@pushary/agent-hooks 1.9.19 → 1.9.21

package/dist/{chunk-DKFAJHLI.js → chunk-BERMVODT.js}

@@ -1,15 +1,15 @@
 import {
   compatibleConfigFile
-} from "./chunk-E2RXTRM2.js";
+} from "./chunk-BDL6GJOQ.js";
 import {
   hookOwnerOf,
   hookOwnerOfCommands,
   liveBridgeProbe,
   resolveBridgeStub
-} from "./chunk-SEZUF33H.js";
+} from "./chunk-PYWZYM74.js";
 import {
   AGENT_CHOICES
-} from "./chunk-YONHM5BQ.js";
+} from "./chunk-247PAUW6.js";
 import {
   claudeSettings,
   codexHooksJson,
@@ -18,17 +18,18 @@ import {
   guardedArgv,
   pusharyDir,
   vscodePluginDir
-} from "./chunk-FEKP3NJR.js";
+} from "./chunk-CEF4UQ3X.js";
 import {
   readJsonSafe
-} from "./chunk-FT7UNIS3.js";
+} from "./chunk-AQFEP65J.js";
 import {
   HOOK_BUDGETS,
   HOOK_COMPATIBLE_PROFILES,
   HOOK_LOCATOR_BINARY,
   OPENCODE_APPROVAL_EVENT,
-  hookCompatibleProfile
-} from "./chunk-6HMCOGKJ.js";
+  hookCompatibleProfile,
+  isRecord
+} from "./chunk-VBPASZU7.js";
 
 // src/opencode-plugin.ts
 var OPENCODE_PLUGIN_MARKER = "pushary-opencode-plugin w1";
@@ -436,7 +437,7 @@ var agentHookOwner = (agent, appAvailable) => {
   const file = agentHookFile(agent);
   if (!file) return "none";
   const document = readJsonSafe(file);
-  return hookOwnerOf(document.kind === "ok" ? document.value : null, appAvailable, agentHooksKeyPath(agent));
+  return hookOwnerOf(document.kind === "ok" && isRecord(document.value) ? document.value : null, appAvailable, agentHooksKeyPath(agent));
 };
 var cliOwnsAnyAgentHooks = (appAvailable) => AGENT_CHOICES.some((agent) => agentHookOwner(agent, appAvailable) === "cli");
 var macAppBridgeAvailable = () => resolveBridgeStub(join2(pusharyDir(), "bin", HOOK_LOCATOR_BINARY), liveBridgeProbe()).kind === "bundle";

package/dist/{chunk-LXYNKZFP.js → chunk-BV5JPACQ.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   renderCommandHelp
-} from "./chunk-LHGB64O2.js";
+} from "./chunk-B6KZME5D.js";
 import {
   getPackageVersion
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-VBPASZU7.js";
 
 // src/cli/usage.ts
 var exitOnHelpFlag = (command) => {

package/dist/{chunk-FEKP3NJR.js → chunk-CEF4UQ3X.js}

@@ -13,7 +13,7 @@ import {
   isReleaseVersion,
   ownPackageName,
   withHookHoldBudget
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-VBPASZU7.js";
 
 // src/setup/paths.ts
 import { homedir as homedir2 } from "os";
@@ -168,13 +168,16 @@ var NpmMissingError = class extends Error {
     this.name = "NpmMissingError";
   }
 };
+var npmPermissionFailureKind = (code, platform) => code === "EPERM" && platform === "win32" ? "file-in-use" : "global-prefix";
 var NpmPermissionError = class extends Error {
-  constructor(detail) {
+  kind;
+  constructor(detail, kind) {
     super(detail);
     this.name = "NpmPermissionError";
+    this.kind = kind;
   }
 };
-var NPM_PERMISSION_CODE = /\bE(?:ACCES|PERM)\b/;
+var NPM_PERMISSION_CODE = /\b(EACCES|EPERM)\b/;
 var ERROR_TEXT_FIELDS = ["code", "stderr", "stdout", "message"];
 var errorTextOf = (err) => {
   if (typeof err !== "object" || err === null) return [String(err)];
@@ -183,8 +186,18 @@ var errorTextOf = (err) => {
     return typeof value === "string" || Buffer.isBuffer(value) ? [value.toString()] : [];
   });
 };
-var isNpmPermissionFailure = (err) => errorTextOf(err).some((text) => NPM_PERMISSION_CODE.test(text));
-var npmInstallFailure = (err) => isNpmPermissionFailure(err) ? new NpmPermissionError(npmErrorMessage(err)) : new Error(npmErrorMessage(err));
+var isNpmPermissionCode = (value) => value === "EACCES" || value === "EPERM";
+var npmPermissionCodeOf = (err) => {
+  for (const text of errorTextOf(err)) {
+    const code = NPM_PERMISSION_CODE.exec(text)?.[1];
+    if (isNpmPermissionCode(code)) return code;
+  }
+  return null;
+};
+var npmInstallFailure = (err, platform = process.platform) => {
+  const code = npmPermissionCodeOf(err);
+  return code === null ? new Error(npmErrorMessage(err)) : new NpmPermissionError(npmErrorMessage(err), npmPermissionFailureKind(code, platform));
+};
 var resolveBinary = (name) => resolveGlobalBinary(name) ?? resolvePathBinary(name);
 var resolvePackageVersionFromBinary = (binary, packageName) => {
   try {
@@ -382,9 +395,9 @@ var installGlobally = (options) => {
   }
   const started = (async () => {
     if (!npmIsOnPath()) throw new NpmMissingError();
-    const { withUpgradeLock } = await import("./global-upgrade-XEMENBZA.js");
-    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-VT6XMQMB.js");
-    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-VW5CI5KS.js");
+    const { withUpgradeLock } = await import("./global-upgrade-AHRKGQ7M.js");
+    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-7Z5WBZVH.js");
+    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-AGUCNYQ5.js");
     let result = "skipped";
     const install = async () => {
       const platform = process.platform;

package/dist/{chunk-MGW26CW7.js → chunk-ESHO7OC3.js}

@@ -1,6 +1,6 @@
 import {
   readConfigFileKey
-} from "./chunk-4ABHSCFJ.js";
+} from "./chunk-FH4O3QGQ.js";
 
 // src/bell/fleet.ts
 import { closeSync, constants, futimesSync, lstatSync, mkdirSync, openSync, readdirSync, unlinkSync } from "fs";

package/dist/{chunk-4ABHSCFJ.js → chunk-FH4O3QGQ.js}

@@ -1,15 +1,19 @@
 import {
   resolveInstallSourceFor
-} from "./chunk-MID7BURF.js";
+} from "./chunk-NVXC6ZBR.js";
 import {
   backupFile,
   readJsonSafe,
   writeFileAtomic,
   writeJsonAtomic
-} from "./chunk-FT7UNIS3.js";
+} from "./chunk-AQFEP65J.js";
 import {
   configFilePath
-} from "./chunk-XQ4HTTBB.js";
+} from "./chunk-4WHNRAOK.js";
+import {
+  API_KEY_PREFIX_PATTERN,
+  isRecord
+} from "./chunk-VBPASZU7.js";
 
 // src/shell-alias.ts
 import { homedir } from "os";
@@ -111,7 +115,6 @@ var isDisabledExport = (line) => {
 };
 var keyPrefix = (key) => key.split(".")[0] ?? key;
 var MAC_APP_KEY_PREFIX_FIELD = "macAppKeyPrefix";
-var KEY_PREFIX_SHAPE = /^pk_[a-f0-9]+$/;
 var findKeyExport = (contents) => {
   const lines = contents.split("\n");
   for (const [index, line] of lines.entries()) {
@@ -120,6 +123,10 @@ var findKeyExport = (contents) => {
   }
   return null;
 };
+var readConfigRecord = (configPath) => {
+  const result = readJsonSafe(configPath);
+  return result.kind === "ok" && isRecord(result.value) ? result.value : null;
+};
 var keepMacAppKeyPrefix = (current, apiKey) => {
   const { [MAC_APP_KEY_PREFIX_FIELD]: recorded, ...rest } = current;
   return recorded === keyPrefix(apiKey) ? { ...rest, [MAC_APP_KEY_PREFIX_FIELD]: recorded } : rest;
@@ -214,9 +221,9 @@ var writeKey = (apiKey, options = {}) => {
       `${configPath} exists but could not be read (${existing.error.message}). Fix its permissions or remove it, then re-run setup. Nothing was changed.`
     );
   }
-  if (existing.kind === "ok") {
+  if (existing.kind === "ok" && isRecord(existing.value)) {
     current = existing.value;
-  } else if (existing.kind === "unparseable") {
+  } else if (existing.kind === "ok" || existing.kind === "unparseable") {
     configBackupPath = backupFile(configPath);
   }
   writeJsonAtomic(
@@ -238,10 +245,10 @@ var writeKey = (apiKey, options = {}) => {
 };
 var clearKey = (options = {}) => {
   const configPath = configFilePath();
-  const existing = readJsonSafe(configPath);
+  const existing = readConfigRecord(configPath);
   let removedFromConfig = false;
-  if (existing.kind === "ok" && typeof existing.value.apiKey === "string") {
-    const { apiKey: _dropped, [MAC_APP_KEY_PREFIX_FIELD]: _adopted, ...rest } = existing.value;
+  if (existing !== null && typeof existing.apiKey === "string") {
+    const { apiKey: _dropped, [MAC_APP_KEY_PREFIX_FIELD]: _adopted, ...rest } = existing;
     writeJsonAtomic(configPath, rest, KEY_FILE_MODE);
     restrictFile(configPath);
     removedFromConfig = true;
@@ -277,22 +284,18 @@ var restrictFile = (filePath) => {
   }
 };
 var readConfigKey = (configPath) => {
-  const result = readJsonSafe(configPath);
-  if (result.kind !== "ok") return null;
-  const key = typeof result.value.apiKey === "string" ? result.value.apiKey.trim() : "";
+  const apiKey = readConfigRecord(configPath)?.apiKey;
+  const key = typeof apiKey === "string" ? apiKey.trim() : "";
   return key || null;
 };
 var readConfigFileKey = () => readConfigKey(configFilePath());
 var readControlMode = (configPath = configFilePath()) => {
-  const result = readJsonSafe(configPath);
-  if (result.kind !== "ok") return null;
-  const value = result.value.controlMode;
+  const value = readConfigRecord(configPath)?.controlMode;
   return value === "auto" || value === "on" || value === "off" ? value : null;
 };
 var readTranscriptPreference = () => {
-  const result = readJsonSafe(configFilePath());
-  if (result.kind !== "ok") return null;
-  return typeof result.value.transcriptsEnabled === "boolean" ? result.value.transcriptsEnabled : null;
+  const value = readConfigRecord(configFilePath())?.transcriptsEnabled;
+  return typeof value === "boolean" ? value : null;
 };
 var readKeySource = () => {
   const configPath = configFilePath();
@@ -304,16 +307,15 @@ var readKeySource = () => {
   return { kind: "none", key: null, origin: null, drift: null };
 };
 var readMacAppKeyPrefix = (configPath = configFilePath()) => {
-  const result = readJsonSafe(configPath);
-  if (result.kind !== "ok") return null;
-  const recorded = result.value[MAC_APP_KEY_PREFIX_FIELD];
-  return typeof recorded === "string" && KEY_PREFIX_SHAPE.test(recorded) ? recorded : null;
+  const recorded = readConfigRecord(configPath)?.[MAC_APP_KEY_PREFIX_FIELD];
+  return typeof recorded === "string" && API_KEY_PREFIX_PATTERN.test(recorded) ? recorded : null;
 };
+var isAdoptedMacAppKey = (key, adoptedPrefix) => keyPrefix(key) === adoptedPrefix;
 var recordMacAppKeyPrefix = (apiKey, configPath = configFilePath()) => {
-  const result = readJsonSafe(configPath);
-  if (result.kind !== "ok" || result.value.apiKey !== apiKey) return false;
-  if (result.value[MAC_APP_KEY_PREFIX_FIELD] === keyPrefix(apiKey)) return false;
-  writeJsonAtomic(configPath, { ...result.value, [MAC_APP_KEY_PREFIX_FIELD]: keyPrefix(apiKey) }, KEY_FILE_MODE);
+  const config = readConfigRecord(configPath);
+  if (config === null || config.apiKey !== apiKey) return false;
+  if (config[MAC_APP_KEY_PREFIX_FIELD] === keyPrefix(apiKey)) return false;
+  writeJsonAtomic(configPath, { ...config, [MAC_APP_KEY_PREFIX_FIELD]: keyPrefix(apiKey) }, KEY_FILE_MODE);
   restrictFile(configPath);
   return true;
 };
@@ -354,6 +356,7 @@ export {
   readTranscriptPreference,
   readKeySource,
   readMacAppKeyPrefix,
+  isAdoptedMacAppKey,
   recordMacAppKeyPrefix,
   findExportedKeyLines,
   findExportedKeyLine

package/dist/{chunk-3FG2VCH3.js → chunk-FUXCWF4Y.js}

@@ -1,6 +1,6 @@
 import {
   ensureCodexTrustsPusharyHooks
-} from "./chunk-W4TZAKOD.js";
+} from "./chunk-Y6PZ3B5U.js";
 import {
   detectClaudeVersion
 } from "./chunk-RIVNNBEK.js";
@@ -12,12 +12,12 @@ import {
   openCodeHookArgv,
   openCodePluginDir,
   openCodeWired
-} from "./chunk-DKFAJHLI.js";
+} from "./chunk-BERMVODT.js";
 import {
   addClaudeMcpServer,
   addPusharyHooks,
   addPusharyToolPermissions
-} from "./chunk-E2RXTRM2.js";
+} from "./chunk-BDL6GJOQ.js";
 import {
   claudeUnprovenHolds,
   claudeWired,
@@ -25,7 +25,7 @@ import {
   codexWired,
   geminiWired,
   planHooks
-} from "./chunk-SEZUF33H.js";
+} from "./chunk-PYWZYM74.js";
 import {
   CLAUDE_HOOK_BINARY,
   CLAUDE_HOOK_EVENTS,
@@ -36,7 +36,7 @@ import {
   needsReregistration,
   registrationSignatures,
   supportedClaudeEvents
-} from "./chunk-YAU4JCYI.js";
+} from "./chunk-YLLGKY7K.js";
 import {
   formatVersion
 } from "./chunk-6ICPEJY5.js";
@@ -59,12 +59,15 @@ import {
   registrationHolderOf,
   resolveGlobalBinary,
   vscodePluginMcp
-} from "./chunk-FEKP3NJR.js";
+} from "./chunk-CEF4UQ3X.js";
 import {
   readJsonSafe,
   writeFileAtomic,
   writeJsonAtomic
-} from "./chunk-FT7UNIS3.js";
+} from "./chunk-AQFEP65J.js";
+import {
+  isRecord
+} from "./chunk-VBPASZU7.js";
 
 // src/reapply.ts
 import { dirname, join } from "path";
@@ -111,7 +114,7 @@ var CLAUDE_SETTINGS = join(homedir(), ".claude", "settings.json");
 var CLAUDE_JSON = join(homedir(), ".claude.json");
 var readJson = (filePath) => {
   const result = readJsonSafe(filePath);
-  if (result.kind === "ok") return result.value;
+  if (result.kind === "ok") return isRecord(result.value) ? result.value : null;
   if (result.kind === "missing") return {};
   return null;
 };

package/dist/{chunk-23QKUOEV.js → chunk-G4TV5GYU.js}

@@ -6,12 +6,12 @@ import {
   permissionDeniedAction,
   releaseThrottle,
   reportEvent
-} from "./chunk-NILVJ7HV.js";
+} from "./chunk-YCL2V5FD.js";
 import {
   machineDecisionFor,
   shouldDeferToNativeMode,
   wireVerdictFor
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-VBPASZU7.js";
 
 // src/machine-decision-audit.ts
 import { basename } from "path";

package/dist/{chunk-TBTCBAQC.js → chunk-GMJOSAAP.js}

@@ -1,21 +1,21 @@
 import {
   defersToNativeMode,
   reportMachineDenial
-} from "./chunk-23QKUOEV.js";
+} from "./chunk-G4TV5GYU.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-736I6CBY.js";
+} from "./chunk-UKCRTTKF.js";
 import {
   announceSubscriptionRequired,
   denyReasonFrom,
   isDeferAnswer,
   oncePerSession
-} from "./chunk-5LQRUBFB.js";
+} from "./chunk-PCVAK67W.js";
 import {
   activeHookSource,
   activeIdentity
-} from "./chunk-E2RXTRM2.js";
+} from "./chunk-BDL6GJOQ.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -40,7 +40,7 @@ import {
   reportEvent,
   scopePathFor,
   settleQuestionsForToolUse
-} from "./chunk-NILVJ7HV.js";
+} from "./chunk-YCL2V5FD.js";
 import {
   askUser,
   cancelQuestion,
@@ -52,20 +52,20 @@ import {
   sendNotification,
   waitForQuestion,
   waitsForThePhone
-} from "./chunk-DVLQ4TVD.js";
+} from "./chunk-Y2BOLNJV.js";
 import {
   SubscriptionRequiredError
-} from "./chunk-SXVXANPI.js";
+} from "./chunk-ZNAGS7O7.js";
 import {
   getMachineId
-} from "./chunk-KRDQQL2X.js";
+} from "./chunk-NBGJ3EOE.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-XQ4HTTBB.js";
+} from "./chunk-4WHNRAOK.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-LHGB64O2.js";
+} from "./chunk-B6KZME5D.js";
 import {
   AGENT_QUESTION_STRATEGY,
   DECISION_STOP_REASON,
@@ -104,7 +104,7 @@ import {
   parseAgentQuestions,
   questionHandedToTheTerminal,
   resolveGate
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-VBPASZU7.js";
 
 // src/claude-permission-rules.ts
 import { readFileSync, statSync } from "fs";

package/dist/{chunk-2YAHQ763.js → chunk-I52ALHOM.js}

@@ -1,12 +1,13 @@
 import {
   findExportedKeyLine,
+  isAdoptedMacAppKey,
   keyPrefix,
   readConfigFileKey,
   readMacAppKeyPrefix
-} from "./chunk-4ABHSCFJ.js";
+} from "./chunk-FH4O3QGQ.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-LHGB64O2.js";
+} from "./chunk-B6KZME5D.js";
 
 // src/key-signed-out.ts
 var VERDICT_BY_CHECK = {
@@ -18,15 +19,14 @@ var VERDICT_BY_CHECK = {
 };
 var activeKeyVerdictOf = (check) => check === null ? "unchecked" : VERDICT_BY_CHECK[check.kind];
 var NOT_SIGNED_OUT = { kind: "none" };
-var isMacAppKey = (key, macAppKeyPrefix) => keyPrefix(key) === macAppKeyPrefix;
 var diagnoseSignedOutKey = (evidence) => {
   const adopted = evidence.macAppKeyPrefix;
   if (evidence.configKey !== null || adopted === null) return NOT_SIGNED_OUT;
   if (evidence.activeKey !== null) {
-    if (!isMacAppKey(evidence.activeKey, adopted) || evidence.activeKeyVerdict === "accepted") return NOT_SIGNED_OUT;
+    if (!isAdoptedMacAppKey(evidence.activeKey, adopted) || evidence.activeKeyVerdict === "accepted") return NOT_SIGNED_OUT;
   }
   const exported = evidence.exportedKey;
-  return { kind: "signed_out_on_mac", deadExport: exported && isMacAppKey(exported.key, adopted) ? exported : null };
+  return { kind: "signed_out_on_mac", deadExport: exported && isAdoptedMacAppKey(exported.key, adopted) ? exported : null };
 };
 var SIGNED_OUT_ON_MAC_MESSAGE = "This computer used the key the Pushary Mac app signed in with, and it was signed out on this Mac, so it no longer works here.";
 var describeSignedOutKey = (diagnosis) => [

package/dist/{chunk-6TQLZP7F.js → chunk-IEYFFMTU.js}

@@ -1,10 +1,10 @@
 import {
   pusharyDir
-} from "./chunk-FEKP3NJR.js";
+} from "./chunk-CEF4UQ3X.js";
 import {
   readJsonSafe,
   writeFileAtomic
-} from "./chunk-FT7UNIS3.js";
+} from "./chunk-AQFEP65J.js";
 import {
   DECLINED_AGENTS_FILE,
   DISCONNECT_AGENT_IDS,
@@ -13,7 +13,7 @@ import {
   serializeDeclinedAgents,
   withDeclinedAgent,
   withoutDeclinedAgent
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-VBPASZU7.js";
 
 // src/declined-agents-file.ts
 import { join } from "path";

package/dist/{chunk-T27NT7LJ.js → chunk-II6OFDB3.js}

@@ -1,16 +1,16 @@
 import {
   registerTranscript
-} from "./chunk-XUUE6MYM.js";
+} from "./chunk-TJ4KMPYO.js";
 import {
   namedEvent
-} from "./chunk-E2RXTRM2.js";
+} from "./chunk-BDL6GJOQ.js";
 import {
   writeDegraded
-} from "./chunk-DVLQ4TVD.js";
+} from "./chunk-Y2BOLNJV.js";
 import {
   claudeShapedHookInput,
   hookCompatibleProfileBySource
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-VBPASZU7.js";
 
 // src/tool-hook-input.ts
 var OPTIONAL_TEXT_FIELDS = ["hook_event_name", "session_id", "cwd", "transcript_path", "tool_use_id", "permission_mode"];

package/dist/{chunk-TNZYTGAJ.js → chunk-IIQ77WUJ.js}

@@ -3,27 +3,27 @@ import {
   expectedLaunchCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "./chunk-OWUDBHXW.js";
+} from "./chunk-Z5EYCMJH.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   hasDaemonServiceDefinition,
   readDaemonNeedsLogin,
   readDaemonStatus
-} from "./chunk-6GQDOO5P.js";
+} from "./chunk-L5NPRGVE.js";
 import {
   readControlMode,
   readKeySource
-} from "./chunk-4ABHSCFJ.js";
+} from "./chunk-FH4O3QGQ.js";
 import {
   getMachineId
-} from "./chunk-KRDQQL2X.js";
+} from "./chunk-NBGJ3EOE.js";
 import {
   getBaseUrl
-} from "./chunk-XQ4HTTBB.js";
+} from "./chunk-4WHNRAOK.js";
 import {
   getPackageVersion
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-VBPASZU7.js";
 
 // src/machines.ts
 import { hostname } from "os";

package/dist/{chunk-ATDOYZXC.js → chunk-IM7EGZVH.js}

@@ -1,6 +1,6 @@
 import {
   getBaseUrl
-} from "./chunk-XQ4HTTBB.js";
+} from "./chunk-4WHNRAOK.js";
 
 // src/transcript-api.ts
 var fetchTranscriptRecipients = async (apiKey, baseUrl = getBaseUrl()) => {

package/dist/{chunk-CRW4P7JU.js → chunk-JHAPJRAN.js}

@@ -1,6 +1,6 @@
 import {
   PRETOOLUSE_GATED_TOOLS
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-VBPASZU7.js";
 
 // src/claude-tools.ts
 var POSTTOOLUSE_MIRROR_ONLY_TOOLS = ["TodoWrite", "Task", "WebFetch", "WebSearch"];

package/dist/{chunk-6GQDOO5P.js → chunk-L5NPRGVE.js}

@@ -4,30 +4,31 @@ import {
 } from "./chunk-XHKBHWLX.js";
 import {
   readControlMode
-} from "./chunk-4ABHSCFJ.js";
+} from "./chunk-FH4O3QGQ.js";
 import {
   getMachineId
-} from "./chunk-KRDQQL2X.js";
+} from "./chunk-NBGJ3EOE.js";
 import {
   pusharyDir,
   resolveGlobalBinary
-} from "./chunk-FEKP3NJR.js";
+} from "./chunk-CEF4UQ3X.js";
 import {
   readJsonSafe,
   writeFileAtomic,
   writeJsonAtomic,
   writeJsonAtomicDurable
-} from "./chunk-FT7UNIS3.js";
+} from "./chunk-AQFEP65J.js";
 import {
   getApiKey
-} from "./chunk-XQ4HTTBB.js";
+} from "./chunk-4WHNRAOK.js";
 import {
   CLI_PACKAGE_NAMES,
   cmdShimTarget,
   getPackageVersion,
   globalPackageFolder,
-  globalRootFor
-} from "./chunk-6HMCOGKJ.js";
+  globalRootFor,
+  isRecord
+} from "./chunk-VBPASZU7.js";
 
 // src/daemon-lifecycle.ts
 import { dirname, join, win32 as win32Path } from "path";
@@ -615,7 +616,7 @@ var acquireDaemonLease = (options = {}) => {
   let currentState = state;
   const isOwner = () => {
     const owner = readJsonSafe(lockPath(dir));
-    return owner.kind === "ok" && owner.value.instanceId === instanceId;
+    return owner.kind === "ok" && isRecord(owner.value) && owner.value.instanceId === instanceId;
   };
   const updateState = (next) => {
     if (!isOwner()) return;
@@ -659,7 +660,7 @@ var acquireDaemonLease = (options = {}) => {
       shouldYield: () => {
         if (!isOwner()) return true;
         const target = readJsonSafe(targetPath(dir));
-        return target.kind === "ok" && (typeof target.value.version === "string" && target.value.version !== installedVersion || isTimestamp(target.value.requestedAt) && Date.parse(target.value.requestedAt) > Date.parse(startedAt));
+        return target.kind === "ok" && isRecord(target.value) && (typeof target.value.version === "string" && target.value.version !== installedVersion || isTimestamp(target.value.requestedAt) && Date.parse(target.value.requestedAt) > Date.parse(startedAt));
       },
       release: () => {
         if (!isOwner()) return;

package/dist/{chunk-A6U4RRFM.js → chunk-LUDGBOLV.js}

@@ -3,11 +3,11 @@ import {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-XGHXQUDG.js";
+} from "./chunk-6WINXCXY.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-ATDOYZXC.js";
+} from "./chunk-IM7EGZVH.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;

package/dist/{chunk-KRDQQL2X.js → chunk-NBGJ3EOE.js}

@@ -1,9 +1,9 @@
 import {
   pusharyDir
-} from "./chunk-FEKP3NJR.js";
+} from "./chunk-CEF4UQ3X.js";
 import {
   writeFileAtomic
-} from "./chunk-FT7UNIS3.js";
+} from "./chunk-AQFEP65J.js";
 
 // src/identity.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-MID7BURF.js → chunk-NVXC6ZBR.js}

@@ -1,9 +1,9 @@
 import {
   configFilePath
-} from "./chunk-XQ4HTTBB.js";
+} from "./chunk-4WHNRAOK.js";
 import {
   normalizeInstallSource
-} from "./chunk-6HMCOGKJ.js";
+} from "./chunk-VBPASZU7.js";
 
 // src/install-source.ts
 import { readFileSync } from "fs";

package/dist/{chunk-SB2GN6OP.js → chunk-OYIN77HO.js}

@@ -20,7 +20,7 @@ var revokeAgentKey = async (apiKey, baseUrl, fetchImpl) => {
   });
   if (!response.ok) return { kind: "refused", status: response.status };
   const revoked = await readRevokedCount(response);
-  if (revoked === null) return { kind: "refused", status: response.status };
+  if (revoked === null) return { kind: "unconfirmed", status: response.status };
   return revoked > 0 ? { kind: "revoked" } : { kind: "not_accepted" };
 };
 var revokeOwnKey = async (apiKey, baseUrl, fetchImpl = fetch) => {
@@ -42,10 +42,11 @@ var REVOKE_DETAIL = {
   revoked: "Revoked the key on pushary.com.",
   not_accepted: "pushary.com had already stopped accepting the key.",
   refused: "pushary.com refused to revoke the key",
+  unconfirmed: "pushary.com did not confirm the key was revoked",
   unreachable: "Could not reach pushary.com to revoke the key"
 };
 var describeRevokeAttempt = (attempt) => {
-  if (attempt.kind === "refused") return `${REVOKE_DETAIL.refused} (HTTP ${attempt.status}).`;
+  if (attempt.kind === "refused" || attempt.kind === "unconfirmed") return `${REVOKE_DETAIL[attempt.kind]} (HTTP ${attempt.status}).`;
   if (attempt.kind === "unreachable") return `${REVOKE_DETAIL.unreachable}: ${attempt.detail}`;
   return REVOKE_DETAIL[attempt.kind];
 };