@pushary/agent-hooks 1.9.7 → 1.9.9

package/dist/{chunk-X5NXPCIC.js → chunk-BZLHTMT6.js}

@@ -1,14 +1,36 @@
 import {
-  guardedArgv
-} from "./chunk-ZUTU43FT.js";
+  compatibleConfigFile
+} from "./chunk-UF6RBP5V.js";
+import {
+  hookOwnerOf,
+  hookOwnerOfCommands,
+  liveBridgeProbe,
+  resolveBridgeStub
+} from "./chunk-BYLKCZ2G.js";
+import {
+  claudeSettings,
+  codexHooksJson,
+  cursorUserHooks,
+  geminiSettings,
+  guardedArgv,
+  pusharyDir,
+  vscodePluginDir
+} from "./chunk-Z23ZBYDW.js";
+import {
+  readJsonSafe
+} from "./chunk-T7E75EKA.js";
 import {
   HOOK_BUDGETS,
-  OPENCODE_APPROVAL_EVENT
-} from "./chunk-QR6VE5ME.js";
+  HOOK_COMPATIBLE_PROFILES,
+  HOOK_LOCATOR_BINARY,
+  OPENCODE_APPROVAL_EVENT,
+  hookCompatibleProfile
+} from "./chunk-5RGA636G.js";
 
 // src/opencode-plugin.ts
 var OPENCODE_PLUGIN_MARKER = "pushary-opencode-plugin w1";
 var OPENCODE_PLUGIN_PLACEHOLDER = "__PUSHARY_COMMAND__";
+var OPENCODE_APPROVAL_EVENTS_PLACEHOLDER = "__PUSHARY_APPROVAL_EVENTS__";
 var OPENCODE_PLUGIN_FILE = "pushary.js";
 var OPENCODE_PLUGIN_DIR = "plugins";
 var OPENCODE_PLUGIN_SIBLING = "package.json";
@@ -262,7 +284,7 @@ export const PusharyPlugin = async ({ client, directory, worktree }) => {
       try {
         const type = event && event.type
         const properties = event && event.properties
-        if (${JSON.stringify(OPENCODE_ASKED_EVENTS)}.includes(type)) {
+        if (${OPENCODE_APPROVAL_EVENTS_PLACEHOLDER}.includes(type)) {
           const asked = askedFrom(properties)
           if (asked) void gate(asked)
           return
@@ -295,12 +317,29 @@ var openCodePluginModule = () => ({
   marker: OPENCODE_PLUGIN_MARKER,
   source: openCodePluginSource(),
   placeholder: OPENCODE_PLUGIN_PLACEHOLDER,
+  approvalEvents: {
+    placeholder: OPENCODE_APPROVAL_EVENTS_PLACEHOLDER,
+    events: OPENCODE_ASKED_EVENTS
+  },
   sibling: {
     path: OPENCODE_PLUGIN_SIBLING,
     contents: OPENCODE_PLUGIN_SIBLING_CONTENTS
   }
 });
-var renderOpenCodePlugin = (module, argv) => module.source.replace(module.placeholder, JSON.stringify(argv));
+var renderOpenCodePlugin = (module, argv, holdsApprovals = true) => module.source.replace(module.placeholder, JSON.stringify(argv)).replace(module.approvalEvents.placeholder, JSON.stringify(holdsApprovals ? module.approvalEvents.events : []));
+var COMMAND_LINE = /^const COMMAND = (.*)$/m;
+var isArgv = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
+var openCodePluginArgv = (contents) => {
+  if (!isOpenCodePluginOurs(contents)) return null;
+  const line = contents.match(COMMAND_LINE)?.[1];
+  if (line === void 0) return null;
+  try {
+    const parsed = JSON.parse(line);
+    return isArgv(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+};
 var isOpenCodePluginOurs = (contents) => contents.includes(OPENCODE_PLUGIN_MARKER);
 
 // src/opencode-config.ts
@@ -362,6 +401,46 @@ var removeOpenCodeMcpServer = (config) => {
   return true;
 };
 
+// src/setup/agent-hook-owner.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+var COMPATIBLE_HOOK_FILES = Object.fromEntries(
+  HOOK_COMPATIBLE_PROFILES.map((profile) => [profile.agentType, () => compatibleConfigFile(profile)])
+);
+var HOOK_FILES = {
+  claude_code: claudeSettings,
+  codex: codexHooksJson,
+  gemini_cli: geminiSettings,
+  cursor: cursorUserHooks,
+  vscode: () => join2(vscodePluginDir(), "hooks", "hooks.json"),
+  ...COMPATIBLE_HOOK_FILES
+};
+var agentHookFile = (agent) => HOOK_FILES[agent]?.() ?? null;
+var readTextOrNull = (path) => {
+  try {
+    return readFileSync2(path, "utf-8");
+  } catch {
+    return null;
+  }
+};
+var openCodePluginOwner = (appAvailable) => {
+  const contents = readTextOrNull(openCodePluginFile());
+  return hookOwnerOfCommands(contents === null ? [] : openCodePluginArgv(contents) ?? [], appAvailable);
+};
+var agentHookOwner = (agent, appAvailable) => {
+  if (agent === "opencode") return openCodePluginOwner(appAvailable);
+  const file = agentHookFile(agent);
+  if (!file) return "none";
+  const document = readJsonSafe(file);
+  const profile = hookCompatibleProfile(agent);
+  return hookOwnerOf(
+    document.kind === "ok" ? document.value : null,
+    appAvailable,
+    profile ? profile.hooksKeyPath : void 0
+  );
+};
+var macAppBridgeAvailable = () => resolveBridgeStub(join2(pusharyDir(), "bin", HOOK_LOCATOR_BINARY), liveBridgeProbe()).kind === "bundle";
+
 export {
   OPENCODE_PLUGIN_PLACEHOLDER,
   OPENCODE_PLUGIN_SIBLING,
@@ -379,5 +458,8 @@ export {
   openCodeConfigFile,
   openCodeInstructionsFile,
   addOpenCodeMcpServer,
-  removeOpenCodeMcpServer
+  removeOpenCodeMcpServer,
+  agentHookFile,
+  agentHookOwner,
+  macAppBridgeAvailable
 };

package/dist/{chunk-BTQGAXZ3.js → chunk-COQ64C4F.js}

@@ -4,40 +4,40 @@ import {
   savePin,
   verifyRecipients
 } from "./chunk-SGZJ5LYH.js";
-import {
-  hookOwnerOf
-} from "./chunk-SD3272LS.js";
 import {
   ensureDaemonRunning
-} from "./chunk-VXRXFU6Q.js";
+} from "./chunk-SZ4Q6ZVS.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-AUUXS44H.js";
+} from "./chunk-APP43AW7.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-4FK6RZVJ.js";
+} from "./chunk-462EQA6K.js";
 import {
   transcriptEnvironmentPreference,
   transcriptsEnabled
-} from "./chunk-HPRZJKRO.js";
+} from "./chunk-VIIHC42X.js";
+import {
+  hookOwnerOf
+} from "./chunk-BYLKCZ2G.js";
 import {
   readTranscriptPreference
-} from "./chunk-ADSQDYYG.js";
+} from "./chunk-REU2VQPH.js";
 import {
   codexHome,
   pusharyDir
-} from "./chunk-ZUTU43FT.js";
+} from "./chunk-Z23ZBYDW.js";
 import {
   writeJsonAtomic
 } from "./chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-Z6HPS67T.js";
+} from "./chunk-IRHABAQT.js";
 
 // src/transcript-registration.ts
 import { createHash } from "crypto";

package/dist/{chunk-N4EUSDKX.js → chunk-DCCSULXK.js}

@@ -14,19 +14,19 @@ import {
 } from "./chunk-U4TMAANR.js";
 import {
   callMcpTool
-} from "./chunk-L76HTPU6.js";
+} from "./chunk-6AYSKVLL.js";
 import {
   reportedInstallSource
-} from "./chunk-4D2AYNSE.js";
+} from "./chunk-BNSKVIAW.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-STQRUH3S.js";
+} from "./chunk-5DCDQ5VW.js";
 import {
   NO_PAIRING_COMPUTER,
   PAIR_TTL_SECONDS,
   classifyConfirmResponse,
   isAnswerSource
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-5RGA636G.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {
@@ -155,7 +155,7 @@ var describeVerifyOutcome = (outcome) => {
         ok: false,
         message: "Nothing to deliver to. Agents are configured; approvals will fall back to the terminal.",
         next: [
-          "Run pushary connect to add your phone.",
+          "Run pushary pair to pair your phone.",
           "Then pushary doctor --roundtrip to test a synthetic question and answer."
         ]
       };
@@ -165,7 +165,7 @@ var describeVerifyOutcome = (outcome) => {
         message: `Delivered to ${plural2(outcome.recipients, "device")} on this site, none of them yours.`,
         next: [
           `Approvals for your agent would wake one of your ${plural2(outcome.otherMembers, "teammate")}.`,
-          "Run pushary connect to add your own phone."
+          "Run pushary pair to pair your own phone."
         ]
       };
     case "unattributable":
@@ -174,7 +174,7 @@ var describeVerifyOutcome = (outcome) => {
         message: `Delivered to ${plural2(outcome.recipients, "device")} on this site, and no way to tell whose.`,
         next: [
           "Browser subscriptions carry no owner, and this site has other members.",
-          "Install the Pushary app with pushary connect, or run pushary doctor --roundtrip to prove it reaches you."
+          "Install the Pushary app and pair it with pushary pair, or run pushary doctor --roundtrip to prove it reaches you."
         ]
       };
     case "error":
@@ -319,8 +319,8 @@ var describeRoundTripOutcome = (outcome) => {
         ok: false,
         message: "Nothing to ask. No phone or browser is connected to this site.",
         next: [
-          "Run pushary connect to add your phone.",
-          "Or pushary connect --app if you already have the Pushary app."
+          "Run pushary pair to pair your phone.",
+          "Or pushary pair --app if you already have the Pushary app."
         ]
       };
     case "error":
@@ -538,14 +538,14 @@ var waitForDevice = async (apiKey, baseline) => {
       consecutiveFailures = 0;
       const channels = probe.status;
       if (reachesYou(channels) || channels.webActive > baseline.webActive) {
-        stop(check, "Phone connected");
+        stop(check, "Phone paired");
         return { kind: "connected", channels };
       }
       await sleep(CONNECT_POLL_INTERVAL_MS);
     }
     stop(yellow("!"), "Didn't detect a connection yet");
     console.log(`  ${dim("Signed in on the app already? Open it and allow notifications.")}`);
-    console.log(`  ${dim("Signing in alone does not connect the phone. Then run")} ${cyan("pushary doctor")}${dim(".")}`);
+    console.log(`  ${dim("Signing in alone does not pair the phone. Then run")} ${cyan("pushary doctor")}${dim(".")}`);
     return { kind: "timeout" };
   } catch (err) {
     stop(yellow("!"), `Couldn't check connection ${dim(`(${err instanceof Error ? err.message : "network error"})`)}`);
@@ -588,14 +588,14 @@ var connectDevice = async (apiKey, options = {}) => {
   }
   const site = await fetchSite(apiKey);
   if (!site) {
-    console.log(`  ${yellow("!")} Couldn't load your subscribe link. Connect your phone later at ${cyan("pushary.com/download")}.`);
+    console.log(`  ${yellow("!")} Couldn't load your subscribe link. Pair your phone later at ${cyan("pushary.com/download")}.`);
     return phoneFailure("no_subscribe_link");
   }
   console.log();
   if (channels.site !== null && channels.site.otherMembers > 0 && channels.phoneReachable) {
     printSiteOnlyWarning(channels);
   } else {
-    console.log(`  ${bold("Connect your phone")}`);
+    console.log(`  ${bold("Pair your phone")}`);
     if (channels.webDesktop > 0) {
       console.log(`  ${dim("A browser on this computer is subscribed, but no phone is connected yet.")}`);
     }
@@ -727,7 +727,7 @@ var printConnectInstructions = async (apiKey) => {
   }
   const site = await fetchSite(apiKey);
   const target = site?.subscribeUrl ?? "https://pushary.com/download";
-  console.log(`  ${dim("Connect your phone for push notifications at")} ${cyan(target)}`);
+  console.log(`  ${dim("Pair your phone for push notifications at")} ${cyan(target)}`);
   console.log(`  ${dim("or get the Pushary app at")} ${cyan("https://pushary.com/download")}`);
   return phoneFailure("no_device");
 };

package/dist/{chunk-JWKBDSPF.js → chunk-DP3WX7FW.js}

@@ -1,9 +1,9 @@
 import {
   CODEX_HOOK_STATUS
-} from "./chunk-H7MMU64M.js";
+} from "./chunk-NGKUXZID.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-STQRUH3S.js";
+} from "./chunk-5DCDQ5VW.js";
 
 // src/setup/codex-trust.ts
 var CODEX_TRUST_TELEMETRY = {

package/dist/chunk-E5HOHIUV.js

@@ -0,0 +1,52 @@
+import {
+  macAppBridgeAvailable
+} from "./chunk-BZLHTMT6.js";
+import {
+  keyPrefix
+} from "./chunk-REU2VQPH.js";
+import {
+  bridgeAgentKey
+} from "./chunk-Z23ZBYDW.js";
+import {
+  readJsonSafe
+} from "./chunk-T7E75EKA.js";
+import {
+  isValidApiKey
+} from "./chunk-5RGA636G.js";
+
+// src/shared-mcp-key.ts
+var asRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+var pusharyKey = (value) => typeof value === "string" && isValidApiKey(value.trim()) ? value.trim() : null;
+var bearerKey = (authorization) => typeof authorization === "string" && authorization.startsWith("Bearer ") ? pusharyKey(authorization.slice("Bearer ".length)) : null;
+var mcpServerBearer = (mcpServers) => bearerKey(asRecord(asRecord(asRecord(mcpServers)?.pushary)?.headers)?.Authorization);
+var appAgentKey = (bridgeAgentKey2) => pusharyKey(asRecord(bridgeAgentKey2)?.key);
+var setupReceiptKey = (claudeMcpReceipt) => bearerKey(asRecord(asRecord(asRecord(claudeMcpReceipt)?.installedPushary)?.headers)?.Authorization);
+var macAppKeepsMcpEntry = (entryKey, keys) => {
+  if (!entryKey) return true;
+  if (keys.appKey) return entryKey === keys.appKey;
+  return entryKey !== keys.setupKey;
+};
+
+// src/mac-app-key.ts
+var NOT_CONNECTED = { kind: "not_connected" };
+var CONNECTED_THROUGH_MAC_APP = "This computer is connected through the Pushary Mac app";
+var PAIR_FROM_MAC_APP = "Pair a phone from the Pushary Mac app: Settings > Phone > Pair.";
+var readMacAppAgentKey = () => {
+  const stored = readJsonSafe(bridgeAgentKey());
+  return stored.kind === "ok" ? appAgentKey(stored.value) : null;
+};
+var macAppConnectionOf = (appKey, appInstalled) => appKey !== null && appInstalled() ? { kind: "connected", keyPrefix: keyPrefix(appKey) } : NOT_CONNECTED;
+var readMacAppConnection = () => macAppConnectionOf(readMacAppAgentKey(), macAppBridgeAvailable);
+var readMacAppConnectionWhenKeyless = (cliKey) => cliKey ? NOT_CONNECTED : readMacAppConnection();
+
+export {
+  pusharyKey,
+  mcpServerBearer,
+  setupReceiptKey,
+  macAppKeepsMcpEntry,
+  CONNECTED_THROUGH_MAC_APP,
+  PAIR_FROM_MAC_APP,
+  readMacAppAgentKey,
+  readMacAppConnection,
+  readMacAppConnectionWhenKeyless
+};

package/dist/{chunk-GU3EJCVV.js → chunk-EA5NWDK7.js}

@@ -1,3 +1,6 @@
+// src/hooks-spec.ts
+var CURSOR_GATE_SCRIPT = "pushary-gate.mjs";
+
 // src/diagnostics/service-runtime.ts
 var unescapeXml = (value) => value.replaceAll("&quot;", '"').replaceAll("&apos;", "'").replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&amp;", "&");
 var unquoteSystemd = (value) => value.replaceAll('\\"', '"').replaceAll("\\\\", "\\").replaceAll("%%", "%");
@@ -37,6 +40,7 @@ var versionManagerOf = (execPath) => {
 var describeVersionManagerPin = (execPath, manager) => `The background service is pinned to ${execPath}, which ${manager} manages. Switching Node versions strands it; run pushary daemon install afterwards.`;
 
 export {
+  CURSOR_GATE_SCRIPT,
   readServiceExecPath,
   versionManagerOf,
   describeVersionManagerPin

package/dist/chunk-EIAEUG7G.js

@@ -0,0 +1,46 @@
+import {
+  pusharyDir
+} from "./chunk-Z23ZBYDW.js";
+import {
+  readJsonSafe,
+  writeFileAtomic
+} from "./chunk-T7E75EKA.js";
+import {
+  DECLINED_AGENTS_FILE,
+  HOOK_SOURCES,
+  normalizeAgentId,
+  parseDeclinedAgents,
+  serializeDeclinedAgents,
+  withDeclinedAgent,
+  withoutDeclinedAgent
+} from "./chunk-5RGA636G.js";
+
+// src/declined-agents-file.ts
+import { join } from "path";
+var DECLINED_AGENTS_MODE = 384;
+var declinedAgentsFile = () => join(pusharyDir(), DECLINED_AGENTS_FILE);
+var readDeclinedAgents = (file = declinedAgentsFile()) => {
+  const stored = readJsonSafe(file);
+  return stored.kind === "ok" ? parseDeclinedAgents(stored.value) : [];
+};
+var writeDeclinedAgents = (agents, file) => writeFileAtomic(file, serializeDeclinedAgents(agents), DECLINED_AGENTS_MODE, "utf-8");
+var changeDeclinedAgents = (file, applies, next) => {
+  const current = readDeclinedAgents(file);
+  if (!applies(current)) return "unchanged";
+  try {
+    writeDeclinedAgents(next(current), file);
+    return "changed";
+  } catch {
+    return "unwritable";
+  }
+};
+var recordDeclinedAgent = (agent, file = declinedAgentsFile()) => changeDeclinedAgents(file, (current) => !current.includes(agent), (current) => withDeclinedAgent(current, agent));
+var clearDeclinedAgent = (agent, file = declinedAgentsFile()) => changeDeclinedAgents(file, (current) => current.includes(agent), (current) => withoutDeclinedAgent(current, agent));
+var declinedAgentForSetupChoice = (choice) => normalizeAgentId(choice, HOOK_SOURCES);
+
+export {
+  declinedAgentsFile,
+  recordDeclinedAgent,
+  clearDeclinedAgent,
+  declinedAgentForSetupChoice
+};

package/dist/{chunk-EB4XGVBG.js → chunk-EUW7JL2K.js}

@@ -1,11 +1,3 @@
-import {
-  pusharyHookExecutable
-} from "./chunk-4YO4T5FV.js";
-import {
-  isProtectedByScope,
-  registerHookEntry
-} from "./chunk-ZUTU43FT.js";
-
 // src/skills-cli.ts
 import { execSync } from "child_process";
 var PUSHARY_SKILL_SOURCE = "Pushary/pushary-skill";
@@ -33,28 +25,6 @@ var installAgentSkill = async (request, effects) => {
   return "packaged-copy";
 };
 
-// src/cursor-config.ts
-var hookCommandOf = (entry) => {
-  const command = entry && typeof entry === "object" && !Array.isArray(entry) ? entry.command : void 0;
-  return typeof command === "string" ? command : "";
-};
-var isPusharyCursorEntry = (entry) => pusharyHookExecutable(hookCommandOf(entry)) !== null;
-var registerCursorGate = (existing, entry) => registerHookEntry(existing, isPusharyCursorEntry, entry);
-var withoutPusharyCursorHooks = (hooks, scope) => {
-  let removed = 0;
-  const kept = {};
-  for (const [event, entries] of Object.entries(hooks)) {
-    if (!Array.isArray(entries)) {
-      kept[event] = entries;
-      continue;
-    }
-    const others = entries.filter((entry) => !isPusharyCursorEntry(entry) || isProtectedByScope(hookCommandOf(entry), scope));
-    removed += entries.length - others.length;
-    if (others.length > 0 || entries.length === 0) kept[event] = others;
-  }
-  return { hooks: kept, removed };
-};
-
 // src/cli/dry-run.ts
 import { execFileSync } from "child_process";
 import { rmSync, writeFileSync } from "fs";
@@ -92,8 +62,6 @@ export {
   PUSHARY_SKILL_NAME,
   installSkillViaSkillsCli,
   installAgentSkill,
-  registerCursorGate,
-  withoutPusharyCursorHooks,
   createGuards,
   describeSetupSideEffects
 };

package/dist/{chunk-T7Y5EADL.js → chunk-F7R3SZ4Q.js}

@@ -10,10 +10,10 @@ import {
   resolvePackageVersionFromBinary,
   resolvePathBinary,
   resolvePathBinaryAsync
-} from "./chunk-ZUTU43FT.js";
+} from "./chunk-Z23ZBYDW.js";
 import {
   MANAGED_PROVIDERS
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-5RGA636G.js";
 
 // src/setup/codex-install.ts
 var NATIVE_BINARY_MIN_BYTES = 20 * 1024 * 1024;

package/dist/{chunk-H37L7TT3.js → chunk-G7RIDXAT.js}

@@ -1,6 +1,6 @@
 import {
   readConfigFileKey
-} from "./chunk-ADSQDYYG.js";
+} from "./chunk-REU2VQPH.js";
 
 // src/bell/fleet.ts
 import { closeSync, constants, futimesSync, lstatSync, mkdirSync, openSync, readdirSync, unlinkSync } from "fs";
@@ -141,7 +141,7 @@ var writeLastShown = (at) => {
   }
 };
 var upgradeLine = (context) => `  ${context.liveAgents} agents running. A bell can't tell you which one needs you, and it can't reach your pocket.
-  pushary connect`;
+  pushary pair`;
 var upgradeNotice = (context, deps = {}) => {
   const env = deps.env ?? process.env;
   if (env.PUSHARY_BELL_QUIET === "1" || env.PUSHARY_BELL_QUIET === "true") return null;

package/dist/{chunk-W2KI5KPD.js → chunk-H5T27W7M.js}

@@ -1,9 +1,9 @@
 import {
   parseSseMessages
-} from "./chunk-L76HTPU6.js";
+} from "./chunk-6AYSKVLL.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-STQRUH3S.js";
+} from "./chunk-5DCDQ5VW.js";
 
 // src/mcp-stdio-bridge.ts
 var MCP_BRIDGE_BINARY = "pushary-mcp";

package/dist/chunk-HBWYMRR5.js

@@ -0,0 +1,94 @@
+import {
+  SIGNED_OUT_ON_MAC_MESSAGE,
+  describeSignedOutKey,
+  readSignedOutDiagnosis
+} from "./chunk-Q6C6ILUS.js";
+import {
+  createIo
+} from "./chunk-U4TMAANR.js";
+import {
+  readKeySource
+} from "./chunk-REU2VQPH.js";
+import {
+  absoluteUrl,
+  checkApiKey,
+  describeKeyCheck,
+  keyCheckFromResponse
+} from "./chunk-QRXPWW3M.js";
+import {
+  EXIT
+} from "./chunk-KZERVKTD.js";
+import {
+  getBaseUrl
+} from "./chunk-IRHABAQT.js";
+
+// src/cli/report-key.ts
+var { dim, yellow } = createIo();
+var printReport = (report) => {
+  console.log(`  ${yellow("!")} ${report.message}`);
+  for (const line of report.next) console.log(`  ${dim(line)}`);
+};
+var signedOutKeyReport = (check) => {
+  if (check.kind !== "rejected") return null;
+  const diagnosis = readSignedOutDiagnosis(readKeySource().key, "rejected");
+  if (diagnosis.kind !== "signed_out_on_mac") return null;
+  return { message: SIGNED_OUT_ON_MAC_MESSAGE, next: describeSignedOutKey(diagnosis), exitCode: EXIT.UNAUTHENTICATED, fatal: true };
+};
+var printKeyCheck = (check, baseUrl) => {
+  const report = signedOutKeyReport(check) ?? describeKeyCheck(check, baseUrl);
+  printReport(report);
+  return report;
+};
+var exitIfKeyFailure = async (response, baseUrl) => {
+  const check = await keyCheckFromResponse(response, baseUrl);
+  if (!check) return;
+  const report = printKeyCheck(check, baseUrl);
+  process.exit(report.exitCode);
+};
+var responseDetail = async (response) => {
+  try {
+    const body = await response.json();
+    const text = [body.error, body.message].find((part) => typeof part === "string" && part);
+    if (typeof text === "string") return text;
+  } catch {
+  }
+  return response.statusText || `HTTP ${response.status}`;
+};
+var exitOnFailedResponse = async (response, baseUrl) => {
+  await exitIfKeyFailure(response, baseUrl);
+  console.log(`  ${yellow("!")} Failed: ${await responseDetail(response)}`);
+  process.exit(EXIT.FAILED);
+};
+var REFUSED_SETTINGS_ACTION = {
+  mode: "change the approval mode",
+  wait: "change how long approvals wait for you",
+  suggestions: "read or accept rule suggestions"
+};
+var APPROVAL_SETTINGS_PATH = "/dashboard/agent/settings";
+var AGENT_KEY_SCOPE = "agent";
+var isAgentKeyRefusal = (status, check) => status === 401 && check.kind === "ok" && check.identity.keyScope === AGENT_KEY_SCOPE;
+var describeAgentKeyRefusal = (request, baseUrl = getBaseUrl()) => ({
+  message: `This computer's key cannot ${REFUSED_SETTINGS_ACTION[request]}. Keys from pushary login, phone pairing and the Mac app run approvals and notifications, not account settings.`,
+  next: [
+    `Change it from the Pushary app, your phone, or the dashboard: ${absoluteUrl(baseUrl, APPROVAL_SETTINGS_PATH)}`,
+    "The key itself is valid. Nothing on this computer needs fixing."
+  ],
+  exitCode: EXIT.USAGE,
+  fatal: true
+});
+var exitOnFailedSettingsRequest = async (response, settings) => {
+  if (response.status === 401) {
+    const check = await checkApiKey(settings.apiKey, { baseUrl: settings.baseUrl });
+    if (isAgentKeyRefusal(response.status, check)) {
+      const report = describeAgentKeyRefusal(settings.request, settings.baseUrl);
+      printReport(report);
+      process.exit(report.exitCode);
+    }
+  }
+  return exitOnFailedResponse(response, settings.baseUrl);
+};
+
+export {
+  printKeyCheck,
+  exitOnFailedSettingsRequest
+};

package/dist/{chunk-CBQACHKY.js → chunk-IIVZZMSO.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-5RGA636G.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-Z6HPS67T.js → chunk-IRHABAQT.js}

@@ -1,6 +1,6 @@
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-STQRUH3S.js";
+} from "./chunk-5DCDQ5VW.js";
 
 // src/config.ts
 import { readFileSync } from "fs";

package/dist/{chunk-QTO6HEZD.js → chunk-K545B734.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-POFBE6ZY.js";
 import {
   autoUpdateState
-} from "./chunk-ZUTU43FT.js";
+} from "./chunk-Z23ZBYDW.js";
 import {
   readJsonSafe,
   writeJsonAtomic
@@ -14,7 +14,7 @@ import {
   cliPackagePathSegments,
   globalUpgradeEntry,
   ownPackageRoot
-} from "./chunk-QR6VE5ME.js";
+} from "./chunk-5RGA636G.js";
 
 // src/auto-update.ts
 import { spawn } from "child_process";

package/dist/{chunk-KYO45G5L.js → chunk-KOWFRUIT.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-ZUTU43FT.js";
+} from "./chunk-Z23ZBYDW.js";
 import {
   writeFileAtomic
 } from "./chunk-T7E75EKA.js";