@pushary/agent-hooks 1.9.15 → 1.9.16

package/dist/bin/pushary-setup.js

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import {
   runBrowserLogin
-} from "../chunk-6LORREOI.js";
+} from "../chunk-DMJPRZVJ.js";
 import {
   coworkOutput,
   coworkSelection
-} from "../chunk-TMQMUGSN.js";
+} from "../chunk-R2FHKTD3.js";
 import "../chunk-PUZZELE6.js";
 import {
   clearDeclinedAgent,
   declinedAgentForSetupChoice
-} from "../chunk-2DCGUCPZ.js";
+} from "../chunk-CXXYHPN7.js";
 import {
   CURSOR_GATE_SCRIPT,
   describeVersionManagerPin,
@@ -20,17 +20,17 @@ import {
   codexTrustOutcome,
   describeCodexTrustConfirmation,
   needsCodexTrustStep
-} from "../chunk-CU7Y7Y4L.js";
+} from "../chunk-LYEXTD64.js";
 import {
   writeStdoutFully
 } from "../chunk-EO23EUOK.js";
 import {
   ensureCodexTrustsPusharyHooks
-} from "../chunk-LJJWNHUW.js";
+} from "../chunk-ISJ5ROXM.js";
 import {
   readManagedControlEvidence,
   waitForMachineReadiness
-} from "../chunk-7QZZK2YU.js";
+} from "../chunk-65OI53N7.js";
 import {
   describeSetupSideEffects,
   installAgentSkill,
@@ -44,7 +44,7 @@ import {
   soleGateFile,
   soleGateReceipt,
   soleGateReceiptFile
-} from "../chunk-H5YC7H6V.js";
+} from "../chunk-HKSH4KWI.js";
 import {
   HERMES_PIP_PACKAGE,
   describeDetection,
@@ -57,7 +57,7 @@ import {
   runHermesConfigScript,
   shortenHome,
   vscodeSettingsTargets
-} from "../chunk-ZMUDVPOT.js";
+} from "../chunk-LJJLMU5B.js";
 import {
   AgentConfigError,
   FX_PUSHARY_TOOLS_RULE,
@@ -68,12 +68,14 @@ import {
   agentFailureWire,
   configFailureKind,
   configureFxSettings,
+  describeMacAccountMismatch,
   describedAgentFailure,
   failedAgentsContext,
   fxIgnoresInstructionsFile,
   fxInstructionsBody,
   fxPusharyEntry,
   inspectFxInstallation,
+  matchMacAccountStep,
   readFxProfileForSetup,
   renderAgentInstructions,
   renderProjectAgentInstructions,
@@ -81,10 +83,10 @@ import {
   withFxPusharyServer,
   writeFxProfile,
   writeInstructionBlock
-} from "../chunk-NDZBDXU3.js";
+} from "../chunk-HDQAN2C3.js";
 import {
   MCP_BRIDGE_BINARY
-} from "../chunk-D72OJS4S.js";
+} from "../chunk-WVSECXIM.js";
 import {
   checkCodexInstall,
   detectProviderLiveCapabilities,
@@ -92,14 +94,14 @@ import {
   hasSpawnProvider,
   nodeCodexInstallProbe,
   resolveControlPolicy
-} from "../chunk-JC3AGMOP.js";
+} from "../chunk-W2AUU35K.js";
 import {
   detectClaudeVersion
 } from "../chunk-RIVNNBEK.js";
 import {
   describeAutoUpdateAnnouncement,
   takeAutoUpdateAnnouncement
-} from "../chunk-6MLSXBNR.js";
+} from "../chunk-JNZU2F5B.js";
 import {
   DAEMON_COLD_START_TIMEOUT_MS,
   clearDaemonNeedsLogin,
@@ -113,29 +115,29 @@ import {
   replaceDaemonService,
   stopDaemonService,
   waitForDaemonRemoteProof
-} from "../chunk-TFV6RATK.js";
+} from "../chunk-PZ33VQ54.js";
 import {
   transcriptPreferenceForSetup
-} from "../chunk-HSVJ62BE.js";
+} from "../chunk-JF2XRQR2.js";
 import "../chunk-XHKBHWLX.js";
 import {
   BROWSER_CONNECT_COMMAND,
   confirmAppConnection,
   connectDevice,
   connectViaAppPairing,
-  describeRoundTrip,
+  describeRoundTripOutcome,
   pairingEscapeApplies,
   printConnectInstructions,
   roundTripEvidence,
   verifyRoundTrip
-} from "../chunk-YOHPJNFW.js";
+} from "../chunk-4MOOSU5Y.js";
 import "../chunk-3EGEA4KH.js";
 import {
   setHumanStream
 } from "../chunk-QCGNGEGE.js";
 import {
   readMacAppAgentKey
-} from "../chunk-6WECKO24.js";
+} from "../chunk-EDXJEQCK.js";
 import {
   OPENCODE_HOOK_BINARY,
   addOpenCodeMcpServer,
@@ -151,12 +153,12 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   openCodeWired
-} from "../chunk-NDKFHLJI.js";
+} from "../chunk-HBDZYQZX.js";
 import {
   ansiPainter,
   createIo,
   useColor
-} from "../chunk-U4TMAANR.js";
+} from "../chunk-FO3MDD26.js";
 import {
   addClaudeMcpServer,
   addCompatibleHooks,
@@ -173,7 +175,7 @@ import {
   hasCompatibleHooks,
   isClaudeMcpSnapshot,
   updateClaudeMcpSnapshot
-} from "../chunk-ME55HQOI.js";
+} from "../chunk-PVOOKOKX.js";
 import {
   KEEP_HINT,
   captureHookTakeover,
@@ -186,19 +188,19 @@ import {
   mcpBearerKey,
   planHooks,
   pusharyHookExecutable
-} from "../chunk-FZW7Q7GM.js";
+} from "../chunk-ZOMVMLMU.js";
 import {
   GEMINI_HOOK_BINARY,
   addGeminiHooks,
   addGeminiMcpServer
-} from "../chunk-VP6WDFVO.js";
+} from "../chunk-EDEIIKCV.js";
 import {
   AGENT_CHOICES,
   effectiveControlMode,
   effectiveVerify,
   parseSetupOptions
 } from "../chunk-YKYFFCB5.js";
-import "../chunk-7VOEZPJ4.js";
+import "../chunk-QJYBHKHO.js";
 import "../chunk-GMXKITVA.js";
 import {
   compareVersion,
@@ -216,28 +218,28 @@ import {
   recordMacAppKeyPrefix,
   resolveShellRc,
   writeKey
-} from "../chunk-5EWNGYFD.js";
+} from "../chunk-DUDI3Z7F.js";
 import {
   reportEvent
-} from "../chunk-IQCNOEQL.js";
+} from "../chunk-IHPSFUL2.js";
 import "../chunk-52JA2WTH.js";
-import "../chunk-YL6HU2KF.js";
+import "../chunk-7EBZRHIH.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-SYLJL63X.js";
+import "../chunk-S2LU6HIZ.js";
 import {
   checkApiKey,
   describeKeyCheck,
   samePusharyAccount
-} from "../chunk-PSWFYNOX.js";
-import "../chunk-3FQCZSEQ.js";
-import "../chunk-NA5D62OI.js";
+} from "../chunk-BARUIIUR.js";
+import "../chunk-3DZG5EXY.js";
+import "../chunk-XIJMMY6M.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-VKTDXQGH.js";
+import "../chunk-VKYDON4A.js";
 import {
   NpmMissingError,
   addCodexHookTrust,
@@ -274,7 +276,7 @@ import {
   hermesConfigReceipt,
   hookTakeoverReceipt,
   installGlobally,
-  npmErrorMessage,
+  npmInstallFailure,
   plannedGlobalPackage,
   pusharyConfigFile,
   readCodexMcpAuth,
@@ -282,18 +284,18 @@ import {
   resolveGlobalBinary,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-HJL5RBOU.js";
+} from "../chunk-5ETPCIG4.js";
 import {
   backupFile,
   readJsonSafe,
   writeFileAtomic,
   writeJsonAtomic
 } from "../chunk-T7E75EKA.js";
-import "../chunk-HTO2XULO.js";
+import "../chunk-PJNZJPPX.js";
 import {
   NPX_LATEST_COMMAND,
   renderCommandHelp
-} from "../chunk-PNUWMEIY.js";
+} from "../chunk-OIAZ2QAC.js";
 import {
   HOOK_COMPATIBLE_PROFILES,
   PRETOOLUSE_GATED_TOOLS,
@@ -321,6 +323,270 @@ import { parse as parseTOML, stringify as stringifyTOML } from "smol-toml";
 // src/cli/exit.ts
 var isExitPromptError = (err) => err instanceof Error && (err.name === "ExitPromptError" || err.message.includes("User force closed") || /force closed the prompt/i.test(err.message));
 
+// ../contracts/src/billing.ts
+var PARTNER_SELF_SERVE_PLANS = ["partner_launch", "partner_growth", "partner_scale"];
+var PARTNER_PLAN_TYPES = ["partner", ...PARTNER_SELF_SERVE_PLANS];
+var PLAN_TYPES = ["free", "agent", "agent_pro", "team", "partner", "starter", "growth", "pro", "enterprise", ...PARTNER_SELF_SERVE_PLANS];
+var PAID_PLAN_TYPES = ["agent", "agent_pro", "team", "partner", "starter", "growth", "pro", ...PARTNER_SELF_SERVE_PLANS];
+var PLAN_CONFIGS = {
+  free: {
+    name: "Free",
+    price: 0,
+    priceId: null,
+    limits: {
+      subscribers: 100,
+      notifications: 500,
+      sites: 1,
+      members: 1,
+      campaigns: 25,
+      dataRetentionDays: 7
+    },
+    features: {
+      abTesting: false,
+      apiAccess: false,
+      prioritySupport: false
+    }
+  },
+  agent: {
+    name: "Agent",
+    price: 9.99,
+    priceId: null,
+    limits: {
+      subscribers: 3,
+      notifications: 5e3,
+      sites: 1,
+      members: 1,
+      campaigns: 0,
+      dataRetentionDays: 30
+    },
+    features: {
+      abTesting: false,
+      apiAccess: true,
+      prioritySupport: false
+    }
+  },
+  agent_pro: {
+    name: "Agent Pro",
+    price: 19.99,
+    priceId: null,
+    limits: {
+      subscribers: 5,
+      notifications: Infinity,
+      sites: 1,
+      members: 5,
+      campaigns: 0,
+      dataRetentionDays: 90
+    },
+    features: {
+      abTesting: false,
+      apiAccess: true,
+      prioritySupport: true
+    }
+  },
+  team: {
+    name: "Team",
+    price: 59.99,
+    priceId: null,
+    limits: {
+      subscribers: 25,
+      notifications: Infinity,
+      sites: 1,
+      members: 10,
+      campaigns: 0,
+      dataRetentionDays: 365
+    },
+    features: {
+      abTesting: false,
+      apiAccess: true,
+      prioritySupport: true
+    }
+  },
+  partner: {
+    name: "Partner",
+    price: 99,
+    priceId: null,
+    limits: {
+      subscribers: 25e3,
+      notifications: 1e5,
+      sites: 1,
+      members: 10,
+      campaigns: 0,
+      dataRetentionDays: 365
+    },
+    features: {
+      abTesting: false,
+      apiAccess: true,
+      prioritySupport: true
+    }
+  },
+  partner_launch: {
+    name: "Partner Launch",
+    price: 99,
+    priceId: null,
+    limits: {
+      subscribers: 5e3,
+      // Closed until request admission and fan-out accounting ship. Never sell
+      // human requests against the legacy notification-delivery counter.
+      notifications: 0,
+      humanDecisionRequests: 25e3,
+      sites: 1,
+      members: 3,
+      campaigns: 0,
+      dataRetentionDays: 90
+    },
+    features: { abTesting: false, apiAccess: true, prioritySupport: false }
+  },
+  partner_growth: {
+    name: "Partner Growth",
+    price: 299,
+    priceId: null,
+    limits: {
+      subscribers: 25e3,
+      // Closed until request admission and fan-out accounting ship. Never sell
+      // human requests against the legacy notification-delivery counter.
+      notifications: 0,
+      humanDecisionRequests: 1e5,
+      sites: 1,
+      members: 10,
+      campaigns: 0,
+      dataRetentionDays: 365
+    },
+    features: { abTesting: false, apiAccess: true, prioritySupport: true }
+  },
+  partner_scale: {
+    name: "Partner Scale",
+    price: 799,
+    priceId: null,
+    limits: {
+      subscribers: 1e5,
+      // Closed until request admission and fan-out accounting ship. Never sell
+      // human requests against the legacy notification-delivery counter.
+      notifications: 0,
+      humanDecisionRequests: 5e5,
+      sites: 1,
+      members: 25,
+      campaigns: 0,
+      dataRetentionDays: 730
+    },
+    features: { abTesting: false, apiAccess: true, prioritySupport: true }
+  },
+  starter: {
+    name: "Starter",
+    price: 29,
+    priceId: null,
+    limits: {
+      subscribers: 5e3,
+      notifications: 25e3,
+      sites: 3,
+      members: 5,
+      campaigns: 250,
+      dataRetentionDays: 30
+    },
+    features: {
+      abTesting: true,
+      apiAccess: true,
+      prioritySupport: false
+    }
+  },
+  growth: {
+    name: "Growth",
+    price: 99,
+    priceId: null,
+    limits: {
+      subscribers: 25e3,
+      notifications: 1e5,
+      sites: 10,
+      members: 15,
+      campaigns: Infinity,
+      dataRetentionDays: 90
+    },
+    features: {
+      abTesting: true,
+      apiAccess: true,
+      prioritySupport: true
+    }
+  },
+  pro: {
+    name: "Pro",
+    price: 149,
+    priceId: null,
+    limits: {
+      subscribers: 1e5,
+      notifications: 5e5,
+      sites: 25,
+      members: 50,
+      campaigns: Infinity,
+      dataRetentionDays: 180
+    },
+    features: {
+      abTesting: true,
+      apiAccess: true,
+      prioritySupport: true
+    }
+  },
+  enterprise: {
+    name: "Enterprise",
+    price: -1,
+    priceId: null,
+    limits: {
+      subscribers: Infinity,
+      notifications: Infinity,
+      sites: Infinity,
+      members: Infinity,
+      campaigns: Infinity,
+      dataRetentionDays: Infinity
+    },
+    features: {
+      abTesting: true,
+      apiAccess: true,
+      prioritySupport: true
+    }
+  }
+};
+
+// src/setup/key-account.ts
+var agentConfigKeySource = (macAppInstalled) => macAppInstalled ? "mac-app" : "agent-settings";
+var pickReusableKey = (candidates) => {
+  if (candidates.storedKey !== null && candidates.storedCheck !== null) {
+    return { source: "stored", key: candidates.storedKey, check: candidates.storedCheck };
+  }
+  if (candidates.envKey && candidates.envCheck !== null) {
+    return { source: "environment", key: candidates.envKey, check: candidates.envCheck };
+  }
+  if (candidates.agentConfigKey !== null && candidates.agentConfigCheck !== null) {
+    return { source: agentConfigKeySource(candidates.macAppInstalled), key: candidates.agentConfigKey, check: candidates.agentConfigCheck };
+  }
+  return null;
+};
+var REUSED_KEY_SOURCE_LABELS = {
+  stored: "the key saved on this machine",
+  environment: "the key in PUSHARY_API_KEY",
+  "mac-app": "the key Pushary for Mac is signed in with",
+  "agent-settings": "a key found in your agent settings"
+};
+var maskKey = (key) => `${key.slice(0, 8)}...${key.slice(-4)}`;
+var describeFoundKey = (reusable) => `Found ${REUSED_KEY_SOURCE_LABELS[reusable.source]}: ${maskKey(reusable.key)}`;
+var describeUsedKey = (reusable) => `Using ${REUSED_KEY_SOURCE_LABELS[reusable.source]}: ${maskKey(reusable.key)}`;
+var keyReuseConfirmation = (context) => context.stdoutIsTty && !context.nonInteractive && !context.dryRun && context.canPairWithApp ? "ask" : "announce";
+var accountHandleOf = (identity) => identity.siteSlug ? `@${identity.siteSlug}` : identity.siteName || null;
+var keyAccountHandle = (check2) => check2.kind === "ok" ? accountHandleOf(check2.identity) : null;
+var continueAsQuestion = (account) => account ? `Continue as ${account}?` : "Continue with this key?";
+var WRONG_ACCOUNT_HINT = `Wrong account? Run ${NPX_LATEST_COMMAND} setup --connect app`;
+var planNameOf = (plan) => {
+  const known = PLAN_TYPES.find((type) => type === plan);
+  return known ? PLAN_CONFIGS[known].name : null;
+};
+var describeSignedIn = (identity) => {
+  const account = accountHandleOf(identity) ?? "your account";
+  const planName = planNameOf(identity.plan);
+  return planName ? `Signed in to ${account} (${planName} plan)` : `Signed in to ${account}`;
+};
+var describeLockedKeyAccount = (key, account) => account ? `${account} has no active plan.` : `The key ${maskKey(key)} is on an account with no active plan.`;
+
+// src/setup/service-notice.ts
+var PHONE_START_OPT_OUT = "Turn it off with --control off.";
+var describeServiceInstall = (servicePresent) => servicePresent ? `Updating the background service that lets your phone start agents. ${PHONE_START_OPT_OUT}` : `Installing a background service so your phone can start agents. ${PHONE_START_OPT_OUT}`;
+
 // src/setup/phone-check.ts
 var planPhoneCheck = (context) => {
   if (context.locked) return "locked";
@@ -334,6 +600,23 @@ var planPhoneCheck = (context) => {
 
 // src/setup/closing.ts
 var ACTIVITY_URL = "pushary.com/dashboard/agent/activity";
+var TRANSCRIPT_SYNC_NOTICE = `Transcripts sync redacted and encrypted. Your phone can decrypt them; authorized Pushary compliance admins can recover them for documented legal obligations. Turn off: ${NPX_LATEST_COMMAND} setup --transcripts off`;
+var PAIR_PHONE_APP_HINT = `${NPX_LATEST_COMMAND} setup --connect app   pair the Pushary app on your phone`;
+var RESTART_AGENTS_LINE = "Restart any open agent sessions so they pick up Pushary.";
+var ANSWERING_DEVICES = {
+  mobile_app: "Your phone",
+  mobile_background: "Your phone",
+  mac_app: "Your Mac"
+};
+var SIMULATED_ANSWER_HEADLINE = "Agents configured. The test answer was simulated.";
+var answerSeconds = (latencyMs) => Math.max(1, Math.round(latencyMs / 1e3));
+var describeAnsweredHeadline = (answer) => {
+  if (!answer) return "You're set. The test question was answered.";
+  if (answer.answerSource === "sandbox") return SIMULATED_ANSWER_HEADLINE;
+  const device = answer.answerSource ? ANSWERING_DEVICES[answer.answerSource] : void 0;
+  const seconds = answerSeconds(answer.latencyMs);
+  return device ? `You're set. ${device} answered in ${seconds}s.` : `You're set. The test question was answered in ${seconds}s.`;
+};
 var COMMAND_SURFACE = [
   { command: "pushary status", summary: "what this machine is connected to" },
   { command: "pushary mode", summary: "choose where approval requests appear" },
@@ -353,14 +636,13 @@ var nextSteps = (facts, reachable) => {
     lines.push("Transcripts: disabled on this machine.");
     lines.push("pushary setup --transcripts on    enable encrypted transcript sync");
   } else {
-    lines.push("Transcripts: Pushary-launched Claude, Codex and Gemini sessions sync redacted, encrypted content. Your phone can decrypt it; authorized Pushary compliance admins can recover it for documented legal obligations.");
-    lines.push("pushary setup --transcripts off   disable transcript sync on this machine");
+    lines.push(TRANSCRIPT_SYNC_NOTICE);
   }
   if (facts.completed.includes("claude_code")) {
     lines.push("pushary claude          launch a managed Claude Code session");
   }
   if (!reachable) {
-    lines.push("pushary pair            pair a phone without re-running setup");
+    lines.push(PAIR_PHONE_APP_HINT);
   }
   lines.push("pushary doctor          re-check everything");
   return lines;
@@ -415,8 +697,8 @@ var describeClosing = (facts) => {
   if (facts.roundTripAnswered === true) {
     return {
       ok: true,
-      headline: "Agents configured. Synthetic answer returned.",
-      next: ["Agent hook activation remains unverified.", ...nextSteps(facts, reachable), "", `Approvals: ${ACTIVITY_URL}`],
+      headline: describeAnsweredHeadline(facts.roundTripAnswer),
+      next: [RESTART_AGENTS_LINE, ...nextSteps(facts, reachable), "", `Approvals: ${ACTIVITY_URL}`],
       exitCode: EXIT.OK,
       reason: "synthetic-answer"
     };
@@ -473,13 +755,26 @@ var describeClosing = (facts) => {
 };
 var RETRY_AGENT_LABEL = "Retry just this agent:";
 var INSTALL_NODE_STEP = "Install the current Node.js LTS, which includes npm, then run setup again.";
-var nextStepFor = (failure) => failure.remedy === "install-node" ? { kind: "install-node", instruction: INSTALL_NODE_STEP } : { kind: "retry-agent", command: retryAgentCommand(failure.agent) };
+var NPM_PREFIX_STEP = "npm can't install globally here. Use nvm, or run: npm config set prefix ~/.npm-global, then run setup again.";
+var nextStepFor = (failure) => {
+  switch (failure.remedy) {
+    case "install-node":
+      return { kind: "install-node", instruction: INSTALL_NODE_STEP };
+    case "fix-npm-prefix":
+      return { kind: "fix-npm-prefix", instruction: NPM_PREFIX_STEP };
+    case "match-mac-account":
+      return { kind: "match-mac-account", instruction: matchMacAccountStep(failure.agent, null) };
+    case "retry-agent":
+      return { kind: "retry-agent", command: retryAgentCommand(failure.agent) };
+  }
+};
 var describeAgentFailures = (failures, agentName) => failures.map((failure) => ({
   summary: `${agentName(failure.agent)}: ${failure.detail}`,
   next: nextStepFor(failure)
 }));
 var agentFailureFollowUps = (failures) => [
   ...failures.some((failure) => failure.remedy === "install-node") ? ["install-node"] : [],
+  ...failures.some((failure) => failure.remedy === "fix-npm-prefix") ? ["fix-npm-prefix"] : [],
   ...failures.some((failure) => failure.remedy === "retry-agent") ? ["run-doctor"] : []
 ];
 var unverifiedKeyClosingReason = (facts) => {
@@ -791,7 +1086,7 @@ var formatError = (err) => {
   if (err instanceof Error) {
     const errWithSignal = err;
     if (errWithSignal.killed && errWithSignal.signal === "SIGTERM") {
-      return "timed out \u2014 check your network connection";
+      return "timed out, check your network connection";
     }
     return err.message;
   }
@@ -823,7 +1118,7 @@ var installGlobally2 = async () => {
     try {
       await installGlobally({ version });
     } catch (err) {
-      throw err instanceof NpmMissingError ? err : new Error(npmErrorMessage(err));
+      throw err instanceof NpmMissingError ? err : npmInstallFailure(err);
     }
   });
   globalInstallReady = true;
@@ -1568,10 +1863,10 @@ var setupCustom = async (apiKey, context) => {
     console.log(`  ${dim(`Use the key saved in ${PUSHARY_CONFIG_FILE} wherever`)} ${cyan("$PUSHARY_API_KEY")} ${dim("appears below.")}`);
   }
   console.log();
-  console.log(`  ${dim("MCP clients (Windsurf, LangChain, custom) \u2014 add this server:")}`);
+  console.log(`  ${dim("For MCP clients (Windsurf, LangChain, custom), add this server:")}`);
   console.log(`  ${cyan("https://pushary.com/api/mcp/mcp")} ${dim("with header")} ${cyan("Authorization: Bearer $PUSHARY_API_KEY")}`);
   console.log();
-  console.log(`  ${dim("No-code / HTTP (n8n, Zapier, scripts) \u2014 ask a human and wait:")}`);
+  console.log(`  ${dim("For no-code or HTTP (n8n, Zapier, scripts), ask a human and wait:")}`);
   console.log(`  ${dim("POST")} ${cyan("https://pushary.com/api/v1/server/ask")} ${dim("body")} ${cyan('{"question":"Approve?","type":"confirm","wait":true}')}`);
   console.log();
   console.log(`  ${dim("Full guide:")} ${cyan("https://pushary.com/docs/agents/connect-any-agent")}`);
@@ -1870,7 +2165,7 @@ var offerProjectInstructions = async (agents, options) => {
   if (targets.length === 0 || !process.stdout.isTTY || options.nonInteractive) return;
   console.log();
   const wanted = await confirm({
-    message: "Add Pushary instructions to this project's CLAUDE.md/AGENTS.md so your whole team's agents can use phone approvals?",
+    message: `Add a Pushary section to ${targets.map((target) => target.file).join(" and ")} in this folder? It tells agents here to ask through Pushary.`,
     default: false
   });
   if (!wanted) return;
@@ -1890,7 +2185,7 @@ var offerClaudeAlias = async (options) => {
     return;
   }
   const wanted = await confirm({
-    message: `Make plain ${bold("claude")} reachable from your phone by default? (adds an alias to ${basename(rc.path)}, reversible)`,
+    message: `Start ${bold("claude")} through Pushary, so your phone can reach idle sessions? This adds an alias to ${basename(rc.path)}.`,
     default: false
   });
   if (!wanted) return;
@@ -1924,8 +2219,7 @@ var verifyKeyOrExit = async (apiKey, options, precomputed) => {
     process.exit(await abortWith("key-refused", report.exitCode, result.kind));
   }
   if (result.kind === "ok") {
-    const { siteSlug, siteName, plan } = result.identity;
-    console.log(`  ${check} Key verified ${dim(`(${siteSlug || siteName} \xB7 plan ${plan})`)}`);
+    console.log(`  ${check} ${describeSignedIn(result.identity)}`);
   } else {
     console.log(`  ${yellow("!")} ${report.message}`);
     for (const line of report.next) console.log(`  ${dim(line)}`);
@@ -1954,6 +2248,14 @@ var usableStoredKey = async (apiKey) => {
   }
   return result.kind === "rejected" || result.kind === "malformed" ? null : result;
 };
+var acceptReusableKey = async (reusable, confirmation) => {
+  if (confirmation === "announce") {
+    console.log(`  ${check} ${describeUsedKey(reusable)}`);
+    return true;
+  }
+  console.log(`  ${describeFoundKey(reusable)}`);
+  return confirm({ message: continueAsQuestion(keyAccountHandle(reusable.check)), default: true });
+};
 var AGENT_NAMES = {
   claude_code: "Claude Code",
   codex: "Codex",
@@ -1980,6 +2282,22 @@ var AGENT_CAPABILITIES = {
 };
 var failedAgentNames = (failures) => failures.map((failure) => AGENT_NAMES[failure.agent]);
 var agentFailureNextLine = (next) => next.kind === "retry-agent" ? `${dim(RETRY_AGENT_LABEL)} ${cyan(next.command)}` : next.instruction;
+var NO_ANSWER_YET = "No answer yet";
+var roundTripAnswerOf = (outcome) => outcome?.kind === "answered" ? { latencyMs: outcome.latencyMs, answerSource: outcome.answerSource } : null;
+var roundTripSpinnerEnd = (outcome) => {
+  const report = describeRoundTripOutcome(outcome);
+  return report.ok ? { ok: true, label: report.message } : { ok: false, label: NO_ANSWER_YET };
+};
+var agentFailureFollowUpLine = (followUp) => {
+  switch (followUp) {
+    case "install-node":
+      return INSTALL_NODE_STEP;
+    case "fix-npm-prefix":
+      return NPM_PREFIX_STEP;
+    case "run-doctor":
+      return `${dim("Run")} ${NPX_LATEST_COMMAND} doctor ${dim("for the reason, or send it to")} ${SUPPORT_EMAIL}`;
+  }
+};
 var printAgentFailures = (failures) => {
   for (const failure of describeAgentFailures(failures, (agent) => AGENT_NAMES[agent])) {
     console.log(`  ${yellow("!")} ${failure.summary}`);
@@ -2062,10 +2380,10 @@ var AGENT_TARGETS = {
 };
 var reportDryRun = (apiKey, agents, keyCheck, controlMode) => {
   console.log();
-  console.log(`  ${bold("Dry run")} ${dim("\u2014 nothing below has been written")}`);
+  console.log(`  ${bold("Dry run.")} ${dim("Nothing below has been written.")}`);
   console.log();
   console.log(
-    apiKey ? `  ${dim("Key:")}        ${dim(`${apiKey.slice(0, 8)}...${apiKey.slice(-4)}`)} ${dim(`(${keyCheck?.kind ?? "not verified"})`)}` : `  ${dim("Key:")}        ${dim("none on this machine \u2014 a real run would acquire one")}`
+    apiKey ? `  ${dim("Key:")}        ${dim(`${apiKey.slice(0, 8)}...${apiKey.slice(-4)}`)} ${dim(`(${keyCheck?.kind ?? "not verified"})`)}` : `  ${dim("Key:")}        ${dim("none on this machine. A real run would acquire one.")}`
   );
   console.log(`  ${dim("Key store:")}  ${PUSHARY_CONFIG_FILE}`);
   console.log(`  ${dim("Control:")}    ${controlMode}`);
@@ -2153,37 +2471,35 @@ var main = async () => {
   storedKey !== envKey ? await usableStoredKey(storedKey) : null;
   const appKey = ambientEligible && envCheck === null && storedCheck === null ? pickAppKey({ fromAgents: AGENT_CHOICES.map(appMcpKeyIfReadable), storedKey, envKey }) : null;
   const appKeyCheck = appKey === null ? null : await usableStoredKey(appKey);
+  const appBridgeAvailable = macAppBridgeAvailable();
+  const canPairWithApp = canShowPairingQr() && !options.skipPhone;
+  const keyReuse = keyReuseConfirmation({
+    stdoutIsTty: process.stdout.isTTY === true,
+    nonInteractive: options.nonInteractive,
+    dryRun: options.dryRun,
+    canPairWithApp
+  });
+  const reusable = pickReusableKey({
+    storedKey,
+    storedCheck,
+    envKey,
+    envCheck,
+    agentConfigKey: appKey,
+    agentConfigCheck: appKeyCheck,
+    macAppInstalled: appBridgeAvailable
+  });
+  const reuseAccepted = reusable !== null && await acceptReusableKey(reusable, keyReuse);
+  const reuseDeclined = reusable !== null && !reuseAccepted;
   let storedKeyCheck = null;
+  let pairedHandle = null;
   if (flagKey) {
     const masked = `${flagKey.slice(0, 8)}...${flagKey.slice(-4)}`;
     console.log(`  ${check} Using API key: ${dim(masked)}`);
     console.log();
     trimmedKey = flagKey;
-  } else if (storedKey !== null && storedCheck !== null) {
-    const masked = `${storedKey.slice(0, 8)}...${storedKey.slice(-4)}`;
-    console.log(`  ${check} Using the key already on this machine: ${dim(masked)}`);
-    console.log(`  ${dim(PUSHARY_CONFIG_FILE)}`);
-    console.log();
-    trimmedKey = storedKey;
-    storedKeyCheck = storedCheck;
-  } else if (envKey && envCheck !== null) {
-    const masked = `${envKey.slice(0, 8)}...${envKey.slice(-4)}`;
-    console.log(`  ${check} Found API key in environment: ${dim(masked)}`);
-    console.log();
-    const useExisting = options.nonInteractive || options.dryRun ? true : await confirm({ message: "Use this key?", default: true });
-    if (useExisting) {
-      trimmedKey = envKey;
-      storedKeyCheck = envCheck;
-    } else {
-      const apiKey = await input({ message: "API key:" });
-      trimmedKey = apiKey.trim();
-    }
-  } else if (appKey !== null && appKeyCheck !== null) {
-    const masked = `${appKey.slice(0, 8)}...${appKey.slice(-4)}`;
-    console.log(`  ${check} Using the key the Pushary Mac app is signed in with: ${dim(masked)}`);
-    console.log();
-    trimmedKey = appKey;
-    storedKeyCheck = appKeyCheck;
+  } else if (reusable !== null && reuseAccepted) {
+    trimmedKey = reusable.key;
+    storedKeyCheck = reusable.check;
   } else if (options.dryRun) {
     console.log(`  ${dim("No key on this machine. A real run would connect one first.")}`);
     console.log();
@@ -2192,18 +2508,16 @@ var main = async () => {
     reportDryRun(null, plannedAgents, null, controlMode);
     await emitJson(options, { ok: true, dryRun: true, agents: plannedAgents, control: controlMode, keyCheck: "skipped", key: "none" });
     return;
-  } else if (connectMode === "app" && canShowPairingQr() && !options.skipPhone) {
-    console.log(`  ${dim("Pairing with your Pushary app.")}`);
-    console.log(`  ${dim("No app yet? Get it at")} ${cyan("https://pushary.com/download")}${dim(", this keeps waiting.")}`);
-    console.log(`  ${dim("No phone? Ctrl-C, then:")} ${cyan(BROWSER_CONNECT_COMMAND)}`);
+  } else if (connectMode === "app" && canPairWithApp) {
+    if (reuseDeclined) console.log();
     markStep("pair");
     const previous = readKeySource();
     const computer = pairingComputerOf(hostname(), process.platform, detectedAgentChoices());
     const paired = await connectViaAppPairing({
       computer,
-      onCancelled: async () => {
+      onCancelled: async (exitCode2) => {
         printPairingEscape();
-        await reportSetupAbort("pairing-cancelled", 130);
+        await reportSetupAbort("pairing-cancelled", exitCode2);
       }
     });
     if (paired.kind === "failed") {
@@ -2212,8 +2526,9 @@ var main = async () => {
     }
     trimmedKey = paired.apiKey;
     keyFromPairing = true;
-    if (paired.handle) {
-      console.log(`  ${check} Connected to ${cyan("@" + paired.handle)}`);
+    pairedHandle = paired.handle ? `@${paired.handle}` : null;
+    if (pairedHandle) {
+      console.log(`  ${check} Connected to ${cyan(pairedHandle)}`);
     }
     if (previous.key && previous.key !== trimmedKey) {
       console.log(`  ${yellow("!")} The key this machine used before (${keyPrefix(previous.key)}) is still active.`);
@@ -2275,24 +2590,26 @@ var main = async () => {
   if (!options.dryRun) recordSetupKey(trimmedKey);
   markStep("verify-key");
   const keyCheck = await verifyKeyOrExit(trimmedKey, options, storedKeyCheck ?? void 0);
-  markStep("resolve-agents");
-  const agents = await resolveAgents(options);
+  if (reuseAccepted && keyReuse === "announce") console.log(`  ${dim(WRONG_ACCOUNT_HINT)}`);
   if (options.dryRun) {
-    reportDryRun(trimmedKey, agents, keyCheck, controlMode);
-    await emitJson(options, { ok: true, dryRun: true, agents, control: controlMode, keyCheck: keyCheck?.kind ?? "skipped" });
+    markStep("resolve-agents");
+    const plannedAgents = await resolveAgents(options);
+    reportDryRun(trimmedKey, plannedAgents, keyCheck, controlMode);
+    await emitJson(options, { ok: true, dryRun: true, agents: plannedAgents, control: controlMode, keyCheck: keyCheck?.kind ?? "skipped" });
     return;
   }
   markStep("save-key");
   const transcriptSync = transcriptPreferenceForSetup(options.transcripts);
   if (transcriptSync) {
     console.log();
-    console.log("  Transcript sync: enabling locally redacted, encrypted sync for Pushary-launched sessions. Your phone can decrypt it; authorized Pushary compliance admins can recover it for documented legal obligations. Disable with pushary setup --transcripts off.");
+    console.log(`  ${TRANSCRIPT_SYNC_NOTICE}`);
   }
   const rc = await saveApiKey(trimmedKey, controlMode, transcriptSync);
   if (trimmedKey === appKey) recordMacAppKeyPrefix(trimmedKey);
   if (keyCheck.kind === "ok") clearDaemonNeedsLogin();
+  markStep("resolve-agents");
+  const agents = await resolveAgents(options);
   const context = { rc };
-  const appBridgeAvailable = macAppBridgeAvailable();
   const accountChecks = /* @__PURE__ */ new Map();
   if (keyCheck) accountChecks.set(trimmedKey, Promise.resolve(keyCheck));
   const accountCheckFor = (key) => {
@@ -2302,15 +2619,20 @@ var main = async () => {
     accountChecks.set(key, pending);
     return pending;
   };
-  const appAccountMatches = async (agent) => {
-    const appKey2 = appWiringAccountKeyFor(agent);
-    if (!appKey2) return false;
-    if (appKey2 === trimmedKey) return true;
+  const setupAccount = keyAccountHandle(keyCheck);
+  const compareAppAccount = async (agent) => {
+    const wiringKey = appWiringAccountKeyFor(agent);
+    if (!wiringKey) return { matches: false, setupAccount, macAccount: null };
+    if (wiringKey === trimmedKey) return { matches: true, setupAccount, macAccount: setupAccount };
     const [cliAccount, appAccount] = await Promise.all([
       accountCheckFor(trimmedKey),
-      accountCheckFor(appKey2)
+      accountCheckFor(wiringKey)
     ]);
-    return samePusharyAccount(cliAccount, appAccount);
+    return {
+      matches: samePusharyAccount(cliAccount, appAccount),
+      setupAccount: keyAccountHandle(cliAccount),
+      macAccount: keyAccountHandle(appAccount)
+    };
   };
   const staleEnvironmentKey = Boolean(envKey && envKey !== trimmedKey);
   if (envKey && staleEnvironmentKey) {
@@ -2335,14 +2657,19 @@ var main = async () => {
         const plan = planHooks({ owner: ownerBefore, takeOverHooks: options.takeOverHooks, nonInteractive: options.nonInteractive });
         const keepAppWiring = plan === "keep";
         if (keepAppWiring) {
-          if (!await appAccountMatches(agent)) {
+          const account = await compareAppAccount(agent);
+          if (!account.matches) {
             hookOwners.push({ agent, owner: "app", kept: true });
-            const failure = describedAgentFailure(agent, "app-account-mismatch");
-            failures.push(failure);
+            failures.push(describedAgentFailure(agent, "app-account-mismatch"));
+            const [summary, ...steps] = describeMacAccountMismatch({
+              agent,
+              agentName: AGENT_NAMES[agent],
+              setupAccount: account.setupAccount,
+              macAccount: account.macAccount
+            });
             console.log(`
-  ${yellow("!")} ${AGENT_NAMES[agent]}: ${failure.detail}`);
-            console.log(`  ${dim("Sign the Mac app into the same account and repair this agent, then re-run setup.")}`);
-            console.log(`  ${dim("Or pass --take-over-hooks if you intentionally want the CLI to own these hooks.")}`);
+  ${yellow("!")} ${summary}`);
+            for (const step of steps) console.log(`  ${dim(step)}`);
             continue;
           }
           console.log(`
@@ -2382,10 +2709,7 @@ var main = async () => {
       console.log();
       const configured = failedAgentsContext(completed.map((agent) => AGENT_NAMES[agent]));
       console.log(`  ${yellow("!")} Failed: ${failedAgentNames(failures).join(", ")}${configured ? ` ${dim(configured)}` : ""}`);
-      for (const followUp of agentFailureFollowUps(failures)) {
-        if (followUp === "install-node") console.log(`  ${INSTALL_NODE_STEP}`);
-        else console.log(`  ${dim("Run")} ${NPX_LATEST_COMMAND} doctor ${dim("for the reason, or send it to")} ${SUPPORT_EMAIL}`);
-      }
+      for (const followUp of agentFailureFollowUps(failures)) console.log(`  ${agentFailureFollowUpLine(followUp)}`);
     }
     markStep("project-instructions");
     await offerProjectInstructions(agents, options);
@@ -2458,12 +2782,12 @@ var main = async () => {
   // being a thing they have to know to run.
   (phone?.reachesYou || phone?.outcome?.kind === "unattributable")) {
     console.log();
-    console.log(`  ${dim("Test delivery and answer return. Agent hooks are a separate check.")}`);
-    await spinner("Waiting for you to tap the notification", async () => {
-      roundTrip = await verifyRoundTrip(trimmedKey);
-    });
-    const report = describeRoundTrip(roundTrip);
-    console.log(`  ${report.ok ? check : yellow("!")} ${report.message}`);
+    console.log(`  ${dim("Answer the test question on your phone.")}`);
+    const answer = verifyRoundTrip(trimmedKey);
+    await spinner("Waiting for you to tap the notification", async () => roundTripSpinnerEnd(await answer));
+    roundTrip = await answer;
+    const report = describeRoundTripOutcome(roundTrip);
+    if (!report.ok) console.log(`  ${yellow("!")} ${report.message}`);
     for (const line of report.next) console.log(`  ${dim(line)}`);
   } else if (verifyMode === "roundtrip" && keyCheck.kind === "ok") {
     console.log();
@@ -2472,7 +2796,7 @@ var main = async () => {
   console.log();
   if (keyCheck.kind === "locked" || keyCheck.kind === "unreachable") {
     const report = describeKeyCheck(keyCheck);
-    const next = [...report.next, "Finish activation: pushary setup (reuses the saved key)."];
+    const next = keyCheck.kind === "locked" ? [...report.next, describeLockedKeyAccount(trimmedKey, pairedHandle), WRONG_ACCOUNT_HINT] : [...report.next, "Finish activation: pushary setup (reuses the saved key)."];
     const exitCode2 = failures.length > 0 || controlLifecycleFailure ? EXIT.PROBLEMS_FOUND : report.exitCode;
     printManualSteps();
     console.log(`  ${yellow(bold(keyCheck.kind === "locked" ? "Agents configured, approvals inactive." : "Configuration saved, activation unverified."))}`);
@@ -2577,6 +2901,7 @@ var main = async () => {
   let controlFailureStage = null;
   let daemon = null;
   if (keyIsTrusted && controlPolicy === "enabled") {
+    console.log(`  ${dim(describeServiceInstall(servicePresent))}`);
     try {
       controlFailureStage = "package-install";
       await installGlobally2();
@@ -2632,7 +2957,8 @@ var main = async () => {
     transcriptSync,
     // null when the check did not run, so it changes nothing. Only an outright
     // `false` is allowed to hold back "Setup complete.".
-    roundTripAnswered: roundTrip === null ? null : roundTrip.kind === "answered" ? true : roundTrip.kind === "unanswered" ? false : null
+    roundTripAnswered: roundTrip === null ? null : roundTrip.kind === "answered" ? true : roundTrip.kind === "unanswered" ? false : null,
+    roundTripAnswer: roundTripAnswerOf(roundTrip)
   });
   console.log(`  ${closing.ok ? green(bold(closing.headline)) : yellow(bold(closing.headline))}`);
   if (failures.length > 0) {