pushary 1.8.0

package/dist/bin/pushary-doctor.js

@@ -0,0 +1,1433 @@
+#!/usr/bin/env node
+import {
+  describeWaitLadder
+} from "../chunk-CVWG2N3Y.js";
+import {
+  readServiceExecPath,
+  versionManagerOf
+} from "../chunk-GU3EJCVV.js";
+import {
+  assessCodexHookTrust,
+  readCodexTrustForPusharyHooks
+} from "../chunk-RHR6NARM.js";
+import {
+  readMachineReadiness,
+  readManagedControlEvidence
+} from "../chunk-DE4Y6TCC.js";
+import {
+  FX_PROFILE_REFUSALS,
+  FX_PUSHARY_TOOLS_RULE,
+  FX_QUESTION_TOOL,
+  HERMES_PIP_PACKAGE,
+  HERMES_PLUGIN_NAME,
+  agentProbes,
+  detectAgent,
+  detectAllAgents,
+  hasInstructionBlock,
+  hermesWiredByPushary,
+  inspectFxInstallation,
+  isDetected,
+  isPluginRegistered,
+  readHermesStatus,
+  resolveHermesPython,
+  retryAgentCommand,
+  shortenHome,
+  vscodeSettingsTargets
+} from "../chunk-MDEPU45E.js";
+import "../chunk-SLFABHW3.js";
+import {
+  OPENCODE_PLUGIN_PLACEHOLDER,
+  openCodePluginDir,
+  openCodePluginFile,
+  openCodeWired
+} from "../chunk-AHV4LNB5.js";
+import {
+  compatibleConfigFile,
+  compatibleInstructionsFile,
+  compatibleMcpFile,
+  hasCompatibleHooks,
+  missingCompatibleHookEvents
+} from "../chunk-J5TIV3J6.js";
+import "../chunk-AXPCESYO.js";
+import {
+  detectProviderLiveCapabilities,
+  hasSpawnProvider,
+  resolveControlPolicy
+} from "../chunk-HQ6G3B5R.js";
+import {
+  AUTO_UPDATE_DISABLE_ENV,
+  autoUpdateOffReason,
+  describeAutoUpdateAnnouncement,
+  describeAutoUpdateCheck,
+  readAutoUpdateState,
+  takeAutoUpdateAnnouncement
+} from "../chunk-UI36QSBI.js";
+import {
+  readLedgerSummary
+} from "../chunk-JU6W3XAU.js";
+import {
+  describeBridgeResolution,
+  isBridgeLocator,
+  liveBridgeProbe,
+  resolveBridgeStub
+} from "../chunk-C2WCPBF7.js";
+import {
+  claudeOtherHolders,
+  claudeUnprovenHolds,
+  claudeWired,
+  codexOtherHolders,
+  codexUnprovenHolds,
+  codexWired,
+  cursorMcpAuthorization,
+  cursorOtherHolders,
+  cursorWired,
+  describeHoldSentence,
+  describeOtherHolder,
+  geminiOtherHolders,
+  geminiWired,
+  holdsLong,
+  pusharyHookExecutable
+} from "../chunk-6J2JC2RT.js";
+import {
+  daemonHasRemoteProof,
+  daemonServiceManagerAvailable,
+  describeDaemonLoginBlock,
+  hasDaemonServiceDefinition,
+  readDaemonNeedsLogin,
+  readDaemonStatus,
+  readInstalledDaemonService
+} from "../chunk-WE2J62NC.js";
+import {
+  GEMINI_HOOK_BINARY,
+  hasGeminiHooks,
+  missingGeminiHookEvents
+} from "../chunk-3EVPNIBE.js";
+import "../chunk-XHKBHWLX.js";
+import "../chunk-CULUZTWQ.js";
+import "../chunk-N6IOSZOE.js";
+import "../chunk-EPCXUP3P.js";
+import "../chunk-NGDD6TXY.js";
+import "../chunk-CVQYGMSR.js";
+import "../chunk-POFBE6ZY.js";
+import {
+  describeReach,
+  describeRoundTrip,
+  fetchChannels,
+  reachVerdict,
+  roundTripEvidence,
+  verifyRoundTrip
+} from "../chunk-M5JDZ45W.js";
+import "../chunk-3EGEA4KH.js";
+import "../chunk-QCGNGEGE.js";
+import {
+  createIo
+} from "../chunk-U4TMAANR.js";
+import {
+  exitOnHelpFlag
+} from "../chunk-HZVVNGEW.js";
+import {
+  parseFlags
+} from "../chunk-GMXKITVA.js";
+import {
+  keyPrefix,
+  readControlMode,
+  readKeySource
+} from "../chunk-P7WQEVWA.js";
+import {
+  callMcpTool,
+  sendMcpRequest
+} from "../chunk-M5ICYGHT.js";
+import {
+  checkApiKey,
+  describeKeyCheck
+} from "../chunk-2ABTSGFT.js";
+import "../chunk-2OY3ZZ5N.js";
+import {
+  getMachineId
+} from "../chunk-LXQ5FBBD.js";
+import {
+  UsageError
+} from "../chunk-7QLSKOSU.js";
+import {
+  EXIT
+} from "../chunk-KZERVKTD.js";
+import "../chunk-DB3ONZB4.js";
+import {
+  CODEX_HOOK_EVENTS,
+  autoUpdateState,
+  claudeJson,
+  claudeSettings,
+  claudeSkillDir,
+  codexAgentsMd,
+  codexConfigToml,
+  codexHookPositions,
+  codexHooksJson,
+  codexSkillDir,
+  codexTrustGaps,
+  cursorPluginDir,
+  cursorUserHooks,
+  cursorUserMcp,
+  fetchLatestPublishedVersion,
+  fxMcpProfile,
+  fxSettings,
+  geminiMd,
+  geminiSettings,
+  hasCodexHooks,
+  hermesConfig,
+  hermesConfigReceipt,
+  missingCodexHookEvents,
+  pusharyConfigFile,
+  readCodexMcpAuth,
+  readGlobalCliInstall,
+  resolvePathBinary,
+  vscodePluginDir
+} from "../chunk-A2A2YTMG.js";
+import "../chunk-T7E75EKA.js";
+import {
+  getBaseUrl
+} from "../chunk-GPEGOGRJ.js";
+import {
+  NPX_LATEST_COMMAND
+} from "../chunk-E4FJTUH4.js";
+import {
+  AGENTS,
+  CURSOR_GATE_EVENTS,
+  HOOK_COMPATIBLE_PROFILES,
+  HOOK_LOCATOR_BINARY,
+  HOOK_SOURCES,
+  SUPPORT_DISCORD,
+  SUPPORT_EMAIL,
+  commandsPackage,
+  getPackageVersion,
+  hookActivationResult,
+  hookCompatibleProfile,
+  isHookActivationReport,
+  isNewerVersion
+} from "../chunk-NQTHFF4W.js";
+
+// bin/pushary-doctor.ts
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { join, resolve } from "path";
+import { homedir as homedir2 } from "os";
+import { execFileSync } from "child_process";
+import { confirm } from "@inquirer/prompts";
+import { parse as parseTOML } from "smol-toml";
+
+// src/diagnostics/global-package.ts
+var NOT_FOUND = "not found";
+var NPM_PREFIX_UNREADABLE = "not found (npm could not report its global prefix)";
+var BOTH_INSTALLED_WARNING = "npm uninstall -g of either name removes every Pushary command";
+var describeInstalledPackage = (installed2) => installed2.version === void 0 ? `${installed2.name}, version unreadable` : `${installed2.name} ${installed2.version}`;
+var describeCommandOwner = (owner) => owner.kind === "owned" ? `the commands run from ${owner.name}` : "which one owns the commands could not be read";
+var globalPackageCheck = (install) => {
+  switch (install.kind) {
+    case "unavailable":
+      return { ok: false, detail: NPM_PREFIX_UNREADABLE, commands: void 0 };
+    case "absent":
+      return { ok: false, detail: NOT_FOUND, commands: void 0 };
+    case "single":
+      return {
+        ok: install.installed.version !== void 0,
+        detail: describeInstalledPackage(install.installed),
+        commands: install.installed
+      };
+    case "both":
+      return {
+        ok: false,
+        detail: `both installed: ${install.installed.map(describeInstalledPackage).join(" and ")}; ${describeCommandOwner(install.owner)}; ${BOTH_INSTALLED_WARNING}`,
+        commands: commandsPackage(install)
+      };
+  }
+};
+
+// src/diagnostics/auto-update.ts
+var globalPackageFreshness = (installed2, latest) => isNewerVersion(latest, installed2) ? { upToDate: false, detail: `${installed2} installed, ${latest} available \u2014 run ${NPX_LATEST_COMMAND} upgrade` } : { upToDate: true, detail: installed2 };
+var AUTO_UPDATE_ON = "on: once a day at session start, within the same major version";
+var AUTO_UPDATE_OFF = {
+  disabled_by_env: `off: ${AUTO_UPDATE_DISABLE_ENV} is set`,
+  disabled_by_user: "off: turn it back on with pushary upgrade --auto=on",
+  ci: "off in CI",
+  windows: "not available on Windows yet",
+  linux: "paused on Linux to protect running sessions; upgrade manually after sessions finish"
+};
+var needsAttention = (input) => input.state.lastResult === "failed" || input.state.lastResult === "needs_manual" || Boolean(input.state.detail);
+var LAST_CHECK_LABEL = "Last automatic update check";
+var describeAutoUpdateStatus = (input) => {
+  const offReason = autoUpdateOffReason(input);
+  const status = {
+    tone: "info",
+    label: "Automatic updates",
+    detail: offReason === null ? AUTO_UPDATE_ON : AUTO_UPDATE_OFF[offReason]
+  };
+  const checkedAt = input.state.at ?? input.state.lastCheckAt;
+  if (checkedAt === void 0) return [status];
+  return [
+    status,
+    {
+      tone: needsAttention(input) ? "warn" : "info",
+      label: LAST_CHECK_LABEL,
+      detail: `${checkedAt}: ${describeAutoUpdateCheck(input.state)}`
+    }
+  ];
+};
+
+// src/diagnostics/bundle.ts
+import { homedir, hostname } from "os";
+var installedGlobalPackages = (install) => {
+  if (install.kind === "single") return [install.installed];
+  if (install.kind === "both") return install.installed;
+  return [];
+};
+var collectBundle = async (options2 = {}) => {
+  const now = options2.now ?? (() => /* @__PURE__ */ new Date());
+  const globalInstall = (options2.readGlobalInstall ?? readGlobalCliInstall)();
+  const source = readKeySource();
+  const identity = options2.identity ?? null;
+  return {
+    generatedAt: now().toISOString(),
+    cliVersion: getPackageVersion(),
+    globalVersion: commandsPackage(globalInstall)?.version ?? null,
+    globalPackages: installedGlobalPackages(globalInstall),
+    node: process.version,
+    platform: process.platform,
+    arch: process.arch,
+    shell: process.env.SHELL ?? null,
+    machineId: getMachineId(),
+    keySource: source.kind,
+    keyPrefix: source.key ? keyPrefix(source.key) : null,
+    // The value of the drift, not the keys: knowing two places disagree is the
+    // whole diagnostic, and the keys themselves are what must not travel.
+    keyDrift: source.drift !== null,
+    identity: identity ? stripWorkspace(identity) : null,
+    agents: detectAllAgents().map((entry) => ({ id: entry.agent, detected: entry.result })),
+    checks: options2.checks ?? []
+  };
+};
+var stripWorkspace = (identity) => {
+  const { workspaceId: _workspaceId, ...rest } = identity;
+  return rest;
+};
+var KEY_PATTERN = /pk_[A-Za-z0-9_]+\.[A-Za-z0-9_]+/g;
+var homePattern = () => new RegExp(homedir().replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g");
+var redactText = (text) => text.replace(KEY_PATTERN, (match) => `${match.split(".")[0]}.REDACTED`).replace(homePattern(), "~").replace(new RegExp(hostname().replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"), "HOST");
+var redact = (bundle) => JSON.parse(redactText(JSON.stringify(bundle)));
+var bundleFileName = (bundle) => `pushary-diagnostics-${bundle.generatedAt.replace(/[:.]/g, "-")}.json`;
+
+// src/diagnostics/exit-code.ts
+var resolveDoctorExit = ({ keyExit, failures }) => {
+  if (keyExit !== null) return keyExit;
+  if (failures.length === 0) return EXIT.OK;
+  const every = (kind) => failures.every((f) => f.kind === kind);
+  if (every("unreachable")) return EXIT.UNREACHABLE;
+  if (every("reachability")) return EXIT.NO_DEVICE;
+  return EXIT.PROBLEMS_FOUND;
+};
+
+// src/diagnostics/config-rewriters.ts
+var CONFIG_REWRITERS = Object.freeze([
+  {
+    id: "cc-switch",
+    label: "cc-switch",
+    markers: [[".cc-switch", "cc-switch.db"], [".cc-switch", "config.json"]],
+    rewrites: ["Claude Code"],
+    what: "replaces ~/.claude/settings.json with what that provider stored plus your common config, rather than merging into the file on disk"
+  }
+]);
+var rewriterFindings = ({ present, agentState }, rewriters = CONFIG_REWRITERS) => rewriters.filter(present).flatMap((rewriter) => rewriter.rewrites.flatMap((agent) => {
+  const state = agentState(agent);
+  if (!state?.wired) return [];
+  return [{ rewriter, agent, state: state.hooksIntact ? "armed" : "suspect" }];
+}));
+var describeRewriterFinding = ({ rewriter, agent, state }) => state === "armed" ? `${rewriter.label} is installed, and a provider switch can take ${agent}'s Pushary hooks out of settings.json` : `${agent}'s Pushary hooks are gone from settings.json, and ${rewriter.label} is one way that happens`;
+var rewriterMechanism = ({ rewriter }) => `${rewriter.label} ${rewriter.what}.`;
+var rewriterRemedy = ({ state }) => state === "armed" ? 'Tick "Apply Common Config" on the provider so a switch keeps them, or re-run setup after each switch' : 'Re-run setup to put them back, then tick "Apply Common Config" on the provider so a switch keeps them';
+
+// src/diagnostics/inert-registrations.ts
+var REGISTRATION_FLAGS = ["agent", "source"];
+var FLAG_PATTERNS = {
+  agent: /--agent(?:=|\s+)([A-Za-z0-9_-]*)/g,
+  source: /--source(?:=|\s+)([A-Za-z0-9_-]*)/g
+};
+function collectHookCommands(value) {
+  if (value === null || typeof value !== "object") return [];
+  const commands = [];
+  for (const [key, nested] of Object.entries(value)) {
+    if (key === "command" && typeof nested === "string") commands.push(nested);
+    else commands.push(...collectHookCommands(nested));
+  }
+  return commands;
+}
+function readHookCommands(contents) {
+  try {
+    return collectHookCommands(JSON.parse(contents));
+  } catch {
+    return contents.split("\n");
+  }
+}
+function registeredNames(contents, flag) {
+  const names = /* @__PURE__ */ new Set();
+  for (const command of readHookCommands(contents)) {
+    if (pusharyHookExecutable(command) === null) continue;
+    for (const match of command.matchAll(FLAG_PATTERNS[flag])) names.add(match[1] ?? "");
+  }
+  return [...names];
+}
+function pusharyAgentsNamedIn(contents) {
+  return registeredNames(contents, "agent");
+}
+function resolvesHookRegistration(name, flag) {
+  if (flag === "agent") return hookCompatibleProfile(name) !== void 0;
+  return HOOK_SOURCES.includes(name);
+}
+function inertRegistrations(configs, resolves) {
+  const findings = [];
+  for (const config of configs) {
+    for (const flag of REGISTRATION_FLAGS) {
+      const names = flag === "agent" ? pusharyAgentsNamedIn(config.contents) : registeredNames(config.contents, flag);
+      for (const name of names) {
+        if (!resolves(name, flag)) findings.push({ file: config.file, named: name });
+      }
+    }
+  }
+  return findings;
+}
+var describeInertRegistration = ({ named }) => `hooks here are registered for "${named}", which this CLI has no profile for, so every one of them stands aside`;
+var inertRegistrationRemedy = () => "Upgrade with npx @pushary/agent-hooks@latest upgrade, or re-run setup to rewrite them for an agent this version knows";
+
+// src/hooks-spec.ts
+var CURSOR_GATE_SCRIPT = "pushary-gate.mjs";
+
+// src/diagnostics/activation.ts
+var readHookActivation = async (apiKey, agentType, target, deps = {}) => {
+  const machineId = deps.machineId ?? getMachineId();
+  const url = new URL("/api/agent/onboarding/activation", deps.baseUrl ?? getBaseUrl());
+  url.searchParams.set("machineId", machineId);
+  url.searchParams.set("agent", agentType);
+  url.searchParams.set("target", target);
+  try {
+    const response = await (deps.fetchImpl ?? fetch)(url, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!response.ok) return { kind: "unavailable", detail: response.status === 404 ? "This server does not report hook activation yet." : `Evidence request returned HTTP ${response.status}.` };
+    const body = await response.json();
+    if (!isHookActivationReport(body) || body.machineId !== machineId || body.agentType !== agentType || body.target !== target) {
+      return { kind: "unavailable", detail: "The server returned invalid or mismatched activation evidence." };
+    }
+    return { kind: "ok", report: body };
+  } catch {
+    return { kind: "unavailable", detail: "Activation evidence could not be read. Retry when the connection is available." };
+  }
+};
+
+// src/diagnostics/roundtrip-plan.ts
+var planRoundTrip = (context) => {
+  if (context.roundtrip) return { kind: "always" };
+  if (context.noPush) return { kind: "never", why: "--no-push" };
+  if (context.json) return { kind: "never", why: "--json" };
+  if (!context.stdinIsTty) return { kind: "never", why: "not a terminal" };
+  return { kind: "ask", defaultAnswer: true };
+};
+
+// src/setup/agent-exec.ts
+var firstToken = (command) => {
+  const trimmed = command.trim();
+  const quote = trimmed[0];
+  if (quote === '"' || quote === "'") {
+    const close = trimmed.indexOf(quote, 1);
+    if (close > 0) return trimmed.slice(1, close);
+  }
+  return trimmed.split(/\s+/)[0] ?? "";
+};
+
+// bin/pushary-doctor.ts
+exitOnHelpFlag("doctor");
+var parseDoctorOptions = (argv) => {
+  const flags = parseFlags(argv, { bools: ["json", "roundtrip", "no-push", "bundle", "help", "h"], values: ["activation", "activation-target"] });
+  if (flags.command !== void 0 && flags.command !== "doctor") {
+    throw new UsageError(`doctor takes no positional arguments (got ${flags.command})`);
+  }
+  const roundtrip = flags.bools.has("roundtrip");
+  const activation2 = flags.values.get("activation") ?? null;
+  if (activation2 && (!Object.hasOwn(AGENTS, activation2) || !AGENTS[activation2].activationGuide)) throw new UsageError("This build supports --activation claude_code. Other integrations remain unverified.");
+  const rawTarget = flags.values.get("activation-target");
+  if (Boolean(activation2) !== Boolean(rawTarget)) throw new UsageError("--activation requires --activation-target with the unique scratch-file path used for this check.");
+  const activationTarget = rawTarget ? resolve(rawTarget) : null;
+  const noPush = flags.bools.has("no-push") || activation2 !== null && !roundtrip;
+  if (roundtrip && noPush) {
+    throw new UsageError("--roundtrip needs to send a push, so it cannot be combined with --no-push");
+  }
+  return { activationTarget, activation: activation2, json: flags.bools.has("json"), roundtrip, noPush, bundle: flags.bools.has("bundle") };
+};
+var activation = null;
+var hookActivation = "unverified";
+var roundTrip = null;
+var options;
+try {
+  options = parseDoctorOptions(process.argv.slice(2));
+} catch (err) {
+  process.stderr.write(`  ! ${err instanceof Error ? err.message : String(err)}
+`);
+  process.stderr.write("  Run `pushary doctor --help` for the full list.\n");
+  process.exit(EXIT.USAGE);
+}
+if (options.json) {
+  console.log = (...args) => {
+    process.stderr.write(`${args.map((a) => typeof a === "string" ? a : String(a)).join(" ")}
+`);
+  };
+}
+var { bold, dim, green, yellow, red, cyan } = createIo();
+var pass = green("\u2713");
+var fail = red("\u2717");
+var warn = yellow("!");
+var CLAUDE_SETTINGS = claudeSettings();
+var registeredConfigs = () => [CLAUDE_SETTINGS, codexHooksJson(), ...HOOK_COMPATIBLE_PROFILES.map((profile) => compatibleConfigFile(profile))].filter(existsSync).map((file) => ({ file, contents: readFileSync(file, "utf-8") }));
+var SKILL_PATH = join(claudeSkillDir(), "SKILL.md");
+var SHELL_FILES = [".zshrc", ".zprofile", ".bashrc", ".bash_profile"].map((f) => join(homedir2(), f));
+var reportFxQuestionRouting = (routing) => {
+  if (routing === "routed") {
+    check(true, "fx: questions go through Pushary", `${FX_QUESTION_TOOL} is off in ${fxSettings()}`);
+    return;
+  }
+  console.log(`  ${warn} fx: questions can still stop in the terminal ${dim(`(${FX_QUESTION_ROUTING_WARNINGS[routing]})`)}`);
+};
+var reportHermesStatus = (status) => {
+  const config = hermesConfig();
+  check(status.pluginInstalled, "Hermes: plugin installed", status.pluginInstalled ? HERMES_PIP_PACKAGE : `${HERMES_PIP_PACKAGE} is not installed in Hermes' Python \u2014 run ${retryAgentCommand("hermes")}`);
+  check(status.pluginEnabled, "Hermes: plugin enabled", status.pluginEnabled ? config : `"${HERMES_PLUGIN_NAME}" is missing from plugins.enabled in ${config} \u2014 run ${retryAgentCommand("hermes")}`);
+  if (status.approvalsRouted) check(true, "Hermes: approvals go through Pushary", `security.approval.transport in ${config}`);
+  else console.log(`  ${warn} Hermes: approvals stay in the terminal ${dim(`(security.approval.transport is not "pushary" in ${config})`)}`);
+  if (status.questionsRouted) check(true, "Hermes: questions go through Pushary", `clarify is off in ${config}`);
+  else console.log(`  ${warn} Hermes: questions can stop in the terminal ${dim(`(clarify is not in agent.disabled_toolsets in ${config})`)}`);
+};
+var FX_QUESTION_ROUTING_WARNINGS = {
+  "full-access": "full-access mode ignores permission rules, so fx's terminal question tool stays on; its instructions ask it to use Pushary instead",
+  overridden: `a rule in ${fxSettings()} keeps ${FX_QUESTION_TOOL} on; make "${FX_QUESTION_TOOL}": "deny" the last rule that matches it`
+};
+var fxBridgeFound = (target) => target.includes("/") ? existsSync(target) : resolvePathBinary(target) !== void 0;
+var readJson = (path) => {
+  try {
+    return JSON.parse(readFileSync(path, "utf-8"));
+  } catch {
+    return null;
+  }
+};
+var commandResolves = (command) => {
+  const target = pusharyHookExecutable(command) ?? firstToken(command);
+  if (!target) return false;
+  if (target.includes("/") || target.includes("\\")) return existsSync(target);
+  try {
+    const whichCmd = process.platform === "win32" ? "where" : "which";
+    execFileSync(whichCmd, [target], { stdio: "ignore", timeout: 5e3 });
+    return true;
+  } catch {
+    return false;
+  }
+};
+var extractHookCommand = (entries, needle) => {
+  if (!Array.isArray(entries)) return null;
+  for (const entry of entries) {
+    const hookList = entry.hooks;
+    const candidates = Array.isArray(hookList) ? hookList : [entry];
+    for (const candidate of candidates) {
+      const command = candidate.command;
+      if (typeof command === "string" && command.includes(needle)) return command;
+    }
+  }
+  return null;
+};
+var extractAgentHookCommand = (entries, needle) => extractHookCommand(entries, needle) ?? extractHookCommand(entries, HOOK_LOCATOR_BINARY);
+var extractHookTimeout = (entries, needle) => {
+  if (!Array.isArray(entries)) return null;
+  for (const entry of entries) {
+    const hookList = entry.hooks;
+    if (!Array.isArray(hookList)) continue;
+    for (const candidate of hookList) {
+      const hook = candidate;
+      if (typeof hook.command === "string" && hook.command.includes(needle) && typeof hook.timeout === "number") {
+        return hook.timeout;
+      }
+    }
+  }
+  return null;
+};
+var results = [];
+var check = (passed, label, detail, kind = "config") => {
+  results.push({ passed, label, detail, kind });
+  const icon = passed ? pass : fail;
+  const suffix = detail ? ` ${dim(`(${detail})`)}` : "";
+  console.log(`  ${icon} ${label}${suffix}`);
+};
+var probes = agentProbes();
+var installed = (agent) => isDetected(detectAgent(probes[agent]));
+var agentsChecked = [];
+var otherHoldersByAgent = {};
+var bridgeStub = null;
+var noteHookTarget = (command) => {
+  const executable = command ? pusharyHookExecutable(command) : null;
+  if (isBridgeLocator(executable)) bridgeStub = executable;
+};
+var reportOtherHolders = (agentLabel, holders) => {
+  if (holders.length === 0) return;
+  otherHoldersByAgent[agentLabel] = holders;
+  for (const holder of holders) {
+    const icon = holdsLong(holder) ? warn : dim("\u2013");
+    console.log(`  ${icon} ${agentLabel}: ${describeOtherHolder(holder)}`);
+  }
+  console.log(`    ${dim(describeHoldSentence(agentLabel))}`);
+};
+var describeReadings = (readings) => readings.map((reading) => `${reading.event} ${reading.status}`).join(", ");
+var CODEX_NONE_LISTED = "Codex lists none of the Pushary hooks, so it runs none of them. Check [features].hooks in config.toml, then re-run setup";
+var reportCodexOwnTrust = (assessment) => {
+  if (assessment.kind === "unlisted") {
+    check(false, "Codex: hooks trusted", CODEX_NONE_LISTED);
+    return;
+  }
+  check(assessment.kind === "trusted", "Codex: hooks trusted", assessment.kind === "trusted" ? `Codex reports ${assessment.trusted} of ${assessment.total} trusted` : `Codex reports ${describeReadings(assessment.failures)}. Type /hooks in Codex and trust them, once`);
+  if (assessment.notListed.length > 0) {
+    console.log(`  ${warn} Codex: does not list ${assessment.notListed.join(", ")} ${dim("(this Codex may not support those events yet)")}`);
+  }
+  if (assessment.disabled.length > 0) {
+    console.log(`  ${warn} Codex: ${assessment.disabled.join(", ")} turned off in Codex ${dim("(turn them back on in /hooks)")}`);
+  }
+};
+var skipped = (label, why) => {
+  console.log(`  ${dim("\u2013")} ${label} ${dim(`(${why})`)}`);
+};
+var checking = (label) => {
+  agentsChecked.push(label);
+};
+var main = async () => {
+  console.log();
+  console.log(`  ${bold("Pushary Doctor")}`);
+  console.log();
+  console.log(`  ${dim("Configuration")}`);
+  const source = readKeySource();
+  let apiKey = source.key ?? void 0;
+  let keySource = source.kind === "env" ? "env" : source.kind === "config" ? "config-file" : null;
+  if (!apiKey) {
+    for (const f of SHELL_FILES) {
+      try {
+        const content = readFileSync(f, "utf-8");
+        const match = content.match(/export\s+PUSHARY_API_KEY=['"](pk_[a-f0-9]+\.[a-f0-9]+)['"]/);
+        if (match) {
+          apiKey = match[1];
+          keySource = "profile";
+          break;
+        }
+      } catch {
+      }
+    }
+  }
+  const maskKey = (k) => `pk_${k.split(".")[0]?.slice(3, 7)}...`;
+  if (keySource === "config-file") {
+    console.log(`  ${pass} API key in ${dim(source.origin ?? "the config file")} ${dim(`(${maskKey(apiKey)})`)}`);
+  } else if (keySource === "profile") {
+    check(
+      false,
+      "API key readable by hooks",
+      `found only in a shell profile (${maskKey(apiKey)}), which hooks do not read \u2014 re-run setup, or open a new terminal`
+    );
+    console.log(`    ${dim("Hooks read $PUSHARY_API_KEY, then")} ${dim(pusharyConfigFile())}`);
+  } else {
+    check(!!apiKey, "API key in environment", apiKey ? maskKey(apiKey) : "PUSHARY_API_KEY not set");
+  }
+  if (source.drift) {
+    check(
+      false,
+      "One key, not two",
+      `shell has ${source.drift.envPrefix}, ${source.drift.configPath} has ${source.drift.configPrefix} \u2014 the shell one wins. Re-run setup, or open a new terminal.`
+    );
+  }
+  let keyVerdict = null;
+  if (apiKey) {
+    keyVerdict = await checkApiKey(apiKey);
+    switch (keyVerdict.kind) {
+      case "ok":
+        check(
+          true,
+          "Key verified with pushary.com",
+          `${keyVerdict.identity.siteSlug || keyVerdict.identity.siteName} \xB7 plan ${keyVerdict.identity.plan} \xB7 ${keyVerdict.identity.subscriptionStatus}`
+        );
+        break;
+      case "locked":
+        check(false, "Plan active", describeKeyCheck(keyVerdict).message);
+        for (const line of describeKeyCheck(keyVerdict).next) console.log(`    ${dim(line)}`);
+        break;
+      case "rejected":
+        check(false, "Key accepted by pushary.com", describeKeyCheck(keyVerdict).message);
+        for (const line of describeKeyCheck(keyVerdict).next) console.log(`    ${dim(line)}`);
+        break;
+      case "malformed":
+        check(false, "Key format", "expected pk_xxx.xxx");
+        break;
+      case "unreachable":
+        check(false, "Key verified with pushary.com", `could not reach pushary.com (${keyVerdict.detail})`, "unreachable");
+        break;
+    }
+  }
+  const CLAUDE_JSON = claudeJson();
+  const claudeInPlay = claudeWired({
+    claudeJson: readJson(CLAUDE_JSON),
+    settings: readJson(CLAUDE_SETTINGS),
+    skillExists: existsSync(SKILL_PATH)
+  });
+  const claudeJson2 = claudeInPlay ? readJson(CLAUDE_JSON) : null;
+  const mcpServers = claudeJson2?.mcpServers ?? {};
+  const pusharyServer = mcpServers?.pushary;
+  if (!claudeInPlay) {
+    skipped("Claude Code", installed("claude_code") ? "installed, but Pushary is not set up for it" : "not installed");
+  } else {
+    checking("Claude Code");
+    check(!!pusharyServer, "Claude Code: MCP server configured");
+    if (pusharyServer) {
+      check(pusharyServer.type === "http", "Claude Code: MCP server type", pusharyServer.type ? String(pusharyServer.type) : 'missing \u2014 add type: "http"');
+      const claudeAuth = pusharyServer.headers?.Authorization;
+      if (typeof claudeAuth === "string" && apiKey) {
+        const matches = claudeAuth === `Bearer ${apiKey}`;
+        check(matches, "Claude Code: MCP key matches active key", matches ? void 0 : "the key in ~/.claude.json is not the key hooks use (rotated?) \u2014 re-run setup");
+      }
+    }
+  }
+  const settings = claudeInPlay ? readJson(CLAUDE_SETTINGS) : null;
+  let claudeHooksMissing = 0;
+  if (settings) {
+    const hooks = settings.hooks;
+    const CLAUDE_HOOK_CHECKS = [
+      { event: "PreToolUse", needle: "pushary-hook", label: "PreToolUse hook" },
+      { event: "PostToolUse", needle: "pushary-post-hook", label: "PostToolUse hook" },
+      { event: "UserPromptSubmit", needle: "pushary-prompt-hook", label: "UserPromptSubmit hook" },
+      { event: "Stop", needle: "pushary-stop-hook", label: "Stop hook" },
+      { event: "StopFailure", needle: "pushary-stopfailure-hook", label: "StopFailure hook" },
+      { event: "Notification", needle: "pushary-notification-hook", label: "Notification hook" },
+      { event: "SessionStart", needle: "pushary-session-start-hook", label: "SessionStart hook" },
+      { event: "SessionEnd", needle: "pushary-session-end-hook", label: "SessionEnd hook" },
+      { event: "PermissionRequest", needle: "pushary-permission-hook", label: "PermissionRequest hook" },
+      { event: "PermissionDenied", needle: "pushary-permission-denied-hook", label: "PermissionDenied hook" }
+    ];
+    for (const { event, needle, label } of CLAUDE_HOOK_CHECKS) {
+      const configured = JSON.stringify(hooks?.[event] ?? []);
+      const present = configured.includes(needle) || configured.includes(HOOK_LOCATOR_BINARY);
+      if (!present) claudeHooksMissing += 1;
+      check(present, `Claude Code: ${label}`, present ? void 0 : "missing \u2014 run npx @pushary/agent-hooks@latest upgrade");
+    }
+    for (const event of claudeUnprovenHolds(settings)) {
+      console.log(`  ${warn} Claude Code: ${event} hook carries no current hold budget ${dim("(an auto-mode block only notifies; run npx @pushary/agent-hooks@latest upgrade)")}`);
+    }
+    const preHookCommand = extractAgentHookCommand(hooks?.PreToolUse, "pushary-hook");
+    if (preHookCommand) {
+      const resolves = commandResolves(preHookCommand);
+      check(resolves, "Claude Code: hook command resolves", resolves ? preHookCommand : `not on PATH \u2014 ${preHookCommand}`);
+    }
+    noteHookTarget(preHookCommand);
+    reportOtherHolders("Claude Code", claudeOtherHolders(settings));
+    const permissions = settings.permissions;
+    const hasWildcard = permissions?.allow?.some((r) => r === "mcp__pushary__*" || r === "MCP(pushary:*)") ?? false;
+    check(hasWildcard, "Claude Code: Pushary tools auto-allowed", hasWildcard ? "mcp__pushary__*" : "missing");
+    const hasLegacyPerms = permissions?.allow?.some((r) => r.startsWith("mcp__pushary__") && r !== "mcp__pushary__*") ?? false;
+    if (hasLegacyPerms) {
+      console.log(`  ${warn} Legacy individual permissions detected ${dim("(run pushary clean, then setup again)")}`);
+    }
+  } else if (claudeInPlay) {
+    check(false, "Claude Code: settings.json", "not found");
+  }
+  const claudeHookState = { wired: claudeInPlay, hooksIntact: settings !== null && claudeHooksMissing === 0 };
+  for (const finding of rewriterFindings({
+    present: (rewriter) => rewriter.markers.some((marker) => existsSync(join(homedir2(), ...marker))),
+    agentState: (agent) => agent === "Claude Code" ? claudeHookState : void 0
+  })) {
+    console.log(`  ${warn} ${describeRewriterFinding(finding)}`);
+    console.log(`    ${dim(rewriterMechanism(finding))}`);
+    console.log(`    ${dim(rewriterRemedy(finding))}`);
+  }
+  const codexConfigPath = codexConfigToml();
+  const codexHooksPath = codexHooksJson();
+  const codexHooksConfig = readJson(codexHooksPath);
+  const codexConfig = existsSync(codexConfigPath) ? readFileSync(codexConfigPath, "utf-8") : "";
+  let codexParsed = {};
+  try {
+    codexParsed = parseTOML(codexConfig);
+  } catch {
+  }
+  const codexInPlay = codexWired({
+    config: codexParsed,
+    hooks: codexHooksConfig,
+    skillExists: existsSync(join(codexSkillDir(), "SKILL.md"))
+  });
+  if (codexInPlay) {
+    checking("Codex");
+    const codexMcp = codexParsed.mcp_servers?.pushary;
+    const codexTransport = !!codexMcp && (typeof codexMcp.url === "string" || typeof codexMcp.command === "string");
+    const codexAuth = readCodexMcpAuth(codexParsed);
+    const codexMcpOk = !!codexMcp && codexTransport && !!codexAuth;
+    check(codexMcpOk, "Codex: MCP server configured", codexMcpOk ? void 0 : !codexMcp ? "no [mcp_servers.pushary] \u2014 re-run setup" : !codexTransport ? "entry has no url \u2014 re-run setup" : "entry has no Authorization header or bearer token \u2014 re-run setup");
+    if (codexMcp) {
+      const hasAutoApprove = codexMcp.default_tools_approval_mode === "approve";
+      check(hasAutoApprove, "Codex: tools auto-allowed", hasAutoApprove ? "default_tools_approval_mode = approve" : "missing \u2014 MCP calls will prompt for approval");
+      if (codexMcp.tools && typeof codexMcp.tools === "object") {
+        console.log(`  ${warn} Codex: per-tool approval overrides detected ${dim("(redundant with default_tools_approval_mode)")}`);
+      }
+      if (codexAuth?.method === "embedded") {
+        const keyMatches = !apiKey || codexAuth.key === apiKey;
+        check(keyMatches, "Codex: MCP key embedded (config.toml)", keyMatches ? "no shell export needed" : "differs from your active key \u2014 re-run setup");
+      } else if (codexAuth?.method === "env") {
+        const envValue = process.env[codexAuth.envVar]?.trim();
+        const exportedInProfile = SHELL_FILES.some((f) => {
+          try {
+            return readFileSync(f, "utf-8").includes(`export ${codexAuth.envVar}=`);
+          } catch {
+            return false;
+          }
+        });
+        check(!!envValue, `Codex: MCP key available in shell ($${codexAuth.envVar})`, envValue ? "set \u2014 re-run setup to embed the key and drop the shell dependency" : exportedInProfile ? "exported in your profile but not in this shell \u2014 restart the terminal, or re-run setup to embed the key in config.toml" : "not set \u2014 Codex reads its key from your shell; re-run setup to embed the key in config.toml");
+        if (envValue && apiKey && envValue !== apiKey) {
+          console.log(`  ${warn} Codex: $${codexAuth.envVar} differs from your active key ${dim("(rotate or re-run setup so hooks and MCP match)")}`);
+        }
+      } else if (codexAuth?.method === "legacy-bearer") {
+        console.log(`  ${warn} Codex: legacy bearer_token entry ${dim("(re-run setup to embed the key as an Authorization header)")}`);
+      }
+    }
+    const codexNotifyPath = codexConfig.match(/["']([^"']*pushary-codex[^"']*)["']/)?.[1] ?? null;
+    const hooksInstalled = !!codexHooksConfig && hasCodexHooks(codexHooksConfig);
+    if (hooksInstalled) {
+      const missingEvents = missingCodexHookEvents(codexHooksConfig);
+      check(missingEvents.length === 0, "Codex: native hooks installed", missingEvents.length === 0 ? `all ${CODEX_HOOK_EVENTS.length} events` : `missing ${missingEvents.join(", ")}, re-run setup`);
+      const hookCommand = extractAgentHookCommand(codexHooksConfig.hooks?.PreToolUse, "pushary-codex-hook") ?? extractAgentHookCommand(codexHooksConfig.hooks?.PermissionRequest, "pushary-codex-hook");
+      if (hookCommand) {
+        const resolves = commandResolves(hookCommand);
+        check(resolves, "Codex: hook command resolves", resolves ? hookCommand : `not on PATH: ${hookCommand}`);
+      }
+      noteHookTarget(hookCommand);
+      reportOtherHolders("Codex", codexOtherHolders(codexHooksConfig));
+      const features = codexParsed.features;
+      const hooksFeatureDisabled = !!features && typeof features === "object" && features.hooks === false;
+      check(!hooksFeatureDisabled, "Codex: hooks feature enabled", hooksFeatureDisabled ? "[features].hooks = false in config.toml" : void 0);
+      if (codexNotifyPath) {
+        console.log(`  ${warn} Codex: stale legacy notify entry ${dim("(double-push risk, re-run setup to remove it)")}`);
+      }
+      if (hookCommand) {
+        const positions = codexHookPositions(codexHooksConfig);
+        const gaps = codexTrustGaps(
+          codexParsed,
+          codexHooksConfig,
+          codexHooksPath,
+          hookCommand,
+          positions
+        );
+        const untrusted = gaps.filter((gap) => gap.kind === "untrusted").map((gap) => gap.event);
+        const stale = gaps.filter((gap) => gap.kind === "stale").map((gap) => gap.event);
+        const codexTrust = await readCodexTrustForPusharyHooks();
+        if (codexTrust.kind === "listed") {
+          reportCodexOwnTrust(assessCodexHookTrust(Object.keys(positions), codexTrust.hooks));
+        } else {
+          const why = codexTrust.kind === "skipped" ? "did not ask" : "could not ask";
+          console.log(`  ${warn} Codex: ${why} Codex about hook trust ${dim(`(${codexTrust.reason}); checking Pushary's own record instead`)}`);
+          check(untrusted.length === 0, "Codex: hooks trusted", untrusted.length === 0 ? "all events trusted" : `untrusted (${untrusted.join(", ")}) \u2014 type /hooks in Codex and trust them, once`);
+        }
+        if (stale.length > 0) {
+          console.log(`  ${warn} Codex: ${stale.join(", ")} trusted at an older shape ${dim("(fires normally; re-run setup to pick up the current one)")}`);
+        }
+      }
+      for (const event of codexUnprovenHolds(codexHooksConfig)) {
+        console.log(`  ${warn} Codex: ${event} hook carries no current hold budget ${dim("(an auto-reviewer denial is not asked about; run npx @pushary/agent-hooks@latest upgrade)")}`);
+      }
+    } else {
+      check(!!codexNotifyPath, "Codex: notify handler configured (deprecated)", codexNotifyPath ? "upgrade Codex and re-run setup for native hooks" : "missing, re-run setup");
+      if (codexNotifyPath) {
+        const resolves = commandResolves(codexNotifyPath);
+        check(resolves, "Codex: notify handler resolves", resolves ? codexNotifyPath : `not found: ${codexNotifyPath}`);
+      }
+    }
+    const codexSkillPath = join(codexSkillDir(), "SKILL.md");
+    check(existsSync(codexSkillPath), "Codex: skill installed");
+    const codexAgentsMd2 = codexAgentsMd();
+    const hasCodexInstructions = hasInstructionBlock(codexAgentsMd2);
+    check(hasCodexInstructions, "Codex: proactive instructions (AGENTS.md)", hasCodexInstructions ? codexAgentsMd2 : "missing \u2014 re-run setup so Codex asks via push, not the terminal");
+  } else {
+    skipped("Codex", installed("codex") ? "installed, but Pushary is not set up for it" : "not installed");
+  }
+  const geminiSettingsPath = geminiSettings();
+  const geminiSettings2 = readJson(geminiSettingsPath);
+  const geminiInPlay = geminiSettings2 !== null && geminiWired({ settings: geminiSettings2 });
+  if (geminiInPlay) {
+    checking("Gemini CLI");
+    const geminiServers = geminiSettings2.mcpServers ?? {};
+    const geminiPushary = geminiServers.pushary;
+    check(!!geminiPushary, "Gemini CLI: MCP server configured");
+    if (geminiPushary) {
+      check(typeof geminiPushary.httpUrl === "string", "Gemini CLI: MCP transport", geminiPushary.httpUrl ? String(geminiPushary.httpUrl) : "missing \u2014 add httpUrl");
+      check(geminiPushary.trust === true, "Gemini CLI: tools auto-allowed", geminiPushary.trust === true ? "trust: true" : "missing \u2014 MCP calls will prompt for confirmation");
+      const geminiAuth = geminiPushary.headers?.Authorization;
+      if (typeof geminiAuth === "string") {
+        if (geminiAuth.includes("${PUSHARY_API_KEY}")) {
+          check(false, "Gemini CLI: API key embedded", "header has an unexpanded ${PUSHARY_API_KEY} \u2014 re-run setup to embed the key");
+        } else if (apiKey && geminiAuth !== `Bearer ${apiKey}`) {
+          check(false, "Gemini CLI: API key matches active key", "embedded key differs from your active key (rotated?) \u2014 re-run setup");
+        } else {
+          check(true, "Gemini CLI: API key embedded");
+        }
+      }
+    }
+    const geminiHooksInstalled = hasGeminiHooks(geminiSettings2);
+    if (geminiHooksInstalled) {
+      const missingEvents = missingGeminiHookEvents(geminiSettings2);
+      check(missingEvents.length === 0, "Gemini CLI: native hooks installed", missingEvents.length === 0 ? "all 5 events" : `missing ${missingEvents.join(", ")}, re-run setup`);
+      const geminiHooks = geminiSettings2.hooks;
+      const hookCommand = extractAgentHookCommand(geminiHooks?.BeforeTool, GEMINI_HOOK_BINARY) ?? extractAgentHookCommand(geminiHooks?.AfterTool, GEMINI_HOOK_BINARY) ?? extractAgentHookCommand(geminiHooks?.SessionStart, GEMINI_HOOK_BINARY);
+      if (hookCommand) {
+        const resolves = commandResolves(hookCommand);
+        check(resolves, "Gemini CLI: hook command resolves", resolves ? hookCommand : `not on PATH: ${hookCommand}`);
+      }
+      noteHookTarget(hookCommand);
+      const geminiTimeout = extractHookTimeout(geminiHooks?.BeforeTool, GEMINI_HOOK_BINARY) ?? extractHookTimeout(geminiHooks?.BeforeTool, HOOK_LOCATOR_BINARY);
+      if (typeof geminiTimeout === "number") {
+        const ok = geminiTimeout >= 3e4;
+        check(ok, "Gemini CLI: hook timeout", ok ? `${geminiTimeout}ms` : `${geminiTimeout}ms too short (Gemini timeouts are milliseconds) \u2014 re-run setup`);
+      }
+      reportOtherHolders("Gemini CLI", geminiOtherHolders(geminiSettings2));
+    } else {
+      check(false, "Gemini CLI: native hooks installed", "no Pushary hooks in ~/.gemini/settings.json \u2014 re-run setup");
+    }
+    const geminiMd2 = geminiMd();
+    const hasGeminiInstructions = hasInstructionBlock(geminiMd2);
+    check(hasGeminiInstructions, "Gemini CLI: proactive instructions (GEMINI.md)", hasGeminiInstructions ? geminiMd2 : "missing \u2014 re-run setup so Gemini asks via push, not the terminal");
+  } else {
+    skipped("Gemini CLI", installed("gemini_cli") ? "installed, but Pushary is not set up for it" : "not installed");
+  }
+  for (const finding of inertRegistrations(registeredConfigs(), resolvesHookRegistration)) {
+    console.log(`  ${warn} ${shortenHome(finding.file)}: ${describeInertRegistration(finding)}`);
+    console.log(`    ${dim(inertRegistrationRemedy())}`);
+  }
+  for (const profile of HOOK_COMPATIBLE_PROFILES) {
+    const configPath = compatibleConfigFile(profile);
+    const config = readJson(configPath);
+    if (!config || !hasCompatibleHooks(config, profile)) {
+      skipped(profile.label, installed(profile.agentType) ? "installed, but Pushary is not set up for it" : "not installed");
+      continue;
+    }
+    checking(profile.label);
+    const missing = missingCompatibleHookEvents(config, profile);
+    check(
+      missing.length === 0,
+      `${profile.label}: native hooks installed`,
+      missing.length === 0 ? shortenHome(configPath) : `missing ${missing.join(", ")} \u2014 re-run setup`
+    );
+    const mcpPath = compatibleMcpFile(profile);
+    if (mcpPath) {
+      const hasServer = Boolean(readJson(mcpPath)?.mcpServers?.pushary);
+      check(hasServer, `${profile.label}: MCP server`, hasServer ? shortenHome(mcpPath) : "missing \u2014 re-run setup");
+    }
+    const instructionsPath = compatibleInstructionsFile(profile);
+    if (instructionsPath) {
+      const present = hasInstructionBlock(instructionsPath);
+      check(
+        present,
+        `${profile.label}: proactive instructions`,
+        present ? shortenHome(instructionsPath) : "missing \u2014 re-run setup so it asks via push, not the terminal"
+      );
+    }
+  }
+  const configuredManagedProviders = [
+    ...claudeInPlay ? ["claude"] : [],
+    ...codexInPlay ? ["codex"] : [],
+    ...geminiInPlay ? ["gemini"] : []
+  ];
+  const controlCapabilities = detectProviderLiveCapabilities(configuredManagedProviders);
+  const controlSupported = hasSpawnProvider(controlCapabilities);
+  const controlMode = readControlMode();
+  const daemon = readDaemonStatus();
+  const loginBlock = readDaemonNeedsLogin();
+  const serviceDefined = hasDaemonServiceDefinition();
+  const managerAvailable = daemonServiceManagerAvailable();
+  const controlPolicy = resolveControlPolicy({
+    mode: controlMode,
+    providerAvailable: controlSupported,
+    managerAvailable,
+    servicePresent: serviceDefined || daemon.kind !== "absent"
+  });
+  const controlRequired = controlPolicy === "enabled";
+  const controlUnsupported = controlMode === "on" && controlPolicy !== "enabled";
+  const daemonOk = controlUnsupported ? false : controlPolicy === "disabled" ? daemon.kind === "absent" && !serviceDefined : controlPolicy === "enabled" ? daemonHasRemoteProof(daemon) : controlPolicy === "legacy" ? false : daemon.kind === "absent" && !serviceDefined;
+  const needsLogin = loginBlock.kind === "blocked" ? `needs login: ${describeDaemonLoginBlock(loginBlock.record)}` : null;
+  const daemonFailure = daemonOk ? null : needsLogin ?? (controlUnsupported ? !controlSupported ? "install and configure a supported Claude Code, Codex or Gemini provider" : "no native background-service manager is available in this OS session" : controlPolicy === "enabled" && daemon.kind === "running" ? "the daemon has not completed an authenticated heartbeat and control poll" : controlPolicy === "disabled" ? `control is disabled but ${serviceDefined ? "the service definition remains" : `local state is ${daemon.kind}`}` : controlPolicy === "legacy" ? "a legacy service exists without a usable provider/service-manager pair" : `local state is ${daemon.kind}`);
+  const daemonDetail = daemonFailure ? needsLogin ? daemonFailure : controlUnsupported ? `${daemonFailure}; re-run setup with \`--control off\`, or repair the missing prerequisite` : controlPolicy === "disabled" ? `${daemonFailure}; re-run setup with \`--control off\`` : controlPolicy === "legacy" ? `${daemonFailure}; run setup with \`--control off\`, or repair the missing prerequisite` : `${daemonFailure}; run \`pushary daemon install\` to install or repair the background service` : controlPolicy === "disabled" ? "disabled by setup" : controlPolicy === "preserve-absent" ? "legacy absence preserved" : !controlRequired && daemon.kind === "absent" ? "managed control is unsupported on this provider or operating-system session" : null;
+  check(
+    daemonOk,
+    "Remote-control daemon",
+    [
+      daemonDetail,
+      daemon.kind,
+      `pid ${daemon.pid ?? "none"}`,
+      `daemon ${daemon.daemonVersion ?? "none"}`,
+      `installed ${daemon.installedVersion}`,
+      `machine ${daemon.machineId ?? "none"}`,
+      `heartbeat ${daemon.lastSuccessfulHeartbeatAt ?? "none yet"}`,
+      `control ${daemon.lastSuccessfulControlAt ?? "none yet"}`,
+      daemon.lastError ? `last error ${daemon.lastError.message} at ${daemon.lastError.at}` : null
+    ].filter((value) => value !== null).join(" \xB7 ")
+  );
+  const serviceFile = serviceDefined ? readInstalledDaemonService() : null;
+  const serviceNode = serviceFile ? readServiceExecPath(serviceFile.contents, process.platform) : null;
+  if (serviceFile && serviceNode) {
+    const present = existsSync(serviceNode);
+    const manager = versionManagerOf(serviceNode);
+    check(
+      present,
+      "Remote-control service runtime",
+      present ? `${serviceNode}${manager ? ` (managed by ${manager}; a version switch strands the service)` : ""}` : `${serviceNode} is gone${manager ? ` (${manager} switched Node since setup)` : ""}; run \`pushary daemon install\` to repin the service`
+    );
+  } else if (serviceFile) {
+    console.log(`  ${warn} Remote-control service runtime ${dim(`(could not read the node path out of ${serviceFile.path})`)}`);
+  }
+  let serverProof = null;
+  if (controlPolicy === "enabled" && apiKey && daemon.machineId) {
+    serverProof = await readMachineReadiness(apiKey, ["spawn", ...controlCapabilities], {
+      machineId: daemon.machineId
+    });
+    if (serverProof.kind === "unsupported") {
+      console.log(`  ${warn} Remote-control server proof unavailable ${dim(`(${serverProof.detail})`)}`);
+    } else {
+      check(
+        serverProof.kind === "ready",
+        "Remote-control server proof",
+        serverProof.kind === "ready" ? "heartbeat \xB7 capabilities \xB7 control queue" : serverProof.detail,
+        serverProof.kind === "failed" ? "unreachable" : void 0
+      );
+    }
+  }
+  const cursorPluginDir2 = cursorPluginDir();
+  const cursorUserHooksJson = readJson(cursorUserHooks());
+  const cursorUserMcpJson = readJson(cursorUserMcp());
+  if (cursorWired({
+    userHooks: cursorUserHooksJson,
+    mcp: cursorUserMcpJson,
+    pluginDirExists: existsSync(cursorPluginDir2)
+  })) {
+    checking("Cursor");
+    const userHooks = cursorUserHooksJson;
+    const gateEntries = CURSOR_GATE_EVENTS.map((event) => ({
+      event,
+      entry: userHooks?.hooks?.[event]?.find((h) => pusharyHookExecutable(String(h.command ?? "")) !== null)
+    }));
+    const missing = gateEntries.filter(({ entry }) => !entry).map(({ event }) => event);
+    if (missing.length === gateEntries.length) {
+      check(false, "Cursor: permission gate registered", "no Pushary gate in ~/.cursor/hooks.json \u2014 re-run setup (a plugin-only hooks.json is never read by Cursor)");
+    } else if (missing.length > 0) {
+      check(false, "Cursor: permission gate registered", `${missing.join(", ")} not registered \u2014 re-run setup`);
+    } else {
+      const paths_ = gateEntries.map(({ entry }) => pusharyHookExecutable(String(entry.command)) ?? "");
+      const broken = paths_.filter((path) => !path || !existsSync(path));
+      check(
+        broken.length === 0,
+        "Cursor: permission gate registered",
+        broken.length === 0 ? `~/.cursor/hooks.json \u2192 ${paths_[0]} (${gateEntries.length} events)` : `gate script not found: ${broken[0]} \u2014 re-run setup`
+      );
+      noteHookTarget(String(gateEntries[0].entry.command));
+    }
+    reportOtherHolders("Cursor", cursorOtherHolders(cursorUserHooksJson));
+    const { authorization: cursorAuth, source: cursorMcpSource } = cursorMcpAuthorization(
+      readJson(join(cursorPluginDir2, "mcp.json")),
+      cursorUserMcpJson
+    );
+    if (!cursorAuth) {
+      check(false, "Cursor: API key linked", `no Authorization in ${cursorMcpSource} \u2014 re-run setup`);
+    } else if (cursorAuth.includes("PUSHARY_API_KEY")) {
+      check(false, "Cursor: API key linked", `${cursorMcpSource} relies on $PUSHARY_API_KEY; re-run setup to embed the key so the gate works when Cursor is launched from the GUI`);
+    } else if (apiKey && cursorAuth !== `Bearer ${apiKey}`) {
+      check(false, "Cursor: API key matches active key", "the embedded key is not the key hooks use (rotated?) \u2014 re-run setup");
+    } else {
+      check(true, "Cursor: API key linked", `embedded in ${cursorMcpSource}`);
+    }
+  } else {
+    skipped("Cursor", installed("cursor") ? "installed, but Pushary is not set up for it" : "not installed");
+  }
+  const vscodePluginDir2 = vscodePluginDir();
+  if (existsSync(vscodePluginDir2)) {
+    checking("VS Code");
+    const registeredIn = vscodeSettingsTargets(existsSync).filter(
+      (settingsPath) => existsSync(settingsPath) && isPluginRegistered(readFileSync(settingsPath, "utf-8"), vscodePluginDir2)
+    );
+    check(
+      registeredIn.length > 0,
+      "VS Code: plugin registered",
+      registeredIn.length > 0 ? registeredIn.join(", ") : "not listed in chat.pluginLocations \u2014 re-run setup (an unregistered plugin directory is never loaded)"
+    );
+    const vscodeHooks = readJson(join(vscodePluginDir2, "hooks", "hooks.json"));
+    const gateCommand = extractAgentHookCommand(vscodeHooks?.hooks?.PreToolUse, CURSOR_GATE_SCRIPT);
+    if (!gateCommand) {
+      check(false, "VS Code: permission gate present", "no Pushary gate in the plugin hooks.json \u2014 re-run setup");
+    } else {
+      const scriptPath = pusharyHookExecutable(gateCommand) ?? "";
+      const resolves = scriptPath ? existsSync(scriptPath) : false;
+      check(
+        resolves,
+        "VS Code: permission gate present",
+        resolves ? scriptPath : `gate script not found: ${scriptPath || gateCommand} \u2014 re-run setup`
+      );
+      noteHookTarget(gateCommand);
+    }
+    const vscodeMcp = readJson(join(vscodePluginDir2, ".mcp.json"));
+    const vscodeServers = vscodeMcp?.mcpServers ?? {};
+    const vscodeAuth = vscodeServers.pushary?.headers?.Authorization;
+    if (!vscodeAuth) {
+      check(false, "VS Code: API key linked", "no Authorization in plugin .mcp.json \u2014 re-run setup");
+    } else if (vscodeAuth.includes("PUSHARY_API_KEY")) {
+      check(false, "VS Code: API key linked", "plugin relies on $PUSHARY_API_KEY; re-run setup to embed the key so the gate works when VS Code is launched from the GUI");
+    } else if (apiKey && vscodeAuth !== `Bearer ${apiKey}`) {
+      check(false, "VS Code: API key matches active key", "the embedded key is not the key hooks use (rotated?) \u2014 re-run setup");
+    } else {
+      check(true, "VS Code: API key linked", "embedded in plugin .mcp.json");
+    }
+  } else {
+    skipped("VS Code", installed("vscode") ? "installed, but Pushary is not set up for it" : "not installed");
+  }
+  if (openCodeWired()) {
+    checking("OpenCode");
+    const plugin = openCodePluginFile();
+    const contents = (() => {
+      try {
+        return readFileSync(plugin, "utf-8");
+      } catch {
+        return "";
+      }
+    })();
+    check(true, "OpenCode: plugin present", plugin);
+    const substituted = !contents.includes(OPENCODE_PLUGIN_PLACEHOLDER);
+    check(
+      substituted,
+      "OpenCode: hook command written",
+      substituted ? "the plugin carries this machine's command" : "placeholder never replaced \u2014 re-run setup"
+    );
+    const target = String(contents.match(/const COMMAND = (\[[^\n]*\])/)?.[1] ?? "");
+    const argv = (() => {
+      try {
+        return JSON.parse(target);
+      } catch {
+        return [];
+      }
+    })();
+    const binary = argv.find((part) => part.includes("/") && part.includes("pushary"));
+    if (binary) {
+      check(
+        existsSync(binary),
+        "OpenCode: hook binary resolves",
+        existsSync(binary) ? binary : `${binary} is not there \u2014 re-run setup`
+      );
+    }
+    const manifest = join(openCodePluginDir(), "package.json");
+    check(
+      existsSync(manifest),
+      "OpenCode: plugins directory declares ESM",
+      existsSync(manifest) ? manifest : `no package.json beside the plugin; Node may load it as CommonJS \u2014 re-run setup`
+    );
+  } else {
+    skipped("OpenCode", installed("opencode") ? "installed, but Pushary is not set up for it" : "not installed");
+  }
+  const fx = inspectFxInstallation(fxMcpProfile(), fxSettings(), process.env);
+  const fxProfile = fx.profile;
+  if (fx.configured) {
+    checking("fx");
+    check(true, "fx: Pushary MCP server configured", fxMcpProfile());
+    const bridge = fx.bridge;
+    if (bridge) {
+      const found = fxBridgeFound(bridge);
+      check(found, "fx: bridge binary resolves", found ? bridge : `${bridge} is not installed or not on PATH \u2014 re-run ${retryAgentCommand("fx")}`);
+    }
+    const settingsProblem = fx.settingsProblem;
+    if (settingsProblem) {
+      console.log(`  ${warn} fx: Pushary tools are not auto-allowed and questions can still stop in the terminal ${dim(`(${settingsProblem})`)}`);
+    } else if (!fx.toolsAllowed) {
+      console.log(`  ${warn} fx: Pushary tools are not auto-allowed ${dim(`(fx will review or prompt for each call; add "${FX_PUSHARY_TOOLS_RULE}": "allow" to permission in ${fxSettings()})`)}`);
+    }
+    const questionRouting = fx.questionRouting;
+    if (settingsProblem === null) reportFxQuestionRouting(questionRouting);
+    const workspacesShowingQuestions = fx.workspacesShowingQuestions;
+    if (workspacesShowingQuestions.length > 0) {
+      console.log(`  ${warn} fx: ${workspacesShowingQuestions.length} workspace(s) replace the global rules and keep ${FX_QUESTION_TOOL} on ${dim(`(add "${FX_QUESTION_TOOL}": "deny" to their permission rules in ${fxSettings()})`)}`);
+    }
+  } else if (fxProfile.kind === "refused" && installed("fx")) {
+    check(false, "fx: MCP profile", `${fxMcpProfile()} ${FX_PROFILE_REFUSALS[fxProfile.reason]} \u2014 fix it, then run ${retryAgentCommand("fx")}`);
+  } else {
+    skipped("fx", installed("fx") ? "installed, but Pushary is not set up for it" : "not installed");
+  }
+  const hermesPython = resolveHermesPython();
+  const hermesStatus = hermesPython ? readHermesStatus(hermesPython) : null;
+  const hermesSetupRecorded = existsSync(hermesConfigReceipt());
+  if (hermesStatus && hermesWiredByPushary(hermesStatus, hermesSetupRecorded)) {
+    checking("Hermes");
+    reportHermesStatus(hermesStatus);
+  } else if (hermesPython && hermesStatus === null && hermesSetupRecorded) {
+    check(false, "Hermes: config readable", `${hermesConfig()} could not be read with Hermes' Python \u2014 run ${retryAgentCommand("hermes")}`);
+  } else {
+    skipped("Hermes", installed("hermes") ? "installed, but Pushary is not set up for it" : "not installed");
+  }
+  if (bridgeStub) {
+    const resolution = resolveBridgeStub(bridgeStub, liveBridgeProbe());
+    check(resolution.kind === "bundle", "Mac app behind pushary-bridge", describeBridgeResolution(resolution));
+  }
+  check(
+    agentsChecked.length > 0,
+    "Wired to at least one agent",
+    agentsChecked.length > 0 ? agentsChecked.join(", ") : "Pushary is installed but configured for no agent \u2014 run npx @pushary/agent-hooks@latest setup"
+  );
+  if (claudeInPlay) {
+    check(existsSync(SKILL_PATH), "Skill installed", existsSync(SKILL_PATH) ? SKILL_PATH : "not found");
+  }
+  const globalPackage = globalPackageCheck(readGlobalCliInstall());
+  const globalVersion = globalPackage.commands?.version ?? "";
+  check(globalPackage.ok, "Global package installed", globalPackage.detail);
+  if (globalPackage.commands && globalVersion) {
+    const latest = await fetchLatestPublishedVersion({ packageName: globalPackage.commands.name });
+    if (latest) {
+      const freshness = globalPackageFreshness(globalVersion, latest);
+      check(freshness.upToDate, "Global package up to date", freshness.detail);
+    }
+  }
+  const autoUpdateStatePath = autoUpdateState();
+  const autoUpdateAnnouncement = takeAutoUpdateAnnouncement(autoUpdateStatePath, true);
+  if (autoUpdateAnnouncement) console.log(`  ${pass} ${describeAutoUpdateAnnouncement(autoUpdateAnnouncement)}`);
+  for (const note of describeAutoUpdateStatus({ env: process.env, platform: process.platform, state: readAutoUpdateState(autoUpdateStatePath) })) {
+    console.log(`  ${note.tone === "warn" ? warn : dim("\u2013")} ${note.label} ${dim(`(${note.detail})`)}`);
+  }
+  console.log();
+  console.log(`  ${dim("Remote control")}`);
+  const aliasRc = SHELL_FILES.find((f) => {
+    try {
+      return /alias\s+claude=['"]?pushary claude/.test(readFileSync(f, "utf-8"));
+    } catch {
+      return false;
+    }
+  });
+  if (aliasRc) {
+    if (globalVersion) {
+      check(true, "claude alias \u2192 pushary claude", `set in ${aliasRc.split("/").pop()}`);
+    } else {
+      check(false, "claude alias \u2192 pushary claude", "alias is set but pushary is not installed \u2014 run `unalias claude` (this shell) or reinstall");
+    }
+  } else {
+    console.log(`  ${dim("\u2013")} claude alias not set ${dim("(optional \u2014 run `pushary claude` directly, or re-run setup to add it)")}`);
+  }
+  if (apiKey) {
+    try {
+      const modeRes = await fetch(`${getBaseUrl()}/api/mcp/mode`, {
+        headers: { Authorization: `Bearer ${apiKey}` },
+        signal: AbortSignal.timeout(8e3)
+      });
+      const relayUrl = modeRes.ok ? (await modeRes.json()).relayUrl : void 0;
+      if (typeof relayUrl === "string" && relayUrl.length > 0) {
+        const healthUrl = relayUrl.replace(/^wss:/, "https:").replace(/\/relay$/, "/health/ready");
+        try {
+          const h = await fetch(healthUrl, { signal: AbortSignal.timeout(6e3) });
+          console.log(h.ok ? `  ${pass} Relay reachable ${dim("(sub-second phone commands)")}` : `  ${dim("\u2013")} Relay advertised but returned ${h.status} ${dim("(commands still delivered via polling)")}`);
+        } catch {
+          console.log(`  ${dim("\u2013")} Relay advertised but unreachable ${dim("(commands still delivered via polling)")}`);
+        }
+      } else {
+        console.log(`  ${dim("\u2013")} Relay not enabled ${dim("(phone commands delivered via polling)")}`);
+      }
+    } catch {
+    }
+  }
+  console.log();
+  console.log(`  ${dim("Connectivity")}`);
+  if (!apiKey) {
+    check(false, "MCP server reachable", "skipped \u2014 no API key");
+    check(false, "API key valid", "skipped");
+    check(false, "MCP handshake", "skipped");
+    const keylessSummary = readLedgerSummary(7);
+    if (keylessSummary.count > 0) {
+      check(false, "Keyless approval moments (7d)", `${keylessSummary.count} counted locally \u2014 npx @pushary/agent-hooks@latest stats`);
+    }
+  } else {
+    let sessionId = "";
+    try {
+      const initResult = await sendMcpRequest(apiKey, {
+        jsonrpc: "2.0",
+        id: 1,
+        method: "initialize",
+        params: {
+          protocolVersion: "2025-03-26",
+          capabilities: {},
+          clientInfo: { name: "pushary-doctor", version: "1.0" }
+        }
+      }, { timeoutMs: 1e4 });
+      check(true, "MCP server reachable", `${initResult.status} ${initResult.statusText}`);
+      sessionId = initResult.sessionId;
+      if (sessionId) {
+        console.log(`  ${pass} Session ID returned ${dim(`(${sessionId.slice(0, 8)}...)`)}`);
+      } else {
+        console.log(`  ${dim("\u2013")} Stateless mode ${dim("(no session ID)")}`);
+      }
+      check(!!initResult.data.result?.serverInfo, "API key valid", initResult.data.result?.serverInfo?.name ?? "unknown server");
+      const toolsResult = await sendMcpRequest(apiKey, {
+        jsonrpc: "2.0",
+        id: 2,
+        method: "tools/list",
+        params: {}
+      }, {
+        sessionId,
+        timeoutMs: 1e4
+      });
+      const toolCount = toolsResult.data.result?.tools?.length ?? 0;
+      check(toolCount > 0, "MCP tools discovered", `${toolCount} tools`);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : "unknown error";
+      check(false, "MCP server reachable", msg);
+    }
+    console.log();
+    console.log(`  ${dim("Notification Delivery")}`);
+    const probe = await fetchChannels(apiKey);
+    if (probe.kind !== "ok") {
+      check(
+        false,
+        "Phone reachable",
+        probe.kind === "unreachable" ? `could not read your devices (${probe.detail})` : probe.kind === "locked" ? "no plan active, so nothing can be delivered" : "the server rejected this key",
+        probe.kind === "unreachable" ? "unreachable" : "config"
+      );
+    } else if (probe.status.precise) {
+      const channels = probe.status;
+      const verdict = reachVerdict(channels);
+      check(
+        verdict.kind === "yours",
+        "Phone reachable",
+        verdict.kind === "yours" ? describeReach(channels) : verdict.kind === "nobody" ? "nothing connected, run pushary connect or get the app at https://pushary.com/download" : `${describeReach(channels)}; run pushary connect to add your own`,
+        "reachability"
+      );
+    }
+    const pushSuppressed = !options.roundtrip && (options.noPush || options.json || !process.stdout.isTTY);
+    if (pushSuppressed) {
+      const why = options.noPush ? "--no-push" : options.json ? "--json" : "not a terminal";
+      console.log(`  ${dim("\u2013")} Test push skipped ${dim(`(${why}; pass --roundtrip to send one)`)}`);
+    } else try {
+      const result = await callMcpTool(apiKey, "send_notification", {
+        title: "Pushary Doctor",
+        body: "If you see this, push notifications are working.",
+        agentName: "Pushary Doctor"
+      }, { sessionId, timeoutMs: 2e4 });
+      const sent = typeof result.sent === "number" ? result.sent : (result.delivery?.mobile?.recipients ?? 0) + (result.delivery?.web?.recipients ?? 0);
+      check(sent > 0, "Push notification sent", sent > 0 ? `${sent} device${sent === 1 ? "" : "s"} \u2014 check your phone` : "reached 0 devices");
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : "network error";
+      check(false, "Push notification sent", msg);
+    }
+    const roundTripPlan = planRoundTrip({
+      roundtrip: options.roundtrip,
+      noPush: options.noPush,
+      json: options.json,
+      stdinIsTty: process.stdin.isTTY === true
+    });
+    const testQuestion = roundTripPlan.kind === "always" ? true : roundTripPlan.kind === "never" ? false : await confirm({
+      message: "Test a synthetic question and answer? (sends a notification; does not test agent hooks)",
+      default: roundTripPlan.defaultAnswer
+    });
+    if (testQuestion) {
+      console.log();
+      console.log(`  ${dim("Question Roundtrip")}`);
+      console.log(`  ${dim("\u2192")} Question sent, waiting for your answer...`);
+      const outcome = await verifyRoundTrip(apiKey, "Pushary Doctor");
+      roundTrip = outcome;
+      const report = describeRoundTrip(outcome);
+      check(report.ok, "Synthetic answer test", report.message);
+      for (const line of report.next) console.log(`    ${dim(line)}`);
+    }
+  }
+  if (apiKey) {
+    try {
+      const res = await fetch(`${getBaseUrl()}/api/mcp/policy`, {
+        headers: { Authorization: `Bearer ${apiKey}` },
+        signal: AbortSignal.timeout(1e4)
+      });
+      if (res.ok) {
+        const policy = await res.json();
+        console.log();
+        console.log(`  ${dim("Wait Ladder")} ${dim("(what happens when you don't answer)")}`);
+        const wildcard = policy.policies?.find((p) => p.tool === "*");
+        const defaultWindow = policy.defaultPushFirstSeconds ?? 20;
+        const defaultLadder = describeWaitLadder(wildcard ?? { tool: "*", mode: "push_first", pushFirstSeconds: defaultWindow, timeoutSeconds: 0, timeoutAction: "escalate" });
+        console.log(`  ${dim("\xB7")} default: ${cyan(`${defaultWindow}s`)} ${dim("\xB7")} ${defaultLadder}`);
+        if (policy.modeOverride) {
+          console.log(`  ${warn} mode override active: ${cyan(policy.modeOverride)} ${dim("(pushary mode status)")}`);
+        }
+        const overrides = (policy.policies ?? []).filter((p) => p.tool !== "*").slice(0, 4);
+        for (const p of overrides) {
+          console.log(`  ${dim("\xB7")} ${p.tool}: ${describeWaitLadder(p)}`);
+        }
+        console.log(`  ${dim("Tune it:")} ${cyan("pushary wait <seconds>")} ${dim("\xB7 full ladder:")} ${cyan("pushary wait status")}`);
+      }
+    } catch {
+    }
+  }
+  if (options.activation) {
+    activation = apiKey ? await readHookActivation(apiKey, options.activation, options.activationTarget) : { kind: "unavailable", detail: "Sign in before reading this workspace\u2019s hook evidence." };
+    const latest = activation.kind === "ok" ? activation.report.evidence[0] : void 0;
+    hookActivation = hookActivationResult(activation.kind === "ok" ? activation.report : null);
+    const observed = hookActivation === "approved_executed" || hookActivation === "denied_observed";
+    check(observed, "Approval for the selected scratch file (last 10 minutes)", activation.kind !== "ok" ? activation.detail : activation.report.truncated ? "Too many recent decisions to establish a unique correlation. Start a quiet test session and retry." : activation.report.evidence.length > 1 ? `${hookActivation}: multiple decisions for this target. Use a new scratch file for each attempt; inspect hookActivationEvidence for all results.` : latest ? `${latest.result}; answer source: ${latest.answerSource ?? "unknown"}; decision ${latest.correlationId}; session ${latest.sessionId}; tool call ${latest.toolUseId}` : "Unverified: no recent runtime-tagged Write approval for this scratch file on this machine.");
+    const guide = AGENTS[options.activation].activationGuide;
+    console.log(`  ${dim(`Real-agent check: https://pushary.com${guide}`)}`);
+  }
+  const managedControl = readManagedControlEvidence(apiKey, configuredManagedProviders, serverProof);
+  console.log(`  ${dim(`Phone-start and steering: ${managedControl.ready ? "local and server checks passed for this run" : "unverified; hook approvals are a separate capability"}.`)}`);
+  console.log();
+  if (!options.activation) console.log(`  ${dim("Agent hook activation is unverified by these checks. Use --activation claude_code --activation-target <unique scratch file> after one real approval.")}`);
+  const failed = results.filter((r) => !r.passed);
+  if (failed.length === 0) {
+    console.log(`  ${green(bold("All checks passed."))}`);
+  } else {
+    console.log(`  ${red(bold(`${failed.length} check${failed.length === 1 ? "" : "s"} failed:`))}`);
+    for (const f of failed) {
+      console.log(`  ${fail} ${f.label}${f.detail ? ` \u2014 ${f.detail}` : ""}`);
+    }
+    console.log();
+    console.log(`  ${dim("Run")} ${cyan("npx @pushary/agent-hooks@latest clean")} ${dim("then")} ${cyan("setup")} ${dim("to fix.")}`);
+    console.log(`  ${dim("Still failing after that? Send this report to")} ${cyan(SUPPORT_EMAIL)} ${dim("or ask on")} ${cyan(SUPPORT_DISCORD)}`);
+  }
+  console.log();
+  const keyExit = keyVerdict && (keyVerdict.kind === "rejected" || keyVerdict.kind === "locked" || keyVerdict.kind === "malformed") ? describeKeyCheck(keyVerdict).exitCode : null;
+  const exitCode = resolveDoctorExit({ keyExit, failures: failed });
+  if (options.bundle) {
+    try {
+      const bundle = redact(
+        await collectBundle({
+          identity: keyVerdict?.kind === "ok" ? keyVerdict.identity : null,
+          checks: results.map((r) => ({ id: r.label, ok: r.passed, detail: r.detail ?? "" }))
+        })
+      );
+      const target = join(process.cwd(), bundleFileName(bundle));
+      writeFileSync(target, `${JSON.stringify(bundle, null, 2)}
+`, "utf-8");
+      const say = options.json ? process.stderr : process.stdout;
+      say.write(`
+  Diagnostics written to ${target}
+`);
+      say.write("  Keys, your home directory and this machine name are redacted. Read it before sharing.\n\n");
+    } catch (err) {
+      process.stderr.write(`  ! could not write the diagnostics file: ${err instanceof Error ? err.message : String(err)}
+`);
+    }
+  }
+  if (options.json) {
+    await new Promise((resolve2, reject) => process.stdout.write(`${JSON.stringify({
+      ok: exitCode === EXIT.OK,
+      exitCode,
+      keyCheck: keyVerdict?.kind ?? null,
+      roundTripEvidence: roundTripEvidence(roundTrip),
+      hookActivation,
+      hookActivationEvidence: activation,
+      daemon,
+      managedControl,
+      daemonNeedsLogin: loginBlock.kind === "blocked" ? loginBlock.record : null,
+      passed: results.filter((r) => r.passed).length,
+      failed: failed.length,
+      checks: results.map((r) => ({ label: r.label, passed: r.passed, detail: r.detail ?? null })),
+      otherHolders: otherHoldersByAgent
+    }, null, 2)}
+`, (error) => error ? reject(error) : resolve2()));
+  }
+  process.exit(exitCode);
+};
+main().catch((err) => {
+  console.error(`  doctor failed: ${err instanceof Error ? err.message : String(err)}`);
+  process.exit(1);
+});