@pushary/agent-hooks 1.9.53 → 1.9.54

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 1.9.54
+
+- For a switch the Pushary Mac app turns on, the login item that keeps Codex app cards on after a restart now runs Pushary's own program and not a shell line, so macOS treats it as part of Pushary and not as a separate `sh` item. A switch turned on with `pushary codex --app-cards on` keeps the login item it has, unchanged.
+
 ## 1.9.53
 
 - `pushary codex --app-cards status --json` prints the switch's state as one line of JSON for a program to read: the state, the Codex app found on this Mac, whether the Mac app turned the switch on, and whether it was turned off on purpose. The Pushary Mac app uses it for its new Settings switch, which is on by default there.
@@ -25,7 +29,7 @@
 - New, off by default: `pushary codex --app-cards on` makes the Codex app start through the same pass-through every time you open it, including after a restart, with no terminal to keep open. `pushary codex --app-cards off` undoes it and `status` says where it stands, including when Pushary or the Codex engine is no longer where the launcher expects. It writes a launcher under `~/.pushary/codex-app`, a login item, and the `CODEX_CLI_PATH` setting for your login session, and leaves that setting alone if another program already owns it. `off` replaces the launcher with one that only runs Codex's engine and leaves that file in place, because the Codex app records its path in `~/.codex/config.toml` and an open Codex keeps using it; `pushary clean` removes it, after which Codex should be reopened.
 - The launcher steps aside by itself: it hands every engine command except the app's own protocol straight to Codex's engine, starts the engine itself when Pushary is missing, broken, never starts it, or the launcher cannot write beside itself, and turns its own setting off if a Codex update moves the engine. If the launcher is stopped, Pushary stops the engine within a few seconds.
 - The pass-through holds at most 64 KiB of the app's input and inspects at most 256 KiB of a line from the engine, loads the code that talks to Pushary only when a card appears, does nothing while idle except check every two seconds that its launcher is still running, lets the engine finish its own shutdown when Codex quits, and keeps copying if anything in it fails. The first time Computer Use asks in a way this version does not know, it says so once in Codex's own log.
-- Setup: a Mac that has the Codex app and no Codex CLI gets native hooks again. The current Codex app keeps its engine behind a small script with its version in a file beside it; setup looked for the version inside the script, found none, and treated Codex as too old for hooks. Setup now reads that file, finds the engine where the app keeps it now, and never takes Pushary's own launcher for Codex.
+- Setup on a Mac that has the Codex app and no Codex CLI: setup never takes Pushary's own launcher for Codex, and it finds the app's engine where the current Codex app keeps it when Codex's settings file does not name one. Before, the first would have skipped native hooks and the second reported Codex as not found. Correction: this entry first said such a Mac got no hooks at all since the Codex app changed its layout. That was wrong. When Codex's settings file names the app's own engine, as it does after Codex has started normally, setup already found it and installed hooks.
 - `pushary codex` is experimental and no longer appears in `pushary --help`. It still runs when typed, and `pushary codex --help` describes it.
 
 ## 1.9.50

package/dist/bin/pushary-clean.js

@@ -1,15 +1,27 @@
 #!/usr/bin/env node
 import {
   CODEX_APP_CARDS_DIRECTORY,
+  LSREGISTER,
+  MAC_APP_BUNDLE_ID,
+  MAC_DEFAULTS_DOMAINS,
+  MAC_KEYCHAIN_ACCOUNTS,
   codexAppCardsFolderStaysOnThisMac,
-  removeCodexAppCardsFromThisMac
-} from "../chunk-SUIB4O3S.js";
+  developerDefaults,
+  installedPusharyBundles,
+  liveMacStatePresence,
+  registeredPusharyBundles,
+  removeCodexAppCardsFromThisMac,
+  runningMacAppPIDs,
+  storedMacAppState,
+  storedPusharyKeychainServices,
+  waitForMacAppExit
+} from "../chunk-ZWOWEXCV.js";
 import {
   PUSHARY_SKILL_NAME,
   PUSHARY_SKILL_SOURCE,
   createGuards
 } from "../chunk-EUW7JL2K.js";
-import "../chunk-ABGN5RN2.js";
+import "../chunk-T5L5NWT3.js";
 import "../chunk-XCEN33UP.js";
 import {
   describeCliKeyRevocation,
@@ -109,7 +121,7 @@ import {
   removeClaudeAlias,
   shellProfileCandidates
 } from "../chunk-VYBH6D4X.js";
-import "../chunk-36NGFHE4.js";
+import "../chunk-E46NE7FB.js";
 import "../chunk-U2L42GVI.js";
 import "../chunk-3RPN7AAT.js";
 import "../chunk-JBT3ZSJS.js";
@@ -186,194 +198,14 @@ import {
 } from "../chunk-LF3TLC7B.js";
 
 // bin/pushary-clean.ts
-import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync5 } from "fs";
-import { dirname, join as join6 } from "path";
-import { homedir as homedir5, tmpdir } from "os";
+import { existsSync as existsSync5, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync4 } from "fs";
+import { dirname, join as join5 } from "path";
+import { homedir as homedir4, tmpdir } from "os";
 import { confirm } from "@inquirer/prompts";
 import { parse as parseTOML, stringify as stringifyTOML } from "smol-toml";
 
-// src/cli/mac-leftovers.ts
-import { execSync, execFileSync } from "child_process";
-import { existsSync, readdirSync } from "fs";
-import { homedir } from "os";
-import { isAbsolute, join } from "path";
-var MAC_APP_BUNDLE = "/Applications/Pushary.app";
-var MAC_APP_BUNDLE_ID = "com.pushary.app";
-var installedPusharyBundles = (home = homedir()) => [MAC_APP_BUNDLE, join(home, "Applications", "Pushary.app")];
-var LSREGISTER = "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";
-var TEST_DEFAULTS_PREFIXES = [
-  "com.pushary.mac.tests.",
-  "com.pushary.tests.",
-  "pushary.tests.",
-  "pushary.quiet-mode-test.",
-  "pushary.drafts.test.",
-  "pushary-optin-",
-  "pushary-completion-test-",
-  "pushary-updates-only-"
-];
-var UUID = "[0-9A-Fa-f]{8}(?:-[0-9A-Fa-f]{4}){3}-[0-9A-Fa-f]{12}";
-var UNPREFIXED_TEST_DEFAULTS_DOMAIN = new RegExp(`^(?:owner-mode|fx-model)-${UUID}$`);
-var DEVELOPER_BUILD_DEFAULTS_DOMAIN = "PusharyMac";
-var isDeveloperDefaultsDomain = (domain) => domain === DEVELOPER_BUILD_DEFAULTS_DOMAIN || UNPREFIXED_TEST_DEFAULTS_DOMAIN.test(domain) || TEST_DEFAULTS_PREFIXES.some((prefix) => domain.startsWith(prefix));
-var PREFERENCES_FILE_EXTENSION = ".plist";
-var preferencesDirectory = (home) => join(home, "Library", "Preferences");
-var preferencesFile = (home, domain) => join(preferencesDirectory(home), `${domain}${PREFERENCES_FILE_EXTENSION}`);
-var namesIn = (directory) => {
-  try {
-    return readdirSync(directory);
-  } catch {
-    return [];
-  }
-};
-var developerDefaults = (home = homedir()) => namesIn(preferencesDirectory(home)).filter((name) => name.endsWith(PREFERENCES_FILE_EXTENSION)).map((name) => name.slice(0, -PREFERENCES_FILE_EXTENSION.length)).filter(isDeveloperDefaultsDomain).map((domain) => ({ domain, file: preferencesFile(home, domain) }));
-var BUNDLE_NAME = "Pushary.app";
-var DUMP_RECORD_SEPARATOR = /^-{20,}$/m;
-var DUMP_PATH_LINES = /^[ \t]*path:[ \t]+(.+?)(?: \(0x[0-9a-f]+\))?[ \t]*$/gm;
-var DUMP_IDENTIFIER_LINES = /^[ \t]*identifier:[ \t]+(\S+)/gm;
-var capturedIn = (text, lines) => [...text.matchAll(lines)].flatMap((match) => match[1] === void 0 ? [] : [match[1]]);
-var appCopyNamedByRecord = (record) => {
-  const paths = capturedIn(record, DUMP_PATH_LINES);
-  const identifiers = capturedIn(record, DUMP_IDENTIFIER_LINES);
-  const namesOneAppCopy = paths.length === 1 && identifiers.length === 1 && identifiers[0] === MAC_APP_BUNDLE_ID;
-  return namesOneAppCopy ? paths : [];
-};
-var isAtOrInside = (path, bundle) => path === bundle || path.startsWith(`${bundle}/`);
-var isUnderBundleNamedPushary = (path) => path.split("/").includes(BUNDLE_NAME);
-var bundlesInLaunchServicesDump = (dump) => {
-  const appCopies = dump.split(DUMP_RECORD_SEPARATOR).flatMap(appCopyNamedByRecord);
-  const isOurs = (path) => isUnderBundleNamedPushary(path) || appCopies.some((copy) => isAtOrInside(path, copy));
-  return [...new Set(capturedIn(dump, DUMP_PATH_LINES).filter(isOurs))];
-};
-var outsideInstalledBundles = (registered, installed) => registered.filter((path) => !installed.some((bundle) => isAtOrInside(path, bundle)));
-var registeredPusharyBundles = (installed = installedPusharyBundles()) => {
-  if (!existsSync(LSREGISTER)) return [];
-  try {
-    const dump = execSync(`${LSREGISTER} -dump`, {
-      encoding: "utf-8",
-      timeout: 6e4,
-      maxBuffer: 256 * 1024 * 1024
-    });
-    return outsideInstalledBundles(bundlesInLaunchServicesDump(dump), installed);
-  } catch {
-    return [];
-  }
-};
-var MAC_KEYCHAIN_SERVICE = "com.pushary.app.mac";
-var MAC_KEYCHAIN_ACCOUNTS = [
-  "pushary.site-api-key",
-  "pushary.site-id",
-  "pushary.partner-enrollments",
-  "pushary.partner-device-key",
-  "clerk.device-token",
-  "clerk.session-id",
-  "clerkDeviceToken",
-  "cachedClient",
-  "cachedClientServerDate",
-  "cachedEnvironment"
-];
-var MAC_DEFAULTS_DOMAINS = ["com.pushary.app", "pushary-bridge", "pushary.render"];
-var PRESENCE_PROBE_TIMEOUT_MS = 1e4;
-var commandSucceeds = (file, args) => {
-  try {
-    execFileSync(file, args, { stdio: "ignore", timeout: PRESENCE_PROBE_TIMEOUT_MS });
-    return true;
-  } catch {
-    return false;
-  }
-};
-var KEYCHAIN_ITEM_NOT_FOUND = 44;
-var keychainItemMayExist = (service, account) => {
-  try {
-    execFileSync("security", ["find-generic-password", "-s", service, "-a", account], { stdio: "ignore" });
-    return true;
-  } catch (error) {
-    return !(error instanceof Error && "status" in error && error.status === KEYCHAIN_ITEM_NOT_FOUND);
-  }
-};
-var liveMacStatePresence = {
-  keychainItem: keychainItemMayExist,
-  defaultsDomain: (domain) => commandSucceeds("defaults", ["read", domain])
-};
-var macLibraryState = (home = homedir()) => [
-  join(home, "Library", "Application Support", "Pushary"),
-  join(home, "Library", "Caches", "com.pushary.app"),
-  join(home, "Library", "Caches", "com.pushary.app.sparkle"),
-  join(home, "Library", "Saved Application State", "com.pushary.app.savedState"),
-  join(home, "Library", "Caches", "pushary-bridge"),
-  join(home, "Library", "HTTPStorages", "com.pushary.app"),
-  join(home, "Library", "HTTPStorages", "com.pushary.app.binarycookies"),
-  join(home, "Library", "HTTPStorages", "pushary-bridge"),
-  ...MAC_DEFAULTS_DOMAINS.map((domain) => preferencesFile(home, domain))
-];
-var USER_CACHE_ENTRIES = [MAC_APP_BUNDLE_ID, "pushary-bridge", "PusharyBridge"];
-var macUserCacheState = (reportedUserCacheDirectory) => {
-  const directory = reportedUserCacheDirectory.trim();
-  return isAbsolute(directory) ? USER_CACHE_ENTRIES.map((entry) => join(directory, entry)) : [];
-};
-var UNKNOWN_USER_CACHE_DIRECTORY = "";
-var reportedDarwinUserCacheDirectory = () => {
-  try {
-    return execFileSync("getconf", ["DARWIN_USER_CACHE_DIR"], {
-      encoding: "utf-8",
-      timeout: PRESENCE_PROBE_TIMEOUT_MS,
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-  } catch {
-    return UNKNOWN_USER_CACHE_DIRECTORY;
-  }
-};
-var CRASH_REPORTER_ENTRY = new RegExp(`^(?:Pushary|PusharyMac|pushary-bridge)_${UUID}\\.plist$`);
-var crashReporterEntries = (home = homedir()) => {
-  const directory = join(home, "Library", "Application Support", "CrashReporter");
-  return namesIn(directory).filter((name) => CRASH_REPORTER_ENTRY.test(name)).map((name) => join(directory, name));
-};
-var storedMacAppState = (home = homedir()) => [
-  ...macLibraryState(home),
-  ...macUserCacheState(reportedDarwinUserCacheDirectory()),
-  ...crashReporterEntries(home)
-];
-var DUMP_SERVICE_LINE = /^\s*"svce"<blob>="(.+)"\s*$/;
-var pusharyKeychainServices = (dump) => {
-  const found = /* @__PURE__ */ new Set();
-  for (const line of dump.split("\n")) {
-    const service = DUMP_SERVICE_LINE.exec(line)?.[1];
-    if (service?.startsWith(MAC_KEYCHAIN_SERVICE)) found.add(service);
-  }
-  return [...found];
-};
-var storedPusharyKeychainServices = () => {
-  const dump = execFileSync("security", ["dump-keychain"], {
-    encoding: "utf-8",
-    timeout: 3e4,
-    maxBuffer: 64 * 1024 * 1024,
-    stdio: ["ignore", "pipe", "ignore"]
-  });
-  const stored = pusharyKeychainServices(dump);
-  return stored.includes(MAC_KEYCHAIN_SERVICE) ? stored : [MAC_KEYCHAIN_SERVICE, ...stored];
-};
-var runningMacAppPIDs = () => {
-  if (process.platform !== "darwin") return [];
-  try {
-    return execSync('pgrep -f "Pushary.app/Contents/MacOS/Pushary"', {
-      encoding: "utf-8",
-      timeout: 1e4,
-      stdio: ["ignore", "pipe", "ignore"]
-    }).split("\n").map((line) => Number(line.trim())).filter((pid) => Number.isInteger(pid) && pid > 0);
-  } catch {
-    return [];
-  }
-};
-var waitForMacAppExit = (attempts = 20, everyMs = 250) => {
-  const idle = new Int32Array(new SharedArrayBuffer(4));
-  for (let attempt = 0; attempt < attempts; attempt++) {
-    if (runningMacAppPIDs().length === 0) return true;
-    Atomics.wait(idle, 0, 0, everyMs);
-  }
-  return runningMacAppPIDs().length === 0;
-};
-
 // src/cli/clean-mac.ts
-import { existsSync as existsSync2 } from "fs";
+import { existsSync } from "fs";
 var deleteDefaultsDomain = (guards2, domain) => {
   try {
     guards2.execFile("defaults", ["delete", domain], { stdio: "ignore", timeout: 1e4 }, `delete preferences ${domain}`);
@@ -433,7 +265,7 @@ var removeMacAppState = (guards2, readServices, statePaths, present) => {
     if (deleteDefaultsDomain(guards2, domain)) removed++;
   }
   for (const path of statePaths) {
-    if (!existsSync2(path)) continue;
+    if (!existsSync(path)) continue;
     try {
       guards2.remove(path, { force: true });
       removed++;
@@ -458,13 +290,13 @@ var quitMacApp = (guards2, state) => {
 };
 
 // src/cli/editor-extension.ts
-import { existsSync as existsSync3, readFileSync, readdirSync as readdirSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
+import { existsSync as existsSync2, readFileSync, readdirSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
 var EDITOR_EXTENSION_ID = "pushary.pushary";
 var EDITOR_EXTENSION_DIRS = [
-  join2(".cursor", "extensions"),
-  join2(".vscode", "extensions")
+  join(".cursor", "extensions"),
+  join(".vscode", "extensions")
 ];
 var EXTENSIONS_JSON = "extensions.json";
 var isOurEntry = (entry) => {
@@ -475,7 +307,7 @@ var isOurEntry = (entry) => {
   return typeof id === "string" && id.toLowerCase() === EDITOR_EXTENSION_ID;
 };
 var recordWithoutUs = (directory) => {
-  const path = join2(directory, EXTENSIONS_JSON);
+  const path = join(directory, EXTENSIONS_JSON);
   try {
     const entries = JSON.parse(readFileSync(path, "utf-8"));
     if (!Array.isArray(entries)) return void 0;
@@ -485,15 +317,15 @@ var recordWithoutUs = (directory) => {
     return void 0;
   }
 };
-var editorExtensionRemovals = (home = homedir2()) => EDITOR_EXTENSION_DIRS.map((relative) => join2(home, relative)).filter(existsSync3).map((directory) => {
-  const folders = readdirSync2(directory).filter((name) => name.startsWith(`${EDITOR_EXTENSION_ID}-`)).map((name) => join2(directory, name));
+var editorExtensionRemovals = (home = homedir()) => EDITOR_EXTENSION_DIRS.map((relative) => join(home, relative)).filter(existsSync2).map((directory) => {
+  const folders = readdirSync(directory).filter((name) => name.startsWith(`${EDITOR_EXTENSION_ID}-`)).map((name) => join(directory, name));
   return { directory, folders, record: recordWithoutUs(directory) };
 }).filter((removal) => removal.folders.length > 0 || removal.record !== void 0);
 
 // src/cli/skills-store.ts
-import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
 var SKILLS_STORE_DIR = ".agents";
 var LOCK_FILE = ".skill-lock.json";
 var lockWithoutUs = (path) => {
@@ -511,26 +343,26 @@ var lockWithoutUs = (path) => {
     return void 0;
   }
 };
-var skillsStoreRemoval = (home = homedir3()) => {
-  const store = join3(home, SKILLS_STORE_DIR);
-  const skillDir = join3(store, "skills", PUSHARY_SKILL_NAME);
-  const lock = lockWithoutUs(join3(store, LOCK_FILE));
+var skillsStoreRemoval = (home = homedir2()) => {
+  const store = join2(home, SKILLS_STORE_DIR);
+  const skillDir = join2(store, "skills", PUSHARY_SKILL_NAME);
+  const lock = lockWithoutUs(join2(store, LOCK_FILE));
   return {
-    skillDir: lock && existsSync4(skillDir) ? skillDir : void 0,
+    skillDir: lock && existsSync3(skillDir) ? skillDir : void 0,
     lock
   };
 };
 
 // src/cli/claude-backups.ts
-import { existsSync as existsSync5, readFileSync as readFileSync3, readdirSync as readdirSync3 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join4 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
 var BACKUP_PREFIX = ".claude.json.backup";
-var claudeJsonBackups = (home = homedir4()) => {
-  const rollingDir = join4(home, ".claude", "backups");
-  const legacy = join4(home, BACKUP_PREFIX);
-  const rolling = existsSync5(rollingDir) ? readdirSync3(rollingDir).filter((name) => name.startsWith(BACKUP_PREFIX)).sort().map((name) => join4(rollingDir, name)) : [];
-  return existsSync5(legacy) ? [...rolling, legacy] : rolling;
+var claudeJsonBackups = (home = homedir3()) => {
+  const rollingDir = join3(home, ".claude", "backups");
+  const legacy = join3(home, BACKUP_PREFIX);
+  const rolling = existsSync4(rollingDir) ? readdirSync2(rollingDir).filter((name) => name.startsWith(BACKUP_PREFIX)).sort().map((name) => join3(rollingDir, name)) : [];
+  return existsSync4(legacy) ? [...rolling, legacy] : rolling;
 };
 var parsed = (path) => {
   try {
@@ -540,7 +372,7 @@ var parsed = (path) => {
     return null;
   }
 };
-var claudeBackupRewrites = (receipt, home = homedir4()) => claudeJsonBackups(home).flatMap((path) => {
+var claudeBackupRewrites = (receipt, home = homedir3()) => claudeJsonBackups(home).flatMap((path) => {
   const backup = parsed(path);
   if (!backup) return [];
   const changed = receipt ? restoreClaudeMcpServer(backup, receipt) : removeClaudeMcpServers(backup);
@@ -586,8 +418,8 @@ var removeGlobalCliPackages = (guards2, request) => {
 };
 
 // src/cli/config-temp-leftovers.ts
-import { lstatSync, readdirSync as readdirSync4 } from "fs";
-import { join as join5 } from "path";
+import { lstatSync, readdirSync as readdirSync3 } from "fs";
+import { join as join4 } from "path";
 var MAC_APP_WRITE_TEMP = /^\..+\.pushary-[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}$/;
 var PID_STAMPED_WRITE_TEMP = /^\.\d+-[^/]+\.pushary-tmp$/;
 var CONFIG_TEMP_MIN_AGE_MS = 6e4;
@@ -595,15 +427,15 @@ var isLeakedConfigTempName = (name) => MAC_APP_WRITE_TEMP.test(name) || PID_STAM
 var leakedConfigTemps = (entries, nowMs) => entries.filter((entry) => entry.isFile && isLeakedConfigTempName(entry.name) && nowMs - entry.modifiedAtMs >= CONFIG_TEMP_MIN_AGE_MS).map((entry) => entry.name);
 var directoryEntries = (directory) => {
   try {
-    return readdirSync4(directory).flatMap((name) => {
-      const stats = lstatSync(join5(directory, name), { throwIfNoEntry: false });
+    return readdirSync3(directory).flatMap((name) => {
+      const stats = lstatSync(join4(directory, name), { throwIfNoEntry: false });
       return stats ? [{ name, isFile: stats.isFile(), modifiedAtMs: stats.mtimeMs }] : [];
     });
   } catch {
     return [];
   }
 };
-var configTempLeftovers = (directories, nowMs) => [...new Set(directories)].flatMap((directory) => leakedConfigTemps(directoryEntries(directory), nowMs).map((name) => join5(directory, name)));
+var configTempLeftovers = (directories, nowMs) => [...new Set(directories)].flatMap((directory) => leakedConfigTemps(directoryEntries(directory), nowMs).map((name) => join4(directory, name)));
 
 // src/app-owned-paths.ts
 var APP_OWNED_ENTRIES = [
@@ -700,13 +532,13 @@ var CURSOR_PLUGIN_DIR = cursorPluginDir();
 var CURSOR_USER_HOOKS = cursorUserHooks();
 var VSCODE_PLUGIN_DIR = vscodePluginDir();
 var PUSHARY_DIR = pusharyDir();
-var SHELL_FILES = [".zshrc", ".zprofile", ".bashrc", ".bash_profile"].map((f) => join6(homedir5(), f));
+var SHELL_FILES = [".zshrc", ".zprofile", ".bashrc", ".bash_profile"].map((f) => join5(homedir4(), f));
 var PRESENCE_BY_RESOLUTION = {
   bundle: "present",
   missing: "gone",
   "no-stub": "absent"
 };
-var macAppPresence = () => PRESENCE_BY_RESOLUTION[resolveBridgeStub(join6(PUSHARY_DIR, "bin", HOOK_LOCATOR_BINARY), liveBridgeProbe()).kind];
+var macAppPresence = () => PRESENCE_BY_RESOLUTION[resolveBridgeStub(join5(PUSHARY_DIR, "bin", HOOK_LOCATOR_BINARY), liveBridgeProbe()).kind];
 var removalScope = (keepMcpServer, keepAppWiring) => ({
   keepAppWiring,
   keepMcpServer
@@ -741,7 +573,7 @@ var guardedRemove = (path, options) => guards.remove(path, options);
 var cursorPluginLeftovers = () => {
   const parent = dirname(CURSOR_PLUGIN_DIR);
   try {
-    return readdirSync5(parent).filter(isCursorPluginLeftover).map((name) => join6(parent, name));
+    return readdirSync4(parent).filter(isCursorPluginLeftover).map((name) => join5(parent, name));
   } catch {
     return [];
   }
@@ -755,14 +587,14 @@ var guardedDaemonRemoval = async () => {
 };
 var guardedInstructionBlockRemoval = (path) => {
   if (!dryRun) return removeInstructionBlock(path);
-  if (!existsSync6(path)) return false;
+  if (!existsSync5(path)) return false;
   const hasBlock = readFileSync4(path, "utf-8").includes("pushary");
   if (hasBlock) wouldNote("rewrite", path);
   return hasBlock;
 };
 var guardedAliasRemoval = () => {
   if (!dryRun) return removeClaudeAlias();
-  const shells = CANDIDATE_RCS.map((name) => join6(homedir5(), name)).filter((path) => existsSync6(path) && readFileSync4(path, "utf-8").includes("pushary claude"));
+  const shells = CANDIDATE_RCS.map((name) => join5(homedir4(), name)).filter((path) => existsSync5(path) && readFileSync4(path, "utf-8").includes("pushary claude"));
   for (const path of shells) wouldNote("rewrite", path);
   return shells;
 };
@@ -787,7 +619,7 @@ var removeFxInstructions = () => {
   }
 };
 var removeCursorUserHook = (scope) => {
-  if (!existsSync6(CURSOR_USER_HOOKS)) return "absent";
+  if (!existsSync5(CURSOR_USER_HOOKS)) return "absent";
   let parsed2;
   try {
     parsed2 = JSON.parse(readFileSync4(CURSOR_USER_HOOKS, "utf-8"));
@@ -832,14 +664,14 @@ var cleanSettingsFile = (path, label, scope) => {
   );
 };
 var agentConfigDirectories = () => [
-  homedir5(),
+  homedir4(),
   dirname(CLAUDE_SETTINGS),
   dirname(codexConfigToml()),
   dirname(geminiSettings()),
   dirname(CURSOR_USER_HOOKS),
   openCodeConfigDir(),
   fxConfigDir(),
-  ...vscodeSettingsTargets(existsSync6).map((settings) => dirname(settings))
+  ...vscodeSettingsTargets(existsSync5).map((settings) => dirname(settings))
 ];
 var restoreTakeoverReceipts = () => {
   const targets = [
@@ -847,15 +679,15 @@ var restoreTakeoverReceipts = () => {
     ["codex", codexHooksJson(), codexConfigToml(), "mcp_servers", "toml"],
     ["gemini_cli", geminiSettings(), geminiSettings(), "mcpServers", "json"],
     ["cursor", CURSOR_USER_HOOKS, null, null, null],
-    ["vscode", join6(VSCODE_PLUGIN_DIR, "hooks", "hooks.json"), vscodePluginMcp(), "mcpServers", "json"]
+    ["vscode", join5(VSCODE_PLUGIN_DIR, "hooks", "hooks.json"), vscodePluginMcp(), "mcpServers", "json"]
   ];
   for (const [agent, hookFile, mcpFile, mcpKey, mcpFormat] of targets) {
     const receiptPath = hookTakeoverReceipt(agent);
-    if (!existsSync6(receiptPath)) continue;
+    if (!existsSync5(receiptPath)) continue;
     try {
       const receipt = readJson(receiptPath);
       if (!isHookTakeoverReceipt(receipt) || receipt.agent !== agent) throw new Error("invalid receipt");
-      const document = existsSync6(hookFile) ? JSON.parse(readFileSync4(hookFile, "utf-8")) : {};
+      const document = existsSync5(hookFile) ? JSON.parse(readFileSync4(hookFile, "utf-8")) : {};
       if (!document || typeof document !== "object" || Array.isArray(document)) throw new Error("invalid hooks file");
       const appAlreadyOwns = hookOwnerOf(document) === "app";
       const cliPositions = agent === "codex" ? codexHookPositions(document) : {};
@@ -866,7 +698,7 @@ var restoreTakeoverReceipts = () => {
         if (mcpFile === hookFile) {
           mcpDocument = document;
         } else {
-          const raw = existsSync6(mcpFile) ? readFileSync4(mcpFile, "utf-8") : "";
+          const raw = existsSync5(mcpFile) ? readFileSync4(mcpFile, "utf-8") : "";
           mcpDocument = raw.trim() ? mcpFormat === "toml" ? parseTOML(raw) : JSON.parse(raw) : {};
         }
         mcpChanged = restoreMcpServer(mcpDocument, mcpKey, receipt.mcpServer);
@@ -876,7 +708,7 @@ var restoreTakeoverReceipts = () => {
       if (!appAlreadyOwns && agent === "codex") {
         if (!mcpDocument) {
           const configPath = codexConfigToml();
-          const raw = existsSync6(configPath) ? readFileSync4(configPath, "utf-8") : "";
+          const raw = existsSync5(configPath) ? readFileSync4(configPath, "utf-8") : "";
           mcpDocument = raw.trim() ? parseTOML(raw) : {};
         }
         codexConfig = mcpDocument;
@@ -972,7 +804,7 @@ var main = async () => {
   }
   if (presence !== "absent") console.log();
   const restoredByTakeover = new Set(
-    ["claude_code", "codex", "gemini_cli"].filter((agent) => existsSync6(hookTakeoverReceipt(agent)))
+    ["claude_code", "codex", "gemini_cli"].filter((agent) => existsSync5(hookTakeoverReceipt(agent)))
   );
   if (keepShared) restoreTakeoverReceipts();
   const sharedMcpKeys = {
@@ -998,7 +830,7 @@ var main = async () => {
   let macAppKeepsCodexAppCards = false;
   if (uid !== void 0) {
     try {
-      const removal = { homeDir: homedir5(), uid, keepWhatTheMacAppTurnedOn: keepShared, dryRun };
+      const removal = { homeDir: homedir4(), uid, keepWhatTheMacAppTurnedOn: keepShared, dryRun };
       const appCards = removeCodexAppCardsFromThisMac(removal);
       macAppKeepsCodexAppCards = codexAppCardsFolderStaysOnThisMac(removal);
       if (appCards === "removed") console.log(`  ${check} Codex app cards ${dim(did("removed"))} ${dim("(quit Codex and open it again)")}`);
@@ -1015,7 +847,7 @@ var main = async () => {
   const claudeHadPusharyEntry = claudeHasPusharyEntry();
   const rawReceipt = readJson(CLAUDE_MCP_RECEIPT);
   const receipt = isClaudeMcpSnapshot(rawReceipt) ? rawReceipt : null;
-  const receiptUnreadable = existsSync6(CLAUDE_MCP_RECEIPT) && !receipt;
+  const receiptUnreadable = existsSync5(CLAUDE_MCP_RECEIPT) && !receipt;
   if (keepClaudeMcp) {
     console.log(`  ${skip} Claude Code MCP servers ${dim("(kept: the Mac app uses it)")}`);
   } else if (claudeJson2) {
@@ -1030,7 +862,7 @@ var main = async () => {
       if (receipt && !keepShared) incompleteClean = true;
       console.log(`  ${skip} Claude Code MCP servers ${dim(receipt ? "(changed after setup; left unchanged)" : "(no pushary entries)")}`);
     }
-  } else if (existsSync6(CLAUDE_MCP_RECEIPT)) {
+  } else if (existsSync5(CLAUDE_MCP_RECEIPT)) {
     incompleteClean = true;
     console.log(`  ${skip} Claude Code MCP servers ${dim("(config missing; setup receipt kept for retry)")}`);
   } else {
@@ -1074,7 +906,7 @@ var main = async () => {
   }
   if (cursorGate === "failed") {
     console.log(`  ${skip} Cursor plugin ${dim("(kept: removing it now would block matched commands)")}`);
-  } else if (existsSync6(CURSOR_PLUGIN_DIR)) {
+  } else if (existsSync5(CURSOR_PLUGIN_DIR)) {
     guardedRemove(CURSOR_PLUGIN_DIR);
     console.log(`  ${check} Cursor plugin ${dim("(removed from ~/.cursor/plugins/local)")}`);
   } else {
@@ -1090,9 +922,9 @@ var main = async () => {
   if (keepShared) {
     console.log(`  ${skip} VS Code plugin ${dim("(kept: the Mac app writes the same plugin directory)")}`);
   }
-  for (const settingsPath of keepShared ? [] : vscodeSettingsTargets(existsSync6)) {
+  for (const settingsPath of keepShared ? [] : vscodeSettingsTargets(existsSync5)) {
     const label = `VS Code plugin ${dim(`(${shortenHome(settingsPath)})`)}`;
-    if (!existsSync6(settingsPath)) {
+    if (!existsSync5(settingsPath)) {
       console.log(`  ${skip} ${label} ${dim("(no settings.json)")}`);
       continue;
     }
@@ -1106,7 +938,7 @@ var main = async () => {
       console.log(`  ${skip} ${label} ${dim("(no pushary entry)")}`);
     }
   }
-  if (!keepShared && existsSync6(VSCODE_PLUGIN_DIR)) {
+  if (!keepShared && existsSync5(VSCODE_PLUGIN_DIR)) {
     guardedRemove(VSCODE_PLUGIN_DIR);
     console.log(`  ${check} VS Code plugin files ${dim(did("removed"))}`);
   }
@@ -1125,7 +957,7 @@ var main = async () => {
   }
   if (keepShared) {
     console.log(`  ${skip} Skill directory ${dim("(kept: the Mac app uses it)")}`);
-  } else if (existsSync6(SKILL_DIR)) {
+  } else if (existsSync5(SKILL_DIR)) {
     guardedRemove(SKILL_DIR);
     console.log(`  ${check} Skill directory ${dim(did("removed"))}`);
   } else {
@@ -1185,7 +1017,7 @@ var main = async () => {
   const codexSkillDir2 = codexSkillDir();
   if (keepShared) {
     console.log(`  ${skip} Codex skill directory ${dim("(kept: the Mac app uses it)")}`);
-  } else if (existsSync6(codexSkillDir2)) {
+  } else if (existsSync5(codexSkillDir2)) {
     guardedRemove(codexSkillDir2);
     console.log(`  ${check} Codex skill directory ${dim(did("removed"))}`);
   } else {
@@ -1238,7 +1070,7 @@ var main = async () => {
     console.log(`  ${skip} Gemini GEMINI.md ${dim("(no pushary block)")}`);
   }
   const openCodePlugin = openCodePluginFile();
-  const openCodePluginContents = existsSync6(openCodePlugin) ? readFileSync4(openCodePlugin, "utf-8") : null;
+  const openCodePluginContents = existsSync5(openCodePlugin) ? readFileSync4(openCodePlugin, "utf-8") : null;
   if (openCodePluginContents === null) {
     console.log(`  ${skip} OpenCode plugin ${dim("(not installed)")}`);
   } else if (!isOpenCodePluginOurs(openCodePluginContents)) {
@@ -1248,15 +1080,15 @@ var main = async () => {
   } else {
     guardedRemove(openCodePlugin, { force: true });
     console.log(`  ${check} OpenCode plugin ${dim(did("removed"))}`);
-    const sibling = join6(openCodePluginDir(), OPENCODE_PLUGIN_SIBLING);
+    const sibling = join5(openCodePluginDir(), OPENCODE_PLUGIN_SIBLING);
     const remaining = (() => {
       try {
-        return readdirSync5(openCodePluginDir()).filter((name) => name !== OPENCODE_PLUGIN_SIBLING);
+        return readdirSync4(openCodePluginDir()).filter((name) => name !== OPENCODE_PLUGIN_SIBLING);
       } catch {
         return [];
       }
     })();
-    const siblingIsOurs = existsSync6(sibling) && readFileSync4(sibling, "utf-8") === OPENCODE_PLUGIN_SIBLING_CONTENTS;
+    const siblingIsOurs = existsSync5(sibling) && readFileSync4(sibling, "utf-8") === OPENCODE_PLUGIN_SIBLING_CONTENTS;
     if (siblingIsOurs && !hasForeignPlugins(remaining)) {
       guardedRemove(sibling, { force: true });
       console.log(`  ${check} OpenCode plugin sibling ${dim(did("removed"))}`);
@@ -1309,7 +1141,7 @@ var main = async () => {
         }
       }
     }
-  } else if (existsSync6(HERMES_CONFIG_RECEIPT)) {
+  } else if (existsSync5(HERMES_CONFIG_RECEIPT)) {
     incompleteClean = true;
     console.log(`  ${skip} Hermes ${dim("(runtime not found; setup receipt kept for retry)")}`);
   } else {
@@ -1358,15 +1190,15 @@ var main = async () => {
   if (leakedTemps.length > 0) {
     console.log(`  ${check} Leftover temp files ${dim(`(${dryRun ? "would remove" : "removed"} ${leakedTemps.length} left by an interrupted config write)`)}`);
   }
-  if (existsSync6(PUSHARY_DIR)) {
+  if (existsSync5(PUSHARY_DIR)) {
     let removed = 0;
     const kept = [];
-    for (const entry of readdirSync5(PUSHARY_DIR)) {
+    for (const entry of readdirSync4(PUSHARY_DIR)) {
       if (keepShared && isAppOwned(entry) || entry === "setup" && (keepShared || incompleteClean) || entry === CODEX_APP_CARDS_DIRECTORY && macAppKeepsCodexAppCards) {
         kept.push(entry);
         continue;
       }
-      guardedRemove(join6(PUSHARY_DIR, entry), { force: true });
+      guardedRemove(join5(PUSHARY_DIR, entry), { force: true });
       removed++;
     }
     if (removed > 0) {
@@ -1383,10 +1215,10 @@ var main = async () => {
   }
   try {
     let swept = 0;
-    for (const f of readdirSync5(tmpdir())) {
+    for (const f of readdirSync4(tmpdir())) {
       if (!f.startsWith("pushary-")) continue;
       try {
-        guardedRemove(join6(tmpdir(), f), { force: true });
+        guardedRemove(join5(tmpdir(), f), { force: true });
         swept++;
       } catch {
       }
@@ -1440,7 +1272,7 @@ var main = async () => {
     console.log(`  ${dim("Still stuck? Send this output to")} ${SUPPORT_EMAIL} ${dim("or")} ${SUPPORT_DISCORD}`);
   } else if (everything) {
     console.log(`  ${green(bold("Clean complete. Nothing of ours is left in any agent config."))}`);
-    const bundle = installedPusharyBundles().find(existsSync6);
+    const bundle = installedPusharyBundles().find(existsSync5);
     if (bundle) {
       console.log(`  ${dim("The app itself is still installed. Drag")} ${bundle} ${dim("to the Trash to finish.")}`);
     }

package/dist/bin/pushary-codex-session.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   letCodexRunWithoutPushary
-} from "../chunk-36NGFHE4.js";
+} from "../chunk-E46NE7FB.js";
 
 // bin/pushary-codex-session.ts
 var args = process.argv.slice(2);
@@ -16,7 +16,7 @@ var desktopAccount = async () => {
     return null;
   }
 };
-var desktopLaunch = await import("../codex-desktop-launch-I2D6QATK.js").catch(() => null);
+var desktopLaunch = await import("../codex-desktop-launch-RIBIFXSF.js").catch(() => null);
 if (desktopLaunch === null && appBehindTheProxy !== void 0) {
   process.exitCode = await letCodexRunWithoutPushary(appBehindTheProxy, args.slice(3));
 } else {
@@ -24,7 +24,7 @@ if (desktopLaunch === null && appBehindTheProxy !== void 0) {
   const stop = () => abort.abort();
   if (!args[0]?.startsWith("--desktop")) for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) process.on(signal, stop);
   try {
-    const { codexDesktopCommand } = desktopLaunch ?? await import("../codex-desktop-launch-I2D6QATK.js");
+    const { codexDesktopCommand } = desktopLaunch ?? await import("../codex-desktop-launch-RIBIFXSF.js");
     const desktop = await codexDesktopCommand(args, [process.execPath, ...process.execArgv, process.argv[1], "codex"], desktopAccount);
     if (desktop !== null) process.exitCode = desktop;
     else {

package/dist/bin/pushary-setup.js

@@ -55,7 +55,7 @@ import {
 } from "../chunk-EUW7JL2K.js";
 import {
   codexEngineBehindLauncher
-} from "../chunk-ABGN5RN2.js";
+} from "../chunk-T5L5NWT3.js";
 import "../chunk-XCEN33UP.js";
 import {
   CURSOR_PLUGIN_BACKUP_INFIX,
@@ -244,7 +244,7 @@ import {
   CODEX_ENGINE_ENTRYPOINT,
   CODEX_ENGINE_MANIFEST,
   codexEngineInside
-} from "../chunk-36NGFHE4.js";
+} from "../chunk-E46NE7FB.js";
 import {
   reportEvent
 } from "../chunk-U2L42GVI.js";

package/dist/{chunk-36NGFHE4.js → chunk-E46NE7FB.js}

@@ -4,6 +4,7 @@ import { rmSync } from "fs";
 import { join } from "path";
 var CODEX_APP_LAUNCH_VARIABLE = "CODEX_CLI_PATH";
 var CODEX_ENGINE_PENDING_VARIABLE = "PUSHARY_CODEX_ENGINE_PENDING";
+var CODEX_APP_LAUNCH_AT_LOGIN_VERB = "codex-app-launch-at-login";
 var CODEX_ENGINE_DIRECTORY = "Contents/Resources/codex-cli";
 var CODEX_ENGINE_ENTRYPOINT = "bin/codex";
 var CODEX_ENGINE_MANIFEST = "codex-package.json";
@@ -60,6 +61,7 @@ var letCodexRunWithoutPushary = (app, engineArgs) => {
 export {
   CODEX_APP_LAUNCH_VARIABLE,
   CODEX_ENGINE_PENDING_VARIABLE,
+  CODEX_APP_LAUNCH_AT_LOGIN_VERB,
   CODEX_ENGINE_DIRECTORY,
   CODEX_ENGINE_ENTRYPOINT,
   CODEX_ENGINE_MANIFEST,

package/dist/{chunk-ABGN5RN2.js → chunk-T5L5NWT3.js}

@@ -12,7 +12,7 @@ import {
   launcherIsGone,
   launcherWaitingOnThisProcess,
   tellTheLauncherTheEngineStarted
-} from "./chunk-36NGFHE4.js";
+} from "./chunk-E46NE7FB.js";
 
 // src/codex-desktop-launch.ts
 import { spawn as spawn2, execFileSync } from "child_process";
@@ -695,7 +695,7 @@ var codexDesktopCommand = async (args, entry, readAccount) => {
     return runCodexDesktopProxy(engine2, args.slice(3), readAccount, { watchesForCards: layoutIsKnown });
   }
   if (args[0] === APP_CARDS_FLAG) {
-    const { codexAppCardsCommandOnThisMac } = await import("./codex-app-cards-switch-RENOSSDD.js");
+    const { codexAppCardsCommandOnThisMac } = await import("./codex-app-cards-switch-P4RVJNRV.js");
     return codexAppCardsCommandOnThisMac(args.slice(1), entry, readAccount);
   }
   if (args.length > 2) throw new Error("Usage: pushary codex --desktop [path/to/Codex.app]");

package/dist/{chunk-SUIB4O3S.js → chunk-ZWOWEXCV.js}

@@ -6,7 +6,7 @@ import {
   everyProgramFileIsThere,
   installedCodexApp,
   shellQuoted
-} from "./chunk-ABGN5RN2.js";
+} from "./chunk-T5L5NWT3.js";
 import {
   writeHuman
 } from "./chunk-QCGNGEGE.js";
@@ -14,17 +14,200 @@ import {
   xml
 } from "./chunk-BL3WAGIK.js";
 import {
+  CODEX_APP_LAUNCH_AT_LOGIN_VERB,
   CODEX_APP_LAUNCH_VARIABLE
-} from "./chunk-36NGFHE4.js";
+} from "./chunk-E46NE7FB.js";
 import {
   writeFileAtomic
 } from "./chunk-AQFEP65J.js";
 
 // src/codex-app-cards-switch.ts
-import { execFileSync } from "child_process";
-import { existsSync, mkdirSync, readFileSync, rmSync } from "fs";
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync as existsSync2, mkdirSync, readFileSync, rmSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+
+// src/cli/mac-leftovers.ts
+import { execSync, execFileSync } from "child_process";
+import { existsSync, readdirSync } from "fs";
 import { homedir } from "os";
-import { join } from "path";
+import { isAbsolute, join } from "path";
+var MAC_APP_BUNDLE = "/Applications/Pushary.app";
+var MAC_APP_BUNDLE_ID = "com.pushary.app";
+var installedPusharyBundles = (home = homedir()) => [MAC_APP_BUNDLE, join(home, "Applications", "Pushary.app")];
+var LSREGISTER = "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";
+var TEST_DEFAULTS_PREFIXES = [
+  "com.pushary.mac.tests.",
+  "com.pushary.tests.",
+  "pushary.tests.",
+  "pushary.quiet-mode-test.",
+  "pushary.drafts.test.",
+  "pushary-optin-",
+  "pushary-completion-test-",
+  "pushary-updates-only-"
+];
+var UUID = "[0-9A-Fa-f]{8}(?:-[0-9A-Fa-f]{4}){3}-[0-9A-Fa-f]{12}";
+var UNPREFIXED_TEST_DEFAULTS_DOMAIN = new RegExp(`^(?:owner-mode|fx-model)-${UUID}$`);
+var DEVELOPER_BUILD_DEFAULTS_DOMAIN = "PusharyMac";
+var isDeveloperDefaultsDomain = (domain) => domain === DEVELOPER_BUILD_DEFAULTS_DOMAIN || UNPREFIXED_TEST_DEFAULTS_DOMAIN.test(domain) || TEST_DEFAULTS_PREFIXES.some((prefix) => domain.startsWith(prefix));
+var PREFERENCES_FILE_EXTENSION = ".plist";
+var preferencesDirectory = (home) => join(home, "Library", "Preferences");
+var preferencesFile = (home, domain) => join(preferencesDirectory(home), `${domain}${PREFERENCES_FILE_EXTENSION}`);
+var namesIn = (directory) => {
+  try {
+    return readdirSync(directory);
+  } catch {
+    return [];
+  }
+};
+var developerDefaults = (home = homedir()) => namesIn(preferencesDirectory(home)).filter((name) => name.endsWith(PREFERENCES_FILE_EXTENSION)).map((name) => name.slice(0, -PREFERENCES_FILE_EXTENSION.length)).filter(isDeveloperDefaultsDomain).map((domain) => ({ domain, file: preferencesFile(home, domain) }));
+var BUNDLE_NAME = "Pushary.app";
+var DUMP_RECORD_SEPARATOR = /^-{20,}$/m;
+var DUMP_PATH_LINES = /^[ \t]*path:[ \t]+(.+?)(?: \(0x[0-9a-f]+\))?[ \t]*$/gm;
+var DUMP_IDENTIFIER_LINES = /^[ \t]*identifier:[ \t]+(\S+)/gm;
+var capturedIn = (text, lines) => [...text.matchAll(lines)].flatMap((match) => match[1] === void 0 ? [] : [match[1]]);
+var appCopyNamedByRecord = (record) => {
+  const paths = capturedIn(record, DUMP_PATH_LINES);
+  const identifiers = capturedIn(record, DUMP_IDENTIFIER_LINES);
+  const namesOneAppCopy = paths.length === 1 && identifiers.length === 1 && identifiers[0] === MAC_APP_BUNDLE_ID;
+  return namesOneAppCopy ? paths : [];
+};
+var isAtOrInside = (path, bundle) => path === bundle || path.startsWith(`${bundle}/`);
+var isUnderBundleNamedPushary = (path) => path.split("/").includes(BUNDLE_NAME);
+var bundlesInLaunchServicesDump = (dump) => {
+  const appCopies = dump.split(DUMP_RECORD_SEPARATOR).flatMap(appCopyNamedByRecord);
+  const isOurs = (path) => isUnderBundleNamedPushary(path) || appCopies.some((copy) => isAtOrInside(path, copy));
+  return [...new Set(capturedIn(dump, DUMP_PATH_LINES).filter(isOurs))];
+};
+var outsideInstalledBundles = (registered, installed) => registered.filter((path) => !installed.some((bundle) => isAtOrInside(path, bundle)));
+var registeredPusharyBundles = (installed = installedPusharyBundles()) => {
+  if (!existsSync(LSREGISTER)) return [];
+  try {
+    const dump = execSync(`${LSREGISTER} -dump`, {
+      encoding: "utf-8",
+      timeout: 6e4,
+      maxBuffer: 256 * 1024 * 1024
+    });
+    return outsideInstalledBundles(bundlesInLaunchServicesDump(dump), installed);
+  } catch {
+    return [];
+  }
+};
+var MAC_KEYCHAIN_SERVICE = "com.pushary.app.mac";
+var MAC_KEYCHAIN_ACCOUNTS = [
+  "pushary.site-api-key",
+  "pushary.site-id",
+  "pushary.partner-enrollments",
+  "pushary.partner-device-key",
+  "clerk.device-token",
+  "clerk.session-id",
+  "clerkDeviceToken",
+  "cachedClient",
+  "cachedClientServerDate",
+  "cachedEnvironment"
+];
+var MAC_DEFAULTS_DOMAINS = ["com.pushary.app", "pushary-bridge", "pushary.render"];
+var PRESENCE_PROBE_TIMEOUT_MS = 1e4;
+var commandSucceeds = (file, args) => {
+  try {
+    execFileSync(file, args, { stdio: "ignore", timeout: PRESENCE_PROBE_TIMEOUT_MS });
+    return true;
+  } catch {
+    return false;
+  }
+};
+var KEYCHAIN_ITEM_NOT_FOUND = 44;
+var keychainItemMayExist = (service, account) => {
+  try {
+    execFileSync("security", ["find-generic-password", "-s", service, "-a", account], { stdio: "ignore" });
+    return true;
+  } catch (error) {
+    return !(error instanceof Error && "status" in error && error.status === KEYCHAIN_ITEM_NOT_FOUND);
+  }
+};
+var liveMacStatePresence = {
+  keychainItem: keychainItemMayExist,
+  defaultsDomain: (domain) => commandSucceeds("defaults", ["read", domain])
+};
+var macLibraryState = (home = homedir()) => [
+  join(home, "Library", "Application Support", "Pushary"),
+  join(home, "Library", "Caches", "com.pushary.app"),
+  join(home, "Library", "Caches", "com.pushary.app.sparkle"),
+  join(home, "Library", "Saved Application State", "com.pushary.app.savedState"),
+  join(home, "Library", "Caches", "pushary-bridge"),
+  join(home, "Library", "HTTPStorages", "com.pushary.app"),
+  join(home, "Library", "HTTPStorages", "com.pushary.app.binarycookies"),
+  join(home, "Library", "HTTPStorages", "pushary-bridge"),
+  ...MAC_DEFAULTS_DOMAINS.map((domain) => preferencesFile(home, domain))
+];
+var USER_CACHE_ENTRIES = [MAC_APP_BUNDLE_ID, "pushary-bridge", "PusharyBridge"];
+var macUserCacheState = (reportedUserCacheDirectory) => {
+  const directory = reportedUserCacheDirectory.trim();
+  return isAbsolute(directory) ? USER_CACHE_ENTRIES.map((entry) => join(directory, entry)) : [];
+};
+var UNKNOWN_USER_CACHE_DIRECTORY = "";
+var reportedDarwinUserCacheDirectory = () => {
+  try {
+    return execFileSync("getconf", ["DARWIN_USER_CACHE_DIR"], {
+      encoding: "utf-8",
+      timeout: PRESENCE_PROBE_TIMEOUT_MS,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+  } catch {
+    return UNKNOWN_USER_CACHE_DIRECTORY;
+  }
+};
+var CRASH_REPORTER_ENTRY = new RegExp(`^(?:Pushary|PusharyMac|pushary-bridge)_${UUID}\\.plist$`);
+var crashReporterEntries = (home = homedir()) => {
+  const directory = join(home, "Library", "Application Support", "CrashReporter");
+  return namesIn(directory).filter((name) => CRASH_REPORTER_ENTRY.test(name)).map((name) => join(directory, name));
+};
+var storedMacAppState = (home = homedir()) => [
+  ...macLibraryState(home),
+  ...macUserCacheState(reportedDarwinUserCacheDirectory()),
+  ...crashReporterEntries(home)
+];
+var DUMP_SERVICE_LINE = /^\s*"svce"<blob>="(.+)"\s*$/;
+var pusharyKeychainServices = (dump) => {
+  const found = /* @__PURE__ */ new Set();
+  for (const line of dump.split("\n")) {
+    const service = DUMP_SERVICE_LINE.exec(line)?.[1];
+    if (service?.startsWith(MAC_KEYCHAIN_SERVICE)) found.add(service);
+  }
+  return [...found];
+};
+var storedPusharyKeychainServices = () => {
+  const dump = execFileSync("security", ["dump-keychain"], {
+    encoding: "utf-8",
+    timeout: 3e4,
+    maxBuffer: 64 * 1024 * 1024,
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+  const stored = pusharyKeychainServices(dump);
+  return stored.includes(MAC_KEYCHAIN_SERVICE) ? stored : [MAC_KEYCHAIN_SERVICE, ...stored];
+};
+var runningMacAppPIDs = () => {
+  if (process.platform !== "darwin") return [];
+  try {
+    return execSync('pgrep -f "Pushary.app/Contents/MacOS/Pushary"', {
+      encoding: "utf-8",
+      timeout: 1e4,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).split("\n").map((line) => Number(line.trim())).filter((pid) => Number.isInteger(pid) && pid > 0);
+  } catch {
+    return [];
+  }
+};
+var waitForMacAppExit = (attempts = 20, everyMs = 250) => {
+  const idle = new Int32Array(new SharedArrayBuffer(4));
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    if (runningMacAppPIDs().length === 0) return true;
+    Atomics.wait(idle, 0, 0, everyMs);
+  }
+  return runningMacAppPIDs().length === 0;
+};
+
+// src/codex-app-cards-switch.ts
 var CODEX_APP_CARDS_LOGIN_ITEM = "com.pushary.codex-app-cards";
 var CODEX_APP_CARDS_DIRECTORY = "codex-app";
 var LAUNCHCTL = "/bin/launchctl";
@@ -39,15 +222,15 @@ var LOGIN_ITEM_MODE = 420;
 var MAC_APP_HELPER = "/Contents/Helpers/pushary-native-transcripts";
 var TEMPORARY_NPX_FOLDER = "/_npx/";
 var codexAppCardsPaths = (homeDir, uid) => {
-  const launcherDirectory = join(homeDir, ".pushary", CODEX_APP_CARDS_DIRECTORY);
-  const loginItemDirectory = join(homeDir, "Library", "LaunchAgents");
+  const launcherDirectory = join2(homeDir, ".pushary", CODEX_APP_CARDS_DIRECTORY);
+  const loginItemDirectory = join2(homeDir, "Library", "LaunchAgents");
   return {
     launcherDirectory,
-    launcherPath: join(launcherDirectory, LAUNCHER_NAME),
-    receiptPath: join(launcherDirectory, RECEIPT_NAME),
-    turnedOffPath: join(launcherDirectory, TURNED_OFF_NAME),
+    launcherPath: join2(launcherDirectory, LAUNCHER_NAME),
+    receiptPath: join2(launcherDirectory, RECEIPT_NAME),
+    turnedOffPath: join2(launcherDirectory, TURNED_OFF_NAME),
     loginItemDirectory,
-    loginItemPath: join(loginItemDirectory, `${CODEX_APP_CARDS_LOGIN_ITEM}.plist`),
+    loginItemPath: join2(loginItemDirectory, `${CODEX_APP_CARDS_LOGIN_ITEM}.plist`),
     loginItemTarget: `gui/${uid}/${CODEX_APP_CARDS_LOGIN_ITEM}`
   };
 };
@@ -56,17 +239,23 @@ var codexAppCardsLoginScript = (launcherPath, engine, entry) => [
   `&& [ -z "$(${LAUNCHCTL} getenv ${CODEX_APP_LAUNCH_VARIABLE})" ];`,
   `then ${LAUNCHCTL} setenv ${CODEX_APP_LAUNCH_VARIABLE} ${shellQuoted(launcherPath)}; fi`
 ].join(" ");
+var isTheMacAppsHelper = (entry) => entry.length > 0 && entry[0].endsWith(MAC_APP_HELPER);
+var loginItemProgram = (launcherPath, engine, entry) => isTheMacAppsHelper(entry) ? [entry[0], CODEX_APP_LAUNCH_AT_LOGIN_VERB] : ["/bin/sh", "-c", codexAppCardsLoginScript(launcherPath, engine, entry)];
+var LISTED_UNDER_THE_MAC_APP = `  <key>AssociatedBundleIdentifiers</key>
+  <array>
+    <string>${MAC_APP_BUNDLE_ID}</string>
+  </array>
+`;
+var propertyListString = (value) => `    <string>${xml(value)}</string>`;
 var codexAppCardsLoginItem = (launcherPath, engine, entry) => `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
   <key>Label</key>
   <string>${CODEX_APP_CARDS_LOGIN_ITEM}</string>
-  <key>ProgramArguments</key>
+${isTheMacAppsHelper(entry) ? LISTED_UNDER_THE_MAC_APP : ""}  <key>ProgramArguments</key>
   <array>
-    <string>/bin/sh</string>
-    <string>-c</string>
-    <string>${xml(codexAppCardsLoginScript(launcherPath, engine, entry))}</string>
+${loginItemProgram(launcherPath, engine, entry).map(propertyListString).join("\n")}
   </array>
   <key>RunAtLoad</key>
   <true/>
@@ -128,6 +317,13 @@ var turnCodexAppCardsOn = (installation, machine) => {
   machine.setLaunchVariable(paths.launcherPath);
   return { kind: "on" };
 };
+var setCodexAppLaunchAtLogin = (paths, machine) => {
+  const isTurnedOn = machine.exists(paths.launcherPath) && machine.exists(paths.loginItemPath);
+  const cannotRun = whatTheLauncherCannotRun(codexAppCardsReceiptFrom(machine.readFile(paths.receiptPath)), machine);
+  if (!isTurnedOn || cannotRun !== null || machine.launchVariable().length > 0) return "left_as_it_is";
+  machine.setLaunchVariable(paths.launcherPath);
+  return "set";
+};
 var leaveOnlyThePathToTheEngine = (paths, machine) => {
   const receipt = codexAppCardsReceiptFrom(machine.readFile(paths.receiptPath));
   const launcher = machine.readFile(paths.launcherPath);
@@ -152,7 +348,6 @@ var rememberCodexAppCardsWereTurnedOff = (paths, machine) => {
   machine.makeDirectory(paths.launcherDirectory, PRIVATE_DIRECTORY_MODE);
   machine.writeFile(paths.turnedOffPath, "", PRIVATE_FILE_MODE);
 };
-var isTheMacAppsHelper = (entry) => entry.length > 0 && entry[0].endsWith(MAC_APP_HELPER);
 var turnedOnByTheMacApp = (receipt) => receipt !== null && isTheMacAppsHelper(receipt.entry);
 var codexAppCardsReport = (paths, machine) => ({
   status: codexAppCardsStatus(paths, machine),
@@ -181,7 +376,7 @@ var removeCodexAppCards = (request, machine) => {
   if (keepsTheOff) rememberCodexAppCardsWereTurnedOff(paths, machine);
   return "removed";
 };
-var launchctl = (args) => execFileSync(LAUNCHCTL, [...args], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+var launchctl = (args) => execFileSync2(LAUNCHCTL, [...args], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
 var launchctlIgnoringFailure = (args) => {
   try {
     return launchctl(args);
@@ -208,7 +403,7 @@ var thisMacsCodexAppCardsMachine = () => ({
   unloadLoginItem: (target) => {
     launchctlIgnoringFailure(["bootout", target]);
   },
-  exists: existsSync,
+  exists: existsSync2,
   readFile: fileContents,
   makeDirectory: (path, mode) => {
     mkdirSync(path, { recursive: true, mode });
@@ -222,6 +417,11 @@ var thisMacsCodexAppCardsMachine = () => ({
 });
 var removeCodexAppCardsFromThisMac = (request) => removeCodexAppCards(request, thisMacsCodexAppCardsMachine());
 var codexAppCardsFolderStaysOnThisMac = (request) => codexAppCardsFolderStays(request, thisMacsCodexAppCardsMachine());
+var setCodexAppLaunchAtLoginOnThisMac = () => {
+  const uid = process.getuid?.();
+  if (uid === void 0) return;
+  setCodexAppLaunchAtLogin(codexAppCardsPaths(homedir2(), uid), thisMacsCodexAppCardsMachine());
+};
 var USAGE = "Usage: pushary codex --app-cards on [path/to/Codex.app] | off | status [--json]";
 var AS_JSON = "--json";
 var TAKES_EFFECT_AFTER_REOPENING = "Quit Codex and open it again.";
@@ -250,7 +450,7 @@ var codexAppCardsCommand = async (args, entry, readAccount, machine, say) => {
   const [action, chosenApp, ...rest] = args;
   const uid = process.getuid?.();
   if (uid === void 0) throw new Error("Codex app cards need macOS");
-  const paths = codexAppCardsPaths(homedir(), uid);
+  const paths = codexAppCardsPaths(homedir2(), uid);
   if (action === "status" && chosenApp === AS_JSON && rest.length === 0) {
     say(JSON.stringify(codexAppCardsReport(paths, machine)));
     return 0;
@@ -270,7 +470,7 @@ var codexAppCardsCommand = async (args, entry, readAccount, machine, say) => {
   if (!await readAccount()) throw new Error("Connect Pushary before turning Codex app cards on");
   const app = installedCodexApp(chosenApp);
   const engine = await desktopEngine(app);
-  const turnedOn = turnCodexAppCardsOn(codexAppCardsInstallation({ homeDir: homedir(), uid, entry, app, engine }), machine);
+  const turnedOn = turnCodexAppCardsOn(codexAppCardsInstallation({ homeDir: homedir2(), uid, entry, app, engine }), machine);
   if (turnedOn.kind === "another_program_owns_the_launch") {
     say(ownedByAnotherProgram(turnedOn.value));
     return 1;
@@ -288,6 +488,18 @@ var sayToThePerson = (line) => {
 var codexAppCardsCommandOnThisMac = (args, entry, readAccount) => codexAppCardsCommand(args, entry, readAccount, thisMacsCodexAppCardsMachine(), sayToThePerson);
 
 export {
+  MAC_APP_BUNDLE_ID,
+  installedPusharyBundles,
+  LSREGISTER,
+  developerDefaults,
+  registeredPusharyBundles,
+  MAC_KEYCHAIN_ACCOUNTS,
+  MAC_DEFAULTS_DOMAINS,
+  liveMacStatePresence,
+  storedMacAppState,
+  storedPusharyKeychainServices,
+  runningMacAppPIDs,
+  waitForMacAppExit,
   CODEX_APP_CARDS_LOGIN_ITEM,
   CODEX_APP_CARDS_DIRECTORY,
   codexAppCardsPaths,
@@ -297,6 +509,7 @@ export {
   codexAppCardsInstallation,
   codexAppCardsStatus,
   turnCodexAppCardsOn,
+  setCodexAppLaunchAtLogin,
   turnCodexAppCardsOff,
   rememberCodexAppCardsWereTurnedOff,
   codexAppCardsReport,
@@ -304,6 +517,7 @@ export {
   removeCodexAppCards,
   removeCodexAppCardsFromThisMac,
   codexAppCardsFolderStaysOnThisMac,
+  setCodexAppLaunchAtLoginOnThisMac,
   runsFromATemporaryFolder,
   codexAppCardsStatusLine,
   codexAppCardsCommand,

package/dist/{codex-app-cards-switch-RENOSSDD.js → codex-app-cards-switch-P4RVJNRV.js}

@@ -17,16 +17,18 @@ import {
   removeCodexAppCards,
   removeCodexAppCardsFromThisMac,
   runsFromATemporaryFolder,
+  setCodexAppLaunchAtLogin,
+  setCodexAppLaunchAtLoginOnThisMac,
   turnCodexAppCardsOff,
   turnCodexAppCardsOn
-} from "./chunk-SUIB4O3S.js";
-import "./chunk-ABGN5RN2.js";
+} from "./chunk-ZWOWEXCV.js";
+import "./chunk-T5L5NWT3.js";
 import "./chunk-XCEN33UP.js";
 import "./chunk-QCGNGEGE.js";
 import "./chunk-BL3WAGIK.js";
 import "./chunk-XHKBHWLX.js";
 import "./chunk-VYBH6D4X.js";
-import "./chunk-36NGFHE4.js";
+import "./chunk-E46NE7FB.js";
 import "./chunk-T6RIKJUO.js";
 import "./chunk-4QQEUJL4.js";
 import "./chunk-OML4YFBN.js";
@@ -55,6 +57,8 @@ export {
   removeCodexAppCards,
   removeCodexAppCardsFromThisMac,
   runsFromATemporaryFolder,
+  setCodexAppLaunchAtLogin,
+  setCodexAppLaunchAtLoginOnThisMac,
   turnCodexAppCardsOff,
   turnCodexAppCardsOn
 };

package/dist/{codex-desktop-launch-I2D6QATK.js → codex-desktop-launch-RIBIFXSF.js}

@@ -10,11 +10,11 @@ import {
   installedCodexApp,
   shellQuoted,
   writeDesktopProxy
-} from "./chunk-ABGN5RN2.js";
+} from "./chunk-T5L5NWT3.js";
 import "./chunk-XCEN33UP.js";
 import {
   CODEX_APP_LAUNCH_VARIABLE
-} from "./chunk-36NGFHE4.js";
+} from "./chunk-E46NE7FB.js";
 export {
   CODEX_APP_LAUNCH_VARIABLE,
   codexAppOnThisMac,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "1.9.53",
+  "version": "1.9.54",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",