@pushary/agent-hooks 1.6.4 → 1.7.1

package/dist/bin/pushary-codex.js

@@ -1,33 +1,32 @@
 #!/usr/bin/env node
 import {
   reportEvent
-} from "../chunk-H6XU22TN.js";
-import "../chunk-YUGGNZSF.js";
+} from "../chunk-WM3U2RUK.js";
+import "../chunk-4C4NRDIC.js";
 import {
   askUser,
   isDecisionStopped,
   waitForAnswer
-} from "../chunk-EREBZHN2.js";
-import "../chunk-VOCZHOXV.js";
+} from "../chunk-ZIIYTQHC.js";
+import "../chunk-KSNAAMU5.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-BJENQBMH.js";
-import "../chunk-DESAUCH2.js";
+import "../chunk-NQFGVAT6.js";
+import "../chunk-JTQDP4ZL.js";
 import {
   getMachineId
-} from "../chunk-DZTKLE7Q.js";
+} from "../chunk-P5CBNSYL.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-VHNDE3ZD.js";
-import "../chunk-K32C2RGK.js";
+import "../chunk-UPKP67TA.js";
+import "../chunk-454KMJHF.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey
-} from "../chunk-OSJEMXSR.js";
-import "../chunk-CAS7GFWI.js";
+} from "../chunk-OAL44FM2.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-EA3IELHP.js";
-import "../chunk-HWJW3CPO.js";
+} from "../chunk-EIZW73P5.js";
+import "../chunk-XFNVG3OV.js";
 
 // bin/pushary-codex.ts
 import { basename } from "path";

package/dist/bin/pushary-connect.js

@@ -1,45 +1,44 @@
 #!/usr/bin/env node
 import {
   printKeyCheck
-} from "../chunk-LFMOYHPY.js";
+} from "../chunk-3T35OE7C.js";
 import {
   connectDevice,
   connectExistingApp,
   printConnectInstructions
-} from "../chunk-XJG2FUWS.js";
+} from "../chunk-AHWJHLG5.js";
 import "../chunk-3EGEA4KH.js";
 import {
   checkApiKey
-} from "../chunk-UGKDBJJX.js";
+} from "../chunk-43SSQCWO.js";
 import "../chunk-QCGNGEGE.js";
 import {
   createIo
-} from "../chunk-5RUIFDTP.js";
+} from "../chunk-O5PRIYFZ.js";
 import {
   exitOnHelpFlag
-} from "../chunk-P4BNYJ5Q.js";
+} from "../chunk-6PV2JQ64.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
 import {
   readKeySource
-} from "../chunk-R4HVHTNA.js";
-import "../chunk-BJENQBMH.js";
-import "../chunk-DESAUCH2.js";
-import "../chunk-DZTKLE7Q.js";
+} from "../chunk-YZKS3ME3.js";
+import "../chunk-NQFGVAT6.js";
+import "../chunk-JTQDP4ZL.js";
+import "../chunk-P5CBNSYL.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-VHNDE3ZD.js";
-import "../chunk-K32C2RGK.js";
+import "../chunk-UPKP67TA.js";
+import "../chunk-454KMJHF.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-OSJEMXSR.js";
-import "../chunk-CAS7GFWI.js";
-import "../chunk-EA3IELHP.js";
-import "../chunk-HWJW3CPO.js";
+import "../chunk-OAL44FM2.js";
+import "../chunk-EIZW73P5.js";
+import "../chunk-XFNVG3OV.js";
 
 // bin/pushary-connect.ts
 exitOnHelpFlag("connect");

package/dist/bin/pushary-cowork.js

@@ -2,15 +2,15 @@
 import {
   coworkOutput,
   parseCoworkOptions
-} from "../chunk-6NLWK6ZV.js";
+} from "../chunk-3QE3BHBW.js";
 import {
   canOpenBrowser,
   openInBrowser
 } from "../chunk-PUZZELE6.js";
-import "../chunk-I2YUMZLE.js";
+import "../chunk-XMN37YJH.js";
 import {
   exitOnHelpFlag
-} from "../chunk-P4BNYJ5Q.js";
+} from "../chunk-6PV2JQ64.js";
 import "../chunk-GMXKITVA.js";
 import {
   UsageError
@@ -18,11 +18,10 @@ import {
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
+import "../chunk-EIZW73P5.js";
 import {
   CLAUDE_CONNECTOR_GUIDE
-} from "../chunk-CAS7GFWI.js";
-import "../chunk-EA3IELHP.js";
-import "../chunk-HWJW3CPO.js";
+} from "../chunk-XFNVG3OV.js";
 
 // bin/pushary-cowork.ts
 exitOnHelpFlag("cowork");

package/dist/bin/pushary-daemon.js

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 import {
   inspectConfiguredManagedProviders
-} from "../chunk-YPONELWS.js";
-import "../chunk-PBKEYMAO.js";
-import "../chunk-53DN77WB.js";
+} from "../chunk-QPR33SHS.js";
+import "../chunk-Y6GKOZBT.js";
+import "../chunk-6SJQ442W.js";
 import {
   HEARTBEAT_INTERVAL_MS,
   sendHeartbeat
-} from "../chunk-JOGA3TL2.js";
-import "../chunk-ZA5UXRNE.js";
+} from "../chunk-YQN7S57T.js";
+import "../chunk-WSC53O7I.js";
 import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "../chunk-GBL4BTG3.js";
+} from "../chunk-Q7QRR6YL.js";
 import {
   SESSION_REAP_SILENCE_MS,
   describeIdleWindow,
@@ -21,15 +21,15 @@ import {
   listProcessProofs,
   ownsLiveProcess,
   silentSpawnedProofs
-} from "../chunk-LDRGVXLR.js";
+} from "../chunk-SNWNA3MQ.js";
 import {
   startRegisteredTranscripts
-} from "../chunk-D3K2FPPJ.js";
+} from "../chunk-7GYGVQBU.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-5SWQZ6HY.js";
-import "../chunk-I2YUMZLE.js";
-import "../chunk-I3XJATMR.js";
-import "../chunk-YXPGFRRW.js";
+import "../chunk-SVEMF2VO.js";
+import "../chunk-XMN37YJH.js";
+import "../chunk-MWVCDP64.js";
+import "../chunk-XDASEYRS.js";
 import {
   DAEMON_LEASE_RENEW_INTERVAL_MS,
   acquireDaemonLease,
@@ -46,47 +46,46 @@ import {
   requestDaemonHandoff,
   stopDaemonRunning,
   writeDaemonNeedsLogin
-} from "../chunk-OZE2TQX5.js";
-import "../chunk-7CLTSZOL.js";
-import "../chunk-LQI7W4RG.js";
-import "../chunk-XOMH53NB.js";
-import "../chunk-66H2QQAK.js";
-import "../chunk-VA2R64I7.js";
+} from "../chunk-AAGLDXH4.js";
+import "../chunk-WZWXBTRF.js";
+import "../chunk-XPMOCJHN.js";
+import "../chunk-O5JD7UI5.js";
+import "../chunk-OTZHT34O.js";
+import "../chunk-XPTCPU6V.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
-import "../chunk-YUGGNZSF.js";
+import "../chunk-4C4NRDIC.js";
 import {
   writeHuman
 } from "../chunk-QCGNGEGE.js";
 import {
   exitOnHelpFlag
-} from "../chunk-P4BNYJ5Q.js";
+} from "../chunk-6PV2JQ64.js";
 import "../chunk-GMXKITVA.js";
 import {
   readControlMode
-} from "../chunk-R4HVHTNA.js";
+} from "../chunk-YZKS3ME3.js";
 import {
   getMachineId
-} from "../chunk-DZTKLE7Q.js";
+} from "../chunk-P5CBNSYL.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-VHNDE3ZD.js";
+import "../chunk-UPKP67TA.js";
 import {
   resolveBinary
-} from "../chunk-K32C2RGK.js";
+} from "../chunk-454KMJHF.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-OSJEMXSR.js";
-import "../chunk-CAS7GFWI.js";
+} from "../chunk-OAL44FM2.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-EA3IELHP.js";
-import "../chunk-HWJW3CPO.js";
+} from "../chunk-EIZW73P5.js";
+import "../chunk-XFNVG3OV.js";
 
 // src/spawn-daemon.ts
 import { execFileSync, spawn } from "child_process";

package/dist/bin/pushary-disconnect.js

@@ -8,38 +8,38 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-3VZX4NSP.js";
+} from "../chunk-NID4UZDN.js";
 import {
   compatibleConfigFile,
   compatibleMcpFile,
   compatiblePermissionRuleFile,
   removeCompatibleHooks,
   removeCompatibleMcpServer
-} from "../chunk-LJEL7IB5.js";
+} from "../chunk-KBLIVEFJ.js";
 import {
   isClaudeMcpSnapshot,
   removeClaudeMcpServers,
   removePusharySettings,
   removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-ZA5UXRNE.js";
+} from "../chunk-WSC53O7I.js";
 import {
   removeGeminiSettings
-} from "../chunk-7CLTSZOL.js";
-import "../chunk-H6XU22TN.js";
-import "../chunk-YUGGNZSF.js";
-import "../chunk-EREBZHN2.js";
-import "../chunk-VOCZHOXV.js";
+} from "../chunk-WZWXBTRF.js";
+import "../chunk-WM3U2RUK.js";
+import "../chunk-4C4NRDIC.js";
+import "../chunk-ZIIYTQHC.js";
+import "../chunk-KSNAAMU5.js";
 import "../chunk-POFBE6ZY.js";
 import {
   exitOnHelpFlag
-} from "../chunk-P4BNYJ5Q.js";
-import "../chunk-BJENQBMH.js";
-import "../chunk-DESAUCH2.js";
-import "../chunk-DZTKLE7Q.js";
+} from "../chunk-6PV2JQ64.js";
+import "../chunk-NQFGVAT6.js";
+import "../chunk-JTQDP4ZL.js";
+import "../chunk-P5CBNSYL.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-VHNDE3ZD.js";
+import "../chunk-UPKP67TA.js";
 import {
   claudeJson,
   claudeMcpReceipt,
@@ -53,15 +53,14 @@ import {
   geminiSettings,
   removeCodexHooks,
   removeCodexSettings
-} from "../chunk-K32C2RGK.js";
+} from "../chunk-454KMJHF.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-OSJEMXSR.js";
+import "../chunk-OAL44FM2.js";
+import "../chunk-EIZW73P5.js";
 import {
   DISCONNECTABLE_AGENTS,
   hookCompatibleProfileBySource
-} from "../chunk-CAS7GFWI.js";
-import "../chunk-EA3IELHP.js";
-import "../chunk-HWJW3CPO.js";
+} from "../chunk-XFNVG3OV.js";
 
 // bin/pushary-disconnect.ts
 import { readdirSync, readFileSync, rmSync, writeFileSync } from "fs";

package/dist/bin/pushary-doctor.js

@@ -4,48 +4,60 @@ import {
 } from "../chunk-CVWG2N3Y.js";
 import {
   readServiceExecPath,
+  retryAgentCommand,
   versionManagerOf
-} from "../chunk-GU3EJCVV.js";
+} from "../chunk-ZEMSCGDD.js";
 import {
   assessCodexHookTrust,
   readCodexTrustForPusharyHooks
-} from "../chunk-53DN77WB.js";
+} from "../chunk-6SJQ442W.js";
 import {
   readMachineReadiness,
   readManagedControlEvidence
-} from "../chunk-JOGA3TL2.js";
-import {
-  CURSOR_GATE_SCRIPT
-} from "../chunk-P32LPT2L.js";
+} from "../chunk-YQN7S57T.js";
 import {
+  FX_PROFILE_REFUSALS,
+  FX_PUSHARY_TOOLS_RULE,
+  FX_QUESTION_TOOL,
+  FX_SETTINGS_REFUSALS,
   agentProbes,
   detectAgent,
   detectAllAgents,
+  fxBridgeTargetOf,
+  fxPusharyEntryOf,
+  fxQuestionRouting,
   hasInstructionBlock,
   isDetected,
+  isFxPusharyEntry,
   isPluginRegistered,
+  pusharyToolsAllowed,
+  readFxFile,
+  readFxProfile,
+  readFxSettings,
   shortenHome,
-  vscodeSettingsTargets
-} from "../chunk-NFH73H5B.js";
+  vscodeSettingsTargets,
+  workspacesShowingQuestionTool
+} from "../chunk-NAAZCNKI.js";
+import "../chunk-2FU43B5Q.js";
 import {
   OPENCODE_PLUGIN_PLACEHOLDER,
   openCodePluginDir,
   openCodePluginFile,
   openCodeWired
-} from "../chunk-3VZX4NSP.js";
+} from "../chunk-NID4UZDN.js";
 import {
   compatibleConfigFile,
   compatibleInstructionsFile,
   compatibleMcpFile,
   hasCompatibleHooks,
   missingCompatibleHookEvents
-} from "../chunk-LJEL7IB5.js";
-import "../chunk-ZA5UXRNE.js";
+} from "../chunk-KBLIVEFJ.js";
+import "../chunk-WSC53O7I.js";
 import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "../chunk-GBL4BTG3.js";
+} from "../chunk-Q7QRR6YL.js";
 import {
   AUTO_UPDATE_DISABLE_ENV,
   autoUpdateOffReason,
@@ -53,16 +65,16 @@ import {
   describeAutoUpdateCheck,
   readAutoUpdateState,
   takeAutoUpdateAnnouncement
-} from "../chunk-P4UYILQK.js";
+} from "../chunk-BYVB3RX3.js";
 import {
   readLedgerSummary
-} from "../chunk-5UWV5GHM.js";
+} from "../chunk-MCNS4725.js";
 import {
   describeBridgeResolution,
   isBridgeLocator,
   liveBridgeProbe,
   resolveBridgeStub
-} from "../chunk-I3XJATMR.js";
+} from "../chunk-MWVCDP64.js";
 import {
   claudeOtherHolders,
   claudeUnprovenHolds,
@@ -79,7 +91,7 @@ import {
   geminiWired,
   holdsLong,
   pusharyHookExecutable
-} from "../chunk-YXPGFRRW.js";
+} from "../chunk-XDASEYRS.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
@@ -88,17 +100,17 @@ import {
   readDaemonNeedsLogin,
   readDaemonStatus,
   readInstalledDaemonService
-} from "../chunk-OZE2TQX5.js";
+} from "../chunk-AAGLDXH4.js";
 import {
   GEMINI_HOOK_BINARY,
   hasGeminiHooks,
   missingGeminiHookEvents
-} from "../chunk-7CLTSZOL.js";
+} from "../chunk-WZWXBTRF.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-H6XU22TN.js";
-import "../chunk-YUGGNZSF.js";
-import "../chunk-EREBZHN2.js";
-import "../chunk-VOCZHOXV.js";
+import "../chunk-WM3U2RUK.js";
+import "../chunk-4C4NRDIC.js";
+import "../chunk-ZIIYTQHC.js";
+import "../chunk-KSNAAMU5.js";
 import "../chunk-POFBE6ZY.js";
 import {
   describeReach,
@@ -107,19 +119,19 @@ import {
   reachVerdict,
   roundTripEvidence,
   verifyRoundTrip
-} from "../chunk-XJG2FUWS.js";
+} from "../chunk-AHWJHLG5.js";
 import "../chunk-3EGEA4KH.js";
 import {
   checkApiKey,
   describeKeyCheck
-} from "../chunk-UGKDBJJX.js";
+} from "../chunk-43SSQCWO.js";
 import "../chunk-QCGNGEGE.js";
 import {
   createIo
-} from "../chunk-5RUIFDTP.js";
+} from "../chunk-O5PRIYFZ.js";
 import {
   exitOnHelpFlag
-} from "../chunk-P4BNYJ5Q.js";
+} from "../chunk-6PV2JQ64.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
@@ -127,22 +139,22 @@ import {
   keyPrefix,
   readControlMode,
   readKeySource
-} from "../chunk-R4HVHTNA.js";
+} from "../chunk-YZKS3ME3.js";
 import {
   callMcpTool,
   sendMcpRequest
-} from "../chunk-BJENQBMH.js";
-import "../chunk-DESAUCH2.js";
+} from "../chunk-NQFGVAT6.js";
+import "../chunk-JTQDP4ZL.js";
 import {
   getMachineId
-} from "../chunk-DZTKLE7Q.js";
+} from "../chunk-P5CBNSYL.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-VHNDE3ZD.js";
+import "../chunk-UPKP67TA.js";
 import {
   CODEX_HOOK_EVENTS,
   autoUpdateState,
@@ -160,18 +172,24 @@ import {
   cursorUserMcp,
   execNpm,
   fetchLatestPublishedVersion,
+  fxMcpProfile,
+  fxSettings,
   geminiMd,
   geminiSettings,
   hasCodexHooks,
   missingCodexHookEvents,
   pusharyConfigFile,
   readCodexMcpAuth,
+  resolvePathBinary,
   vscodePluginDir
-} from "../chunk-K32C2RGK.js";
+} from "../chunk-454KMJHF.js";
 import "../chunk-T7E75EKA.js";
 import {
   getBaseUrl
-} from "../chunk-OSJEMXSR.js";
+} from "../chunk-OAL44FM2.js";
+import {
+  NPX_LATEST_COMMAND
+} from "../chunk-EIZW73P5.js";
 import {
   AGENTS,
   CURSOR_GATE_EVENTS,
@@ -180,17 +198,12 @@ import {
   HOOK_SOURCES,
   SUPPORT_DISCORD,
   SUPPORT_EMAIL,
+  getPackageVersion,
   hookActivationResult,
   hookCompatibleProfile,
-  isHookActivationReport
-} from "../chunk-CAS7GFWI.js";
-import {
-  NPX_LATEST_COMMAND
-} from "../chunk-EA3IELHP.js";
-import {
-  getPackageVersion,
+  isHookActivationReport,
   isNewerVersion
-} from "../chunk-HWJW3CPO.js";
+} from "../chunk-XFNVG3OV.js";
 
 // bin/pushary-doctor.ts
 import { existsSync, readFileSync, writeFileSync } from "fs";
@@ -355,6 +368,9 @@ function inertRegistrations(configs, resolves) {
 var describeInertRegistration = ({ named }) => `hooks here are registered for "${named}", which this CLI has no profile for, so every one of them stands aside`;
 var inertRegistrationRemedy = () => "Upgrade with npx @pushary/agent-hooks@latest upgrade, or re-run setup to rewrite them for an agent this version knows";
 
+// src/hooks-spec.ts
+var CURSOR_GATE_SCRIPT = "pushary-gate.mjs";
+
 // src/diagnostics/activation.ts
 var readHookActivation = async (apiKey, agentType, target, deps = {}) => {
   const machineId = deps.machineId ?? getMachineId();
@@ -443,6 +459,24 @@ var CLAUDE_SETTINGS = claudeSettings();
 var registeredConfigs = () => [CLAUDE_SETTINGS, codexHooksJson(), ...HOOK_COMPATIBLE_PROFILES.map((profile) => compatibleConfigFile(profile))].filter(existsSync).map((file) => ({ file, contents: readFileSync(file, "utf-8") }));
 var SKILL_PATH = join(claudeSkillDir(), "SKILL.md");
 var SHELL_FILES = [".zshrc", ".zprofile", ".bashrc", ".bash_profile"].map((f) => join(homedir2(), f));
+var reportFxQuestionRouting = (routing) => {
+  if (routing === "routed") {
+    check(true, "fx: questions go through Pushary", `${FX_QUESTION_TOOL} is off in ${fxSettings()}`);
+    return;
+  }
+  console.log(`  ${warn} fx: questions can still stop in the terminal ${dim(`(${FX_QUESTION_ROUTING_WARNINGS[routing]})`)}`);
+};
+var fxSettingsProblem = (read) => {
+  if (read.kind === "missing") return `${fxSettings()} is missing, so fx runs with no Pushary rules; re-run ${retryAgentCommand("fx")}`;
+  if (read.kind === "unreadable") return `${fxSettings()} could not be read`;
+  if (read.kind === "refused") return `${fxSettings()} ${FX_SETTINGS_REFUSALS[read.reason]}`;
+  return null;
+};
+var FX_QUESTION_ROUTING_WARNINGS = {
+  "full-access": "full-access mode ignores permission rules, so fx's terminal question tool stays on; its instructions ask it to use Pushary instead",
+  overridden: `a rule in ${fxSettings()} keeps ${FX_QUESTION_TOOL} on; make "${FX_QUESTION_TOOL}": "deny" the last rule that matches it`
+};
+var fxBridgeFound = (target) => target.includes("/") ? existsSync(target) : resolvePathBinary(target) !== void 0;
 var readJson = (path) => {
   try {
     return JSON.parse(readFileSync(path, "utf-8"));
@@ -1061,6 +1095,35 @@ var main = async () => {
   } else {
     skipped("OpenCode", installed("opencode") ? "installed, but Pushary is not set up for it" : "not installed");
   }
+  const fxProfile = readFxFile(fxMcpProfile(), readFxProfile);
+  const fxEntry = fxProfile.kind === "profile" ? fxPusharyEntryOf(fxProfile.profile) : void 0;
+  if (isFxPusharyEntry(fxEntry)) {
+    checking("fx");
+    check(true, "fx: Pushary MCP server configured", fxMcpProfile());
+    const bridge = fxBridgeTargetOf(fxEntry);
+    if (bridge) {
+      const found = fxBridgeFound(bridge);
+      check(found, "fx: bridge binary resolves", found ? bridge : `${bridge} is not installed or not on PATH \u2014 re-run ${retryAgentCommand("fx")}`);
+    }
+    const fxSettingsRead = readFxFile(fxSettings(), readFxSettings);
+    const settingsProblem = fxSettingsProblem(fxSettingsRead);
+    const fxSettings2 = fxSettingsRead.kind === "settings" ? fxSettingsRead.settings : {};
+    if (settingsProblem) {
+      console.log(`  ${warn} fx: Pushary tools are not auto-allowed and questions can still stop in the terminal ${dim(`(${settingsProblem})`)}`);
+    } else if (!pusharyToolsAllowed(fxSettings2)) {
+      console.log(`  ${warn} fx: Pushary tools are not auto-allowed ${dim(`(fx will review or prompt for each call; add "${FX_PUSHARY_TOOLS_RULE}": "allow" to permission in ${fxSettings()})`)}`);
+    }
+    const questionRouting = fxQuestionRouting(fxSettings2, process.env);
+    if (settingsProblem === null) reportFxQuestionRouting(questionRouting);
+    const workspacesShowingQuestions = workspacesShowingQuestionTool(fxSettings2);
+    if (workspacesShowingQuestions.length > 0) {
+      console.log(`  ${warn} fx: ${workspacesShowingQuestions.length} workspace(s) replace the global rules and keep ${FX_QUESTION_TOOL} on ${dim(`(add "${FX_QUESTION_TOOL}": "deny" to their permission rules in ${fxSettings()})`)}`);
+    }
+  } else if (fxProfile.kind === "refused" && installed("fx")) {
+    check(false, "fx: MCP profile", `${fxMcpProfile()} ${FX_PROFILE_REFUSALS[fxProfile.reason]} \u2014 fix it, then run ${retryAgentCommand("fx")}`);
+  } else {
+    skipped("fx", installed("fx") ? "installed, but Pushary is not set up for it" : "not installed");
+  }
   if (bridgeStub) {
     const resolution = resolveBridgeStub(bridgeStub, liveBridgeProbe());
     check(resolution.kind === "bundle", "Mac app behind pushary-bridge", describeBridgeResolution(resolution));