@pushary/agent-hooks 1.5.0 → 1.6.0

package/dist/chunk-BY2CRWBO.js

@@ -0,0 +1,38 @@
+import {
+  NPX_LATEST_COMMAND
+} from "./chunk-EA3IELHP.js";
+
+// src/setup/codex-trust.ts
+var CODEX_TRUST_TELEMETRY = {
+  verified: "verified",
+  refused: "manual",
+  unlisted: "manual",
+  skipped: "unverified",
+  unavailable: "unverified"
+};
+var isUnanswered = (confirmation) => confirmation.kind === "skipped" || confirmation.kind === "unavailable";
+var codexTrustOutcome = (confirmation, portedTrustWritten) => isUnanswered(confirmation) && !portedTrustWritten ? "manual" : CODEX_TRUST_TELEMETRY[confirmation.kind];
+var CODEX_TRUST_REFUSED = "Codex did not accept the trust Pushary asked for, so its hooks are not trusted yet. Open Codex, run /hooks, and choose Trust for the Pushary hooks.";
+var describeUnlistedCodexHooks = (warnings) => {
+  const said = warnings[0] ? ` Codex said: ${warnings[0]}` : "";
+  return `Codex does not list the Pushary hooks, so it will not run them.${said} Run ${NPX_LATEST_COMMAND} doctor for details.`;
+};
+var describeCodexTrustConfirmation = (confirmation) => {
+  switch (confirmation.kind) {
+    case "verified":
+      return confirmation.wrote ? "Codex trusted the Pushary hooks when asked, and confirmed it." : "Codex confirms the Pushary hooks are trusted.";
+    case "refused":
+      return confirmation.writeError ? `${CODEX_TRUST_REFUSED} Codex said: ${confirmation.writeError}` : CODEX_TRUST_REFUSED;
+    case "unlisted":
+      return describeUnlistedCodexHooks(confirmation.warnings);
+    case "skipped":
+      return `Pushary did not ask Codex to confirm the trust: ${confirmation.reason}.`;
+    case "unavailable":
+      return `Codex could not be asked to confirm the Pushary hooks are trusted (${confirmation.reason}).`;
+  }
+};
+
+export {
+  codexTrustOutcome,
+  describeCodexTrustConfirmation
+};

package/dist/{chunk-43LJSM4F.js → chunk-CSW6A2EW.js}

@@ -13,7 +13,7 @@ import {
 import {
   isValidApiKey,
   normalizeKeyScope
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-YFD7CRIZ.js";
 
 // src/session.ts
 var samePusharyAccount = (left, right) => left.kind === "ok" && right.kind === "ok" && left.identity.workspaceId !== "" && left.identity.workspaceId === right.identity.workspaceId && left.identity.siteId === right.identity.siteId;

package/dist/{chunk-7XT76LWT.js → chunk-DZ75BJ7V.js}

@@ -4,14 +4,14 @@ import {
 } from "./chunk-XHKBHWLX.js";
 import {
   getMachineId
-} from "./chunk-UQHUUZ5H.js";
+} from "./chunk-7JSE6JTZ.js";
 import {
   pusharyDir,
   resolveGlobalBinary
-} from "./chunk-DYHXOXUF.js";
+} from "./chunk-F2OPOBRO.js";
 import {
   readControlMode
-} from "./chunk-USQDVBEV.js";
+} from "./chunk-TDKE3V6W.js";
 import {
   readJsonSafe,
   writeFileAtomic,

package/dist/{chunk-DTQNDR7C.js → chunk-E7MJBWSR.js}

@@ -1,6 +1,6 @@
 import {
   readConfigFileKey
-} from "./chunk-USQDVBEV.js";
+} from "./chunk-TDKE3V6W.js";
 
 // src/bell/fleet.ts
 import { closeSync, constants, futimesSync, lstatSync, mkdirSync, openSync, readdirSync, unlinkSync } from "fs";

package/dist/{chunk-DYHXOXUF.js → chunk-F2OPOBRO.js}

@@ -2,7 +2,7 @@ import {
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY,
   withHookHoldBudget
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-YFD7CRIZ.js";
 import {
   isReleaseVersion
 } from "./chunk-HWJW3CPO.js";
@@ -314,7 +314,8 @@ var CODEX_HOOK_BINARY = "pushary-codex-hook";
 var codexHome = () => codexHomeFrom(homedir());
 var codexHomeFrom = (home) => process.env.CODEX_HOME?.trim() || join2(home, ".codex");
 var codexConfigToml = () => join2(codexHome(), "config.toml");
-var codexHooksJson = () => join2(codexHome(), "hooks.json");
+var codexHooksJsonIn = (home) => join2(home, "hooks.json");
+var codexHooksJson = () => codexHooksJsonIn(codexHome());
 var codexAgentsMd = () => join2(codexHome(), "AGENTS.md");
 var codexSkillDir = () => join2(codexHome(), "skills", "pushary");
 var CODEX_HOOK_EVENTS = [
@@ -386,10 +387,11 @@ var readCodexMcpAuth = (config) => {
   if (typeof pushary.bearer_token === "string") return { method: "legacy-bearer" };
   return void 0;
 };
+var isPusharyCodexCommand = (command) => command.includes(CODEX_HOOK_BINARY) || command.includes(HOOK_LOCATOR_BINARY);
 var isPusharyCommand = (hook, scope) => {
   const command = String(asRecord2(hook)?.command ?? "");
   if (isProtectedByScope(command, scope)) return false;
-  return command.includes(CODEX_HOOK_BINARY) || command.includes(HOOK_LOCATOR_BINARY);
+  return isPusharyCodexCommand(command);
 };
 var isPusharyCodexHook = (entry, scope) => {
   const hooks = asRecord2(entry)?.hooks;
@@ -463,23 +465,6 @@ var codexEntryTrustHash = (eventKey, entry) => {
   if (typeof entry.matcher === "string") identity.matcher = entry.matcher;
   return "sha256:" + createHash("sha256").update(canonicalJson(identity), "utf8").digest("hex");
 };
-var codexTrustSchemeAgrees = (hooksConfig, config, hooksJsonPath) => {
-  const hooks = asRecord2(hooksConfig?.hooks);
-  const state = asRecord2(asRecord2(config.hooks)?.state);
-  if (!hooks || !state) return false;
-  for (const [event, entries] of Object.entries(hooks)) {
-    if (!Array.isArray(entries)) continue;
-    const eventKey = CODEX_EVENT_KEY[event] ?? codexEventKeyOf(event);
-    for (const [index, entry] of entries.entries()) {
-      const record = asRecord2(entry);
-      if (!record) continue;
-      const stored = asRecord2(state[`${hooksJsonPath}:${eventKey}:${index}:0`])?.trusted_hash;
-      if (typeof stored !== "string") continue;
-      if (stored === codexEntryTrustHash(eventKey, record)) return true;
-    }
-  }
-  return false;
-};
 var codexHookPositions = (hooksConfig) => {
   const hooks = asRecord2(hooksConfig?.hooks);
   const positions = {};
@@ -676,18 +661,19 @@ export {
   codexHome,
   codexHomeFrom,
   codexConfigToml,
+  codexHooksJsonIn,
   codexHooksJson,
   codexAgentsMd,
   codexSkillDir,
   CODEX_HOOK_EVENTS,
   addCodexMcpServer,
   readCodexMcpAuth,
+  isPusharyCodexCommand,
   codexRegistrationHolder,
   addCodexHooks,
   removeCodexHooks,
   hasCodexHooks,
   missingCodexHookEvents,
-  codexTrustSchemeAgrees,
   codexHookPositions,
   codexVacatedIndexes,
   dropVacatedCodexHookTrust,

package/dist/{chunk-43ZDACBO.js → chunk-F4KRNFDE.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-YFD7CRIZ.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-ORLJNJEO.js → chunk-FDF72XHK.js}

@@ -1,9 +1,9 @@
 import {
   registerTranscript
-} from "./chunk-NFKVRMTM.js";
+} from "./chunk-A2GS2ENL.js";
 import {
   degradedLine
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-YFD7CRIZ.js";
 
 // src/tool-hook-input.ts
 var OPTIONAL_TEXT_FIELDS = ["hook_event_name", "session_id", "cwd", "transcript_path", "tool_use_id", "permission_mode"];

package/dist/{chunk-JF736N4C.js → chunk-FI3LQCUH.js}

@@ -3,28 +3,28 @@ import {
   addPusharyToolPermissions,
   isPusharyHook,
   removeClaudeMcpServers
-} from "./chunk-J4J45VPZ.js";
+} from "./chunk-HWG7X3VI.js";
 import {
   CLAUDE_HOOK_EVENTS,
   addGeminiMcpServer,
   removeGeminiMcpServer
-} from "./chunk-EADZPVYW.js";
+} from "./chunk-BK5F3FGE.js";
 import {
   CLAUDE_CODE_AGENT,
   parseApplyPatchFiles
-} from "./chunk-FDHMNT24.js";
+} from "./chunk-66BIMA62.js";
 import {
   guardBinary,
   holdBudgetOf,
   registerHookEntry
-} from "./chunk-DYHXOXUF.js";
+} from "./chunk-F2OPOBRO.js";
 import {
   PHONE_ANSWERED_TOOLS,
   hookCompatibleProfile,
   hookCompatibleProfileBySource,
   toToolLookup,
   withHookHoldBudget
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-YFD7CRIZ.js";
 
 // src/compatible-config.ts
 import { homedir } from "os";

package/dist/{chunk-DLJN5XEU.js → chunk-G5LENVCZ.js}

@@ -1,12 +1,12 @@
 import {
   openCodeConfigDirFrom
-} from "./chunk-TUXFIVOH.js";
+} from "./chunk-B6TYEKJR.js";
 import {
   codexHomeFrom
-} from "./chunk-DYHXOXUF.js";
+} from "./chunk-F2OPOBRO.js";
 import {
   HOOK_COMPATIBLE_PROFILES
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-YFD7CRIZ.js";
 
 // src/vscode-config.ts
 import { homedir } from "os";

package/dist/{chunk-K3QVDAZW.js → chunk-GDXSCXQC.js}

@@ -1,6 +1,6 @@
 import {
   HOOK_LOCATOR_BINARY
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-YFD7CRIZ.js";
 
 // src/diagnostics/bridge.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-5HYNICS7.js → chunk-GOXINLDU.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_HOLD_BUDGET_ENV,
   hookHoldBudgetProof
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-YFD7CRIZ.js";
 
 // src/hold-budget.ts
 var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {

package/dist/{chunk-2QT3GCU4.js → chunk-GP6SFVEN.js}

@@ -1,6 +1,6 @@
 import {
   readTranscriptPreference
-} from "./chunk-USQDVBEV.js";
+} from "./chunk-TDKE3V6W.js";
 
 // src/transcript-setting.ts
 var transcriptEnvironmentPreference = () => {

package/dist/{chunk-J4J45VPZ.js → chunk-HWG7X3VI.js}

@@ -1,17 +1,17 @@
 import {
   CLAUDE_HOOK_EVENTS,
   supportedClaudeEvents
-} from "./chunk-EADZPVYW.js";
+} from "./chunk-BK5F3FGE.js";
 import {
   guardBinary,
   holdBudgetOf,
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-DYHXOXUF.js";
+} from "./chunk-F2OPOBRO.js";
 import {
   HOOK_LOCATOR_BINARY,
   withHookHoldBudget
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-YFD7CRIZ.js";
 
 // src/claude-config.ts
 import { join } from "path";

package/dist/{chunk-PCGZXWGQ.js → chunk-KZBGITM4.js}

@@ -1,15 +1,15 @@
 import {
   AGENT_CHOICES
-} from "./chunk-TFKBFQCE.js";
+} from "./chunk-A5URWZTP.js";
 import {
   isBridgeLocator
-} from "./chunk-K3QVDAZW.js";
+} from "./chunk-GDXSCXQC.js";
 import {
   pusharyHookExecutable
-} from "./chunk-NTQSICPJ.js";
+} from "./chunk-MOQOJOMD.js";
 import {
   BELL_HOOK_BINARY
-} from "./chunk-SOCEY746.js";
+} from "./chunk-OR3A3RLH.js";
 
 // src/setup/hook-ownership.ts
 var commandsIn = (value) => {

package/dist/{chunk-NTQSICPJ.js → chunk-MOQOJOMD.js}

@@ -2,17 +2,17 @@ import {
   CLAUDE_HOOK_EVENTS,
   GEMINI_HOOK_EVENTS,
   hasGeminiHooks
-} from "./chunk-EADZPVYW.js";
+} from "./chunk-BK5F3FGE.js";
 import {
   CODEX_HOOK_EVENTS,
   hasCodexHooks,
   holdBudgetOf
-} from "./chunk-DYHXOXUF.js";
+} from "./chunk-F2OPOBRO.js";
 import {
   CURSOR_GATE_EVENTS,
   HOOK_LOCATOR_BINARY,
   hookCommandHoldBudget
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-YFD7CRIZ.js";
 
 // src/diagnostics/wiring.ts
 var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;

package/dist/{chunk-3NBODGQS.js → chunk-NDS27FXU.js}

@@ -1,6 +1,6 @@
 import {
   parseVersion
-} from "./chunk-EADZPVYW.js";
+} from "./chunk-BK5F3FGE.js";
 
 // src/setup/agent-probe.ts
 import { execSync } from "child_process";

package/dist/{chunk-H5LHTC5X.js → chunk-NYD7W7AT.js}

@@ -1,6 +1,6 @@
 import {
   resolvePathBinary
-} from "./chunk-DYHXOXUF.js";
+} from "./chunk-F2OPOBRO.js";
 
 // src/hermes-config.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-PNNBMH4E.js → chunk-OP7HFIWE.js}

@@ -1,18 +1,21 @@
 import {
   detectClaudeVersion
-} from "./chunk-3NBODGQS.js";
+} from "./chunk-NDS27FXU.js";
+import {
+  ensureCodexTrustsPusharyHooks
+} from "./chunk-XQOT4CCK.js";
 import {
   addClaudeMcpServer,
   addPusharyHooks,
   addPusharyToolPermissions
-} from "./chunk-J4J45VPZ.js";
+} from "./chunk-HWG7X3VI.js";
 import {
   claudeUnprovenHolds,
   claudeWired,
   codexUnprovenHolds,
   codexWired,
   geminiWired
-} from "./chunk-NTQSICPJ.js";
+} from "./chunk-MOQOJOMD.js";
 import {
   CLAUDE_HOOK_BINARY,
   CLAUDE_HOOK_EVENTS,
@@ -24,7 +27,7 @@ import {
   needsReregistration,
   registrationSignatures,
   supportedClaudeEvents
-} from "./chunk-EADZPVYW.js";
+} from "./chunk-BK5F3FGE.js";
 import {
   CODEX_HOOK_BINARY,
   addCodexHookTrust,
@@ -44,7 +47,7 @@ import {
   registrationHolderOf,
   resolveGlobalBinary,
   vscodePluginMcp
-} from "./chunk-DYHXOXUF.js";
+} from "./chunk-F2OPOBRO.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -123,6 +126,7 @@ var reapplyClaudeSettings = (apiKey, paths = {}) => {
   const claudeJsonWritable = claudeJson != null;
   let hooks = false;
   let mcp = false;
+  let failed = false;
   try {
     if (!settingsWritable) throw new Error("settings.json could not be parsed");
     const s = settings;
@@ -132,6 +136,7 @@ var reapplyClaudeSettings = (apiKey, paths = {}) => {
     writeJson(settingsPath, s);
     hooks = true;
   } catch {
+    failed = true;
   }
   if (apiKey) {
     try {
@@ -141,9 +146,10 @@ var reapplyClaudeSettings = (apiKey, paths = {}) => {
       writeJson(claudeJsonPath, cj);
       mcp = true;
     } catch {
+      failed = true;
     }
   }
-  return { configured: true, reapplied: hooks || mcp, hooks, mcp };
+  return { configured: true, reapplied: hooks || mcp, hooks, mcp, failed };
 };
 var reapplyClaudeForVersion = (apiKey, paths = {}) => {
   const idle = { verdict: "current", rewrote: false, missing: [] };
@@ -212,6 +218,7 @@ var reapplyCodexSettings = (apiKey, paths = {}) => {
   const command = guardBinary((paths.resolveBinary ?? resolveGlobalBinary)(CODEX_HOOK_BINARY) ?? CODEX_HOOK_BINARY);
   let hooks = false;
   let mcp = false;
+  let failed = hooksConfig === null || config === null;
   const vacated = codexVacatedIndexes(hooksConfig ?? void 0);
   if (hooksConfig != null) {
     try {
@@ -219,6 +226,7 @@ var reapplyCodexSettings = (apiKey, paths = {}) => {
       writeJson(hooksPath, hooksConfig);
       hooks = true;
     } catch {
+      failed = true;
     }
   }
   if (config != null) {
@@ -229,15 +237,18 @@ var reapplyCodexSettings = (apiKey, paths = {}) => {
       }
       if (apiKey) {
         addCodexMcpServer(config, apiKey);
-        mcp = true;
       }
       if (hooks || apiKey) {
         writeFileAtomic(configPath, stringifyTOML(config), modeToPreserve(configPath), "utf-8");
+        mcp = Boolean(apiKey);
       }
     } catch {
+      failed = true;
+      hooks = false;
     }
   }
-  return { configured: true, reapplied: hooks || mcp, hooks, mcp };
+  if (config === null) hooks = false;
+  return { configured: true, reapplied: hooks || mcp, hooks, mcp, failed };
 };
 var repairCodexHolds = (paths = {}) => {
   const idle = { configured: false, reapplied: false, hooks: false, mcp: false };
@@ -262,13 +273,14 @@ var reapplyGeminiSettings = (apiKey, paths = {}) => {
   let mcp = false;
   try {
     addGeminiHooks(settings, guardBinary(resolveGlobalBinary(GEMINI_HOOK_BINARY) ?? GEMINI_HOOK_BINARY));
-    hooks = true;
     if (apiKey) {
       addGeminiMcpServer(settings, apiKey);
-      mcp = true;
     }
     writeJson(settingsPath, settings);
+    hooks = true;
+    mcp = Boolean(apiKey);
   } catch {
+    return { configured: true, reapplied: false, hooks: false, mcp: false, failed: true };
   }
   return { configured: true, reapplied: hooks || mcp, hooks, mcp };
 };
@@ -283,7 +295,7 @@ var reapplyPluginMcp = (mcpPath, apiKey) => {
     writeJson(mcpPath, mcpConfig);
     return { configured: true, reapplied: true, hooks: false, mcp: true };
   } catch {
-    return { configured: true, reapplied: false, hooks: false, mcp: false };
+    return { configured: true, reapplied: false, hooks: false, mcp: false, failed: true };
   }
 };
 var reapplyCursorPlugin = (apiKey, paths = {}) => reapplyPluginMcp(
@@ -305,10 +317,13 @@ var reapplyAllAgents = (apiKey) => {
       const result = runner.run();
       if (result.configured) done.push({ id: runner.id, label: runner.label, result });
     } catch {
+      done.push({ id: runner.id, label: runner.label, result: { configured: false, reapplied: false, hooks: false, mcp: false, failed: true } });
     }
   }
   return done;
 };
+var isRewrittenCodex = (agent) => agent.id === "codex" && agent.result.hooks;
+var ensureCodexTrustAfterReapply = async (agents, options = {}) => agents.some(isRewrittenCodex) ? ensureCodexTrustsPusharyHooks(options) : null;
 
 export {
   reapplyClaudeSettings,
@@ -319,5 +334,6 @@ export {
   reapplyGeminiSettings,
   reapplyCursorPlugin,
   reapplyVsCodePlugin,
-  reapplyAllAgents
+  reapplyAllAgents,
+  ensureCodexTrustAfterReapply
 };

package/dist/{chunk-SOCEY746.js → chunk-OR3A3RLH.js}

@@ -1,6 +1,6 @@
 import {
   guardBinary
-} from "./chunk-DYHXOXUF.js";
+} from "./chunk-F2OPOBRO.js";
 
 // src/bell/install.ts
 import { join } from "path";

package/dist/{chunk-XWEONSLV.js → chunk-PCVVCS4A.js}

@@ -1,7 +1,7 @@
 import {
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-43LJSM4F.js";
+} from "./chunk-CSW6A2EW.js";
 import {
   createIo
 } from "./chunk-5RUIFDTP.js";

package/dist/{chunk-KJRALILH.js → chunk-PRZXYILJ.js}

@@ -15,11 +15,11 @@ import {
 } from "./chunk-HETOKNIL.js";
 import {
   reportedInstallSource
-} from "./chunk-HU5LSYL2.js";
+} from "./chunk-VMNI33F5.js";
 import {
   PAIR_TTL_SECONDS,
   isAnswerSource
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-YFD7CRIZ.js";
 import {
   NPX_LATEST_COMMAND
 } from "./chunk-EA3IELHP.js";

package/dist/{chunk-OSSDK5RS.js → chunk-RBPJO4KG.js}

@@ -1,6 +1,6 @@
 import {
   autoUpdateState
-} from "./chunk-DYHXOXUF.js";
+} from "./chunk-F2OPOBRO.js";
 import {
   readJsonSafe,
   writeJsonAtomic
@@ -19,7 +19,7 @@ var GLOBAL_PACKAGE_SUBPATH = "/lib/node_modules/@pushary/agent-hooks";
 var UPGRADE_ENTRY_SUBPATH = ["dist", "bin", "pushary-upgrade.js"];
 var NON_GLOBAL_INSTALL_SEGMENTS = ["/_npx/", "/.volta/"];
 var NOT_DISABLED_VALUES = /* @__PURE__ */ new Set(["", "0"]);
-var AUTO_UPDATE_RESULTS = ["updated", "current", "needs_manual", "failed"];
+var AUTO_UPDATE_RESULTS = ["updated", "current", "needs_manual", "failed", "finish_pending"];
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isAutoUpdateResult = (value) => typeof value === "string" && AUTO_UPDATE_RESULTS.some((result) => result === value);
 var stringField = (record, key) => {
@@ -53,6 +53,7 @@ var autoUpdateOffReason = (input) => {
   if (input.state.disabled === true) return "disabled_by_user";
   if (isContinuousIntegration(input.env)) return "ci";
   if (input.platform === "win32") return "windows";
+  if (input.platform === "linux") return "linux";
   return null;
 };
 var globalInstallPrefix = (packageRoot) => {
@@ -89,6 +90,7 @@ var parseAutoUpdateFlag = (args) => {
 };
 var AUTO_UPDATE_RESULT_LABELS = {
   updated: "updated",
+  finish_pending: "installed; configuration refresh pending",
   current: "up to date",
   needs_manual: "needs a manual upgrade",
   failed: "failed"
@@ -98,6 +100,7 @@ var describeAutoUpdateCheck = (state) => {
   const label = state.lastResult ? AUTO_UPDATE_RESULT_LABELS[state.lastResult] : "no result recorded";
   return [label, versionsOf(state), state.detail].filter(Boolean).join(", ");
 };
+var hasPendingUpgradeFinish = (state, installed) => state.to === installed && (state.lastResult === "finish_pending" || state.lastResult === "updated" && Boolean(state.detail));
 var pendingAutoUpdateAnnouncement = (state) => state.lastResult === "updated" && state.announced !== true && state.from && state.to ? { from: state.from, to: state.to } : null;
 var describeAutoUpdateAnnouncement = (announcement) => `Pushary updated itself from ${announcement.from} to ${announcement.to}.`;
 var takeAutoUpdateAnnouncement = (statePath, markAnnounced) => {
@@ -154,6 +157,7 @@ export {
   upgradeEntryFor,
   parseAutoUpdateFlag,
   describeAutoUpdateCheck,
+  hasPendingUpgradeFinish,
   describeAutoUpdateAnnouncement,
   takeAutoUpdateAnnouncement,
   readAutoUpdateState,

package/dist/{chunk-TIWURSLS.js → chunk-SFNRAEEW.js}

@@ -1,6 +1,6 @@
 import {
   redactSecrets
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-YFD7CRIZ.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";

package/dist/{chunk-USQDVBEV.js → chunk-TDKE3V6W.js}

@@ -1,6 +1,6 @@
 import {
   resolveInstallSourceFor
-} from "./chunk-HU5LSYL2.js";
+} from "./chunk-VMNI33F5.js";
 import {
   backupFile,
   readJsonSafe,

package/dist/{chunk-HU5LSYL2.js → chunk-VMNI33F5.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-OSJEMXSR.js";
 import {
   normalizeInstallSource
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-YFD7CRIZ.js";
 
 // src/install-source.ts
 import { readFileSync } from "fs";

package/dist/{chunk-UYDTFCHW.js → chunk-VZANUMIF.js}

@@ -1,6 +1,6 @@
 import {
   PRETOOLUSE_GATED_TOOLS
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-YFD7CRIZ.js";
 
 // src/claude-tools.ts
 var POSTTOOLUSE_MIRROR_ONLY_TOOLS = ["TodoWrite", "Task", "WebFetch", "WebSearch"];

package/dist/{chunk-3ZSGKLSO.js → chunk-XGL5JC6U.js}

@@ -1,6 +1,6 @@
 import {
   SETUP_FLAGS
-} from "./chunk-TFKBFQCE.js";
+} from "./chunk-A5URWZTP.js";
 import {
   parseFlags
 } from "./chunk-GMXKITVA.js";
@@ -14,7 +14,7 @@ import {
   CLAUDE_CONNECTOR_URL,
   COWORK_CONNECTOR_LIMIT,
   COWORK_STANDING_INSTRUCTIONS
-} from "./chunk-T4QY64OR.js";
+} from "./chunk-YFD7CRIZ.js";
 
 // src/cli/cowork.ts
 import { readFileSync } from "fs";