@pushary/agent-hooks 1.9.8 → 1.9.10

package/dist/bin/pushary-setup.js

@@ -1,40 +1,36 @@
 #!/usr/bin/env node
 import {
   runBrowserLogin
-} from "../chunk-NWDG3MSW.js";
+} from "../chunk-YUQHUGTH.js";
 import {
   coworkOutput,
   coworkSelection
-} from "../chunk-B64KHETR.js";
+} from "../chunk-BVPPYR7B.js";
 import "../chunk-PUZZELE6.js";
 import {
   clearDeclinedAgent,
   declinedAgentForSetupChoice
-} from "../chunk-BXET3ALR.js";
-import {
-  agentHookFile,
-  agentHookOwner,
-  macAppBridgeAvailable
-} from "../chunk-3Z3A37WD.js";
+} from "../chunk-C6QTMWJZ.js";
 import {
+  CURSOR_GATE_SCRIPT,
   describeVersionManagerPin,
   versionManagerOf
-} from "../chunk-GU3EJCVV.js";
+} from "../chunk-EA5NWDK7.js";
 import {
   codexTrustOutcome,
   describeCodexTrustConfirmation,
   needsCodexTrustStep
-} from "../chunk-6TE27XZR.js";
+} from "../chunk-DAOQT4WK.js";
 import {
   writeStdoutFully
 } from "../chunk-EO23EUOK.js";
 import {
   ensureCodexTrustsPusharyHooks
-} from "../chunk-MGRFDGWU.js";
+} from "../chunk-Y7JM47CI.js";
 import {
   readManagedControlEvidence,
   waitForMachineReadiness
-} from "../chunk-2QTO5YIT.js";
+} from "../chunk-XKMGHVXW.js";
 import {
   describeSetupSideEffects,
   installAgentSkill,
@@ -44,7 +40,7 @@ import {
   CURSOR_PLUGIN_BACKUP_INFIX,
   CURSOR_PLUGIN_STAGING_PREFIX,
   registerCursorGate
-} from "../chunk-TCWKTUAE.js";
+} from "../chunk-BVSIM4EF.js";
 import {
   HERMES_PIP_PACKAGE,
   describeDetection,
@@ -57,7 +53,7 @@ import {
   runHermesConfigScript,
   shortenHome,
   vscodeSettingsTargets
-} from "../chunk-KFF7G225.js";
+} from "../chunk-S2DAKKQQ.js";
 import {
   AgentConfigError,
   FX_PUSHARY_TOOLS_RULE,
@@ -81,39 +77,10 @@ import {
   withFxPusharyServer,
   writeFxProfile,
   writeInstructionBlock
-} from "../chunk-ZN3C6GBG.js";
+} from "../chunk-2HXG2QDI.js";
 import {
   MCP_BRIDGE_BINARY
-} from "../chunk-HRULIYDU.js";
-import {
-  OPENCODE_HOOK_BINARY,
-  addOpenCodeMcpServer,
-  installOpenCodePlugin,
-  openCodeConfigDir,
-  openCodeConfigFile,
-  openCodeHookArgv,
-  openCodeInstructionsFile,
-  openCodePluginDir,
-  openCodePluginFile,
-  openCodeWired
-} from "../chunk-MFF3ONG5.js";
-import {
-  addClaudeMcpServer,
-  addCompatibleHooks,
-  addCompatibleMcpServer,
-  addCompatibleToolPermissions,
-  addPusharyHooks,
-  addPusharyToolPermissions,
-  captureClaudeMcpServer,
-  compatibleConfigFile,
-  compatibleHookEvents,
-  compatibleInstructionsFile,
-  compatibleMcpFile,
-  compatiblePermissionRuleFile,
-  hasCompatibleHooks,
-  isClaudeMcpSnapshot,
-  updateClaudeMcpSnapshot
-} from "../chunk-KHNFLYJO.js";
+} from "../chunk-OL2Z7WI4.js";
 import {
   checkCodexInstall,
   detectProviderLiveCapabilities,
@@ -121,29 +88,14 @@ import {
   hasSpawnProvider,
   nodeCodexInstallProbe,
   resolveControlPolicy
-} from "../chunk-I6MJXLMY.js";
+} from "../chunk-EVC765EO.js";
 import {
   detectClaudeVersion
 } from "../chunk-RIVNNBEK.js";
 import {
   describeAutoUpdateAnnouncement,
   takeAutoUpdateAnnouncement
-} from "../chunk-7PT35RY2.js";
-import {
-  KEEP_HINT,
-  captureHookTakeover,
-  captureMcpServer,
-  describeAppOwnership,
-  describeHookOwnership,
-  mcpBearerKey,
-  planHooks
-} from "../chunk-YIG2R3BJ.js";
-import {
-  AGENT_CHOICES,
-  effectiveControlMode,
-  effectiveVerify,
-  parseSetupOptions
-} from "../chunk-DL7XWKYV.js";
+} from "../chunk-U5FP5JIS.js";
 import {
   DAEMON_COLD_START_TIMEOUT_MS,
   clearDaemonNeedsLogin,
@@ -157,35 +109,11 @@ import {
   replaceDaemonService,
   stopDaemonService,
   waitForDaemonRemoteProof
-} from "../chunk-LKLVTG3V.js";
-import {
-  claudeWired,
-  codexWired,
-  geminiWired,
-  pusharyHookExecutable
-} from "../chunk-2QGYMY7A.js";
-import {
-  GEMINI_HOOK_BINARY,
-  addGeminiHooks,
-  addGeminiMcpServer
-} from "../chunk-3I6IVOZV.js";
-import "../chunk-WG3K4TCH.js";
+} from "../chunk-RPQLZLKC.js";
 import {
   transcriptPreferenceForSetup
-} from "../chunk-M6BZZFVQ.js";
+} from "../chunk-QGRENWJL.js";
 import "../chunk-XHKBHWLX.js";
-import {
-  compareVersion,
-  parseVersion
-} from "../chunk-6ICPEJY5.js";
-import {
-  reportEvent
-} from "../chunk-KRCR2CRQ.js";
-import "../chunk-N6IOSZOE.js";
-import "../chunk-CD47ZFFZ.js";
-import "../chunk-2VZAALEJ.js";
-import "../chunk-DKMD6AWR.js";
-import "../chunk-POFBE6ZY.js";
 import {
   BROWSER_CONNECT_COMMAND,
   confirmAppConnection,
@@ -196,17 +124,82 @@ import {
   printConnectInstructions,
   roundTripEvidence,
   verifyRoundTrip
-} from "../chunk-IAD2RT4L.js";
+} from "../chunk-6KNC6KLL.js";
 import "../chunk-3EGEA4KH.js";
 import {
   setHumanStream
 } from "../chunk-QCGNGEGE.js";
+import {
+  readMacAppAgentKey
+} from "../chunk-BOSXFI7L.js";
+import {
+  OPENCODE_HOOK_BINARY,
+  addOpenCodeMcpServer,
+  agentHookFile,
+  agentHookOwner,
+  agentHooksKeyPath,
+  installOpenCodePlugin,
+  macAppBridgeAvailable,
+  openCodeConfigDir,
+  openCodeConfigFile,
+  openCodeHookArgv,
+  openCodeInstructionsFile,
+  openCodePluginDir,
+  openCodePluginFile,
+  openCodeWired
+} from "../chunk-QAGWWDXQ.js";
+import {
+  addClaudeMcpServer,
+  addCompatibleHooks,
+  addCompatibleMcpServer,
+  addCompatibleToolPermissions,
+  addPusharyHooks,
+  addPusharyToolPermissions,
+  captureClaudeMcpServer,
+  compatibleConfigFile,
+  compatibleHookEvents,
+  compatibleInstructionsFile,
+  compatibleMcpFile,
+  compatiblePermissionRuleFile,
+  hasCompatibleHooks,
+  isClaudeMcpSnapshot,
+  updateClaudeMcpSnapshot
+} from "../chunk-7HGR5GNY.js";
 import {
   ansiPainter,
   createIo,
   useColor
 } from "../chunk-U4TMAANR.js";
+import {
+  KEEP_HINT,
+  captureHookTakeover,
+  captureMcpServer,
+  claudeWired,
+  codexWired,
+  describeAppOwnership,
+  describeHookOwnership,
+  geminiWired,
+  mcpBearerKey,
+  planHooks,
+  pusharyHookExecutable
+} from "../chunk-SIHYBIEN.js";
+import {
+  GEMINI_HOOK_BINARY,
+  addGeminiHooks,
+  addGeminiMcpServer
+} from "../chunk-PR2VDVCP.js";
+import {
+  AGENT_CHOICES,
+  effectiveControlMode,
+  effectiveVerify,
+  parseSetupOptions
+} from "../chunk-ZGADIZDS.js";
+import "../chunk-GQYX24UC.js";
 import "../chunk-GMXKITVA.js";
+import {
+  compareVersion,
+  parseVersion
+} from "../chunk-6ICPEJY5.js";
 import {
   KEY_FILE_MODE,
   exportLine,
@@ -219,22 +212,30 @@ import {
   recordMacAppKeyPrefix,
   resolveShellRc,
   writeKey
-} from "../chunk-N4QSPI3B.js";
-import "../chunk-MKTJEXZ3.js";
+} from "../chunk-GTZ4HIHU.js";
+import {
+  reportEvent
+} from "../chunk-LDQGURCF.js";
+import "../chunk-N6IOSZOE.js";
+import "../chunk-MD4SVNT6.js";
+import "../chunk-ZSGJYSF2.js";
+import "../chunk-I3W7GJ5R.js";
 import {
   checkApiKey,
   describeKeyCheck,
   samePusharyAccount
-} from "../chunk-LWOO567I.js";
-import "../chunk-TCQ43LSG.js";
-import "../chunk-DUZVXBBU.js";
+} from "../chunk-XXLCYKVS.js";
+import "../chunk-NQ67AF3V.js";
+import "../chunk-POFBE6ZY.js";
+import "../chunk-UM5WXBKN.js";
+import "../chunk-H4F5O3RE.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-FQ2GORVG.js";
+import "../chunk-Q3UMWSE4.js";
 import {
   NpmMissingError,
   addCodexHookTrust,
@@ -266,6 +267,7 @@ import {
   geminiSettings,
   guardBinary,
   guardCursorGate,
+  guardNodeScript,
   guardedArgv,
   hermesConfigReceipt,
   hookTakeoverReceipt,
@@ -278,18 +280,18 @@ import {
   resolveGlobalBinary,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-ZBHUHJG6.js";
+} from "../chunk-UJZ7AGSC.js";
 import {
   backupFile,
   readJsonSafe,
   writeFileAtomic,
   writeJsonAtomic
 } from "../chunk-T7E75EKA.js";
-import "../chunk-5QUPKDI5.js";
+import "../chunk-2M52CFVO.js";
 import {
   NPX_LATEST_COMMAND,
   renderCommandHelp
-} from "../chunk-7DVNSQWF.js";
+} from "../chunk-TCXL5FQQ.js";
 import {
   HOOK_COMPATIBLE_PROFILES,
   PRETOOLUSE_GATED_TOOLS,
@@ -303,7 +305,7 @@ import {
   isValidApiKey,
   launchedPackage,
   ownPackageName
-} from "../chunk-I5IJRMNV.js";
+} from "../chunk-5RGA636G.js";
 
 // bin/pushary-setup.ts
 import { existsSync, readFileSync, writeFileSync, mkdirSync, cpSync, rmSync, renameSync, realpathSync, statSync, openSync, readSync, closeSync } from "fs";
@@ -644,6 +646,24 @@ var pickAppKey = (candidates) => candidates.fromAgents.find(
   (candidate) => typeof candidate === "string" && candidate !== candidates.storedKey && candidate !== candidates.envKey && isValidApiKey(candidate)
 ) ?? null;
 
+// src/vscode-gate-hooks.ts
+var isRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var runsTheGate = (entry) => typeof entry.command === "string" && (pusharyHookExecutable(entry.command)?.endsWith(CURSOR_GATE_SCRIPT) ?? false);
+var guardedEntry = (entry, command) => isRecord(entry) && runsTheGate(entry) ? { ...entry, command } : entry;
+var guardVsCodeGateHooks = (document, gateScript) => {
+  if (!isRecord(document) || !isRecord(document.hooks)) {
+    return { kind: "invalid", reason: "bundled VS Code hooks.json has no hooks map" };
+  }
+  const hooks = document.hooks;
+  const preToolUse = hooks.PreToolUse;
+  if (!Array.isArray(preToolUse) || preToolUse.length === 0) {
+    return { kind: "invalid", reason: "bundled VS Code hooks.json is missing a PreToolUse entry" };
+  }
+  const command = guardNodeScript(gateScript);
+  const guarded = Object.fromEntries(Object.entries(hooks).map(([event, entries]) => [event, Array.isArray(entries) ? entries.map((entry) => guardedEntry(entry, command)) : entries]));
+  return { kind: "guarded", document: { ...document, hooks: guarded } };
+};
+
 // src/setup/pairing-computer.ts
 var LOCAL_NETWORK_SUFFIX = /\.local$/i;
 var computerNameOfHost = (host) => host.replace(LOCAL_NETWORK_SUFFIX, "").trim() || null;
@@ -1308,16 +1328,11 @@ var resolveBundledVsCodePlugin = () => {
   ];
   return candidates.find((p) => existsSync(join3(p, ".claude-plugin", "plugin.json"))) ?? null;
 };
-var pinVsCodeGatePath = (pluginDir) => {
+var pinGuardedVsCodeGate = (pluginDir) => {
   const hooksPath = join3(pluginDir, "hooks", "hooks.json");
-  const data = readJson(hooksPath);
-  const entries = data.hooks?.PreToolUse;
-  if (!Array.isArray(entries) || entries.length === 0) {
-    throw new Error("bundled VS Code hooks.json is missing a PreToolUse entry");
-  }
-  const gate = join3(pluginDir, "scripts", "pushary-gate.mjs");
-  data.hooks.PreToolUse = entries.map((entry) => ({ ...entry, command: `node "${gate}"` }));
-  writeJson(hooksPath, data);
+  const guarded = guardVsCodeGateHooks(readJson(hooksPath), join3(pluginDir, "scripts", CURSOR_GATE_SCRIPT));
+  if (guarded.kind === "invalid") throw new Error(guarded.reason);
+  writeJson(hooksPath, guarded.document);
 };
 var registerVsCodePlugin = (pluginDir) => {
   const written = [];
@@ -1379,7 +1394,7 @@ var setupVsCode = async (apiKey) => {
       mcp.mcpServers = servers;
       writeJsonAtomic(mcpPath, mcp, KEY_FILE_MODE);
     }
-    pinVsCodeGatePath(VSCODE_PLUGIN_DIR);
+    pinGuardedVsCodeGate(VSCODE_PLUGIN_DIR);
   });
   let registration = { written: [], manual: [] };
   await spinner("Registering the plugin with VS Code", async () => {
@@ -1417,7 +1432,7 @@ var saveApiKey = async (apiKey, controlMode, transcriptSync) => {
   let result;
   await spinner("Saving your API key", async () => {
     result = writeKey(apiKey, {
-      ...controlMode === null ? {} : { controlMode },
+      controlMode,
       transcriptsEnabled: transcriptSync
     });
   });
@@ -1633,14 +1648,30 @@ var clearSetupChoiceDecline = (agent) => {
   const declined = declinedAgentForSetupChoice(agent);
   if (declined) clearDeclinedAgent(declined);
 };
+var compatibleAppMcpEntries = () => Object.fromEntries(HOOK_COMPATIBLE_PROFILES.flatMap((profile) => {
+  const file = compatibleMcpFile(profile);
+  return file === null ? [] : [[profile.agentType, { file: () => file, container: "mcpServers" }]];
+}));
+var APP_MCP_ENTRIES = {
+  claude_code: { file: () => CLAUDE_JSON, container: "mcpServers" },
+  gemini_cli: { file: () => GEMINI_SETTINGS, container: "mcpServers" },
+  cursor: { file: cursorUserMcp, container: "mcpServers" },
+  vscode: { file: () => VSCODE_PLUGIN_MCP, container: "mcpServers" },
+  opencode: { file: openCodeConfigFile, container: "mcp" },
+  ...compatibleAppMcpEntries()
+};
+var MAC_APP_DEVICE_KEY_AGENTS = new Set(
+  HOOK_COMPATIBLE_PROFILES.filter((profile) => profile.mcp === null).map((profile) => profile.agentType)
+);
 var appMcpKeyFor = (agent) => {
   if (agent === "codex") {
     const auth = readCodexMcpAuth(readAgentToml(codexConfigToml()));
     return auth?.method === "embedded" ? auth.key : null;
   }
-  const file = agent === "claude_code" ? CLAUDE_JSON : agent === "gemini_cli" ? GEMINI_SETTINGS : agent === "cursor" ? cursorUserMcp() : agent === "vscode" ? VSCODE_PLUGIN_MCP : null;
-  return file ? mcpBearerKey(readAgentJson(file), "mcpServers", "headers") : null;
+  const entry = APP_MCP_ENTRIES[agent];
+  return entry ? mcpBearerKey(readAgentJson(entry.file()), entry.container, "headers") : null;
 };
+var appWiringAccountKeyFor = (agent) => MAC_APP_DEVICE_KEY_AGENTS.has(agent) ? readMacAppAgentKey() : appMcpKeyFor(agent);
 var appMcpKeyIfReadable = (agent) => {
   try {
     return appMcpKeyFor(agent);
@@ -1652,7 +1683,7 @@ var captureTakeoverReceipt = (agent) => {
   const hookFile = agentHookFile(agent);
   if (!hookFile) return;
   const document = readAgentJson(hookFile);
-  const captured = captureHookTakeover(agent, document);
+  const captured = captureHookTakeover(agent, document, agentHooksKeyPath(agent));
   if (!captured) throw new Error(`Cannot safely take over ${AGENT_NAMES[agent]}'s hooks: no Mac app wiring was found.`);
   const codexConfig = agent === "codex" ? readAgentToml(codexConfigToml()) : null;
   const mcp = agent === "claude_code" ? [readAgentJson(CLAUDE_JSON), "mcpServers"] : agent === "codex" ? [codexConfig, "mcp_servers"] : agent === "gemini_cli" ? [document, "mcpServers"] : agent === "vscode" ? [readAgentJson(VSCODE_PLUGIN_MCP), "mcpServers"] : null;
@@ -2006,7 +2037,7 @@ var reportDryRun = (apiKey, agents, keyCheck, controlMode) => {
     apiKey ? `  ${dim("Key:")}        ${dim(`${apiKey.slice(0, 8)}...${apiKey.slice(-4)}`)} ${dim(`(${keyCheck?.kind ?? "not verified"})`)}` : `  ${dim("Key:")}        ${dim("none on this machine \u2014 a real run would acquire one")}`
   );
   console.log(`  ${dim("Key store:")}  ${PUSHARY_CONFIG_FILE}`);
-  console.log(`  ${dim("Control:")}    ${controlMode ?? "unchanged (legacy install)"}`);
+  console.log(`  ${dim("Control:")}    ${controlMode}`);
   const rc = resolveShellRc();
   console.log(`  ${dim("Shell rc:")}   ${rc ? rc.path : dim("none for this shell; the key would stay in Pushary's config only")}`);
   console.log();
@@ -2060,7 +2091,7 @@ var main = async () => {
 `);
     process.exit(EXIT.OK);
   }
-  const controlMode = effectiveControlMode(options, readControlMode(), existsSync(PUSHARY_CONFIG_FILE));
+  const controlMode = effectiveControlMode(options, readControlMode());
   recordSetupOptions(options);
   if (options.json) {
     jsonMode = true;
@@ -2241,7 +2272,7 @@ var main = async () => {
     return pending;
   };
   const appAccountMatches = async (agent) => {
-    const appKey2 = appMcpKeyFor(agent);
+    const appKey2 = appWiringAccountKeyFor(agent);
     if (!appKey2) return false;
     if (appKey2 === trimmedKey) return true;
     const [cliAccount, appAccount] = await Promise.all([

package/dist/bin/pushary-stats.js

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import {
   readLedgerSummary
-} from "../chunk-ZSTSEBG7.js";
+} from "../chunk-IIVZZMSO.js";
 import {
   exitOnHelpFlag
-} from "../chunk-CKV3UPMU.js";
+} from "../chunk-2HFSKYLN.js";
 import "../chunk-KZERVKTD.js";
 import {
   getApiKey
-} from "../chunk-5QUPKDI5.js";
-import "../chunk-7DVNSQWF.js";
-import "../chunk-I5IJRMNV.js";
+} from "../chunk-2M52CFVO.js";
+import "../chunk-TCXL5FQQ.js";
+import "../chunk-5RGA636G.js";
 
 // bin/pushary-stats.ts
 exitOnHelpFlag("stats");

package/dist/bin/pushary-status.js

@@ -2,56 +2,72 @@
 import {
   describeLastSeen,
   listMachines
-} from "../chunk-2QTO5YIT.js";
-import "../chunk-I6MJXLMY.js";
+} from "../chunk-XKMGHVXW.js";
+import "../chunk-EVC765EO.js";
 import "../chunk-RIVNNBEK.js";
-import "../chunk-LKLVTG3V.js";
+import "../chunk-RPQLZLKC.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-6ICPEJY5.js";
 import {
   describeReach,
   fetchChannels,
   reachVerdict
-} from "../chunk-IAD2RT4L.js";
+} from "../chunk-6KNC6KLL.js";
 import "../chunk-3EGEA4KH.js";
 import "../chunk-QCGNGEGE.js";
+import {
+  CONNECTED_THROUGH_MAC_APP,
+  readMacAppConnectionWhenKeyless
+} from "../chunk-BOSXFI7L.js";
 import {
   SIGNED_OUT_ON_MAC_MESSAGE,
   activeKeyVerdictOf,
   describeSignedOutKey,
   readSignedOutDiagnosis
-} from "../chunk-2WXF3QJR.js";
+} from "../chunk-LXA236ZQ.js";
+import "../chunk-QAGWWDXQ.js";
+import "../chunk-7HGR5GNY.js";
 import {
   createIo
 } from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-CKV3UPMU.js";
+} from "../chunk-2HFSKYLN.js";
+import "../chunk-SIHYBIEN.js";
+import "../chunk-PR2VDVCP.js";
+import "../chunk-ZGADIZDS.js";
+import "../chunk-GQYX24UC.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
+import "../chunk-6ICPEJY5.js";
 import {
   readKeySource
-} from "../chunk-N4QSPI3B.js";
-import "../chunk-MKTJEXZ3.js";
+} from "../chunk-GTZ4HIHU.js";
+import "../chunk-LDQGURCF.js";
+import "../chunk-N6IOSZOE.js";
+import "../chunk-MD4SVNT6.js";
+import "../chunk-ZSGJYSF2.js";
+import "../chunk-I3W7GJ5R.js";
 import {
   checkApiKey,
   describeKeyCheck
-} from "../chunk-LWOO567I.js";
-import "../chunk-TCQ43LSG.js";
-import "../chunk-DUZVXBBU.js";
+} from "../chunk-XXLCYKVS.js";
+import "../chunk-NQ67AF3V.js";
+import "../chunk-POFBE6ZY.js";
+import "../chunk-UM5WXBKN.js";
+import "../chunk-H4F5O3RE.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-FQ2GORVG.js";
-import "../chunk-ZBHUHJG6.js";
+import "../chunk-Q3UMWSE4.js";
+import "../chunk-UJZ7AGSC.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-5QUPKDI5.js";
-import "../chunk-7DVNSQWF.js";
-import "../chunk-I5IJRMNV.js";
+import "../chunk-2M52CFVO.js";
+import "../chunk-TCXL5FQQ.js";
+import "../chunk-5RGA636G.js";
 
 // src/status.ts
 var signedOutReport = (facts, lines) => {
@@ -60,6 +76,12 @@ var signedOutReport = (facts, lines) => {
   lines.push({ label: "Server", value: "key signed out on this Mac", ok: false });
   return { lines, headline: SIGNED_OUT_ON_MAC_MESSAGE, next: [...describeSignedOutKey(signedOut)], exitCode: EXIT.UNAUTHENTICATED };
 };
+var connectedThroughMacAppReport = (macApp) => ({
+  lines: [{ label: "Key", value: `${macApp.keyPrefix} held by the Pushary Mac app`, ok: true }],
+  headline: `${CONNECTED_THROUGH_MAC_APP}.`,
+  next: ["Approvals, phone pairing and account settings for this computer are in the Pushary Mac app."],
+  exitCode: EXIT.OK
+});
 var keySourceLine = (source) => {
   if (source.kind === "none") {
     return { label: "Key", value: "none found", ok: false };
@@ -100,6 +122,7 @@ var buildStatusReport = (facts) => {
   if (facts.source.kind === "none") {
     const signedOut = signedOutReport(facts, lines);
     if (signedOut) return signedOut;
+    if (facts.macApp?.kind === "connected") return connectedThroughMacAppReport(facts.macApp);
     return {
       lines,
       headline: "Not set up on this machine.",
@@ -191,6 +214,7 @@ var statusJson = (facts, report) => ({
   keySource: facts.source.kind,
   keyOrigin: facts.source.origin,
   keyPrefix: facts.source.key ? facts.source.key.split(".")[0] : null,
+  connectedThroughMacApp: facts.macApp?.kind === "connected",
   drift: facts.source.drift ? {
     env: facts.source.drift.envPrefix,
     config: facts.source.drift.configPrefix,
@@ -224,7 +248,13 @@ var main = async () => {
     if (keyCheck.kind === "ok") channels = await fetchChannels(source.key);
   }
   const machines = devices && keyCheck?.kind === "ok" ? await listMachines(source.key) : null;
-  const facts = { source, keyCheck, channels, signedOut: readSignedOutDiagnosis(source.key, activeKeyVerdictOf(keyCheck)) };
+  const facts = {
+    source,
+    keyCheck,
+    channels,
+    signedOut: readSignedOutDiagnosis(source.key, activeKeyVerdictOf(keyCheck)),
+    macApp: readMacAppConnectionWhenKeyless(source.key)
+  };
   const report = buildStatusReport(facts);
   if (json) {
     const payload = statusJson(facts, report);