189,12 +208,7 @@ var checkAndInstall = async (context) => {
   } catch (error) {
     return { result: "failed", from: installed, to: latest, detail: npmErrorMessage(error) };
   }
-  try {
-    context.finish({ entry: upgradeEntryFor(context.prefix), prefix: context.prefix, logPath: context.logPath });
-  } catch {
-    return { result: "updated", from: installed, to: latest, detail: incompleteFinishDetail(context.logPath) };
-  }
-  return { result: "updated", from: installed, to: latest };
+  return finishInstalledUpgrade(context, installed, latest);
 };
 var recordAutoUpdateCheck = (statePath, check, at) => updateAutoUpdateState(statePath, {
   lastCheckAt: at,
@@ -206,6 +220,7 @@ var recordAutoUpdateCheck = (statePath, check, at) => updateAutoUpdateState(stat
   announced: check.result === "updated" ? false : void 0
 });
 var runAutoUpdate = async (run = {}) => {
+  if ((run.platform ?? process.platform) === "linux") return { kind: "linux" };
   const packageRoot = run.packageRoot ?? ownPackageRoot();
   const prefix = packageRoot === void 0 ? null : globalInstallPrefix(packageRoot);
   if (packageRoot === void 0 || prefix === null) return { kind: "not_global_install" };
@@ -216,6 +231,7 @@ var runAutoUpdate = async (run = {}) => {
   try {
     const check = await checkAndInstall({
       packageRoot,
+      statePath: run.statePath ?? autoUpdateState(),
       prefix,
       logPath,
       now,
@@ -284,6 +300,7 @@ var finishUpgrade = async () => {
     apiKey = void 0;
   }
   const inspectedAgents = reapplyAllAgents(apiKey);
+  const codexTrust = await ensureCodexTrustAfterReapply(inspectedAgents);
   const refreshed = inspectedAgents.filter((agent) => agent.result.reapplied);
   const configuredControlProviders = inspectedAgents.filter((agent) => agent.result.configured && (agent.id === "claude" || agent.id === "codex" || agent.id === "gemini")).map((agent) => agent.id);
   const controlMode = readControlMode();
@@ -332,6 +349,10 @@ var finishUpgrade = async () => {
   } else {
     console.log("No agent config on this machine needed refreshing.");
   }
+  if (codexTrust) {
+    console.log();
+    console.log(describeCodexTrustConfirmation(codexTrust));
+  }
   console.log();
   if (!daemonReady) {
     console.error(controlPolicy === "disabled" ? "Upgrade installed, but the disabled background service could not be fully removed. Re-run setup with --control off." : controlPolicy === "legacy" ? legacyStopFailure ? `Upgrade installed, but the legacy background service could not be stopped: ${legacyStopFailure}. Run setup with --control off.` : "Upgrade installed and the legacy background service was stopped, but it cannot be safely adopted. Run setup with --control off, or restore its provider and native service manager." : controlPolicy === "enabled" && !apiKey ? "Upgrade installed, but phone-start could not be reconciled because no API key was readable. Re-run setup." : "Upgrade installed, but the background service did not start. Run: pushary daemon install");
@@ -344,6 +365,7 @@ var finishUpgrade = async () => {
 var AUTO_UPDATE_ON_MESSAGE = "Automatic updates are on. Pushary checks for a new version once a day, when an agent session starts.";
 var AUTO_UPDATE_OFF_MESSAGE = "Automatic updates are off. Turn them back on with: pushary upgrade --auto=on";
 var AUTO_UPDATE_RUN_MESSAGES = {
+  linux: `Automatic updates are paused on Linux to protect running sessions. When your sessions have finished, run: ${NPX_LATEST_COMMAND} upgrade`,
   not_global_install: `This copy of Pushary is not a global npm install, so it does not update itself. Run: ${NPX_LATEST_COMMAND} upgrade`,
   locked: "Another automatic update is already running."
 };
@@ -361,7 +383,18 @@ var runAutomaticUpdate = async () => {
     return;
   }
   console.log(`Automatic update: ${describeAutoUpdateCheck(outcome.state)}`);
-  if (outcome.state.lastResult === "failed") process.exitCode = 1;
+  if (outcome.state.lastResult === "failed" || outcome.state.lastResult === "finish_pending") process.exitCode = 1;
+};
+var finishGlobalUpgrade = () => {
+  const upgradedBinary = resolveGlobalBinary("pushary-upgrade");
+  if (!upgradedBinary) {
+    console.error("Upgrade installed, but the new pushary-upgrade binary could not be found on PATH.");
+    process.exit(1);
+  }
+  execFileSync2(upgradedBinary, [FINISH_UPGRADE_FLAG], {
+    stdio: "inherit",
+    shell: needsShell(upgradedBinary)
+  });
 };
 var main = async () => {
   if (process.argv.includes(FINISH_UPGRADE_FLAG)) {
@@ -400,6 +433,11 @@ var main = async () => {
     console.log("Check the result with: pushary doctor");
     return;
   }
+  const pending = readAutoUpdateState(autoUpdateState());
+  if (hasPendingUpgradeFinish(pending, installed)) {
+    finishGlobalUpgrade();
+    updateAutoUpdateState(autoUpdateState(), { lastResult: "updated", detail: void 0, announced: false });
+  }
   const latest = await fetchLatestPublishedVersion();
   if (latest && !isNewerVersion(latest, installed)) {
     console.log(`Already on the latest version (${installed}).`);
@@ -412,14 +450,6 @@ var main = async () => {
     console.error(`Upgrade failed: ${npmErrorMessage(err)}`);
     process.exit(1);
   }
-  const upgradedBinary = resolveGlobalBinary("pushary-upgrade");
-  if (!upgradedBinary) {
-    console.error("Upgrade installed, but the new pushary-upgrade binary could not be found on PATH.");
-    process.exit(1);
-  }
-  execFileSync2(upgradedBinary, [FINISH_UPGRADE_FLAG], {
-    stdio: "inherit",
-    shell: needsShell(upgradedBinary)
-  });
+  finishGlobalUpgrade();
 };
 main();

package/dist/{chunk-EADZPVYW.js → chunk-2AUIEZYS.js}

@@ -5,7 +5,7 @@ import {
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-DYHXOXUF.js";
+} from "./chunk-6IU45EHE.js";
 import {
   CLAUDE_PRETOOLUSE_MATCHER,
   HOOK_BUDGETS,

package/dist/{chunk-J4J45VPZ.js → chunk-4ERLRNOK.js}

@@ -1,13 +1,13 @@
 import {
   CLAUDE_HOOK_EVENTS,
   supportedClaudeEvents
-} from "./chunk-EADZPVYW.js";
+} from "./chunk-2AUIEZYS.js";
 import {
   guardBinary,
   holdBudgetOf,
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-DYHXOXUF.js";
+} from "./chunk-6IU45EHE.js";
 import {
   HOOK_LOCATOR_BINARY,
   withHookHoldBudget

package/dist/{chunk-SOCEY746.js → chunk-5UQ5ATIE.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-DYHXOXUF.js";
+} from "./chunk-6IU45EHE.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-KEOLNHR3.js → chunk-5ZZG76S2.js}

@@ -2,7 +2,7 @@ import {
   resolveBinary,
   resolveGlobalPackageVersion,
   resolvePackageVersionFromBinary
-} from "./chunk-DYHXOXUF.js";
+} from "./chunk-6IU45EHE.js";
 import {
   MANAGED_PROVIDERS
 } from "./chunk-T4QY64OR.js";