@pushary/agent-hooks 1.9.66 → 1.9.68

package/dist/{chunk-AWGBL4P3.js → chunk-RWXDWOQQ.js}

@@ -4,24 +4,24 @@ import {
   outcomeOfFailedAsk,
   reportMachineDenial,
   storedWaitDeadline
-} from "./chunk-V4EOFOB2.js";
+} from "./chunk-E5PEOVUJ.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-6BGVSV2Q.js";
+} from "./chunk-7YJSDXLM.js";
 import {
   isAdmitted,
   readAdmissionRules
-} from "./chunk-QN25WBXL.js";
+} from "./chunk-PGOPIIOQ.js";
 import {
   isDeferAnswer,
   oncePerSession
-} from "./chunk-ZJV7SFIJ.js";
+} from "./chunk-2HMKZYF5.js";
 import {
   activeHookSource,
   activeIdentity,
   namedSource
-} from "./chunk-3EZP5ZPS.js";
+} from "./chunk-TVVJ6OYG.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -45,10 +45,10 @@ import {
   reportEvent,
   scopePathFor,
   settleQuestionsForToolUse
-} from "./chunk-2BL6KWN7.js";
+} from "./chunk-6IFEYELN.js";
 import {
   repoKeyFor
-} from "./chunk-XXIJBYNW.js";
+} from "./chunk-GMHQYX3D.js";
 import {
   askUser,
   cancelQuestion,
@@ -65,20 +65,20 @@ import {
   waitForQuestion,
   waitsForThePhone,
   withdrawQuestion
-} from "./chunk-ZAZUDYSF.js";
+} from "./chunk-QYTOYNV2.js";
 import {
   getMachineId
-} from "./chunk-IA5VWIHV.js";
+} from "./chunk-2VYQG2HG.js";
 import {
   claudeConfigDir
-} from "./chunk-GDLT32I4.js";
+} from "./chunk-LQAAOXYJ.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-A47UKPC7.js";
+} from "./chunk-32OSSYGZ.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-GO7YKPT3.js";
+} from "./chunk-X2MTVD4W.js";
 import {
   AGENT_QUESTION_STRATEGY,
   AGENT_QUESTION_TOOL,
@@ -133,7 +133,7 @@ import {
   terminalStaysLiveForTheCall,
   timeoutActionWithoutLocalPrompt,
   unansweredRefusalReason
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/terminal-answer-watch.ts
 import { closeSync, openSync, readSync, statSync } from "fs";
@@ -296,36 +296,45 @@ var reportDecisionEpisode = async (apiKey, input) => {
 
 // src/hook.ts
 import { basename } from "path";
-var START_MS = Date.now();
-var ACTIVE_AGENT = activeIdentity(process.argv);
-var ACTIVE_SOURCE = activeHookSource(process.argv);
-var HANDED_DOWN_BY_THE_MAC_BRIDGE = namedSource(process.argv) !== void 0;
-var CLAUDE_SESSION_ATTENDED_ENV = "CLAUDE_CODE_SESSION_ATTENDED";
-var PUSHARY_IS_SOLE_GATE = ACTIVE_SOURCE !== null && hookCompatibleProfileBySource(ACTIVE_SOURCE)?.soleGate != null;
-var agentNameIn = (projectName) => `${ACTIVE_AGENT.label} - ${projectName}`;
+
+// src/pre-tool-use-output.ts
 var allow = (reason) => claudePreToolUseOutput("allow", reason);
 var deny = (reason) => claudePreToolUseOutput("deny", reason);
-var allowWithInput = (updatedInput) => claudePreToolUseOutput("allow", void 0, updatedInput);
 var ask = (reason) => claudePreToolUseOutput("ask", reason);
 var halted = (reason) => claudeStoppedPreToolUseOutput(reason);
-var undecidedCall = (reason) => PUSHARY_IS_SOLE_GATE ? deny(reason) : void 0;
+
+// src/permission-ask-outcome.ts
 var questionLimitOutput = (handBack) => handBack.kind === "refuse" ? deny(handBack.reason) : ask(QUESTION_LIMIT_PROMPT_REASON);
-var outcomeOfFailedPermissionAsk = (error, sessionId, questionLimitFacts) => {
+var outcomeOfFailedPermissionAsk = (error, sessionId, questionLimitFacts, subscriptionRequiredOutput) => {
   if (isQuestionLimitRefusal(error)) return questionLimitOutput(questionLimitHandBack(questionLimitFacts));
-  return outcomeOfFailedAsk(error, sessionId, halted(UNVERIFIABLE_APPROVAL_REASON)) ?? undecidedCall(SOLE_GATE_SUBSCRIPTION_REASON);
+  return outcomeOfFailedAsk(error, sessionId, halted(UNVERIFIABLE_APPROVAL_REASON)) ?? subscriptionRequiredOutput;
 };
-var handlePushOnly = async (apiKey, description, projectName, timeoutSeconds, timeoutAction, sessionId, machineId, toolName, toolTarget, decision, signals, agentPromptFollows) => {
+var handlePushOnly = async (apiKey, call, timeoutSeconds, timeoutAction, signals) => {
+  const {
+    description,
+    projectName,
+    agentName,
+    sessionId,
+    machineId,
+    toolName,
+    toolTarget,
+    decision,
+    agentPromptFollows,
+    startMs,
+    subscriptionRequiredOutput,
+    announceWait: announceWait2
+  } = call;
   const effectiveWait = effectiveWaitSeconds(timeoutAction, timeoutSeconds, "claude");
   const now = Date.now();
-  const requestedDeadline = hookWaitDeadline(START_MS, effectiveWait, "claude", now);
-  const clampCut = hookWaitClamped(START_MS, effectiveWait, "claude", now);
+  const requestedDeadline = hookWaitDeadline(startMs, effectiveWait, "claude", now);
+  const clampCut = hookWaitClamped(startMs, effectiveWait, "claude", now);
   let result;
   try {
     result = await askUser(apiKey, {
       question: `Allow ${description || UNNAMED_ACTION}?`,
       type: "confirm",
       context: `Agent wants to run this in ${projectName}`,
-      agentName: agentNameIn(projectName),
+      agentName,
       sessionId,
       machineId,
       toolName,
@@ -337,11 +346,11 @@ var handlePushOnly = async (apiKey, description, projectName, timeoutSeconds, ti
     return outcomeOfFailedPermissionAsk(error, sessionId, {
       refusesUnanswered: refusesWhenUnanswered({ mode: "push_only", timeoutAction }),
       agentPromptFollows
-    });
+    }, subscriptionRequiredOutput);
   }
   if (isDecisionStopped(result)) return halted(DECISION_STOP_REASON);
   const deadline = storedWaitDeadline(result, requestedDeadline);
-  if (waitsForThePhone(result)) announceWait(effectiveWait, result.answerUrl, sessionId);
+  if (waitsForThePhone(result)) announceWait2(effectiveWait, result.answerUrl, sessionId);
   const answer = await waitForQuestion(apiKey, result, deadline);
   if (isDecisionStopped(answer)) return halted(DECISION_STOP_REASON);
   if (!answer.answered && isLocalQuestionHandoff(result)) return ask("Approve in the current client.");
@@ -362,18 +371,29 @@ var handlePushOnly = async (apiKey, description, projectName, timeoutSeconds, ti
       return ask("No push response, asking in terminal");
   }
 };
-var handleTerminalOnly = () => {
-  return ask();
-};
-var handlePushFirst = async (apiKey, description, projectName, pushFirstSeconds, sessionId, machineId, toolName, toolTarget, decision, signals, agentPromptFollows) => {
-  const requestedDeadline = hookWaitDeadline(START_MS, pushFirstSeconds, "claude", Date.now());
+var handlePushFirst = async (apiKey, call, pushFirstSeconds, signals) => {
+  const {
+    description,
+    projectName,
+    agentName,
+    sessionId,
+    machineId,
+    toolName,
+    toolTarget,
+    decision,
+    agentPromptFollows,
+    startMs,
+    subscriptionRequiredOutput,
+    announceWait: announceWait2
+  } = call;
+  const requestedDeadline = hookWaitDeadline(startMs, pushFirstSeconds, "claude", Date.now());
   let result;
   try {
     result = await askUser(apiKey, {
       question: `Allow ${description || UNNAMED_ACTION}?`,
       type: "confirm",
       context: `Agent wants to run this in ${projectName}`,
-      agentName: agentNameIn(projectName),
+      agentName,
       sessionId,
       machineId,
       toolName,
@@ -382,10 +402,10 @@ var handlePushFirst = async (apiKey, description, projectName, pushFirstSeconds,
       ...decision
     });
   } catch (error) {
-    return outcomeOfFailedPermissionAsk(error, sessionId, { refusesUnanswered: false, agentPromptFollows });
+    return outcomeOfFailedPermissionAsk(error, sessionId, { refusesUnanswered: false, agentPromptFollows }, subscriptionRequiredOutput);
   }
   if (isDecisionStopped(result)) return halted(DECISION_STOP_REASON);
-  if (waitsForThePhone(result)) announceWait(pushFirstSeconds, result.answerUrl, sessionId);
+  if (waitsForThePhone(result)) announceWait2(pushFirstSeconds, result.answerUrl, sessionId);
   const deadline = storedWaitDeadline(result, requestedDeadline);
   const answer = await waitForQuestion(apiKey, result, deadline, 1500);
   if (isDecisionStopped(answer)) return halted(DECISION_STOP_REASON);
@@ -396,6 +416,20 @@ var handlePushFirst = async (apiKey, description, projectName, pushFirstSeconds,
   }
   return ask(WITHDRAWN_APPROVAL_REASON);
 };
+
+// src/hook.ts
+var START_MS = Date.now();
+var ACTIVE_AGENT = activeIdentity(process.argv);
+var ACTIVE_SOURCE = activeHookSource(process.argv);
+var HANDED_DOWN_BY_THE_MAC_BRIDGE = namedSource(process.argv) !== void 0;
+var CLAUDE_SESSION_ATTENDED_ENV = "CLAUDE_CODE_SESSION_ATTENDED";
+var PUSHARY_IS_SOLE_GATE = ACTIVE_SOURCE !== null && hookCompatibleProfileBySource(ACTIVE_SOURCE)?.soleGate != null;
+var agentNameIn = (projectName) => `${ACTIVE_AGENT.label} - ${projectName}`;
+var allowWithInput = (updatedInput) => claudePreToolUseOutput("allow", void 0, updatedInput);
+var undecidedCall = (reason) => PUSHARY_IS_SOLE_GATE ? deny(reason) : void 0;
+var handleTerminalOnly = () => {
+  return ask();
+};
 var handleNotifyOnly = async (apiKey, description, projectName, sessionId, machineId) => {
   try {
     await sendNotification(apiKey, {
@@ -522,6 +556,20 @@ var dispatchModeHandler = async (apiKey, input, toolPolicy, machineId, trainingC
     permissionMode: input.permission_mode
   };
   const signals = {};
+  const permissionAsk = {
+    description,
+    projectName,
+    agentName: agentNameIn(projectName),
+    sessionId,
+    machineId,
+    toolName: input.tool_name,
+    toolTarget,
+    decision,
+    agentPromptFollows,
+    startMs: START_MS,
+    subscriptionRequiredOutput: undecidedCall(SOLE_GATE_SUBSCRIPTION_REASON),
+    announceWait
+  };
   const runHandler = () => {
     const mode = ownPrompt ? toolPolicy.mode : approvalModeWithoutLocalPrompt(toolPolicy.mode);
     if (terminalLive && pushesToThePhone(mode)) {
@@ -529,15 +577,15 @@ var dispatchModeHandler = async (apiKey, input, toolPolicy, machineId, trainingC
     }
     switch (mode) {
       case "push_only":
-        return handlePushOnly(apiKey, description, projectName, toolPolicy.timeoutSeconds, ownPrompt ? toolPolicy.timeoutAction : timeoutActionWithoutLocalPrompt(toolPolicy), sessionId, machineId, input.tool_name, toolTarget, decision, signals, agentPromptFollows);
+        return handlePushOnly(apiKey, permissionAsk, toolPolicy.timeoutSeconds, ownPrompt ? toolPolicy.timeoutAction : timeoutActionWithoutLocalPrompt(toolPolicy), signals);
       case "terminal_only":
         return Promise.resolve(handleTerminalOnly());
       case "push_first":
-        return handlePushFirst(apiKey, description, projectName, toolPolicy.pushFirstSeconds, sessionId, machineId, input.tool_name, toolTarget, decision, signals, agentPromptFollows);
+        return handlePushFirst(apiKey, permissionAsk, toolPolicy.pushFirstSeconds, signals);
       case "notify_only":
         return handleNotifyOnly(apiKey, description, projectName, sessionId, machineId);
       default:
-        return handlePushFirst(apiKey, description, projectName, toolPolicy.pushFirstSeconds, sessionId, machineId, input.tool_name, toolTarget, decision, signals, agentPromptFollows);
+        return handlePushFirst(apiKey, permissionAsk, toolPolicy.pushFirstSeconds, signals);
     }
   };
   const result = await runHandler();

package/dist/{chunk-6ZXCWK27.js → chunk-SL7CIZCL.js}

@@ -4,13 +4,13 @@ import {
   configFailureKind,
   retryAgentCommand,
   writeSetupConfigFile
-} from "./chunk-5FJDODOA.js";
+} from "./chunk-ODAAK2RZ.js";
 import {
   MCP_BRIDGE_BINARY
-} from "./chunk-HUGVJBDN.js";
+} from "./chunk-53RH3ZIK.js";
 import {
   KEY_FILE_MODE
-} from "./chunk-CNJ7SI5V.js";
+} from "./chunk-PBEW5CJK.js";
 import {
   CLINE_SERVER_NAME_TAKEN,
   CLINE_SETTINGS_REFUSALS,
@@ -23,19 +23,22 @@ import {
   clinePusharyEntryOf,
   clineServerNameTakenElsewhere,
   clineSettingsText,
+  guardedArgv,
   isClinePusharyEntry,
+  isPusharyMcpUrl,
   otherPusharyServerNames,
   readClineSettings,
   renderAgentInstructions,
   withClinePusharyServer,
   withRefreshedClineKey,
   withoutClinePusharyServer
-} from "./chunk-GDLT32I4.js";
+} from "./chunk-LQAAOXYJ.js";
 import {
   readJsonSafe,
+  resolveGlobalBinary,
   writeFileAtomic,
   writeJsonAtomic
-} from "./chunk-KS3O6O7E.js";
+} from "./chunk-NAQCWM4U.js";
 
 // src/fx-config.ts
 var FX_SERVER_NAME = "pushary";
@@ -57,6 +60,9 @@ var ALIAS_SERVERS_KEY = "mcpServers";
 var LOCAL_TRANSPORT = "local";
 var SERVER_TRANSPORTS = /* @__PURE__ */ new Set(["local", "stdio", "http", "sse"]);
 var STDIO_TRANSPORTS = /* @__PURE__ */ new Set(["local", "stdio"]);
+var REMOTE_TRANSPORTS = /* @__PURE__ */ new Set(["http", "sse"]);
+var FX_HTTP_CALLS_CAN_DROP = "fx's MCP-v2 engine (FX_MCP_ENGINE=v2) reuses an HTTP connection the server has already closed, so the first Pushary call after a few idle minutes can fail without reaching Pushary";
+var FX_RELOAD_AFTER_BRIDGE = "Restart fx, or run /mcp reload in each running fx session, so it reaches Pushary through the local bridge.";
 var AMBIGUOUS_SERVER_KEYS = /* @__PURE__ */ new Set([
   "mcpserver",
   "mcpservers",
@@ -200,6 +206,22 @@ var isFxPusharyEntry = (value) => {
   return STDIO_TRANSPORTS.has(transport) && (commandNamesBridge(entry.command) || commandNamesBridge(entry.args));
 };
 var fxPusharyEntryOf = (profile) => asRecord(profile[fxServersKeyOf(profile)])?.[FX_SERVER_NAME];
+var connectsOverHttp = (entry) => entry.type === void 0 || typeof entry.type === "string" && REMOTE_TRANSPORTS.has(entry.type);
+var isFxPusharyHttpEntry = (value) => {
+  const entry = asRecord(value);
+  return entry !== void 0 && entry.enabled !== false && connectsOverHttp(entry) && isPusharyMcpUrl(entry.url);
+};
+var isOtherPusharyHttpServer = ([name, entry]) => name !== FX_SERVER_NAME && isFxPusharyHttpEntry(entry);
+var serverNameOf = ([name]) => name;
+var fxOtherPusharyHttpServers = (profile) => Object.entries(asRecord(profile[fxServersKeyOf(profile)]) ?? {}).filter(isOtherPusharyHttpServer).map(serverNameOf);
+var quotedServerNames = (names) => names.map((name) => `"${name}"`).join(", ");
+var fxOtherHttpServersNote = (names, profilePath, retryCommand) => `fx also reaches Pushary over HTTP through ${quotedServerNames(names)} in ${profilePath}. ${FX_HTTP_CALLS_CAN_DROP}. Remove ${names.length === 1 ? "it" : "them"}, then run ${retryCommand}.`;
+var FX_HTTP_ENTRY_KEPT_BECAUSE = {
+  "no-key": "this machine has no saved Pushary key for the local bridge",
+  "no-bridge": "the Pushary bridge is not installed globally on this machine"
+};
+var fxHttpEntryKeptNote = (reason, profilePath, retryCommand) => `fx still reaches Pushary over HTTP ("${FX_SERVER_NAME}" in ${profilePath}), because ${FX_HTTP_ENTRY_KEPT_BECAUSE[reason]}. ${FX_HTTP_CALLS_CAN_DROP}. Run ${retryCommand} to switch it.`;
+var fxHttpEntryDoctorNote = (profilePath, upgradeCommand) => `${profilePath} points "${FX_SERVER_NAME}" straight at Pushary over HTTP. ${FX_HTTP_CALLS_CAN_DROP}. Run ${upgradeCommand} to switch it to the local bridge.`;
 var isBridgeTarget = (part) => namesBridge(part);
 var fxBridgeTargetOf = (value) => {
   const entry = asRecord(value);
@@ -435,6 +457,31 @@ var fxServerHolder = (profilePath, appBridge) => {
   if (!isFxPusharyEntry(entry)) return "none";
   return fxBridgeTargetOf(entry) === appBridge ? "app" : "cli";
 };
+var fxBridgeEntryAt = (bridgePath) => fxPusharyEntry(guardedArgv({ kind: "binary", path: bridgePath, runtime: "node" }));
+var cliFxBridgeEntry = () => fxBridgeEntryAt(resolveGlobalBinary(MCP_BRIDGE_BINARY) ?? MCP_BRIDGE_BINARY);
+var installedCliFxBridgeEntry = () => {
+  const installed = resolveGlobalBinary(MCP_BRIDGE_BINARY);
+  return installed === void 0 ? void 0 : fxBridgeEntryAt(installed);
+};
+var NO_FX_PUSHARY_HTTP_WIRING = { pusharyOverHttp: false, otherHttpServers: [] };
+var inspectFxPusharyHttpWiring = (profilePath) => {
+  const read = readFxFile(profilePath, readFxProfile);
+  if (read.kind !== "profile") return NO_FX_PUSHARY_HTTP_WIRING;
+  return {
+    pusharyOverHttp: isFxPusharyHttpEntry(fxPusharyEntryOf(read.profile)),
+    otherHttpServers: fxOtherPusharyHttpServers(read.profile)
+  };
+};
+var switchFxHttpEntryToBridge = (profilePath, bridgeEntry) => {
+  const read = readFxFile(profilePath, readFxProfile);
+  if (read.kind !== "profile" || !isFxPusharyHttpEntry(fxPusharyEntryOf(read.profile))) return "not-http";
+  try {
+    writeFxProfile(profilePath, withFxPusharyServer(read.profile, bridgeEntry));
+    return "switched";
+  } catch {
+    return "failed";
+  }
+};
 var fxSettingsReadRefusal = (filePath, read) => {
   if (read.kind === "unreadable") return `${filePath} could not be read`;
   if (read.kind === "refused") return `${filePath} ${FX_SETTINGS_REFUSALS[read.reason]}`;
@@ -701,15 +748,22 @@ var removeClineServer = (settingsPath) => {
 export {
   FX_PUSHARY_TOOLS_RULE,
   fxInstructionsBody,
+  FX_RELOAD_AFTER_BRIDGE,
   FX_PROFILE_REFUSALS,
-  fxPusharyEntry,
   withFxPusharyServer,
+  fxOtherHttpServersNote,
+  fxHttpEntryKeptNote,
+  fxHttpEntryDoctorNote,
   FX_QUESTION_TOOL,
   fxIgnoresInstructionsFile,
   readFxProfileForSetup,
   writeFxProfile,
   macAppFxBridge,
   fxServerHolder,
+  cliFxBridgeEntry,
+  installedCliFxBridgeEntry,
+  inspectFxPusharyHttpWiring,
+  switchFxHttpEntryToBridge,
   configureFxSettings,
   inspectFxInstallation,
   planFxRemoval,

package/dist/{chunk-3EZP5ZPS.js → chunk-TVVJ6OYG.js}

@@ -1,11 +1,11 @@
 import {
   addGeminiMcpServer,
   removeGeminiMcpServer
-} from "./chunk-YQDCTID4.js";
+} from "./chunk-73DHP3JX.js";
 import {
   CLAUDE_CODE_AGENT,
   compatibleToolLookup
-} from "./chunk-2BL6KWN7.js";
+} from "./chunk-6IFEYELN.js";
 import {
   CLAUDE_HOOK_EVENTS,
   PUSHARY_MCP_URL,
@@ -17,7 +17,7 @@ import {
   isPusharyHook,
   registerHookEntry,
   removeClaudeMcpServers
-} from "./chunk-GDLT32I4.js";
+} from "./chunk-LQAAOXYJ.js";
 import {
   HOOK_COMPATIBLE_PROFILES,
   PHONE_ANSWERED_TOOLS,
@@ -28,7 +28,7 @@ import {
   pusharyMissingReason,
   refusalOutput,
   withHookHoldBudget
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/config-document.ts
 import { parse, stringify } from "smol-toml";

package/dist/{chunk-B6JC676X.js → chunk-UC2J5RR4.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_HOLD_BUDGET_ENV,
   hookHoldBudgetProof
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/hold-budget.ts
 var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {

package/dist/{chunk-26W46E46.js → chunk-UETS2WEA.js}

@@ -2,25 +2,31 @@ import {
   SIGNED_OUT_ON_MAC_MESSAGE,
   describeSignedOutKey,
   readSignedOutDiagnosis
-} from "./chunk-YB3HMDKE.js";
+} from "./chunk-P4XZX7CL.js";
+import {
+  APPROVAL_RULES_PATH
+} from "./chunk-7V63A4AI.js";
 import {
   createIo
 } from "./chunk-FO3MDD26.js";
 import {
   readKeySource
-} from "./chunk-CNJ7SI5V.js";
+} from "./chunk-PBEW5CJK.js";
 import {
   absoluteUrl,
   checkApiKey,
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-QR2QWGQI.js";
+} from "./chunk-BSMHSN3Y.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
 import {
   getBaseUrl
-} from "./chunk-A47UKPC7.js";
+} from "./chunk-32OSSYGZ.js";
+import {
+  KEY_SCOPE
+} from "./chunk-RQOT6QL3.js";
 
 // src/cli/report-key.ts
 var { dim, yellow } = createIo();
@@ -61,16 +67,28 @@ var exitOnFailedResponse = async (response, baseUrl) => {
 };
 var REFUSED_SETTINGS_ACTION = {
   mode: "change the approval mode",
+  mode_clear: "end a temporary approval mode",
   wait: "change how long approvals wait for you",
   suggestions: "read or accept rule suggestions"
 };
-var APPROVAL_SETTINGS_PATH = "/dashboard/agent/settings";
-var AGENT_KEY_SCOPE = "agent";
-var isAgentKeyRefusal = (status, check) => status === 401 && check.kind === "ok" && check.identity.keyScope === AGENT_KEY_SCOPE;
+var settingsChangeStep = (request, baseUrl) => {
+  const approvalRules = absoluteUrl(baseUrl, APPROVAL_RULES_PATH);
+  switch (request) {
+    case "mode":
+      return `Change it in the Pushary app, or on the dashboard: ${approvalRules}`;
+    case "mode_clear":
+      return "A temporary mode ends on its own. To end it now, pick a mode in the Pushary app.";
+    case "wait":
+      return `Change it on the dashboard: ${approvalRules}`;
+    case "suggestions":
+      return `Review them on the dashboard: ${approvalRules}`;
+  }
+};
+var isAgentKeyRefusal = (status, check) => status === 401 && check.kind === "ok" && check.identity.keyScope === KEY_SCOPE.agent;
 var describeAgentKeyRefusal = (request, baseUrl = getBaseUrl()) => ({
-  message: `This computer's key cannot ${REFUSED_SETTINGS_ACTION[request]}. Keys from pushary login, phone pairing and the Mac app run approvals and notifications, not account settings.`,
+  message: `This computer's key cannot ${REFUSED_SETTINGS_ACTION[request]}. It runs approvals and notifications, not account settings.`,
   next: [
-    `Change it from the Pushary app, your phone, or the dashboard: ${absoluteUrl(baseUrl, APPROVAL_SETTINGS_PATH)}`,
+    settingsChangeStep(request, baseUrl),
     "The key itself is valid. Nothing on this computer needs fixing."
   ],
   exitCode: EXIT.USAGE,
@@ -90,6 +108,5 @@ var exitOnFailedSettingsRequest = async (response, settings) => {
 
 export {
   printKeyCheck,
-  APPROVAL_SETTINGS_PATH,
   exitOnFailedSettingsRequest
 };

package/dist/{chunk-EU2ZOZC3.js → chunk-UXN73YAE.js}

@@ -1,6 +1,6 @@
 import {
   SETUP_FLAGS
-} from "./chunk-UTAARXYQ.js";
+} from "./chunk-ZK5WYAMI.js";
 import {
   parseFlags
 } from "./chunk-NMUI3ZWG.js";
@@ -9,7 +9,7 @@ import {
 } from "./chunk-PPY5N2E6.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-GO7YKPT3.js";
+} from "./chunk-X2MTVD4W.js";
 import {
   CLAUDE_CONNECTOR_GUIDE,
   CLAUDE_CONNECTOR_STEPS,
@@ -17,7 +17,7 @@ import {
   CLAUDE_CONNECTOR_URL,
   COWORK_CONNECTOR_LIMIT,
   COWORK_STANDING_INSTRUCTIONS
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/cli/cowork.ts
 import { readFileSync } from "fs";

package/dist/{chunk-XFQAK35L.js → chunk-VHMZPN3N.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   redactSecretsFromContent
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/cli/json.ts
 var writeStdoutFully = (text) => new Promise((resolve, reject) => {

package/dist/{chunk-45KMS76L.js → chunk-VKZ3RJ5U.js}

@@ -2,7 +2,7 @@ import {
   isApprovalMode,
   isRecord,
   isTimeoutAction
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/cli/settings-response.ts
 var isFiniteNumber = (value) => typeof value === "number" && Number.isFinite(value);

package/dist/{chunk-T6YLXO6N.js → chunk-VRFFMTIG.js}

@@ -1,9 +1,9 @@
 import {
   realpath
-} from "./chunk-MDIGG3Q7.js";
+} from "./chunk-MFWHANKG.js";
 import {
   findNativeClaudeInstall
-} from "./chunk-RJ6JEHCP.js";
+} from "./chunk-JAKWPQ2L.js";
 import {
   readGlobalPrefixAsync,
   resolveGlobalBinary,
@@ -13,10 +13,10 @@ import {
   resolvePackageVersionFromBinary,
   resolvePathBinary,
   resolvePathBinaryAsync
-} from "./chunk-KS3O6O7E.js";
+} from "./chunk-NAQCWM4U.js";
 import {
   MANAGED_PROVIDERS
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/live-capabilities.ts
 import { homedir } from "os";

package/dist/{chunk-DIUTSF6I.js → chunk-WPOXZPEH.js}

@@ -12,7 +12,7 @@ import {
   reachVerdict,
   reachesYou,
   verifyDelivery
-} from "./chunk-MNNQEUQC.js";
+} from "./chunk-AJIT4SCL.js";
 import {
   humanIsTty,
   writeHuman
@@ -24,14 +24,14 @@ import {
 } from "./chunk-FO3MDD26.js";
 import {
   reportedInstallSource
-} from "./chunk-XIJTXRWB.js";
+} from "./chunk-METUT7V4.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-GO7YKPT3.js";
+} from "./chunk-X2MTVD4W.js";
 import {
   NO_PAIRING_COMPUTER,
   PAIR_TTL_SECONDS
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/onboarding.ts
 import qrcodeTerminal from "qrcode-terminal";

package/dist/{chunk-GO7YKPT3.js → chunk-X2MTVD4W.js}

@@ -2,7 +2,7 @@ import {
   DISCONNECT_AGENT_IDS,
   SETUP_AGENT_CHOICES,
   isApprovalMode
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/cli/mode-request.ts
 var parseDuration = (value) => {

package/dist/{chunk-5J7OZBJ4.js → chunk-XQKB4LEK.js}

@@ -1,9 +1,9 @@
 import {
   findNativeClaudeInstall
-} from "./chunk-RJ6JEHCP.js";
+} from "./chunk-JAKWPQ2L.js";
 import {
   isFile
-} from "./chunk-KS3O6O7E.js";
+} from "./chunk-NAQCWM4U.js";
 
 // src/wrapper/claudeBinary.ts
 import { homedir } from "os";

package/dist/{chunk-QOIPUYUD.js → chunk-XZKSUJ55.js}

@@ -7,7 +7,7 @@ import {
   recordSealerFor,
   uploadTranscriptRecords,
   wrapSessionKey
-} from "./chunk-XEXF2OFZ.js";
+} from "./chunk-NWN6GGJL.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;