@pushary/agent-hooks 1.8.2 → 1.9.0

package/dist/bin/pushary-upgrade.js

@@ -1,22 +1,22 @@
 #!/usr/bin/env node
 import {
   describeCodexTrustConfirmation
-} from "../chunk-DXBS2EL7.js";
+} from "../chunk-7LLNRCOK.js";
 import {
   ensureCodexTrustAfterReapply,
   reapplyAllAgents
-} from "../chunk-B3UVRGYP.js";
-import "../chunk-W2LJ4O3A.js";
+} from "../chunk-XXVMUMKT.js";
+import "../chunk-JW7DKTT6.js";
 import {
   waitForMachineReadiness
-} from "../chunk-I3XLHSOC.js";
-import "../chunk-644AEX4T.js";
+} from "../chunk-7TQQSQZ7.js";
+import "../chunk-MQJWO3AA.js";
 import {
   detectProviderLiveCapabilities,
   expectedLaunchCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "../chunk-XQZEIWAV.js";
+} from "../chunk-CFAD2LTH.js";
 import "../chunk-RIVNNBEK.js";
 import {
   AUTO_UPDATE_DISABLE_ENV,
@@ -28,8 +28,8 @@ import {
   readAutoUpdateState,
   updateAutoUpdateState,
   upgradeEntryFor
-} from "../chunk-64H5IZZD.js";
-import "../chunk-XEGVVU5H.js";
+} from "../chunk-P25O4K3J.js";
+import "../chunk-NAJ3UV4E.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
@@ -40,23 +40,23 @@ import {
   replaceDaemonService,
   stopDaemonService,
   waitForDaemonRemoteProof
-} from "../chunk-EIGJYCOE.js";
-import "../chunk-S2UNQQQS.js";
+} from "../chunk-LQESQPIT.js";
+import "../chunk-YFS4HYCI.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-VFFHQC7W.js";
+import "../chunk-VYNTRHB6.js";
 import "../chunk-POFBE6ZY.js";
 import {
   exitOnHelpFlag
-} from "../chunk-CB23AO4D.js";
+} from "../chunk-K75TP4JY.js";
 import {
   readControlMode
-} from "../chunk-TJMAXQ5Q.js";
-import "../chunk-4A3UQERT.js";
+} from "../chunk-ZRHA4PGN.js";
+import "../chunk-VV4SBPCQ.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-5Y2DY6X4.js";
+import "../chunk-US3RDXK7.js";
 import {
   LATEST_TAG,
   autoUpdateLock,
@@ -73,86 +73,61 @@ import {
   readGlobalCliInstallAt,
   readGlobalPrefix,
   vscodePluginDir
-} from "../chunk-UPLV5AJF.js";
-import "../chunk-T7E75EKA.js";
+} from "../chunk-R76C43H7.js";
+import {
+  writeJsonAtomic
+} from "../chunk-T7E75EKA.js";
 import {
   getApiKey
-} from "../chunk-ON5JW2HP.js";
+} from "../chunk-EG46RJRF.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-35X5UDML.js";
+} from "../chunk-SDSKTRIV.js";
 import {
   CANONICAL_PACKAGE,
   LEGACY_PACKAGE,
   commandsPackage,
+  getPackageVersion,
   globalUpgradeEntry,
   isNewerVersion,
   isReleaseVersion,
   isSameMajorVersion,
   ownPackageRoot,
   packageVersionAt
-} from "../chunk-5YY3IJT4.js";
-
-// bin/pushary-upgrade.ts
-import { existsSync as existsSync2 } from "fs";
-import { homedir } from "os";
-import { join } from "path";
+} from "../chunk-4PCF34AB.js";
 
-// src/global-upgrade.ts
-import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync } from "fs";
-
-// src/auto-update-run.ts
-import { execFileSync } from "child_process";
-import { closeSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeSync } from "fs";
-import { dirname } from "path";
-var FINISH_UPGRADE_FLAG = "--finish-upgrade";
-var LOCK_STALE_MS = 10 * 60 * 1e3;
-var INSTALL_TIMEOUT_MS = 12e4;
+// src/upgrade-lock.ts
+import { fork } from "child_process";
+import { createHash } from "crypto";
+import { existsSync, mkdirSync, readFileSync, realpathSync, unlinkSync } from "fs";
+import { createServer, Server } from "net";
+import { basename, dirname, join } from "path";
+var LOCK_HOST = "127.0.0.1";
+var LOCK_PORT_START = 49152;
+var LOCK_PORT_COUNT = 16384;
+var INHERITED_LOCK_ENV = "PUSHARY_UPGRADE_LOCK";
+var LOCK_READY = "pushary-upgrade-lock-ready";
+var LOCK_HANDLE = "pushary-upgrade-lock-handle";
+var HANDOFF_TIMEOUT_MS = 1e4;
 var FINISH_TIMEOUT_MS = 5 * 60 * 1e3;
-var LOG_LIMIT_BYTES = 256 * 1024;
-var UNREADABLE_INSTALLED_VERSION = "could not read the installed version";
-var UNREACHABLE_REGISTRY = "could not read the latest version from the npm registry";
-var MANUAL_UPGRADE_COMMAND = `${NPX_LATEST_COMMAND} upgrade`;
-var isAlreadyExists = (error) => error instanceof Error && "code" in error && error.code === "EEXIST";
-var createLock = (lockPath, now) => {
-  const handle = openSync(lockPath, "wx");
-  try {
-    writeSync(handle, `${JSON.stringify({ pid: process.pid, at: new Date(now).toISOString() })}
-`);
-  } finally {
-    closeSync(handle);
-  }
-};
-var tryCreateLock = (lockPath, now) => {
+var KERNEL_LOCK_FORMAT = "kernel-v1";
+var heldLocks = /* @__PURE__ */ new Map();
+var canonicalLockPath = (path) => {
+  mkdirSync(dirname(path), { recursive: true });
+  return join(realpathSync(dirname(path)), basename(path));
+};
+var lockPort = (path) => LOCK_PORT_START + createHash("sha256").update(path).digest().readUInt32BE(0) % LOCK_PORT_COUNT;
+var readLockRecord = (path) => {
   try {
-    createLock(lockPath, now);
-    return "acquired";
-  } catch (error) {
-    if (isAlreadyExists(error)) return "held";
-    throw error;
-  }
-};
-var isStaleLock = (lockPath, now) => {
-  const modifiedAt = statSync(lockPath, { throwIfNoEntry: false })?.mtimeMs;
-  return modifiedAt !== void 0 && now - modifiedAt > LOCK_STALE_MS;
-};
-var takeOverLock = (lockPath, now) => {
-  try {
-    unlinkSync(lockPath);
+    const value = JSON.parse(readFileSync(path, "utf8"));
+    const pid = value && typeof value === "object" && "pid" in value ? value.pid : void 0;
+    return {
+      pid: typeof pid === "number" && Number.isInteger(pid) && pid > 0 ? pid : void 0,
+      installationPending: value !== null && typeof value === "object" && "installationPending" in value && value.installationPending === true,
+      usesKernelLock: value !== null && typeof value === "object" && "format" in value && value.format === KERNEL_LOCK_FORMAT
+    };
   } catch {
-    return "held";
-  }
-  return tryCreateLock(lockPath, now);
-};
-var isAbandonedLock = (evidence) => evidence.stale || evidence.holderPid !== void 0 && !evidence.holderAlive;
-var lockHolderPid = (lockPath) => {
-  try {
-    const holder = JSON.parse(readFileSync(lockPath, "utf8"));
-    const pid = holder && typeof holder === "object" && "pid" in holder ? holder.pid : void 0;
-    return typeof pid === "number" && Number.isInteger(pid) && pid > 0 ? pid : void 0;
-  } catch {
-    return void 0;
+    return { pid: void 0, usesKernelLock: false, installationPending: false };
   }
 };
 var isProcessAlive = (pid) => {
@@ -160,54 +135,138 @@ var isProcessAlive = (pid) => {
     process.kill(pid, 0);
     return true;
   } catch (error) {
-    return error instanceof Error && "code" in error && error.code === "EPERM";
+    return !(error instanceof Error && "code" in error && error.code === "ESRCH");
   }
 };
-var readLockHolder = (lockPath, now, isAlive) => {
-  const holderPid = lockHolderPid(lockPath);
-  return {
-    holderPid,
-    holderAlive: holderPid !== void 0 && isAlive(holderPid),
-    stale: isStaleLock(lockPath, now)
-  };
+var rejectConnection = (socket) => {
+  socket.destroy();
 };
-var acquireAutoUpdateLock = (lockPath, now) => {
-  mkdirSync(dirname(lockPath), { recursive: true });
-  if (tryCreateLock(lockPath, now) === "acquired") return "acquired";
-  if (!isStaleLock(lockPath, now)) return "held";
-  return takeOverLock(lockPath, now);
-};
-var releaseAutoUpdateLock = (lockPath) => {
+var inheritLock = (path) => new Promise((resolve) => {
+  const done = (claim) => {
+    clearTimeout(timer);
+    process.off("message", receive);
+    process.off("disconnect", disconnected);
+    resolve(claim);
+  };
+  const disconnected = () => done({ kind: "unavailable", reason: "Upgrade parent disconnected before transferring its lock" });
+  const receive = (message, handle) => {
+    if (message !== LOCK_HANDLE || !(handle instanceof Server)) return;
+    const address = handle.address();
+    if (address === null || typeof address === "string" || address.port !== lockPort(path) || address.address !== LOCK_HOST) {
+      handle.close();
+      done({ kind: "unavailable", reason: "Invalid inherited upgrade lock" });
+      return;
+    }
+    handle.on("connection", rejectConnection);
+    heldLocks.set(path, handle);
+    done({ kind: "inherited" });
+    process.disconnect?.();
+  };
+  const timer = setTimeout(() => done({ kind: "unavailable", reason: "Upgrade lock handoff timed out" }), HANDOFF_TIMEOUT_MS);
+  process.on("message", receive);
+  process.once("disconnect", disconnected);
+  if (!process.send || !process.connected) return disconnected();
+  process.send(LOCK_READY, (error) => {
+    if (error) disconnected();
+  });
+});
+var claimUpgradeLock = async (request = {}) => {
+  let server;
   try {
-    unlinkSync(lockPath);
-  } catch {
-    return;
+    const path = canonicalLockPath(request.lockPath ?? autoUpdateLock());
+    const inheritedPath = process.env[INHERITED_LOCK_ENV];
+    delete process.env[INHERITED_LOCK_ENV];
+    if (inheritedPath === path && !heldLocks.has(path)) return await inheritLock(path);
+    server = createServer(rejectConnection);
+    const listener = server;
+    await new Promise((resolve, reject) => {
+      listener.once("error", reject);
+      listener.listen({ host: LOCK_HOST, port: lockPort(path), exclusive: true }, resolve);
+    });
+    const record = readLockRecord(path);
+    if (record.installationPending) {
+      server.close();
+      return { kind: "unavailable", reason: `An earlier installation did not finish safely. Stop its npm processes (or restart the computer), then remove ${path} and retry the upgrade.` };
+    }
+    if (existsSync(path) && !record.usesKernelLock && (record.pid === void 0 || (request.isAlive ?? isProcessAlive)(record.pid))) {
+      server.close();
+      return { kind: "held", holderPid: record.pid };
+    }
+    writeJsonAtomic(path, { pid: process.pid, format: KERNEL_LOCK_FORMAT }, 384);
+    heldLocks.set(path, server);
+    return { kind: "acquired" };
+  } catch (error) {
+    server?.close();
+    if (error instanceof Error && "code" in error && error.code === "EADDRINUSE") {
+      return { kind: "held", holderPid: readLockRecord(request.lockPath ?? autoUpdateLock()).pid };
+    }
+    return { kind: "unavailable", reason: npmErrorMessage(error) };
   }
 };
-var upgradeLockVerdict = (evidence) => {
-  if (evidence.holderPid !== void 0 && evidence.holderPid === evidence.parentPid) return "inherited";
-  if (isAbandonedLock(evidence)) return "take_over";
-  return "held";
-};
-var claimUpgradeLockAt = (lockPath, request) => {
-  const now = request.now ?? Date.now();
-  mkdirSync(dirname(lockPath), { recursive: true });
-  if (tryCreateLock(lockPath, now) === "acquired") return { kind: "acquired" };
-  const holder = readLockHolder(lockPath, now, request.isAlive ?? isProcessAlive);
-  const verdict = upgradeLockVerdict({ ...holder, parentPid: request.parentPid ?? process.ppid });
-  if (verdict === "inherited") return { kind: "inherited" };
-  if (verdict === "take_over" && takeOverLock(lockPath, now) === "acquired") return { kind: "acquired" };
-  return { kind: "held", holderPid: holder.holderPid };
-};
-var claimUpgradeLock = (request = {}) => {
+var releaseAutoUpdateLock = (lockPath) => {
+  const path = canonicalLockPath(lockPath);
+  const server = heldLocks.get(path);
+  if (!server) return;
+  heldLocks.delete(path);
   try {
-    return claimUpgradeLockAt(request.lockPath ?? autoUpdateLock(), request);
-  } catch {
-    return { kind: "unavailable" };
+    const record = readLockRecord(path);
+    if (record.pid === process.pid && !record.installationPending) unlinkSync(path);
+  } finally {
+    server.close();
   }
 };
+var finishWithUpgradeLock = (request) => new Promise((resolve, reject) => {
+  const path = canonicalLockPath(request.lockPath ?? autoUpdateLock());
+  const server = heldLocks.get(path);
+  if (!server) return reject(new Error("Cannot finish an upgrade without its lock"));
+  const child = fork(request.entry, [...request.args], {
+    execArgv: [],
+    stdio: request.stdio ?? ["inherit", "inherit", "inherit", "ipc"],
+    env: { ...process.env, ...request.env, [INHERITED_LOCK_ENV]: path }
+  });
+  const timer = setTimeout(() => child.kill("SIGKILL"), FINISH_TIMEOUT_MS);
+  child.on("message", (message) => {
+    if (message === LOCK_READY) child.send(LOCK_HANDLE, server, (error) => {
+      if (error) child.kill();
+    });
+  });
+  child.once("error", (error) => {
+    clearTimeout(timer);
+    reject(error);
+  });
+  child.once("exit", (code, signal) => {
+    clearTimeout(timer);
+    if (code === 0) resolve();
+    else reject(new Error(`Upgrade finish exited with ${signal ?? code}`));
+  });
+});
+var installWithUpgradeLock = (request, lockPath = autoUpdateLock(), runNpm) => {
+  const path = canonicalLockPath(lockPath);
+  if (!heldLocks.has(path)) throw new Error("Cannot install an upgrade without its lock");
+  writeJsonAtomic(path, { pid: process.pid, format: KERNEL_LOCK_FORMAT, installationPending: true }, 384);
+  installPackageGlobally(request, runNpm);
+  writeJsonAtomic(path, { pid: process.pid, format: KERNEL_LOCK_FORMAT }, 384);
+};
+
+// bin/pushary-upgrade.ts
+import { existsSync as existsSync3 } from "fs";
+import { homedir } from "os";
+import { join as join2 } from "path";
+
+// src/global-upgrade.ts
+import { existsSync as existsSync2 } from "fs";
+
+// src/auto-update-run.ts
+import { closeSync, mkdirSync as mkdirSync2, openSync, statSync, writeSync } from "fs";
+import { dirname as dirname2 } from "path";
+var FINISH_UPGRADE_FLAG = "--finish-upgrade";
+var INSTALL_TIMEOUT_MS = 12e4;
+var LOG_LIMIT_BYTES = 256 * 1024;
+var UNREADABLE_INSTALLED_VERSION = "could not read the installed version";
+var UNREACHABLE_REGISTRY = "could not read the latest version from the npm registry";
+var MANUAL_UPGRADE_COMMAND = `${NPX_LATEST_COMMAND} upgrade`;
 var openAutoUpdateLog = (logPath) => {
-  mkdirSync(dirname(logPath), { recursive: true });
+  mkdirSync2(dirname2(logPath), { recursive: true });
   const size = statSync(logPath, { throwIfNoEntry: false })?.size ?? 0;
   return openSync(logPath, size > LOG_LIMIT_BYTES ? "w" : "a");
 };
@@ -224,13 +283,15 @@ var appendAutoUpdateLog = (logPath, line) => {
     return;
   }
 };
-var finishInNewInstall = (request) => {
+var finishInNewInstall = async (request) => {
   const handle = openAutoUpdateLog(request.logPath);
   try {
-    execFileSync(process.execPath, [request.entry, FINISH_UPGRADE_FLAG], {
-      stdio: ["ignore", handle, handle],
-      env: { ...process.env, npm_config_prefix: request.prefix },
-      timeout: FINISH_TIMEOUT_MS
+    await finishWithUpgradeLock({
+      entry: request.entry,
+      args: [FINISH_UPGRADE_FLAG],
+      lockPath: request.lockPath,
+      stdio: ["ignore", handle, handle, "ipc"],
+      env: { npm_config_prefix: request.prefix }
     });
   } finally {
     closeSync(handle);
@@ -238,11 +299,11 @@ var finishInNewInstall = (request) => {
 };
 var incompleteFinishDetail = (logPath) => `installed, but refreshing the agent configs did not finish cleanly; see ${logPath}`;
 var newMajorDetail = (latest) => `${latest} is a new major version; run ${MANUAL_UPGRADE_COMMAND}`;
-var finishInstalledUpgrade = (context, from, to) => {
+var finishInstalledUpgrade = async (context, from, to) => {
   const pending = { result: "finish_pending", from, to, detail: incompleteFinishDetail(context.logPath) };
   recordAutoUpdateCheck(context.statePath, pending, new Date(context.now()).toISOString());
   try {
-    context.finish({ entry: upgradeEntryFor(context.location), prefix: context.location.prefix, logPath: context.logPath });
+    await context.finish({ lockPath: context.lockPath, entry: upgradeEntryFor(context.location), prefix: context.location.prefix, logPath: context.logPath });
     return { result: "updated", from, to };
   } catch {
     return pending;
@@ -265,14 +326,13 @@ var checkAndInstall = async (context) => {
   }
   appendAutoUpdateLog(context.logPath, `${new Date(context.now()).toISOString()} installing ${context.location.packageName}@${latest} into ${context.location.prefix}`);
   try {
-    installPackageGlobally({
+    installWithUpgradeLock({
       packageName: context.location.packageName,
       version: latest,
       prefix: context.location.prefix,
       timeoutMs: INSTALL_TIMEOUT_MS
-    }, context.runNpm);
+    }, context.lockPath, context.runNpm);
   } catch (error) {
-    if (pendingFinish) return finishInstalledUpgrade(context, previous.from, installed);
     return { result: "failed", from: installed, to: latest, detail: npmErrorMessage(error) };
   }
   return finishInstalledUpgrade(context, installed, latest);
@@ -294,9 +354,17 @@ var runAutoUpdate = async (run = {}) => {
   const now = run.now ?? Date.now;
   const lockPath = run.lockPath ?? autoUpdateLock();
   const logPath = run.logPath ?? autoUpdateLog();
-  if (acquireAutoUpdateLock(lockPath, now()) === "held") return { kind: "locked" };
+  const claim = await claimUpgradeLock({ lockPath });
+  if (claim.kind === "unavailable") {
+    const at = new Date(now()).toISOString();
+    const state = recordAutoUpdateCheck(run.statePath ?? autoUpdateState(), { result: "failed", detail: claim.reason }, at);
+    appendAutoUpdateLog(logPath, `${at} ${describeAutoUpdateCheck(state)}`);
+    return { kind: "recorded", state };
+  }
+  if (claim.kind !== "acquired") return { kind: "locked" };
   try {
     const check = await checkAndInstall({
+      lockPath,
       packageRoot,
       statePath: run.statePath ?? autoUpdateState(),
       location,
@@ -327,14 +395,12 @@ var readGlobalUpgradeSubject = (platform = process.platform) => {
   const prefix = readGlobalPrefix();
   return globalUpgradeSubject(prefix, prefix === void 0 ? { kind: "unavailable" } : readGlobalCliInstallAt(prefix, platform));
 };
-var finishWithThisNode = (entry) => {
-  execFileSync2(process.execPath, [entry, FINISH_UPGRADE_FLAG], { stdio: "inherit" });
-};
-var finishGlobalUpgrade = (subject, platform = process.platform, runFinish = finishWithThisNode) => {
+var finishWithThisNode = (entry) => finishWithUpgradeLock({ entry, args: [FINISH_UPGRADE_FLAG] });
+var finishGlobalUpgrade = async (subject, platform = process.platform, runFinish = finishWithThisNode) => {
   const entry = globalUpgradeEntry(subject.prefix, subject.name, platform);
-  if (!existsSync(entry)) return { kind: "entry_missing", entry };
+  if (!existsSync2(entry)) return { kind: "entry_missing", entry };
   try {
-    runFinish(entry);
+    await runFinish(entry);
     return { kind: "finished" };
   } catch {
     return { kind: "failed" };
@@ -342,22 +408,30 @@ var finishGlobalUpgrade = (subject, platform = process.platform, runFinish = fin
 };
 var describeHeldUpgradeLock = (holderPid) => `Another Pushary upgrade is already running${holderPid === void 0 ? "" : ` (pid ${holderPid})`}. Try again when it has finished.`;
 var withUpgradeLock = async (run, request = {}) => {
-  const claim = claimUpgradeLock(request);
+  const claim = await claimUpgradeLock(request);
+  if (claim.kind === "unavailable") return { kind: "refused", exitCode: EXIT.FAILED, message: `Could not lock the Pushary upgrade: ${claim.reason}` };
   if (claim.kind === "held") return { kind: "refused", exitCode: EXIT.FAILED, message: describeHeldUpgradeLock(claim.holderPid) };
   try {
     await run();
   } finally {
-    if (claim.kind === "acquired") releaseAutoUpdateLock(request.lockPath ?? autoUpdateLock());
+    releaseAutoUpdateLock(request.lockPath ?? autoUpdateLock());
   }
   return { kind: "ran" };
 };
+var finishUpgradeWithLock = async (run, request) => {
+  const outcome = await withUpgradeLock(run, request);
+  if (outcome.kind === "refused") {
+    updateAutoUpdateState(request.statePath, { lastResult: "finish_pending", to: request.installedVersion, detail: outcome.message });
+  }
+  return outcome;
+};
 var describeUpgradeStart = (subject, latest) => `Upgrading ${subject.name} ${subject.version} -> ${latest ?? "latest"}`;
 var upgradeInstalledPackage = async (subject, effects) => {
   const pendingFinish = effects.hasPendingFinish(subject.version);
   const latest = await effects.fetchLatest(subject.name);
   const newerPublished = latest !== void 0 && isNewerVersion(latest, subject.version);
   if (pendingFinish && !newerPublished) {
-    const finish = effects.finish(subject);
+    const finish = await effects.finish(subject);
     if (finish.kind !== "finished") return { kind: "pending_finish_failed", finish };
     effects.recordFinished();
   }
@@ -368,7 +442,7 @@ var upgradeInstalledPackage = async (subject, effects) => {
   } catch (error) {
     return { kind: "install_failed", detail: npmErrorMessage(error) };
   }
-  return { kind: "installed", finish: effects.finish(subject) };
+  return { kind: "installed", finish: await effects.finish(subject) };
 };
 
 // bin/pushary-upgrade.ts
@@ -378,32 +452,32 @@ var detectInstallModes = () => {
     {
       label: "Cursor plugin",
       upgrade: "updates itself through Cursor",
-      present: existsSync2(cursorPluginDir())
+      present: existsSync3(cursorPluginDir())
     },
     {
       label: "VS Code plugin",
       upgrade: `${NPX_LATEST_COMMAND} setup --agents vscode`,
-      present: existsSync2(vscodePluginDir())
+      present: existsSync3(vscodePluginDir())
     },
     {
       label: "Codex config",
       upgrade: `${NPX_LATEST_COMMAND} setup --agents codex`,
-      present: existsSync2(codexConfigToml())
+      present: existsSync3(codexConfigToml())
     },
     {
       label: "Claude Code config",
       upgrade: `${NPX_LATEST_COMMAND} setup --agents claude_code`,
-      present: existsSync2(claudeJson())
+      present: existsSync3(claudeJson())
     },
     {
       label: "Gemini config",
       upgrade: `${NPX_LATEST_COMMAND} setup --agents gemini_cli`,
-      present: existsSync2(geminiSettings())
+      present: existsSync3(geminiSettings())
     },
     {
       label: "Hermes plugin (pip)",
       upgrade: `${NPX_LATEST_COMMAND} setup --agents hermes`,
-      present: existsSync2(join(homedir(), ".hermes"))
+      present: existsSync3(join2(homedir(), ".hermes"))
     }
   ];
   return candidates.filter((candidate) => candidate.present).map(({ label, upgrade }) => ({ label, upgrade }));
@@ -553,7 +627,7 @@ var upgradeSubject = async (subject) => {
       updateAutoUpdateState(autoUpdateState(), { lastResult: "updated", detail: void 0, announced: false });
     },
     announce: (line) => console.log(line),
-    install: (packageName) => installPackageGlobally({ packageName, version: LATEST_TAG, timeoutMs: 12e4 }),
+    install: (packageName) => installWithUpgradeLock({ packageName, version: LATEST_TAG, timeoutMs: 12e4 }),
     finish: (installedSubject) => finishGlobalUpgrade(installedSubject)
   });
   reportGlobalUpgrade(outcome);
@@ -571,15 +645,17 @@ var upgradeGlobalInstall = async () => {
   }
   await upgradeSubject(subject);
 };
-var runUnderUpgradeLock = async (run) => {
-  const locked = await withUpgradeLock(run);
+var reportUpgradeLock = (locked) => {
   if (locked.kind === "ran") return;
   console.error(locked.message);
   process.exitCode = locked.exitCode;
 };
 var main = async () => {
   if (process.argv.includes(FINISH_UPGRADE_FLAG)) {
-    await runUnderUpgradeLock(finishUpgrade);
+    reportUpgradeLock(await finishUpgradeWithLock(finishUpgrade, {
+      installedVersion: getPackageVersion(),
+      statePath: autoUpdateState()
+    }));
     return;
   }
   const autoFlag = parseAutoUpdateFlag(process.argv.slice(2));
@@ -596,6 +672,6 @@ var main = async () => {
     await runAutomaticUpdate();
     return;
   }
-  await runUnderUpgradeLock(upgradeGlobalInstall);
+  reportUpgradeLock(await withUpgradeLock(upgradeGlobalInstall));
 };
 main();

package/dist/bin/pushary-wait.js

@@ -4,33 +4,33 @@ import {
 } from "../chunk-CVWG2N3Y.js";
 import {
   exitOnFailedResponse
-} from "../chunk-NHCUXTEM.js";
+} from "../chunk-2V64X5RE.js";
 import {
   createIo
 } from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-CB23AO4D.js";
+} from "../chunk-K75TP4JY.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-DVW2MYCM.js";
-import "../chunk-2SLCHCVN.js";
-import "../chunk-4A3UQERT.js";
+import "../chunk-75CEJ4WP.js";
+import "../chunk-P6VDRQF3.js";
+import "../chunk-VV4SBPCQ.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-UPLV5AJF.js";
+import "../chunk-R76C43H7.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-ON5JW2HP.js";
-import "../chunk-35X5UDML.js";
-import "../chunk-5YY3IJT4.js";
+} from "../chunk-EG46RJRF.js";
+import "../chunk-SDSKTRIV.js";
+import "../chunk-4PCF34AB.js";
 
 // bin/pushary-wait.ts
 exitOnHelpFlag("wait");

package/dist/bin/pushary.js

@@ -1,23 +1,23 @@
 #!/usr/bin/env node
 import {
   installNetworkDefaults
-} from "../chunk-2SLCHCVN.js";
-import "../chunk-4A3UQERT.js";
+} from "../chunk-P6VDRQF3.js";
+import "../chunk-VV4SBPCQ.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-UPLV5AJF.js";
+import "../chunk-R76C43H7.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-ON5JW2HP.js";
+import "../chunk-EG46RJRF.js";
 import {
   COMMANDS,
   isCommandName,
   renderHelp
-} from "../chunk-35X5UDML.js";
+} from "../chunk-SDSKTRIV.js";
 import {
   getPackageVersion
-} from "../chunk-5YY3IJT4.js";
+} from "../chunk-4PCF34AB.js";
 
 // src/cli/runtime.ts
 var supportsRuntime = (version) => {

package/dist/{chunk-NHCUXTEM.js → chunk-2V64X5RE.js}

@@ -4,7 +4,7 @@ import {
 import {
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-DVW2MYCM.js";
+} from "./chunk-75CEJ4WP.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";

package/dist/{chunk-ZJYJAD52.js → chunk-3OFHFVPX.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-UPLV5AJF.js";
+} from "./chunk-R76C43H7.js";
 import {
   readJsonSafe
 } from "./chunk-T7E75EKA.js";