@pushary/agent-hooks 1.9.7 → 1.9.8

package/dist/bin/pushary-status.js

@@ -2,52 +2,64 @@
 import {
   describeLastSeen,
   listMachines
-} from "../chunk-MBK7N46B.js";
-import "../chunk-T7Y5EADL.js";
+} from "../chunk-2QTO5YIT.js";
+import "../chunk-I6MJXLMY.js";
 import "../chunk-RIVNNBEK.js";
-import "../chunk-VXRXFU6Q.js";
+import "../chunk-LKLVTG3V.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
 import {
   describeReach,
   fetchChannels,
   reachVerdict
-} from "../chunk-N4EUSDKX.js";
+} from "../chunk-IAD2RT4L.js";
 import "../chunk-3EGEA4KH.js";
 import "../chunk-QCGNGEGE.js";
+import {
+  SIGNED_OUT_ON_MAC_MESSAGE,
+  activeKeyVerdictOf,
+  describeSignedOutKey,
+  readSignedOutDiagnosis
+} from "../chunk-2WXF3QJR.js";
 import {
   createIo
 } from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-UFVGSEWH.js";
+} from "../chunk-CKV3UPMU.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
 import {
   readKeySource
-} from "../chunk-ADSQDYYG.js";
-import "../chunk-L76HTPU6.js";
+} from "../chunk-N4QSPI3B.js";
+import "../chunk-MKTJEXZ3.js";
 import {
   checkApiKey,
   describeKeyCheck
-} from "../chunk-KFKL3FHS.js";
-import "../chunk-JXISQ7DT.js";
-import "../chunk-KYO45G5L.js";
+} from "../chunk-LWOO567I.js";
+import "../chunk-TCQ43LSG.js";
+import "../chunk-DUZVXBBU.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-4D2AYNSE.js";
-import "../chunk-ZUTU43FT.js";
+import "../chunk-FQ2GORVG.js";
+import "../chunk-ZBHUHJG6.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-Z6HPS67T.js";
-import "../chunk-STQRUH3S.js";
-import "../chunk-QR6VE5ME.js";
+import "../chunk-5QUPKDI5.js";
+import "../chunk-7DVNSQWF.js";
+import "../chunk-I5IJRMNV.js";
 
 // src/status.ts
+var signedOutReport = (facts, lines) => {
+  const signedOut = facts.signedOut;
+  if (signedOut?.kind !== "signed_out_on_mac") return null;
+  lines.push({ label: "Server", value: "key signed out on this Mac", ok: false });
+  return { lines, headline: SIGNED_OUT_ON_MAC_MESSAGE, next: [...describeSignedOutKey(signedOut)], exitCode: EXIT.UNAUTHENTICATED };
+};
 var keySourceLine = (source) => {
   if (source.kind === "none") {
     return { label: "Key", value: "none found", ok: false };
@@ -86,6 +98,8 @@ var buildStatusReport = (facts) => {
     });
   }
   if (facts.source.kind === "none") {
+    const signedOut = signedOutReport(facts, lines);
+    if (signedOut) return signedOut;
     return {
       lines,
       headline: "Not set up on this machine.",
@@ -95,6 +109,8 @@ var buildStatusReport = (facts) => {
   }
   const check = facts.keyCheck;
   if (check && check.kind !== "ok") {
+    const signedOut = check.kind === "rejected" ? signedOutReport(facts, lines) : null;
+    if (signedOut) return signedOut;
     const report = describeKeyCheck(check);
     lines.push({ label: "Server", value: report.message, ok: check.kind === "unreachable" ? null : false });
     return { lines, headline: report.message, next: [...report.next], exitCode: report.exitCode };
@@ -148,7 +164,7 @@ var buildStatusReport = (facts) => {
       return {
         lines,
         headline: verdict.kind === "nobody" ? "Configured, but no device can receive an approval." : verdict.kind === "others" ? "Configured, but the only devices here are your teammates'." : "Configured, and nothing proves an approval reaches you.",
-        next: verdict.kind === "nobody" ? ["Run `pushary connect` to add your phone, or install the Pushary app."] : ["Run `pushary connect` to add your own phone.", "Or `pushary doctor --roundtrip` to prove one of these is yours."],
+        next: verdict.kind === "nobody" ? ["Run `pushary pair` to pair your phone, or install the Pushary app."] : ["Run `pushary pair` to pair your own phone.", "Or `pushary doctor --roundtrip` to prove one of these is yours."],
         exitCode: EXIT.NO_DEVICE
       };
     }
@@ -156,7 +172,7 @@ var buildStatusReport = (facts) => {
       return {
         lines,
         headline: "Configured, but nothing in your pocket can receive an approval.",
-        next: ["Run `pushary connect` and connect your phone, or install the Pushary app."],
+        next: ["Run `pushary pair` to pair your phone, or install the Pushary app."],
         exitCode: EXIT.NO_DEVICE
       };
     }
@@ -208,7 +224,7 @@ var main = async () => {
     if (keyCheck.kind === "ok") channels = await fetchChannels(source.key);
   }
   const machines = devices && keyCheck?.kind === "ok" ? await listMachines(source.key) : null;
-  const facts = { source, keyCheck, channels };
+  const facts = { source, keyCheck, channels, signedOut: readSignedOutDiagnosis(source.key, activeKeyVerdictOf(keyCheck)) };
   const report = buildStatusReport(facts);
   if (json) {
     const payload = statusJson(facts, report);

package/dist/bin/pushary-stop-hook.js

@@ -2,49 +2,47 @@
 import {
   activeHookSource,
   activeIdentity
-} from "../chunk-MZPXVH4A.js";
-import "../chunk-ANEAA37E.js";
+} from "../chunk-KHNFLYJO.js";
 import {
   readHookInput
-} from "../chunk-XWAYAO3V.js";
-import "../chunk-BTQGAXZ3.js";
+} from "../chunk-WWOHTTVP.js";
+import "../chunk-DPGSLWOS.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-SD3272LS.js";
-import "../chunk-SBLPHUEB.js";
-import "../chunk-MNWRUGMH.js";
-import "../chunk-4YO4T5FV.js";
-import "../chunk-VXRXFU6Q.js";
-import "../chunk-JCWZ23MJ.js";
-import "../chunk-7264S5HZ.js";
-import "../chunk-AUUXS44H.js";
-import "../chunk-4FK6RZVJ.js";
-import "../chunk-HPRZJKRO.js";
+import "../chunk-YIG2R3BJ.js";
+import "../chunk-DL7XWKYV.js";
+import "../chunk-LKLVTG3V.js";
+import "../chunk-2QGYMY7A.js";
+import "../chunk-3I6IVOZV.js";
+import "../chunk-WG3K4TCH.js";
+import "../chunk-ZBK6E2OR.js";
+import "../chunk-CLOSJ4ES.js";
+import "../chunk-M6BZZFVQ.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
 import {
   handleStop,
   handleSubagentStop,
   isSubagentStop
-} from "../chunk-QFEM7R6T.js";
+} from "../chunk-KRCR2CRQ.js";
 import "../chunk-N6IOSZOE.js";
-import "../chunk-6DJTDHBI.js";
-import "../chunk-D6S5EKXA.js";
-import "../chunk-AVNKVF7N.js";
+import "../chunk-CD47ZFFZ.js";
+import "../chunk-2VZAALEJ.js";
+import "../chunk-DKMD6AWR.js";
 import "../chunk-POFBE6ZY.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-ADSQDYYG.js";
-import "../chunk-L76HTPU6.js";
-import "../chunk-KFKL3FHS.js";
-import "../chunk-JXISQ7DT.js";
-import "../chunk-KYO45G5L.js";
+import "../chunk-N4QSPI3B.js";
+import "../chunk-MKTJEXZ3.js";
+import "../chunk-LWOO567I.js";
+import "../chunk-TCQ43LSG.js";
+import "../chunk-DUZVXBBU.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-4D2AYNSE.js";
-import "../chunk-ZUTU43FT.js";
+import "../chunk-FQ2GORVG.js";
+import "../chunk-ZBHUHJG6.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-Z6HPS67T.js";
-import "../chunk-STQRUH3S.js";
-import "../chunk-QR6VE5ME.js";
+import "../chunk-5QUPKDI5.js";
+import "../chunk-7DVNSQWF.js";
+import "../chunk-I5IJRMNV.js";
 
 // bin/pushary-stop-hook.ts
 var AGENT = activeIdentity(process.argv);

package/dist/bin/pushary-stopfailure-hook.js

@@ -2,47 +2,45 @@
 import {
   activeHookSource,
   activeIdentity
-} from "../chunk-MZPXVH4A.js";
-import "../chunk-ANEAA37E.js";
+} from "../chunk-KHNFLYJO.js";
 import {
   readHookInput
-} from "../chunk-XWAYAO3V.js";
-import "../chunk-BTQGAXZ3.js";
+} from "../chunk-WWOHTTVP.js";
+import "../chunk-DPGSLWOS.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-SD3272LS.js";
-import "../chunk-SBLPHUEB.js";
-import "../chunk-MNWRUGMH.js";
-import "../chunk-4YO4T5FV.js";
-import "../chunk-VXRXFU6Q.js";
-import "../chunk-JCWZ23MJ.js";
-import "../chunk-7264S5HZ.js";
-import "../chunk-AUUXS44H.js";
-import "../chunk-4FK6RZVJ.js";
-import "../chunk-HPRZJKRO.js";
+import "../chunk-YIG2R3BJ.js";
+import "../chunk-DL7XWKYV.js";
+import "../chunk-LKLVTG3V.js";
+import "../chunk-2QGYMY7A.js";
+import "../chunk-3I6IVOZV.js";
+import "../chunk-WG3K4TCH.js";
+import "../chunk-ZBK6E2OR.js";
+import "../chunk-CLOSJ4ES.js";
+import "../chunk-M6BZZFVQ.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
 import {
   handleStopFailure
-} from "../chunk-QFEM7R6T.js";
+} from "../chunk-KRCR2CRQ.js";
 import "../chunk-N6IOSZOE.js";
-import "../chunk-6DJTDHBI.js";
-import "../chunk-D6S5EKXA.js";
-import "../chunk-AVNKVF7N.js";
+import "../chunk-CD47ZFFZ.js";
+import "../chunk-2VZAALEJ.js";
+import "../chunk-DKMD6AWR.js";
 import "../chunk-POFBE6ZY.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-ADSQDYYG.js";
-import "../chunk-L76HTPU6.js";
-import "../chunk-KFKL3FHS.js";
-import "../chunk-JXISQ7DT.js";
-import "../chunk-KYO45G5L.js";
+import "../chunk-N4QSPI3B.js";
+import "../chunk-MKTJEXZ3.js";
+import "../chunk-LWOO567I.js";
+import "../chunk-TCQ43LSG.js";
+import "../chunk-DUZVXBBU.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-4D2AYNSE.js";
-import "../chunk-ZUTU43FT.js";
+import "../chunk-FQ2GORVG.js";
+import "../chunk-ZBHUHJG6.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-Z6HPS67T.js";
-import "../chunk-STQRUH3S.js";
-import "../chunk-QR6VE5ME.js";
+import "../chunk-5QUPKDI5.js";
+import "../chunk-7DVNSQWF.js";
+import "../chunk-I5IJRMNV.js";
 
 // bin/pushary-stopfailure-hook.ts
 var AGENT = activeIdentity(process.argv);

package/dist/bin/pushary-suggestions.js

@@ -1,37 +1,40 @@
 #!/usr/bin/env node
+import {
+  exitOnFailedSettingsRequest
+} from "../chunk-BEJRK4DF.js";
+import "../chunk-2WXF3QJR.js";
 import {
   createIo
 } from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-UFVGSEWH.js";
+} from "../chunk-CKV3UPMU.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
+import "../chunk-N4QSPI3B.js";
+import "../chunk-LWOO567I.js";
+import "../chunk-TCQ43LSG.js";
+import "../chunk-DUZVXBBU.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
+import "../chunk-FQ2GORVG.js";
+import "../chunk-ZBHUHJG6.js";
+import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-Z6HPS67T.js";
-import "../chunk-STQRUH3S.js";
-import "../chunk-QR6VE5ME.js";
+} from "../chunk-5QUPKDI5.js";
+import "../chunk-7DVNSQWF.js";
+import "../chunk-I5IJRMNV.js";
 
 // bin/pushary-suggestions.ts
 exitOnHelpFlag("suggestions");
-var { dim, green, cyan, red } = createIo();
-var errorMessage = async (res) => {
-  try {
-    const body = await res.json();
-    return body.error ?? `HTTP ${res.status}`;
-  } catch {
-    return `HTTP ${res.status}`;
-  }
-};
+var { dim, green, cyan } = createIo();
 {
   const raw = process.argv.slice(2);
   const positional = raw[0] === "suggestions" ? raw.slice(1) : raw;
@@ -46,6 +49,7 @@ var errorMessage = async (res) => {
 var main = async () => {
   const apiKey = getApiKey();
   const baseUrl = getBaseUrl();
+  const settings = { request: "suggestions", apiKey, baseUrl };
   const headers = { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" };
   const rest = process.argv.slice(2);
   const args = rest[0] === "suggestions" ? rest.slice(1) : rest;
@@ -61,18 +65,12 @@ var main = async () => {
       headers,
       body: JSON.stringify({ id })
     });
-    if (!res2.ok) {
-      console.error(`  ${red("\u2717")} ${await errorMessage(res2)}`);
-      process.exit(1);
-    }
+    if (!res2.ok) await exitOnFailedSettingsRequest(res2, settings);
     console.log(`  ${green("\u2713")} Accepted. The rule is live now; your agents will pick it up on their next check.`);
     return;
   }
   const res = await fetch(`${baseUrl}/api/mcp/suggestions`, { headers });
-  if (!res.ok) {
-    console.error(`  ${red("\u2717")} ${await errorMessage(res)}`);
-    process.exit(1);
-  }
+  if (!res.ok) await exitOnFailedSettingsRequest(res, settings);
   const { suggestions } = await res.json();
   if (suggestions.length === 0) {
     console.log(`  ${dim("No pending suggestions. Keep approving; a rule is offered once a pattern is earned.")}`);

package/dist/bin/pushary-transcript-register.js

@@ -1,32 +1,31 @@
 #!/usr/bin/env node
 import {
   registerTranscript
-} from "../chunk-BTQGAXZ3.js";
+} from "../chunk-DPGSLWOS.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-SD3272LS.js";
-import "../chunk-SBLPHUEB.js";
-import "../chunk-MNWRUGMH.js";
-import "../chunk-4YO4T5FV.js";
-import "../chunk-VXRXFU6Q.js";
-import "../chunk-JCWZ23MJ.js";
-import "../chunk-7264S5HZ.js";
-import "../chunk-AUUXS44H.js";
-import "../chunk-4FK6RZVJ.js";
-import "../chunk-HPRZJKRO.js";
+import "../chunk-YIG2R3BJ.js";
+import "../chunk-DL7XWKYV.js";
+import "../chunk-LKLVTG3V.js";
+import "../chunk-2QGYMY7A.js";
+import "../chunk-3I6IVOZV.js";
+import "../chunk-WG3K4TCH.js";
+import "../chunk-ZBK6E2OR.js";
+import "../chunk-CLOSJ4ES.js";
+import "../chunk-M6BZZFVQ.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-6DJTDHBI.js";
+import "../chunk-CD47ZFFZ.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-ADSQDYYG.js";
-import "../chunk-KYO45G5L.js";
+import "../chunk-N4QSPI3B.js";
+import "../chunk-DUZVXBBU.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-4D2AYNSE.js";
-import "../chunk-ZUTU43FT.js";
+import "../chunk-FQ2GORVG.js";
+import "../chunk-ZBHUHJG6.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-Z6HPS67T.js";
-import "../chunk-STQRUH3S.js";
-import "../chunk-QR6VE5ME.js";
+import "../chunk-5QUPKDI5.js";
+import "../chunk-7DVNSQWF.js";
+import "../chunk-I5IJRMNV.js";
 
 // bin/pushary-transcript-register.ts
 var raw = "";

package/dist/bin/pushary-transcripts.js

@@ -6,17 +6,17 @@ import {
 } from "../chunk-SGZJ5LYH.js";
 import {
   transcriptsEnabled
-} from "../chunk-HPRZJKRO.js";
+} from "../chunk-M6BZZFVQ.js";
 import {
   exitOnHelpFlag
-} from "../chunk-UFVGSEWH.js";
-import "../chunk-ADSQDYYG.js";
+} from "../chunk-CKV3UPMU.js";
+import "../chunk-N4QSPI3B.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-4D2AYNSE.js";
+import "../chunk-FQ2GORVG.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-Z6HPS67T.js";
-import "../chunk-STQRUH3S.js";
-import "../chunk-QR6VE5ME.js";
+import "../chunk-5QUPKDI5.js";
+import "../chunk-7DVNSQWF.js";
+import "../chunk-I5IJRMNV.js";
 
 // bin/pushary-transcripts.ts
 exitOnHelpFlag("transcripts");

package/dist/bin/pushary-upgrade.js

@@ -9,29 +9,33 @@ import {
   upgradeFinishOutcome,
   upgradeInstalledPackage,
   withUpgradeLock
-} from "../chunk-3PVDOCFI.js";
+} from "../chunk-ZW3XZLJC.js";
 import {
   installWithUpgradeLock
-} from "../chunk-RQGODFQN.js";
+} from "../chunk-V5HPPF3E.js";
 import {
   ensureCodexTrustAfterReapply,
   reapplyAllAgents
-} from "../chunk-NIBFSARF.js";
+} from "../chunk-MXHTGVFZ.js";
+import "../chunk-3Z3A37WD.js";
 import {
   describeCodexTrustConfirmation
-} from "../chunk-JWKBDSPF.js";
-import "../chunk-H7MMU64M.js";
+} from "../chunk-6TE27XZR.js";
+import "../chunk-MGRFDGWU.js";
 import {
   waitForMachineReadiness
-} from "../chunk-MBK7N46B.js";
-import "../chunk-X5NXPCIC.js";
-import "../chunk-ANEAA37E.js";
+} from "../chunk-2QTO5YIT.js";
+import {
+  appAgentKey
+} from "../chunk-OP7IHC2I.js";
+import "../chunk-MFF3ONG5.js";
+import "../chunk-KHNFLYJO.js";
 import {
   detectProviderLiveCapabilities,
   expectedLaunchCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "../chunk-T7Y5EADL.js";
+} from "../chunk-I6MJXLMY.js";
 import "../chunk-RIVNNBEK.js";
 import {
   AUTO_UPDATE_DISABLE_ENV,
@@ -42,8 +46,9 @@ import {
   parseAutoUpdateFlag,
   readAutoUpdateState,
   updateAutoUpdateState
-} from "../chunk-QTO6HEZD.js";
-import "../chunk-4YO4T5FV.js";
+} from "../chunk-7PT35RY2.js";
+import "../chunk-YIG2R3BJ.js";
+import "../chunk-DL7XWKYV.js";
 import {
   DAEMON_COLD_START_TIMEOUT_MS,
   daemonHasRemoteProof,
@@ -55,45 +60,60 @@ import {
   replaceDaemonService,
   stopDaemonService,
   waitForDaemonRemoteProof
-} from "../chunk-VXRXFU6Q.js";
-import "../chunk-JCWZ23MJ.js";
+} from "../chunk-LKLVTG3V.js";
+import "../chunk-2QGYMY7A.js";
+import "../chunk-3I6IVOZV.js";
+import "../chunk-WG3K4TCH.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-6DJTDHBI.js";
+import "../chunk-KRCR2CRQ.js";
+import "../chunk-N6IOSZOE.js";
+import "../chunk-CD47ZFFZ.js";
+import "../chunk-2VZAALEJ.js";
+import "../chunk-DKMD6AWR.js";
 import "../chunk-POFBE6ZY.js";
 import {
   exitOnHelpFlag
-} from "../chunk-UFVGSEWH.js";
+} from "../chunk-CKV3UPMU.js";
+import "../chunk-GMXKITVA.js";
 import {
-  readControlMode
-} from "../chunk-ADSQDYYG.js";
-import "../chunk-KYO45G5L.js";
+  readControlMode,
+  recordMacAppKeyPrefix
+} from "../chunk-N4QSPI3B.js";
+import "../chunk-MKTJEXZ3.js";
+import "../chunk-LWOO567I.js";
+import "../chunk-TCQ43LSG.js";
+import "../chunk-DUZVXBBU.js";
+import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-4D2AYNSE.js";
+import "../chunk-FQ2GORVG.js";
 import {
   LATEST_TAG,
   autoUpdateState,
+  bridgeAgentKey,
   claudeJson,
   codexConfigToml,
   cursorPluginDir,
   fetchLatestPublishedVersion,
   geminiSettings,
   vscodePluginDir
-} from "../chunk-ZUTU43FT.js";
-import "../chunk-T7E75EKA.js";
+} from "../chunk-ZBHUHJG6.js";
+import {
+  readJsonSafe
+} from "../chunk-T7E75EKA.js";
 import {
   getApiKey
-} from "../chunk-Z6HPS67T.js";
+} from "../chunk-5QUPKDI5.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-STQRUH3S.js";
+} from "../chunk-7DVNSQWF.js";
 import {
   CANONICAL_PACKAGE,
   LEGACY_PACKAGE,
   getPackageVersion
-} from "../chunk-QR6VE5ME.js";
+} from "../chunk-I5IJRMNV.js";
 
 // bin/pushary-upgrade.ts
 import { existsSync } from "fs";
@@ -142,9 +162,13 @@ var finishUpgrade = async () => {
   } catch {
     apiKey = void 0;
   }
+  const bridgeAgentKey2 = readJsonSafe(bridgeAgentKey());
+  const macAppKey = bridgeAgentKey2.kind === "ok" ? appAgentKey(bridgeAgentKey2.value) : null;
+  if (macAppKey) recordMacAppKeyPrefix(macAppKey);
   const inspectedAgents = reapplyAllAgents(apiKey);
   const codexTrust = await ensureCodexTrustAfterReapply(inspectedAgents);
   const refreshed = inspectedAgents.filter((agent) => agent.result.reapplied);
+  const keptForApp = inspectedAgents.filter((agent) => agent.heldBy === "app");
   const failedRefreshes = inspectedAgents.filter((agent) => agent.result.failed);
   const configuredControlProviders = inspectedAgents.filter((agent) => agent.result.configured && (agent.id === "claude" || agent.id === "codex" || agent.id === "gemini")).map((agent) => agent.id);
   const controlMode = readControlMode();
@@ -191,9 +215,14 @@ var finishUpgrade = async () => {
       console.log();
       console.log("No key was readable here, so MCP entries kept the key they already had.");
     }
-  } else if (failedRefreshes.length === 0) {
+  } else if (failedRefreshes.length === 0 && keptForApp.length === 0) {
     console.log("No agent config on this machine needed refreshing.");
   }
+  if (keptForApp.length > 0) {
+    if (refreshed.length > 0) console.log();
+    console.log(KEPT_FOR_APP_HEADING);
+    for (const agent of keptForApp) console.log(`  ${agent.label}`);
+  }
   if (codexTrust) {
     console.log();
     console.log(describeCodexTrustConfirmation(codexTrust));
@@ -212,6 +241,7 @@ var finishUpgrade = async () => {
   console.log(controlPolicy === "disabled" ? "Done. Your hooks use the new global install; phone-start remains disabled." : controlPolicy === "unsupported" || controlPolicy === "preserve-absent" ? "Done. Your hooks use the new global install; no background service was added." : "Done. Your hooks and background service use the new global install.");
   console.log("Verify with: pushary doctor");
 };
+var KEPT_FOR_APP_HEADING = "Kept for the Pushary Mac app, which owns these agents. Nothing in their config was changed:";
 var AUTO_UPDATE_ON_MESSAGE = "Automatic updates are on. Pushary checks for a new version once a day, when an agent session starts.";
 var AUTO_UPDATE_OFF_MESSAGE = "Automatic updates are off. Turn them back on with: pushary upgrade --auto=on";
 var AUTO_UPDATE_RUN_MESSAGES = {