@pushary/agent-hooks 1.9.7 → 1.9.9

package/dist/bin/pushary-status.js

@@ -2,52 +2,86 @@
 import {
   describeLastSeen,
   listMachines
-} from "../chunk-MBK7N46B.js";
-import "../chunk-T7Y5EADL.js";
+} from "../chunk-QIOIO7VN.js";
+import "../chunk-F7R3SZ4Q.js";
 import "../chunk-RIVNNBEK.js";
-import "../chunk-VXRXFU6Q.js";
+import "../chunk-SZ4Q6ZVS.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-6ICPEJY5.js";
 import {
   describeReach,
   fetchChannels,
   reachVerdict
-} from "../chunk-N4EUSDKX.js";
+} from "../chunk-DCCSULXK.js";
 import "../chunk-3EGEA4KH.js";
 import "../chunk-QCGNGEGE.js";
+import {
+  SIGNED_OUT_ON_MAC_MESSAGE,
+  activeKeyVerdictOf,
+  describeSignedOutKey,
+  readSignedOutDiagnosis
+} from "../chunk-Q6C6ILUS.js";
+import {
+  CONNECTED_THROUGH_MAC_APP,
+  readMacAppConnectionWhenKeyless
+} from "../chunk-E5HOHIUV.js";
+import "../chunk-BZLHTMT6.js";
+import "../chunk-UF6RBP5V.js";
 import {
   createIo
 } from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-UFVGSEWH.js";
+} from "../chunk-TO3PS646.js";
+import "../chunk-BYLKCZ2G.js";
+import "../chunk-M3STIAGU.js";
+import "../chunk-ZGADIZDS.js";
+import "../chunk-MLGIVVSG.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
+import "../chunk-6ICPEJY5.js";
 import {
   readKeySource
-} from "../chunk-ADSQDYYG.js";
-import "../chunk-L76HTPU6.js";
+} from "../chunk-REU2VQPH.js";
+import "../chunk-KQFTBQ66.js";
+import "../chunk-N6IOSZOE.js";
+import "../chunk-MD4SVNT6.js";
+import "../chunk-WRPYCIV2.js";
+import "../chunk-6AYSKVLL.js";
 import {
   checkApiKey,
   describeKeyCheck
-} from "../chunk-KFKL3FHS.js";
-import "../chunk-JXISQ7DT.js";
-import "../chunk-KYO45G5L.js";
+} from "../chunk-QRXPWW3M.js";
+import "../chunk-UPIZSCYD.js";
+import "../chunk-POFBE6ZY.js";
+import "../chunk-5N5L6DNN.js";
+import "../chunk-KOWFRUIT.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-4D2AYNSE.js";
-import "../chunk-ZUTU43FT.js";
+import "../chunk-BNSKVIAW.js";
+import "../chunk-Z23ZBYDW.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-Z6HPS67T.js";
-import "../chunk-STQRUH3S.js";
-import "../chunk-QR6VE5ME.js";
+import "../chunk-IRHABAQT.js";
+import "../chunk-5DCDQ5VW.js";
+import "../chunk-5RGA636G.js";
 
 // src/status.ts
+var signedOutReport = (facts, lines) => {
+  const signedOut = facts.signedOut;
+  if (signedOut?.kind !== "signed_out_on_mac") return null;
+  lines.push({ label: "Server", value: "key signed out on this Mac", ok: false });
+  return { lines, headline: SIGNED_OUT_ON_MAC_MESSAGE, next: [...describeSignedOutKey(signedOut)], exitCode: EXIT.UNAUTHENTICATED };
+};
+var connectedThroughMacAppReport = (macApp) => ({
+  lines: [{ label: "Key", value: `${macApp.keyPrefix} held by the Pushary Mac app`, ok: true }],
+  headline: `${CONNECTED_THROUGH_MAC_APP}.`,
+  next: ["Approvals, phone pairing and account settings for this computer are in the Pushary Mac app."],
+  exitCode: EXIT.OK
+});
 var keySourceLine = (source) => {
   if (source.kind === "none") {
     return { label: "Key", value: "none found", ok: false };
@@ -86,6 +120,9 @@ var buildStatusReport = (facts) => {
     });
   }
   if (facts.source.kind === "none") {
+    const signedOut = signedOutReport(facts, lines);
+    if (signedOut) return signedOut;
+    if (facts.macApp?.kind === "connected") return connectedThroughMacAppReport(facts.macApp);
     return {
       lines,
       headline: "Not set up on this machine.",
@@ -95,6 +132,8 @@ var buildStatusReport = (facts) => {
   }
   const check = facts.keyCheck;
   if (check && check.kind !== "ok") {
+    const signedOut = check.kind === "rejected" ? signedOutReport(facts, lines) : null;
+    if (signedOut) return signedOut;
     const report = describeKeyCheck(check);
     lines.push({ label: "Server", value: report.message, ok: check.kind === "unreachable" ? null : false });
     return { lines, headline: report.message, next: [...report.next], exitCode: report.exitCode };
@@ -148,7 +187,7 @@ var buildStatusReport = (facts) => {
       return {
         lines,
         headline: verdict.kind === "nobody" ? "Configured, but no device can receive an approval." : verdict.kind === "others" ? "Configured, but the only devices here are your teammates'." : "Configured, and nothing proves an approval reaches you.",
-        next: verdict.kind === "nobody" ? ["Run `pushary connect` to add your phone, or install the Pushary app."] : ["Run `pushary connect` to add your own phone.", "Or `pushary doctor --roundtrip` to prove one of these is yours."],
+        next: verdict.kind === "nobody" ? ["Run `pushary pair` to pair your phone, or install the Pushary app."] : ["Run `pushary pair` to pair your own phone.", "Or `pushary doctor --roundtrip` to prove one of these is yours."],
         exitCode: EXIT.NO_DEVICE
       };
     }
@@ -156,7 +195,7 @@ var buildStatusReport = (facts) => {
       return {
         lines,
         headline: "Configured, but nothing in your pocket can receive an approval.",
-        next: ["Run `pushary connect` and connect your phone, or install the Pushary app."],
+        next: ["Run `pushary pair` to pair your phone, or install the Pushary app."],
         exitCode: EXIT.NO_DEVICE
       };
     }
@@ -175,6 +214,7 @@ var statusJson = (facts, report) => ({
   keySource: facts.source.kind,
   keyOrigin: facts.source.origin,
   keyPrefix: facts.source.key ? facts.source.key.split(".")[0] : null,
+  connectedThroughMacApp: facts.macApp?.kind === "connected",
   drift: facts.source.drift ? {
     env: facts.source.drift.envPrefix,
     config: facts.source.drift.configPrefix,
@@ -208,7 +248,13 @@ var main = async () => {
     if (keyCheck.kind === "ok") channels = await fetchChannels(source.key);
   }
   const machines = devices && keyCheck?.kind === "ok" ? await listMachines(source.key) : null;
-  const facts = { source, keyCheck, channels };
+  const facts = {
+    source,
+    keyCheck,
+    channels,
+    signedOut: readSignedOutDiagnosis(source.key, activeKeyVerdictOf(keyCheck)),
+    macApp: readMacAppConnectionWhenKeyless(source.key)
+  };
   const report = buildStatusReport(facts);
   if (json) {
     const payload = statusJson(facts, report);

package/dist/bin/pushary-stop-hook.js

@@ -1,50 +1,47 @@
 #!/usr/bin/env node
-import {
-  activeHookSource,
-  activeIdentity
-} from "../chunk-MZPXVH4A.js";
-import "../chunk-ANEAA37E.js";
 import {
   readHookInput
-} from "../chunk-XWAYAO3V.js";
-import "../chunk-BTQGAXZ3.js";
+} from "../chunk-R5RIVOPL.js";
+import "../chunk-COQ64C4F.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-SD3272LS.js";
-import "../chunk-SBLPHUEB.js";
-import "../chunk-MNWRUGMH.js";
-import "../chunk-4YO4T5FV.js";
-import "../chunk-VXRXFU6Q.js";
-import "../chunk-JCWZ23MJ.js";
-import "../chunk-7264S5HZ.js";
-import "../chunk-AUUXS44H.js";
-import "../chunk-4FK6RZVJ.js";
-import "../chunk-HPRZJKRO.js";
+import "../chunk-SZ4Q6ZVS.js";
+import "../chunk-APP43AW7.js";
+import "../chunk-462EQA6K.js";
+import "../chunk-VIIHC42X.js";
 import "../chunk-XHKBHWLX.js";
+import {
+  activeHookSource,
+  activeIdentity
+} from "../chunk-UF6RBP5V.js";
+import "../chunk-BYLKCZ2G.js";
+import "../chunk-M3STIAGU.js";
+import "../chunk-ZGADIZDS.js";
+import "../chunk-MLGIVVSG.js";
+import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
+import "../chunk-REU2VQPH.js";
 import {
   handleStop,
   handleSubagentStop,
   isSubagentStop
-} from "../chunk-QFEM7R6T.js";
+} from "../chunk-KQFTBQ66.js";
 import "../chunk-N6IOSZOE.js";
-import "../chunk-6DJTDHBI.js";
-import "../chunk-D6S5EKXA.js";
-import "../chunk-AVNKVF7N.js";
+import "../chunk-MD4SVNT6.js";
+import "../chunk-WRPYCIV2.js";
+import "../chunk-6AYSKVLL.js";
+import "../chunk-QRXPWW3M.js";
+import "../chunk-UPIZSCYD.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-GMXKITVA.js";
-import "../chunk-ADSQDYYG.js";
-import "../chunk-L76HTPU6.js";
-import "../chunk-KFKL3FHS.js";
-import "../chunk-JXISQ7DT.js";
-import "../chunk-KYO45G5L.js";
+import "../chunk-5N5L6DNN.js";
+import "../chunk-KOWFRUIT.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-4D2AYNSE.js";
-import "../chunk-ZUTU43FT.js";
+import "../chunk-BNSKVIAW.js";
+import "../chunk-Z23ZBYDW.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-Z6HPS67T.js";
-import "../chunk-STQRUH3S.js";
-import "../chunk-QR6VE5ME.js";
+import "../chunk-IRHABAQT.js";
+import "../chunk-5DCDQ5VW.js";
+import "../chunk-5RGA636G.js";
 
 // bin/pushary-stop-hook.ts
 var AGENT = activeIdentity(process.argv);

package/dist/bin/pushary-stopfailure-hook.js

@@ -1,48 +1,45 @@
 #!/usr/bin/env node
-import {
-  activeHookSource,
-  activeIdentity
-} from "../chunk-MZPXVH4A.js";
-import "../chunk-ANEAA37E.js";
 import {
   readHookInput
-} from "../chunk-XWAYAO3V.js";
-import "../chunk-BTQGAXZ3.js";
+} from "../chunk-R5RIVOPL.js";
+import "../chunk-COQ64C4F.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-SD3272LS.js";
-import "../chunk-SBLPHUEB.js";
-import "../chunk-MNWRUGMH.js";
-import "../chunk-4YO4T5FV.js";
-import "../chunk-VXRXFU6Q.js";
-import "../chunk-JCWZ23MJ.js";
-import "../chunk-7264S5HZ.js";
-import "../chunk-AUUXS44H.js";
-import "../chunk-4FK6RZVJ.js";
-import "../chunk-HPRZJKRO.js";
+import "../chunk-SZ4Q6ZVS.js";
+import "../chunk-APP43AW7.js";
+import "../chunk-462EQA6K.js";
+import "../chunk-VIIHC42X.js";
 import "../chunk-XHKBHWLX.js";
+import {
+  activeHookSource,
+  activeIdentity
+} from "../chunk-UF6RBP5V.js";
+import "../chunk-BYLKCZ2G.js";
+import "../chunk-M3STIAGU.js";
+import "../chunk-ZGADIZDS.js";
+import "../chunk-MLGIVVSG.js";
+import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
+import "../chunk-REU2VQPH.js";
 import {
   handleStopFailure
-} from "../chunk-QFEM7R6T.js";
+} from "../chunk-KQFTBQ66.js";
 import "../chunk-N6IOSZOE.js";
-import "../chunk-6DJTDHBI.js";
-import "../chunk-D6S5EKXA.js";
-import "../chunk-AVNKVF7N.js";
+import "../chunk-MD4SVNT6.js";
+import "../chunk-WRPYCIV2.js";
+import "../chunk-6AYSKVLL.js";
+import "../chunk-QRXPWW3M.js";
+import "../chunk-UPIZSCYD.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-GMXKITVA.js";
-import "../chunk-ADSQDYYG.js";
-import "../chunk-L76HTPU6.js";
-import "../chunk-KFKL3FHS.js";
-import "../chunk-JXISQ7DT.js";
-import "../chunk-KYO45G5L.js";
+import "../chunk-5N5L6DNN.js";
+import "../chunk-KOWFRUIT.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-4D2AYNSE.js";
-import "../chunk-ZUTU43FT.js";
+import "../chunk-BNSKVIAW.js";
+import "../chunk-Z23ZBYDW.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-Z6HPS67T.js";
-import "../chunk-STQRUH3S.js";
-import "../chunk-QR6VE5ME.js";
+import "../chunk-IRHABAQT.js";
+import "../chunk-5DCDQ5VW.js";
+import "../chunk-5RGA636G.js";
 
 // bin/pushary-stopfailure-hook.ts
 var AGENT = activeIdentity(process.argv);

package/dist/bin/pushary-suggestions.js

@@ -1,37 +1,40 @@
 #!/usr/bin/env node
+import {
+  exitOnFailedSettingsRequest
+} from "../chunk-HBWYMRR5.js";
+import "../chunk-Q6C6ILUS.js";
 import {
   createIo
 } from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-UFVGSEWH.js";
+} from "../chunk-TO3PS646.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
+import "../chunk-REU2VQPH.js";
+import "../chunk-QRXPWW3M.js";
+import "../chunk-5N5L6DNN.js";
+import "../chunk-KOWFRUIT.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
+import "../chunk-BNSKVIAW.js";
+import "../chunk-Z23ZBYDW.js";
+import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-Z6HPS67T.js";
-import "../chunk-STQRUH3S.js";
-import "../chunk-QR6VE5ME.js";
+} from "../chunk-IRHABAQT.js";
+import "../chunk-5DCDQ5VW.js";
+import "../chunk-5RGA636G.js";
 
 // bin/pushary-suggestions.ts
 exitOnHelpFlag("suggestions");
-var { dim, green, cyan, red } = createIo();
-var errorMessage = async (res) => {
-  try {
-    const body = await res.json();
-    return body.error ?? `HTTP ${res.status}`;
-  } catch {
-    return `HTTP ${res.status}`;
-  }
-};
+var { dim, green, cyan } = createIo();
 {
   const raw = process.argv.slice(2);
   const positional = raw[0] === "suggestions" ? raw.slice(1) : raw;
@@ -46,6 +49,7 @@ var errorMessage = async (res) => {
 var main = async () => {
   const apiKey = getApiKey();
   const baseUrl = getBaseUrl();
+  const settings = { request: "suggestions", apiKey, baseUrl };
   const headers = { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" };
   const rest = process.argv.slice(2);
   const args = rest[0] === "suggestions" ? rest.slice(1) : rest;
@@ -61,18 +65,12 @@ var main = async () => {
       headers,
       body: JSON.stringify({ id })
     });
-    if (!res2.ok) {
-      console.error(`  ${red("\u2717")} ${await errorMessage(res2)}`);
-      process.exit(1);
-    }
+    if (!res2.ok) await exitOnFailedSettingsRequest(res2, settings);
     console.log(`  ${green("\u2713")} Accepted. The rule is live now; your agents will pick it up on their next check.`);
     return;
   }
   const res = await fetch(`${baseUrl}/api/mcp/suggestions`, { headers });
-  if (!res.ok) {
-    console.error(`  ${red("\u2717")} ${await errorMessage(res)}`);
-    process.exit(1);
-  }
+  if (!res.ok) await exitOnFailedSettingsRequest(res, settings);
   const { suggestions } = await res.json();
   if (suggestions.length === 0) {
     console.log(`  ${dim("No pending suggestions. Keep approving; a rule is offered once a pattern is earned.")}`);

package/dist/bin/pushary-transcript-register.js

@@ -1,32 +1,30 @@
 #!/usr/bin/env node
 import {
   registerTranscript
-} from "../chunk-BTQGAXZ3.js";
+} from "../chunk-COQ64C4F.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-SD3272LS.js";
-import "../chunk-SBLPHUEB.js";
-import "../chunk-MNWRUGMH.js";
-import "../chunk-4YO4T5FV.js";
-import "../chunk-VXRXFU6Q.js";
-import "../chunk-JCWZ23MJ.js";
-import "../chunk-7264S5HZ.js";
-import "../chunk-AUUXS44H.js";
-import "../chunk-4FK6RZVJ.js";
-import "../chunk-HPRZJKRO.js";
+import "../chunk-SZ4Q6ZVS.js";
+import "../chunk-APP43AW7.js";
+import "../chunk-462EQA6K.js";
+import "../chunk-VIIHC42X.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-6ICPEJY5.js";
-import "../chunk-6DJTDHBI.js";
+import "../chunk-BYLKCZ2G.js";
+import "../chunk-M3STIAGU.js";
+import "../chunk-ZGADIZDS.js";
+import "../chunk-MLGIVVSG.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-ADSQDYYG.js";
-import "../chunk-KYO45G5L.js";
+import "../chunk-6ICPEJY5.js";
+import "../chunk-REU2VQPH.js";
+import "../chunk-MD4SVNT6.js";
+import "../chunk-KOWFRUIT.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-4D2AYNSE.js";
-import "../chunk-ZUTU43FT.js";
+import "../chunk-BNSKVIAW.js";
+import "../chunk-Z23ZBYDW.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-Z6HPS67T.js";
-import "../chunk-STQRUH3S.js";
-import "../chunk-QR6VE5ME.js";
+import "../chunk-IRHABAQT.js";
+import "../chunk-5DCDQ5VW.js";
+import "../chunk-5RGA636G.js";
 
 // bin/pushary-transcript-register.ts
 var raw = "";

package/dist/bin/pushary-transcripts.js

@@ -6,17 +6,17 @@ import {
 } from "../chunk-SGZJ5LYH.js";
 import {
   transcriptsEnabled
-} from "../chunk-HPRZJKRO.js";
+} from "../chunk-VIIHC42X.js";
 import {
   exitOnHelpFlag
-} from "../chunk-UFVGSEWH.js";
-import "../chunk-ADSQDYYG.js";
+} from "../chunk-TO3PS646.js";
+import "../chunk-REU2VQPH.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-4D2AYNSE.js";
+import "../chunk-BNSKVIAW.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-Z6HPS67T.js";
-import "../chunk-STQRUH3S.js";
-import "../chunk-QR6VE5ME.js";
+import "../chunk-IRHABAQT.js";
+import "../chunk-5DCDQ5VW.js";
+import "../chunk-5RGA636G.js";
 
 // bin/pushary-transcripts.ts
 exitOnHelpFlag("transcripts");

package/dist/bin/pushary-upgrade.js

@@ -9,29 +9,27 @@ import {
   upgradeFinishOutcome,
   upgradeInstalledPackage,
   withUpgradeLock
-} from "../chunk-3PVDOCFI.js";
+} from "../chunk-VHPFNLRS.js";
 import {
   installWithUpgradeLock
-} from "../chunk-RQGODFQN.js";
+} from "../chunk-AZOKPWVI.js";
 import {
   ensureCodexTrustAfterReapply,
   reapplyAllAgents
-} from "../chunk-NIBFSARF.js";
+} from "../chunk-6EBGOHDJ.js";
 import {
   describeCodexTrustConfirmation
-} from "../chunk-JWKBDSPF.js";
-import "../chunk-H7MMU64M.js";
+} from "../chunk-DP3WX7FW.js";
+import "../chunk-NGKUXZID.js";
 import {
   waitForMachineReadiness
-} from "../chunk-MBK7N46B.js";
-import "../chunk-X5NXPCIC.js";
-import "../chunk-ANEAA37E.js";
+} from "../chunk-QIOIO7VN.js";
 import {
   detectProviderLiveCapabilities,
   expectedLaunchCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "../chunk-T7Y5EADL.js";
+} from "../chunk-F7R3SZ4Q.js";
 import "../chunk-RIVNNBEK.js";
 import {
   AUTO_UPDATE_DISABLE_ENV,
@@ -42,8 +40,7 @@ import {
   parseAutoUpdateFlag,
   readAutoUpdateState,
   updateAutoUpdateState
-} from "../chunk-QTO6HEZD.js";
-import "../chunk-4YO4T5FV.js";
+} from "../chunk-K545B734.js";
 import {
   DAEMON_COLD_START_TIMEOUT_MS,
   daemonHasRemoteProof,
@@ -55,23 +52,41 @@ import {
   replaceDaemonService,
   stopDaemonService,
   waitForDaemonRemoteProof
-} from "../chunk-VXRXFU6Q.js";
-import "../chunk-JCWZ23MJ.js";
+} from "../chunk-SZ4Q6ZVS.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-6ICPEJY5.js";
-import "../chunk-6DJTDHBI.js";
-import "../chunk-POFBE6ZY.js";
+import {
+  readMacAppAgentKey
+} from "../chunk-E5HOHIUV.js";
+import "../chunk-BZLHTMT6.js";
+import "../chunk-UF6RBP5V.js";
 import {
   exitOnHelpFlag
-} from "../chunk-UFVGSEWH.js";
+} from "../chunk-TO3PS646.js";
+import "../chunk-BYLKCZ2G.js";
+import "../chunk-M3STIAGU.js";
+import "../chunk-ZGADIZDS.js";
+import "../chunk-MLGIVVSG.js";
+import "../chunk-GMXKITVA.js";
+import "../chunk-6ICPEJY5.js";
 import {
-  readControlMode
-} from "../chunk-ADSQDYYG.js";
-import "../chunk-KYO45G5L.js";
+  readControlMode,
+  recordMacAppKeyPrefix
+} from "../chunk-REU2VQPH.js";
+import "../chunk-KQFTBQ66.js";
+import "../chunk-N6IOSZOE.js";
+import "../chunk-MD4SVNT6.js";
+import "../chunk-WRPYCIV2.js";
+import "../chunk-6AYSKVLL.js";
+import "../chunk-QRXPWW3M.js";
+import "../chunk-UPIZSCYD.js";
+import "../chunk-POFBE6ZY.js";
+import "../chunk-5N5L6DNN.js";
+import "../chunk-KOWFRUIT.js";
+import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-4D2AYNSE.js";
+import "../chunk-BNSKVIAW.js";
 import {
   LATEST_TAG,
   autoUpdateState,
@@ -81,19 +96,19 @@ import {
   fetchLatestPublishedVersion,
   geminiSettings,
   vscodePluginDir
-} from "../chunk-ZUTU43FT.js";
+} from "../chunk-Z23ZBYDW.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey
-} from "../chunk-Z6HPS67T.js";
+} from "../chunk-IRHABAQT.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-STQRUH3S.js";
+} from "../chunk-5DCDQ5VW.js";
 import {
   CANONICAL_PACKAGE,
   LEGACY_PACKAGE,
   getPackageVersion
-} from "../chunk-QR6VE5ME.js";
+} from "../chunk-5RGA636G.js";
 
 // bin/pushary-upgrade.ts
 import { existsSync } from "fs";
@@ -142,9 +157,12 @@ var finishUpgrade = async () => {
   } catch {
     apiKey = void 0;
   }
+  const macAppKey = readMacAppAgentKey();
+  if (macAppKey) recordMacAppKeyPrefix(macAppKey);
   const inspectedAgents = reapplyAllAgents(apiKey);
   const codexTrust = await ensureCodexTrustAfterReapply(inspectedAgents);
   const refreshed = inspectedAgents.filter((agent) => agent.result.reapplied);
+  const keptForApp = inspectedAgents.filter((agent) => agent.heldBy === "app");
   const failedRefreshes = inspectedAgents.filter((agent) => agent.result.failed);
   const configuredControlProviders = inspectedAgents.filter((agent) => agent.result.configured && (agent.id === "claude" || agent.id === "codex" || agent.id === "gemini")).map((agent) => agent.id);
   const controlMode = readControlMode();
@@ -191,9 +209,14 @@ var finishUpgrade = async () => {
       console.log();
       console.log("No key was readable here, so MCP entries kept the key they already had.");
     }
-  } else if (failedRefreshes.length === 0) {
+  } else if (failedRefreshes.length === 0 && keptForApp.length === 0) {
     console.log("No agent config on this machine needed refreshing.");
   }
+  if (keptForApp.length > 0) {
+    if (refreshed.length > 0) console.log();
+    console.log(KEPT_FOR_APP_HEADING);
+    for (const agent of keptForApp) console.log(`  ${agent.label}`);
+  }
   if (codexTrust) {
     console.log();
     console.log(describeCodexTrustConfirmation(codexTrust));
@@ -212,6 +235,7 @@ var finishUpgrade = async () => {
   console.log(controlPolicy === "disabled" ? "Done. Your hooks use the new global install; phone-start remains disabled." : controlPolicy === "unsupported" || controlPolicy === "preserve-absent" ? "Done. Your hooks use the new global install; no background service was added." : "Done. Your hooks and background service use the new global install.");
   console.log("Verify with: pushary doctor");
 };
+var KEPT_FOR_APP_HEADING = "Kept for the Pushary Mac app, which owns these agents. Nothing in their config was changed:";
 var AUTO_UPDATE_ON_MESSAGE = "Automatic updates are on. Pushary checks for a new version once a day, when an agent session starts.";
 var AUTO_UPDATE_OFF_MESSAGE = "Automatic updates are off. Turn them back on with: pushary upgrade --auto=on";
 var AUTO_UPDATE_RUN_MESSAGES = {