@pushary/agent-hooks 1.9.6 → 1.9.8

package/dist/bin/pushary-status.js

@@ -2,52 +2,64 @@
 import {
   describeLastSeen,
   listMachines
-} from "../chunk-SVTHEMM3.js";
-import "../chunk-MKJ3RTUS.js";
+} from "../chunk-2QTO5YIT.js";
+import "../chunk-I6MJXLMY.js";
 import "../chunk-RIVNNBEK.js";
-import "../chunk-ZC3TF4LR.js";
+import "../chunk-LKLVTG3V.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
 import {
   describeReach,
   fetchChannels,
   reachVerdict
-} from "../chunk-YPXUD6DW.js";
+} from "../chunk-IAD2RT4L.js";
 import "../chunk-3EGEA4KH.js";
 import "../chunk-QCGNGEGE.js";
+import {
+  SIGNED_OUT_ON_MAC_MESSAGE,
+  activeKeyVerdictOf,
+  describeSignedOutKey,
+  readSignedOutDiagnosis
+} from "../chunk-2WXF3QJR.js";
 import {
   createIo
 } from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-FBD3QGVJ.js";
+} from "../chunk-CKV3UPMU.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
 import {
   readKeySource
-} from "../chunk-5BHROGRB.js";
-import "../chunk-ZPW4MJOV.js";
+} from "../chunk-N4QSPI3B.js";
+import "../chunk-MKTJEXZ3.js";
 import {
   checkApiKey,
   describeKeyCheck
-} from "../chunk-4QKM44N6.js";
-import "../chunk-W4Q7NFXU.js";
-import "../chunk-3BUAEQCY.js";
+} from "../chunk-LWOO567I.js";
+import "../chunk-TCQ43LSG.js";
+import "../chunk-DUZVXBBU.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-75CA37FZ.js";
-import "../chunk-HJXZJF6O.js";
+import "../chunk-FQ2GORVG.js";
+import "../chunk-ZBHUHJG6.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-2QRE6QH2.js";
-import "../chunk-L6USMDTW.js";
-import "../chunk-Q4E56K4X.js";
+import "../chunk-5QUPKDI5.js";
+import "../chunk-7DVNSQWF.js";
+import "../chunk-I5IJRMNV.js";
 
 // src/status.ts
+var signedOutReport = (facts, lines) => {
+  const signedOut = facts.signedOut;
+  if (signedOut?.kind !== "signed_out_on_mac") return null;
+  lines.push({ label: "Server", value: "key signed out on this Mac", ok: false });
+  return { lines, headline: SIGNED_OUT_ON_MAC_MESSAGE, next: [...describeSignedOutKey(signedOut)], exitCode: EXIT.UNAUTHENTICATED };
+};
 var keySourceLine = (source) => {
   if (source.kind === "none") {
     return { label: "Key", value: "none found", ok: false };
@@ -86,6 +98,8 @@ var buildStatusReport = (facts) => {
     });
   }
   if (facts.source.kind === "none") {
+    const signedOut = signedOutReport(facts, lines);
+    if (signedOut) return signedOut;
     return {
       lines,
       headline: "Not set up on this machine.",
@@ -95,6 +109,8 @@ var buildStatusReport = (facts) => {
   }
   const check = facts.keyCheck;
   if (check && check.kind !== "ok") {
+    const signedOut = check.kind === "rejected" ? signedOutReport(facts, lines) : null;
+    if (signedOut) return signedOut;
     const report = describeKeyCheck(check);
     lines.push({ label: "Server", value: report.message, ok: check.kind === "unreachable" ? null : false });
     return { lines, headline: report.message, next: [...report.next], exitCode: report.exitCode };
@@ -148,7 +164,7 @@ var buildStatusReport = (facts) => {
       return {
         lines,
         headline: verdict.kind === "nobody" ? "Configured, but no device can receive an approval." : verdict.kind === "others" ? "Configured, but the only devices here are your teammates'." : "Configured, and nothing proves an approval reaches you.",
-        next: verdict.kind === "nobody" ? ["Run `pushary connect` to add your phone, or install the Pushary app."] : ["Run `pushary connect` to add your own phone.", "Or `pushary doctor --roundtrip` to prove one of these is yours."],
+        next: verdict.kind === "nobody" ? ["Run `pushary pair` to pair your phone, or install the Pushary app."] : ["Run `pushary pair` to pair your own phone.", "Or `pushary doctor --roundtrip` to prove one of these is yours."],
         exitCode: EXIT.NO_DEVICE
       };
     }
@@ -156,7 +172,7 @@ var buildStatusReport = (facts) => {
       return {
         lines,
         headline: "Configured, but nothing in your pocket can receive an approval.",
-        next: ["Run `pushary connect` and connect your phone, or install the Pushary app."],
+        next: ["Run `pushary pair` to pair your phone, or install the Pushary app."],
         exitCode: EXIT.NO_DEVICE
       };
     }
@@ -208,7 +224,7 @@ var main = async () => {
     if (keyCheck.kind === "ok") channels = await fetchChannels(source.key);
   }
   const machines = devices && keyCheck?.kind === "ok" ? await listMachines(source.key) : null;
-  const facts = { source, keyCheck, channels };
+  const facts = { source, keyCheck, channels, signedOut: readSignedOutDiagnosis(source.key, activeKeyVerdictOf(keyCheck)) };
   const report = buildStatusReport(facts);
   if (json) {
     const payload = statusJson(facts, report);

package/dist/bin/pushary-stop-hook.js

@@ -2,49 +2,47 @@
 import {
   activeHookSource,
   activeIdentity
-} from "../chunk-TE5M6GGK.js";
-import "../chunk-IR5FRUPQ.js";
+} from "../chunk-KHNFLYJO.js";
 import {
   readHookInput
-} from "../chunk-HWQNQVY6.js";
-import "../chunk-VRT3EEZN.js";
+} from "../chunk-WWOHTTVP.js";
+import "../chunk-DPGSLWOS.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-NVGDMTX3.js";
-import "../chunk-SPXBXN23.js";
-import "../chunk-SJN22ADZ.js";
-import "../chunk-D7SOOVHX.js";
-import "../chunk-ZC3TF4LR.js";
-import "../chunk-UKNKYTTY.js";
-import "../chunk-Q23MMVTD.js";
-import "../chunk-5AXCOTIT.js";
-import "../chunk-7JTVYR5B.js";
-import "../chunk-KK54WQ74.js";
+import "../chunk-YIG2R3BJ.js";
+import "../chunk-DL7XWKYV.js";
+import "../chunk-LKLVTG3V.js";
+import "../chunk-2QGYMY7A.js";
+import "../chunk-3I6IVOZV.js";
+import "../chunk-WG3K4TCH.js";
+import "../chunk-ZBK6E2OR.js";
+import "../chunk-CLOSJ4ES.js";
+import "../chunk-M6BZZFVQ.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
 import {
   handleStop,
   handleSubagentStop,
   isSubagentStop
-} from "../chunk-CCDVL63C.js";
+} from "../chunk-KRCR2CRQ.js";
 import "../chunk-N6IOSZOE.js";
-import "../chunk-DJ4BB264.js";
-import "../chunk-WN6WYUCV.js";
-import "../chunk-DA4FTGTK.js";
+import "../chunk-CD47ZFFZ.js";
+import "../chunk-2VZAALEJ.js";
+import "../chunk-DKMD6AWR.js";
 import "../chunk-POFBE6ZY.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-5BHROGRB.js";
-import "../chunk-ZPW4MJOV.js";
-import "../chunk-4QKM44N6.js";
-import "../chunk-W4Q7NFXU.js";
-import "../chunk-3BUAEQCY.js";
+import "../chunk-N4QSPI3B.js";
+import "../chunk-MKTJEXZ3.js";
+import "../chunk-LWOO567I.js";
+import "../chunk-TCQ43LSG.js";
+import "../chunk-DUZVXBBU.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-75CA37FZ.js";
-import "../chunk-HJXZJF6O.js";
+import "../chunk-FQ2GORVG.js";
+import "../chunk-ZBHUHJG6.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-2QRE6QH2.js";
-import "../chunk-L6USMDTW.js";
-import "../chunk-Q4E56K4X.js";
+import "../chunk-5QUPKDI5.js";
+import "../chunk-7DVNSQWF.js";
+import "../chunk-I5IJRMNV.js";
 
 // bin/pushary-stop-hook.ts
 var AGENT = activeIdentity(process.argv);

package/dist/bin/pushary-stopfailure-hook.js

@@ -2,47 +2,45 @@
 import {
   activeHookSource,
   activeIdentity
-} from "../chunk-TE5M6GGK.js";
-import "../chunk-IR5FRUPQ.js";
+} from "../chunk-KHNFLYJO.js";
 import {
   readHookInput
-} from "../chunk-HWQNQVY6.js";
-import "../chunk-VRT3EEZN.js";
+} from "../chunk-WWOHTTVP.js";
+import "../chunk-DPGSLWOS.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-NVGDMTX3.js";
-import "../chunk-SPXBXN23.js";
-import "../chunk-SJN22ADZ.js";
-import "../chunk-D7SOOVHX.js";
-import "../chunk-ZC3TF4LR.js";
-import "../chunk-UKNKYTTY.js";
-import "../chunk-Q23MMVTD.js";
-import "../chunk-5AXCOTIT.js";
-import "../chunk-7JTVYR5B.js";
-import "../chunk-KK54WQ74.js";
+import "../chunk-YIG2R3BJ.js";
+import "../chunk-DL7XWKYV.js";
+import "../chunk-LKLVTG3V.js";
+import "../chunk-2QGYMY7A.js";
+import "../chunk-3I6IVOZV.js";
+import "../chunk-WG3K4TCH.js";
+import "../chunk-ZBK6E2OR.js";
+import "../chunk-CLOSJ4ES.js";
+import "../chunk-M6BZZFVQ.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
 import {
   handleStopFailure
-} from "../chunk-CCDVL63C.js";
+} from "../chunk-KRCR2CRQ.js";
 import "../chunk-N6IOSZOE.js";
-import "../chunk-DJ4BB264.js";
-import "../chunk-WN6WYUCV.js";
-import "../chunk-DA4FTGTK.js";
+import "../chunk-CD47ZFFZ.js";
+import "../chunk-2VZAALEJ.js";
+import "../chunk-DKMD6AWR.js";
 import "../chunk-POFBE6ZY.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-5BHROGRB.js";
-import "../chunk-ZPW4MJOV.js";
-import "../chunk-4QKM44N6.js";
-import "../chunk-W4Q7NFXU.js";
-import "../chunk-3BUAEQCY.js";
+import "../chunk-N4QSPI3B.js";
+import "../chunk-MKTJEXZ3.js";
+import "../chunk-LWOO567I.js";
+import "../chunk-TCQ43LSG.js";
+import "../chunk-DUZVXBBU.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-75CA37FZ.js";
-import "../chunk-HJXZJF6O.js";
+import "../chunk-FQ2GORVG.js";
+import "../chunk-ZBHUHJG6.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-2QRE6QH2.js";
-import "../chunk-L6USMDTW.js";
-import "../chunk-Q4E56K4X.js";
+import "../chunk-5QUPKDI5.js";
+import "../chunk-7DVNSQWF.js";
+import "../chunk-I5IJRMNV.js";
 
 // bin/pushary-stopfailure-hook.ts
 var AGENT = activeIdentity(process.argv);

package/dist/bin/pushary-suggestions.js

@@ -1,37 +1,40 @@
 #!/usr/bin/env node
+import {
+  exitOnFailedSettingsRequest
+} from "../chunk-BEJRK4DF.js";
+import "../chunk-2WXF3QJR.js";
 import {
   createIo
 } from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-FBD3QGVJ.js";
+} from "../chunk-CKV3UPMU.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
+import "../chunk-N4QSPI3B.js";
+import "../chunk-LWOO567I.js";
+import "../chunk-TCQ43LSG.js";
+import "../chunk-DUZVXBBU.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
+import "../chunk-FQ2GORVG.js";
+import "../chunk-ZBHUHJG6.js";
+import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-2QRE6QH2.js";
-import "../chunk-L6USMDTW.js";
-import "../chunk-Q4E56K4X.js";
+} from "../chunk-5QUPKDI5.js";
+import "../chunk-7DVNSQWF.js";
+import "../chunk-I5IJRMNV.js";
 
 // bin/pushary-suggestions.ts
 exitOnHelpFlag("suggestions");
-var { dim, green, cyan, red } = createIo();
-var errorMessage = async (res) => {
-  try {
-    const body = await res.json();
-    return body.error ?? `HTTP ${res.status}`;
-  } catch {
-    return `HTTP ${res.status}`;
-  }
-};
+var { dim, green, cyan } = createIo();
 {
   const raw = process.argv.slice(2);
   const positional = raw[0] === "suggestions" ? raw.slice(1) : raw;
@@ -46,6 +49,7 @@ var errorMessage = async (res) => {
 var main = async () => {
   const apiKey = getApiKey();
   const baseUrl = getBaseUrl();
+  const settings = { request: "suggestions", apiKey, baseUrl };
   const headers = { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" };
   const rest = process.argv.slice(2);
   const args = rest[0] === "suggestions" ? rest.slice(1) : rest;
@@ -61,18 +65,12 @@ var main = async () => {
       headers,
       body: JSON.stringify({ id })
     });
-    if (!res2.ok) {
-      console.error(`  ${red("\u2717")} ${await errorMessage(res2)}`);
-      process.exit(1);
-    }
+    if (!res2.ok) await exitOnFailedSettingsRequest(res2, settings);
     console.log(`  ${green("\u2713")} Accepted. The rule is live now; your agents will pick it up on their next check.`);
     return;
   }
   const res = await fetch(`${baseUrl}/api/mcp/suggestions`, { headers });
-  if (!res.ok) {
-    console.error(`  ${red("\u2717")} ${await errorMessage(res)}`);
-    process.exit(1);
-  }
+  if (!res.ok) await exitOnFailedSettingsRequest(res, settings);
   const { suggestions } = await res.json();
   if (suggestions.length === 0) {
     console.log(`  ${dim("No pending suggestions. Keep approving; a rule is offered once a pattern is earned.")}`);

package/dist/bin/pushary-transcript-register.js

@@ -1,32 +1,31 @@
 #!/usr/bin/env node
 import {
   registerTranscript
-} from "../chunk-VRT3EEZN.js";
+} from "../chunk-DPGSLWOS.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-NVGDMTX3.js";
-import "../chunk-SPXBXN23.js";
-import "../chunk-SJN22ADZ.js";
-import "../chunk-D7SOOVHX.js";
-import "../chunk-ZC3TF4LR.js";
-import "../chunk-UKNKYTTY.js";
-import "../chunk-Q23MMVTD.js";
-import "../chunk-5AXCOTIT.js";
-import "../chunk-7JTVYR5B.js";
-import "../chunk-KK54WQ74.js";
+import "../chunk-YIG2R3BJ.js";
+import "../chunk-DL7XWKYV.js";
+import "../chunk-LKLVTG3V.js";
+import "../chunk-2QGYMY7A.js";
+import "../chunk-3I6IVOZV.js";
+import "../chunk-WG3K4TCH.js";
+import "../chunk-ZBK6E2OR.js";
+import "../chunk-CLOSJ4ES.js";
+import "../chunk-M6BZZFVQ.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-DJ4BB264.js";
+import "../chunk-CD47ZFFZ.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-5BHROGRB.js";
-import "../chunk-3BUAEQCY.js";
+import "../chunk-N4QSPI3B.js";
+import "../chunk-DUZVXBBU.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-75CA37FZ.js";
-import "../chunk-HJXZJF6O.js";
+import "../chunk-FQ2GORVG.js";
+import "../chunk-ZBHUHJG6.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-2QRE6QH2.js";
-import "../chunk-L6USMDTW.js";
-import "../chunk-Q4E56K4X.js";
+import "../chunk-5QUPKDI5.js";
+import "../chunk-7DVNSQWF.js";
+import "../chunk-I5IJRMNV.js";
 
 // bin/pushary-transcript-register.ts
 var raw = "";

package/dist/bin/pushary-transcripts.js

@@ -6,17 +6,17 @@ import {
 } from "../chunk-SGZJ5LYH.js";
 import {
   transcriptsEnabled
-} from "../chunk-KK54WQ74.js";
+} from "../chunk-M6BZZFVQ.js";
 import {
   exitOnHelpFlag
-} from "../chunk-FBD3QGVJ.js";
-import "../chunk-5BHROGRB.js";
+} from "../chunk-CKV3UPMU.js";
+import "../chunk-N4QSPI3B.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-75CA37FZ.js";
+import "../chunk-FQ2GORVG.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-2QRE6QH2.js";
-import "../chunk-L6USMDTW.js";
-import "../chunk-Q4E56K4X.js";
+import "../chunk-5QUPKDI5.js";
+import "../chunk-7DVNSQWF.js";
+import "../chunk-I5IJRMNV.js";
 
 // bin/pushary-transcripts.ts
 exitOnHelpFlag("transcripts");

package/dist/bin/pushary-upgrade.js

@@ -5,42 +5,52 @@ import {
   finishUpgradeWithLock,
   readGlobalUpgradeSubject,
   runAutoUpdate,
+  upgradeFinishExitCode,
+  upgradeFinishOutcome,
   upgradeInstalledPackage,
   withUpgradeLock
-} from "../chunk-PYZC54KA.js";
+} from "../chunk-ZW3XZLJC.js";
 import {
   installWithUpgradeLock
-} from "../chunk-EZAFBC2C.js";
-import {
-  describeCodexTrustConfirmation
-} from "../chunk-JUFKJCZG.js";
+} from "../chunk-V5HPPF3E.js";
 import {
   ensureCodexTrustAfterReapply,
   reapplyAllAgents
-} from "../chunk-2I23NFVT.js";
-import "../chunk-IMGJYFCX.js";
+} from "../chunk-MXHTGVFZ.js";
+import "../chunk-3Z3A37WD.js";
+import {
+  describeCodexTrustConfirmation
+} from "../chunk-6TE27XZR.js";
+import "../chunk-MGRFDGWU.js";
 import {
   waitForMachineReadiness
-} from "../chunk-SVTHEMM3.js";
-import "../chunk-IR5FRUPQ.js";
+} from "../chunk-2QTO5YIT.js";
+import {
+  appAgentKey
+} from "../chunk-OP7IHC2I.js";
+import "../chunk-MFF3ONG5.js";
+import "../chunk-KHNFLYJO.js";
 import {
   detectProviderLiveCapabilities,
   expectedLaunchCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "../chunk-MKJ3RTUS.js";
+} from "../chunk-I6MJXLMY.js";
 import "../chunk-RIVNNBEK.js";
 import {
   AUTO_UPDATE_DISABLE_ENV,
   describeAutoUpdateCheck,
   hasPendingUpgradeFinish,
   isAutoUpdateDisabledByEnv,
+  isUnfinishedAutoUpdate,
   parseAutoUpdateFlag,
   readAutoUpdateState,
   updateAutoUpdateState
-} from "../chunk-SNJ3BOCP.js";
-import "../chunk-D7SOOVHX.js";
+} from "../chunk-7PT35RY2.js";
+import "../chunk-YIG2R3BJ.js";
+import "../chunk-DL7XWKYV.js";
 import {
+  DAEMON_COLD_START_TIMEOUT_MS,
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   disableDaemonService,
@@ -50,45 +60,60 @@ import {
   replaceDaemonService,
   stopDaemonService,
   waitForDaemonRemoteProof
-} from "../chunk-ZC3TF4LR.js";
-import "../chunk-UKNKYTTY.js";
+} from "../chunk-LKLVTG3V.js";
+import "../chunk-2QGYMY7A.js";
+import "../chunk-3I6IVOZV.js";
+import "../chunk-WG3K4TCH.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-DJ4BB264.js";
+import "../chunk-KRCR2CRQ.js";
+import "../chunk-N6IOSZOE.js";
+import "../chunk-CD47ZFFZ.js";
+import "../chunk-2VZAALEJ.js";
+import "../chunk-DKMD6AWR.js";
 import "../chunk-POFBE6ZY.js";
 import {
   exitOnHelpFlag
-} from "../chunk-FBD3QGVJ.js";
+} from "../chunk-CKV3UPMU.js";
+import "../chunk-GMXKITVA.js";
 import {
-  readControlMode
-} from "../chunk-5BHROGRB.js";
-import "../chunk-3BUAEQCY.js";
+  readControlMode,
+  recordMacAppKeyPrefix
+} from "../chunk-N4QSPI3B.js";
+import "../chunk-MKTJEXZ3.js";
+import "../chunk-LWOO567I.js";
+import "../chunk-TCQ43LSG.js";
+import "../chunk-DUZVXBBU.js";
+import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-75CA37FZ.js";
+import "../chunk-FQ2GORVG.js";
 import {
   LATEST_TAG,
   autoUpdateState,
+  bridgeAgentKey,
   claudeJson,
   codexConfigToml,
   cursorPluginDir,
   fetchLatestPublishedVersion,
   geminiSettings,
   vscodePluginDir
-} from "../chunk-HJXZJF6O.js";
-import "../chunk-T7E75EKA.js";
+} from "../chunk-ZBHUHJG6.js";
+import {
+  readJsonSafe
+} from "../chunk-T7E75EKA.js";
 import {
   getApiKey
-} from "../chunk-2QRE6QH2.js";
+} from "../chunk-5QUPKDI5.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-L6USMDTW.js";
+} from "../chunk-7DVNSQWF.js";
 import {
   CANONICAL_PACKAGE,
   LEGACY_PACKAGE,
   getPackageVersion
-} from "../chunk-Q4E56K4X.js";
+} from "../chunk-I5IJRMNV.js";
 
 // bin/pushary-upgrade.ts
 import { existsSync } from "fs";
@@ -137,9 +162,13 @@ var finishUpgrade = async () => {
   } catch {
     apiKey = void 0;
   }
+  const bridgeAgentKey2 = readJsonSafe(bridgeAgentKey());
+  const macAppKey = bridgeAgentKey2.kind === "ok" ? appAgentKey(bridgeAgentKey2.value) : null;
+  if (macAppKey) recordMacAppKeyPrefix(macAppKey);
   const inspectedAgents = reapplyAllAgents(apiKey);
   const codexTrust = await ensureCodexTrustAfterReapply(inspectedAgents);
   const refreshed = inspectedAgents.filter((agent) => agent.result.reapplied);
+  const keptForApp = inspectedAgents.filter((agent) => agent.heldBy === "app");
   const failedRefreshes = inspectedAgents.filter((agent) => agent.result.failed);
   const configuredControlProviders = inspectedAgents.filter((agent) => agent.result.configured && (agent.id === "claude" || agent.id === "codex" || agent.id === "gemini")).map((agent) => agent.id);
   const controlMode = readControlMode();
@@ -166,7 +195,7 @@ var finishUpgrade = async () => {
     } else {
       const service = await replaceDaemonService();
       const daemon = service.kind === "ok" ? await ensureDaemonRunning({ spawnDaemon: () => {
-      } }) : null;
+      }, waitTimeoutMs: DAEMON_COLD_START_TIMEOUT_MS }) : null;
       const localProof = daemon?.kind === "running" || daemon?.kind === "started" ? await waitForDaemonRemoteProof() : null;
       const serverProof = localProof && daemonHasRemoteProof(localProof) ? await waitForMachineReadiness(apiKey, expectedLaunchCapabilities(configuredControlProviders)) : null;
       daemonReady = service.kind === "ok" && localProof !== null && daemonHasRemoteProof(localProof) && (serverProof?.kind === "ready" || serverProof?.kind === "unsupported");
@@ -174,6 +203,7 @@ var finishUpgrade = async () => {
   } else if (controlMode === "on" && controlPolicy === "unsupported") {
     daemonReady = false;
   }
+  const finishOutcome = upgradeFinishOutcome({ controlMode, controlPolicy, daemonReady, failedRefreshCount: failedRefreshes.length });
   console.log();
   if (refreshed.length > 0) {
     console.log("Refreshed so the new hook set is active now:");
@@ -185,9 +215,14 @@ var finishUpgrade = async () => {
       console.log();
       console.log("No key was readable here, so MCP entries kept the key they already had.");
     }
-  } else if (failedRefreshes.length === 0) {
+  } else if (failedRefreshes.length === 0 && keptForApp.length === 0) {
     console.log("No agent config on this machine needed refreshing.");
   }
+  if (keptForApp.length > 0) {
+    if (refreshed.length > 0) console.log();
+    console.log(KEPT_FOR_APP_HEADING);
+    for (const agent of keptForApp) console.log(`  ${agent.label}`);
+  }
   if (codexTrust) {
     console.log();
     console.log(describeCodexTrustConfirmation(codexTrust));
@@ -195,17 +230,18 @@ var finishUpgrade = async () => {
   console.log();
   if (!daemonReady) {
     console.error(controlPolicy === "disabled" ? "Upgrade installed, but the disabled background service could not be fully removed. Re-run setup with --control off." : controlPolicy === "legacy" ? legacyStopFailure ? `Upgrade installed, but the legacy background service could not be stopped: ${legacyStopFailure}. Run setup with --control off.` : "Upgrade installed and the legacy background service was stopped, but it cannot be safely adopted. Run setup with --control off, or restore its provider and native service manager." : controlPolicy === "enabled" && !apiKey ? "Upgrade installed, but phone-start could not be reconciled because no API key was readable. Re-run setup." : "Upgrade installed, but the background service did not start. Run: pushary daemon install");
-    process.exitCode = 1;
+    process.exitCode = upgradeFinishExitCode(finishOutcome);
     return;
   }
   if (failedRefreshes.length > 0) {
     console.error(`Upgrade installed, but refreshing agent configuration failed for: ${failedRefreshes.map((agent) => agent.label).join(", ")}. Check the config files and run pushary upgrade again.`);
-    process.exitCode = 1;
+    process.exitCode = upgradeFinishExitCode(finishOutcome);
     return;
   }
   console.log(controlPolicy === "disabled" ? "Done. Your hooks use the new global install; phone-start remains disabled." : controlPolicy === "unsupported" || controlPolicy === "preserve-absent" ? "Done. Your hooks use the new global install; no background service was added." : "Done. Your hooks and background service use the new global install.");
   console.log("Verify with: pushary doctor");
 };
+var KEPT_FOR_APP_HEADING = "Kept for the Pushary Mac app, which owns these agents. Nothing in their config was changed:";
 var AUTO_UPDATE_ON_MESSAGE = "Automatic updates are on. Pushary checks for a new version once a day, when an agent session starts.";
 var AUTO_UPDATE_OFF_MESSAGE = "Automatic updates are off. Turn them back on with: pushary upgrade --auto=on";
 var AUTO_UPDATE_RUN_MESSAGES = {
@@ -227,7 +263,7 @@ var runAutomaticUpdate = async () => {
     return;
   }
   console.log(`Automatic update: ${describeAutoUpdateCheck(outcome.state)}`);
-  if (outcome.state.lastResult === "failed" || outcome.state.lastResult === "finish_pending") process.exitCode = 1;
+  if (isUnfinishedAutoUpdate(outcome.state)) process.exitCode = 1;
 };
 var FINISH_FAILED_MESSAGE = "Upgrade installed, but refreshing the agent configs did not finish. Fix the problem printed above, then run pushary upgrade again.";
 var describeFinishFailure = (finish) => finish.kind === "entry_missing" ? `Upgrade installed, but the new pushary-upgrade entry was not found at ${finish.entry}.` : FINISH_FAILED_MESSAGE;
@@ -272,7 +308,7 @@ var upgradeSubject = async (subject) => {
     fetchLatest: (packageName) => fetchLatestPublishedVersion({ packageName }),
     hasPendingFinish: (installed) => hasPendingUpgradeFinish(readAutoUpdateState(autoUpdateState()), installed),
     recordFinished: () => {
-      updateAutoUpdateState(autoUpdateState(), { lastResult: "updated", detail: void 0, announced: false });
+      updateAutoUpdateState(autoUpdateState(), { lastResult: "updated", detail: void 0, announced: false, finishAttempts: void 0 });
     },
     announce: (line) => console.log(line),
     install: (packageName) => installWithUpgradeLock({ packageName, version: LATEST_TAG, timeoutMs: 12e4 }),