pushary 1.8.0

package/dist/bin/pushary-gemini-hook.js

@@ -0,0 +1,381 @@
+#!/usr/bin/env node
+import {
+  triggerAutoUpdate
+} from "../chunk-UI36QSBI.js";
+import {
+  isGatingMoment,
+  recordKeylessMoment
+} from "../chunk-JU6W3XAU.js";
+import {
+  readHookInput
+} from "../chunk-KGDWDSNL.js";
+import {
+  announceSubscriptionRequired,
+  denyReasonFrom,
+  isDeferAnswer
+} from "../chunk-5OP5MQI7.js";
+import "../chunk-JZTHGAPA.js";
+import "../chunk-SGZJ5LYH.js";
+import "../chunk-EYK3GSRH.js";
+import "../chunk-ZVSKMPBZ.js";
+import "../chunk-C2WCPBF7.js";
+import "../chunk-6J2JC2RT.js";
+import "../chunk-WE2J62NC.js";
+import "../chunk-3EVPNIBE.js";
+import "../chunk-OKXS7WDZ.js";
+import "../chunk-MPWXGONV.js";
+import "../chunk-SAXBC4AZ.js";
+import "../chunk-OLQRRFBX.js";
+import "../chunk-XHKBHWLX.js";
+import {
+  UNNAMED_ACTION,
+  deriveActionBody,
+  deriveBlocker,
+  deriveToolTarget,
+  describeToolCall,
+  fetchModeState,
+  getPolicy,
+  handlePostToolUse,
+  handleSessionEnd,
+  handleStop,
+  handleUserPrompt,
+  policyRequestFor,
+  readLastPrompt,
+  readLastUserPrompt,
+  repoKeyFor,
+  reportEvent,
+  scopePathFor
+} from "../chunk-CULUZTWQ.js";
+import {
+  DEFAULT_SESSION
+} from "../chunk-N6IOSZOE.js";
+import "../chunk-EPCXUP3P.js";
+import {
+  DECISION_STOP_REASON,
+  UNVERIFIABLE_APPROVAL_REASON,
+  askUser,
+  isDecisionStopped,
+  isLocalQuestionHandoff,
+  sendNotification,
+  waitForQuestion
+} from "../chunk-NGDD6TXY.js";
+import {
+  exitAfterClientReports
+} from "../chunk-CVQYGMSR.js";
+import "../chunk-POFBE6ZY.js";
+import "../chunk-GMXKITVA.js";
+import "../chunk-P7WQEVWA.js";
+import {
+  SubscriptionRequiredError
+} from "../chunk-M5ICYGHT.js";
+import "../chunk-2ABTSGFT.js";
+import "../chunk-2OY3ZZ5N.js";
+import {
+  getMachineId
+} from "../chunk-LXQ5FBBD.js";
+import "../chunk-7QLSKOSU.js";
+import {
+  EXIT
+} from "../chunk-KZERVKTD.js";
+import "../chunk-DB3ONZB4.js";
+import "../chunk-A2A2YTMG.js";
+import "../chunk-T7E75EKA.js";
+import {
+  getApiKey
+} from "../chunk-GPEGOGRJ.js";
+import "../chunk-E4FJTUH4.js";
+import {
+  KILL_REASON,
+  effectiveWaitSeconds,
+  gateOutputFor,
+  hookWaitClamped,
+  hookWaitDeadline,
+  resolveGate
+} from "../chunk-NQTHFF4W.js";
+
+// bin/pushary-gemini-hook.ts
+import { basename } from "path";
+
+// src/gemini-adapter.ts
+import { isAbsolute, resolve } from "path";
+var GEMINI_AGENT = { type: "gemini_cli", label: "Gemini CLI" };
+var geminiOwnsLifecycle = (bridge) => bridge !== "1";
+var GEMINI_TOOL_MAP = {
+  run_shell_command: "Bash",
+  write_file: "Write",
+  replace: "Edit",
+  read_file: "Read"
+};
+var firstString = (...values) => values.find((v) => typeof v === "string" && v.length > 0);
+var toGeminiPolicyLookup = (toolName, toolInput, cwd, mcpContext) => {
+  if (mcpContext?.server_name && mcpContext.tool_name) {
+    return { tool: `mcp__${mcpContext.server_name}__${mcpContext.tool_name}`, input: toolInput };
+  }
+  const canonical = GEMINI_TOOL_MAP[toolName];
+  if (!canonical) return { tool: toolName, input: toolInput };
+  if (canonical === "Bash") {
+    const command = firstString(toolInput.command);
+    return { tool: "Bash", input: command ? { command } : {} };
+  }
+  const filePath = firstString(toolInput.file_path, toolInput.absolute_path, toolInput.path);
+  if (!filePath) return { tool: canonical, input: {} };
+  return {
+    tool: canonical,
+    input: { file_path: cwd && !isAbsolute(filePath) ? resolve(cwd, filePath) : filePath }
+  };
+};
+var geminiAllow = () => ({ kind: "allow" });
+var geminiDeny = (reason) => ({ kind: "deny", reason });
+var geminiPass = () => ({ kind: "pass" });
+var NO_LOCAL_INPUT = "This unattended Gemini session has no local approval input. Use an interactive session or Every time.";
+var NO_ANSWER_IN_TIME = "No answer from your phone in time, and this unattended Gemini session has no local approval input. Retry when you can answer on your phone.";
+var HANDLED_ON_MACHINE = "You chose to handle this on your machine, but this unattended Gemini session has no local approval input. Use an interactive session.";
+var NO_DEVICE = "No phone or other notification channel is connected to Pushary, and this unattended Gemini session has no local approval input. Connect one in Pushary, then retry.";
+var SUBSCRIPTION_REQUIRED = "Your Pushary workspace has no active subscription, so approvals cannot reach your phone, and this unattended Gemini session has no local approval input. Renew Pushary, then retry.";
+var geminiLocalHandoff = (bridge, reason = NO_LOCAL_INPUT) => geminiOwnsLifecycle(bridge) ? geminiPass() : geminiDeny(reason);
+var geminiSubscriptionRequiredDecision = (bridge) => geminiLocalHandoff(bridge, SUBSCRIPTION_REQUIRED);
+var geminiPushOnlyHandoff = (askStatus, bridge) => askStatus === "notified" || askStatus === "terminal" ? geminiLocalHandoff(bridge) : geminiPass();
+var fromPhoneAnswer = (answer) => answer.value === "yes" ? geminiAllow() : geminiDeny(denyReasonFrom(answer.value, answer.note));
+var geminiPushFirstDecision = (pushed, bridge) => {
+  if (!pushed) return geminiPass();
+  const { answer, localHandoff } = pushed;
+  if (isDecisionStopped(answer)) return geminiDeny(DECISION_STOP_REASON);
+  if (localHandoff) return geminiLocalHandoff(bridge, pushed.noDevices ? NO_DEVICE : NO_LOCAL_INPUT);
+  if (answer.answered) return isDeferAnswer(answer.value) ? geminiLocalHandoff(bridge, HANDLED_ON_MACHINE) : fromPhoneAnswer(answer);
+  return geminiLocalHandoff(bridge, NO_ANSWER_IN_TIME);
+};
+var geminiPushOnlyDecision = (pushed, timeoutAction, bridge) => {
+  if (!pushed) return geminiDeny(UNVERIFIABLE_APPROVAL_REASON);
+  const { answer, localHandoff, clampCut, askStatus } = pushed;
+  if (isDecisionStopped(answer)) return geminiDeny(DECISION_STOP_REASON);
+  if (localHandoff) return geminiPushOnlyHandoff(askStatus, bridge);
+  if (answer.answered) return isDeferAnswer(answer.value) ? geminiPass() : fromPhoneAnswer(answer);
+  if (clampCut) return geminiPass();
+  return geminiTimeoutDecision(timeoutAction);
+};
+var toGeminiWire = (decision) => {
+  if (decision.kind === "pass") return null;
+  return gateOutputFor(
+    "gemini",
+    "BeforeTool",
+    decision.kind,
+    decision.kind === "deny" ? decision.reason : void 0
+  ) ?? null;
+};
+var geminiTimeoutDecision = (timeoutAction, denyReason = "No response within timeout") => {
+  if (timeoutAction === "approve") return geminiAllow();
+  if (timeoutAction === "deny") return geminiDeny(denyReason);
+  return geminiPass();
+};
+
+// bin/pushary-gemini-hook.ts
+var START_MS = Date.now();
+var agentNameFor = (input) => `${GEMINI_AGENT.label} - ${basename(input.cwd ?? process.cwd())}`;
+var pushQuestion = async (apiKey, input, lookup, waitSeconds, mode, pollInterval = 2e3) => {
+  const projectName = basename(input.cwd ?? process.cwd());
+  const description = describeToolCall(lookup.tool, lookup.input, "hook");
+  const result = await askUser(apiKey, {
+    question: `Allow ${description || UNNAMED_ACTION}?`,
+    type: "confirm",
+    context: `Agent wants to run this in ${projectName}`,
+    agentName: agentNameFor(input),
+    sessionId: input.session_id,
+    machineId: getMachineId(),
+    toolName: lookup.tool,
+    toolTarget: deriveToolTarget(lookup.tool, lookup.input),
+    intent: readLastPrompt(input.session_id || DEFAULT_SESSION) ?? (input.transcript_path ? readLastUserPrompt(input.transcript_path) : void 0),
+    action: description,
+    blocker: deriveBlocker(mode),
+    actionBody: deriveActionBody(input.tool_name ?? "", input.tool_input ?? {}),
+    repoKey: repoKeyFor(input.cwd)
+  });
+  const now = Date.now();
+  const deadline = hookWaitDeadline(START_MS, waitSeconds, "gemini", now);
+  const clampCut = hookWaitClamped(START_MS, waitSeconds, "gemini", now);
+  const answer = await waitForQuestion(apiKey, result, deadline, pollInterval);
+  return {
+    answer,
+    localHandoff: !answer.answered && isLocalQuestionHandoff(result),
+    clampCut,
+    askStatus: result.status,
+    noDevices: result.noDevices === true
+  };
+};
+var notifyApprovalNeeded = async (apiKey, input, lookup) => {
+  try {
+    await sendNotification(apiKey, {
+      title: "Agent needs approval",
+      body: describeToolCall(lookup.tool, lookup.input, "hook"),
+      agentName: agentNameFor(input),
+      sessionId: input.session_id,
+      machineId: getMachineId()
+    });
+  } catch {
+  }
+};
+var geminiStepsAside = (error, input) => {
+  announceSubscriptionRequired(error.upgradeUrl, input.session_id);
+  return geminiSubscriptionRequiredDecision(process.env.PUSHARY_GEMINI_BRIDGE);
+};
+var handlePushOnly = async (apiKey, input, lookup, timeoutSeconds, timeoutAction) => {
+  let pushed;
+  try {
+    pushed = await pushQuestion(apiKey, input, lookup, effectiveWaitSeconds(timeoutAction, timeoutSeconds, "gemini"), "push_only");
+  } catch (error) {
+    if (error instanceof SubscriptionRequiredError) return geminiStepsAside(error, input);
+    pushed = void 0;
+  }
+  return geminiPushOnlyDecision(pushed, timeoutAction, process.env.PUSHARY_GEMINI_BRIDGE);
+};
+var handlePushFirst = async (apiKey, input, lookup, pushFirstSeconds) => {
+  let pushed;
+  try {
+    pushed = await pushQuestion(apiKey, input, lookup, pushFirstSeconds, "push_first", 1500);
+  } catch (error) {
+    if (error instanceof SubscriptionRequiredError) return geminiStepsAside(error, input);
+    pushed = void 0;
+  }
+  return geminiPushFirstDecision(pushed, process.env.PUSHARY_GEMINI_BRIDGE);
+};
+var decideBeforeTool = async (input) => {
+  let apiKey;
+  try {
+    apiKey = getApiKey();
+  } catch {
+    try {
+      const lookup = toGeminiPolicyLookup(input.tool_name ?? "", input.tool_input ?? {}, input.cwd, input.mcp_context);
+      if (isGatingMoment(lookup.tool, lookup.input)) {
+        recordKeylessMoment({
+          ts: Date.now(),
+          tool: lookup.tool,
+          project: basename(input.cwd ?? process.cwd()),
+          sessionId: input.session_id
+        });
+      }
+    } catch {
+    }
+    return geminiPass();
+  }
+  try {
+    const modeState = await fetchModeState(apiKey, input.session_id);
+    const policyRequest = policyRequestFor("gemini_cli");
+    const lookup = toGeminiPolicyLookup(input.tool_name ?? "", input.tool_input ?? {}, input.cwd, input.mcp_context);
+    const config = await getPolicy(apiKey, modeState.policyVersion, policyRequest.agent, policyRequest.repoAware, input.session_id);
+    const scopePath = modeState.scope ? scopePathFor(lookup.tool, lookup.input, input.cwd) : void 0;
+    const verdict = resolveGate({
+      modeState,
+      config,
+      toolName: lookup.tool,
+      toolInputs: [lookup.input],
+      scopePaths: scopePath ? [scopePath] : [],
+      cwd: input.cwd,
+      repoKey: repoKeyFor(input.cwd),
+      sessionId: input.session_id
+    });
+    if (verdict.kind === "kill") return geminiDeny(KILL_REASON);
+    if (verdict.kind === "allow") return geminiAllow();
+    if (verdict.kind === "deny") return geminiDeny(verdict.reason);
+    if (verdict.kind === "defer") return geminiPass();
+    const toolPolicy = verdict.policy;
+    switch (toolPolicy.mode) {
+      case "push_only":
+        return handlePushOnly(apiKey, input, lookup, toolPolicy.timeoutSeconds, toolPolicy.timeoutAction);
+      case "terminal_only":
+        return geminiLocalHandoff(process.env.PUSHARY_GEMINI_BRIDGE);
+      case "push_first":
+        return handlePushFirst(apiKey, input, lookup, toolPolicy.pushFirstSeconds);
+      case "notify_only":
+        await notifyApprovalNeeded(apiKey, input, lookup);
+        return geminiLocalHandoff(process.env.PUSHARY_GEMINI_BRIDGE);
+      default:
+        return handlePushFirst(apiKey, input, lookup, toolPolicy.pushFirstSeconds);
+    }
+  } catch {
+    return geminiPass();
+  }
+};
+var reportSessionStart = async (input) => {
+  try {
+    await reportEvent({
+      event: "session_begin",
+      agentType: GEMINI_AGENT.type,
+      agentName: agentNameFor(input),
+      action: "Session started",
+      sessionId: input.session_id
+    }, { maxAttempts: 1, timeoutMs: 5e3 });
+  } catch {
+  }
+};
+var toCanonicalResult = (toolResponse) => {
+  if (!toolResponse || typeof toolResponse !== "object" || Array.isArray(toolResponse)) return void 0;
+  const error = toolResponse.error;
+  return error ? { error } : {};
+};
+var emitContext = (event, additionalContext) => {
+  if (!additionalContext) return;
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: { hookEventName: event, additionalContext }
+  }));
+};
+var emit = (wire) => {
+  if (wire) process.stdout.write(JSON.stringify(wire));
+};
+var main = async () => {
+  const input = await readHookInput("gemini");
+  if (!input) {
+    return exitAfterClientReports(EXIT.OK);
+  }
+  try {
+    switch (input.hook_event_name) {
+      case "BeforeTool":
+        emit(toGeminiWire(await decideBeforeTool(input)));
+        break;
+      case "AfterTool": {
+        const lookup = toGeminiPolicyLookup(input.tool_name ?? "", input.tool_input ?? {}, input.cwd, input.mcp_context);
+        emitContext("AfterTool", await handlePostToolUse({
+          tool_name: lookup.tool,
+          tool_input: lookup.input,
+          tool_result: toCanonicalResult(input.tool_response),
+          cwd: input.cwd,
+          session_id: input.session_id,
+          transcript_path: input.transcript_path
+        }, GEMINI_AGENT));
+        break;
+      }
+      case "BeforeAgent":
+        emitContext("BeforeAgent", await handleUserPrompt({
+          prompt: input.prompt,
+          cwd: input.cwd,
+          session_id: input.session_id
+        }, GEMINI_AGENT));
+        break;
+      case "AfterAgent":
+        if (geminiOwnsLifecycle(process.env.PUSHARY_GEMINI_BRIDGE)) {
+          await handleStop({
+            cwd: input.cwd,
+            session_id: input.session_id,
+            transcript_path: input.transcript_path,
+            last_assistant_message: input.prompt_response
+          }, GEMINI_AGENT);
+        }
+        break;
+      case "SessionEnd":
+        if (geminiOwnsLifecycle(process.env.PUSHARY_GEMINI_BRIDGE)) {
+          await handleSessionEnd({
+            cwd: input.cwd,
+            session_id: input.session_id,
+            reason: input.reason
+          }, GEMINI_AGENT);
+        }
+        break;
+      case "SessionStart":
+        triggerAutoUpdate({ isSubagentStart: false });
+        if (geminiOwnsLifecycle(process.env.PUSHARY_GEMINI_BRIDGE)) await reportSessionStart(input);
+        break;
+      default:
+        break;
+    }
+  } catch {
+  }
+};
+main();

package/dist/bin/pushary-hook.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/bin/pushary-hook.js

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+import {
+  handlePreToolUse
+} from "../chunk-Q7E4I6UA.js";
+import {
+  activeHookSource,
+  normalizeToolCall,
+  profileFromArgv
+} from "../chunk-J5TIV3J6.js";
+import "../chunk-AXPCESYO.js";
+import "../chunk-CJVVKOSR.js";
+import "../chunk-JU6W3XAU.js";
+import {
+  readToolHookInput
+} from "../chunk-KGDWDSNL.js";
+import "../chunk-5OP5MQI7.js";
+import "../chunk-JZTHGAPA.js";
+import "../chunk-SGZJ5LYH.js";
+import "../chunk-EYK3GSRH.js";
+import "../chunk-ZVSKMPBZ.js";
+import "../chunk-C2WCPBF7.js";
+import "../chunk-6J2JC2RT.js";
+import "../chunk-WE2J62NC.js";
+import "../chunk-3EVPNIBE.js";
+import "../chunk-OKXS7WDZ.js";
+import "../chunk-MPWXGONV.js";
+import "../chunk-SAXBC4AZ.js";
+import "../chunk-OLQRRFBX.js";
+import "../chunk-XHKBHWLX.js";
+import {
+  canonicalGateInputs
+} from "../chunk-CULUZTWQ.js";
+import "../chunk-N6IOSZOE.js";
+import "../chunk-EPCXUP3P.js";
+import "../chunk-NGDD6TXY.js";
+import {
+  exitAfterClientReports
+} from "../chunk-CVQYGMSR.js";
+import "../chunk-POFBE6ZY.js";
+import {
+  exitOnHelpFlag
+} from "../chunk-HZVVNGEW.js";
+import "../chunk-GMXKITVA.js";
+import "../chunk-P7WQEVWA.js";
+import "../chunk-M5ICYGHT.js";
+import "../chunk-2ABTSGFT.js";
+import "../chunk-2OY3ZZ5N.js";
+import "../chunk-LXQ5FBBD.js";
+import "../chunk-7QLSKOSU.js";
+import {
+  EXIT
+} from "../chunk-KZERVKTD.js";
+import "../chunk-DB3ONZB4.js";
+import "../chunk-A2A2YTMG.js";
+import "../chunk-T7E75EKA.js";
+import "../chunk-GPEGOGRJ.js";
+import "../chunk-E4FJTUH4.js";
+import {
+  renderPreToolUseVerdict
+} from "../chunk-NQTHFF4W.js";
+
+// bin/pushary-hook.ts
+exitOnHelpFlag("hook");
+var profile = profileFromArgv(process.argv);
+var FALLBACK_TO_TERMINAL = {
+  hookSpecificOutput: {
+    hookEventName: "PreToolUse",
+    permissionDecision: "ask",
+    permissionDecisionReason: "Pushary hook error, falling back to terminal"
+  }
+};
+var emit = (verdict) => {
+  const output = verdict && profile ? renderPreToolUseVerdict(profile, verdict) : verdict;
+  if (output !== void 0) process.stdout.write(JSON.stringify(output));
+};
+var main = async () => {
+  const raw = await readToolHookInput(
+    activeHookSource(process.argv),
+    "PreToolUse"
+  );
+  if (!raw?.tool_name) {
+    return exitAfterClientReports(EXIT.OK);
+  }
+  try {
+    const canonical = profile ? canonicalGateInputs(profile.source, raw.tool_name, [raw.tool_input ?? {}], raw.cwd) : void 0;
+    emit(await handlePreToolUse(normalizeToolCall(profile, raw), canonical));
+  } catch (err) {
+    process.stderr.write(
+      `[pushary-hook] Error: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    emit(FALLBACK_TO_TERMINAL);
+  }
+};
+main();

package/dist/bin/pushary-login.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/bin/pushary-login.js

@@ -0,0 +1,198 @@
+#!/usr/bin/env node
+import {
+  runBrowserLogin
+} from "../chunk-JYG4B33G.js";
+import "../chunk-PUZZELE6.js";
+import {
+  recoverDaemonAfterLogin
+} from "../chunk-WE2J62NC.js";
+import "../chunk-XHKBHWLX.js";
+import "../chunk-3EGEA4KH.js";
+import {
+  createIo
+} from "../chunk-U4TMAANR.js";
+import {
+  exitOnHelpFlag
+} from "../chunk-HZVVNGEW.js";
+import {
+  parseFlags
+} from "../chunk-GMXKITVA.js";
+import {
+  readConfigFileKey,
+  readControlMode,
+  readKeySource,
+  writeKey
+} from "../chunk-P7WQEVWA.js";
+import {
+  checkApiKey,
+  describeKeyCheck
+} from "../chunk-2ABTSGFT.js";
+import "../chunk-2OY3ZZ5N.js";
+import "../chunk-LXQ5FBBD.js";
+import {
+  UsageError
+} from "../chunk-7QLSKOSU.js";
+import {
+  EXIT
+} from "../chunk-KZERVKTD.js";
+import "../chunk-DB3ONZB4.js";
+import "../chunk-A2A2YTMG.js";
+import "../chunk-T7E75EKA.js";
+import "../chunk-GPEGOGRJ.js";
+import "../chunk-E4FJTUH4.js";
+import {
+  getPackageVersion,
+  isValidApiKey
+} from "../chunk-NQTHFF4W.js";
+
+// bin/pushary-login.ts
+exitOnHelpFlag("login");
+var parseLoginOptions = (argv) => {
+  const flags = parseFlags(argv, {
+    bools: ["with-token", "no-browser", "json", "force", "help", "h"],
+    values: []
+  });
+  if (flags.command !== void 0 && flags.command !== "login") {
+    throw new UsageError(`login takes no positional arguments (got ${flags.command})`);
+  }
+  return {
+    withToken: flags.bools.has("with-token"),
+    noBrowser: flags.bools.has("no-browser"),
+    json: flags.bools.has("json"),
+    force: flags.bools.has("force")
+  };
+};
+var options;
+try {
+  options = parseLoginOptions(process.argv.slice(2));
+} catch (err) {
+  process.stderr.write(`  ! ${err instanceof Error ? err.message : String(err)}
+`);
+  process.stderr.write("  Run `pushary login --help` for the full list.\n");
+  process.exit(EXIT.USAGE);
+}
+var { bold, dim, green, cyan, yellow } = createIo();
+var check = green("\u2713");
+var say = options.json ? (line) => process.stderr.write(`${line}
+`) : (line) => process.stdout.write(`${line}
+`);
+var emit = (payload) => {
+  if (options.json) process.stdout.write(`${JSON.stringify(payload, null, 2)}
+`);
+};
+var readStdin = async () => {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+  return Buffer.concat(chunks).toString("utf8").trim();
+};
+var recoverControl = () => {
+  const daemon = recoverDaemonAfterLogin();
+  if (daemon?.cleared) {
+    say(readControlMode() === "off" ? `  ${check} ${dim("Account verified. Phone-start remains off.")}` : daemon.restarted ? `  ${check} ${dim("Background daemon restarted with the verified key.")}` : `  ${yellow("!")} ${dim(`Background daemon may start again${daemon.detail ? ` (${daemon.detail})` : ""}`)}`);
+  }
+  return daemon;
+};
+var store = async (apiKey, siteSlug, keyName) => {
+  const verdict = await checkApiKey(apiKey);
+  const report = describeKeyCheck(verdict);
+  if (verdict.kind !== "ok") {
+    say(`  ${yellow("!")} ${report.message}`);
+    for (const line of report.next) say(`  ${dim(line)}`);
+    if (report.fatal) {
+      emit({ ok: false, reason: verdict.kind, keyCheck: verdict.kind, exitCode: report.exitCode });
+      return report.exitCode;
+    }
+  }
+  if (verdict.kind === "ok") siteSlug = verdict.identity.siteSlug;
+  const result = writeKey(apiKey);
+  say("");
+  say(verdict.kind === "ok" ? `  ${check} ${bold("Signed in.")}${siteSlug ? ` ${dim(`Site ${siteSlug}`)}` : ""}` : `  ${yellow("!")} ${verdict.kind === "locked" ? "Key saved, approvals inactive." : "Key saved, account readiness unverified."}`);
+  say(`  ${dim(`Key saved to ${result.configPath}`)}`);
+  if (result.rc.kind === "written" || result.rc.kind === "updated") {
+    say(`  ${dim(`Shell export ${result.rc.kind} in ${result.rc.path}`)}`);
+  } else if (result.rc.kind === "declined") {
+    say(`  ${yellow("!")} ${dim(`Left ${result.rc.path} alone: line ${result.rc.declinedLine} already sets PUSHARY_API_KEY.`)}`);
+  }
+  const daemon = verdict.kind === "ok" ? recoverControl() : null;
+  emit({
+    ok: verdict.kind === "ok",
+    siteSlug,
+    keyName,
+    configPath: result.configPath,
+    rc: result.rc.kind,
+    daemon,
+    keyCheck: verdict.kind,
+    ...verdict.kind !== "ok" ? { reason: verdict.kind } : {},
+    exitCode: report.exitCode
+  });
+  return report.exitCode;
+};
+var loginWithToken = async () => {
+  const token = await readStdin();
+  if (!token) {
+    say(`  ${yellow("!")} Nothing arrived on stdin. Pipe the key in: pushary login --with-token < key.txt`);
+    emit({ ok: false, reason: "no_input" });
+    process.exit(EXIT.INPUT_REQUIRED);
+  }
+  if (!isValidApiKey(token)) {
+    say(`  ${yellow("!")} That does not look like a Pushary key. Expected pk_xxx.xxx`);
+    emit({ ok: false, reason: "malformed" });
+    process.exit(EXIT.USAGE);
+  }
+  process.exit(await store(token, "", "pasted key"));
+};
+var main = async () => {
+  if (options.withToken) await loginWithToken();
+  if (!options.force) {
+    const existing = readKeySource();
+    if (existing.key) {
+      const verdict = await checkApiKey(existing.key);
+      if (verdict.kind === "ok") {
+        say("");
+        say(`  ${check} Already signed in ${dim(`(${verdict.identity.siteSlug})`)}`);
+        say(`  ${dim("Run")} ${cyan("pushary login --force")} ${dim("to replace this key.")}`);
+        const daemon = existing.key === readConfigFileKey() ? recoverControl() : null;
+        if (daemon === null) say("  The saved service key differs from this shell. Run pushary setup with the intended key before starting managed control.");
+        emit({ ok: true, reused: true, siteSlug: verdict.identity.siteSlug, keyCheck: "ok", daemon, exitCode: EXIT.OK });
+        process.exit(EXIT.OK);
+      }
+      if (verdict.kind === "locked" || verdict.kind === "unreachable") {
+        const report = describeKeyCheck(verdict);
+        say(`  ${yellow("!")} ${report.message}`);
+        for (const line of report.next) say(`  ${dim(line)}`);
+        say("  Existing key kept. Re-run pushary login to recheck readiness without replacing it.");
+        emit({ ok: false, reused: true, reason: verdict.kind, keyCheck: verdict.kind, exitCode: report.exitCode });
+        process.exit(report.exitCode);
+      }
+    }
+  }
+  const outcome = await runBrowserLogin(
+    { say, bold, dim, cyan, yellow },
+    { cliVersion: getPackageVersion(), noBrowser: options.noBrowser }
+  );
+  if (outcome.kind === "ok") {
+    process.exit(await store(outcome.apiKey, outcome.siteSlug, outcome.keyName));
+  }
+  if (outcome.kind === "unavailable") {
+    say(`  ${yellow("!")} Couldn't start a login ${dim(`(${outcome.detail})`)}`);
+    say(`  ${dim("Check your connection, or paste a key with")} ${cyan("pushary login --with-token < key.txt")}`);
+    emit({ ok: false, reason: "unreachable", detail: outcome.detail });
+    process.exit(EXIT.UNREACHABLE);
+  }
+  if (outcome.kind === "rejected") {
+    say("");
+    say(`  ${yellow("!")} That request was rejected in the browser. Nothing was written.`);
+    emit({ ok: false, reason: "rejected" });
+    process.exit(EXIT.NOT_CONFIGURED);
+  }
+  say("");
+  say(`  ${yellow("!")} The code expired before it was approved.`);
+  say(`  ${dim("Run")} ${cyan("pushary login")} ${dim("for a fresh one.")}`);
+  emit({ ok: false, reason: "expired" });
+  process.exit(EXIT.NOT_CONFIGURED);
+};
+main().catch((err) => {
+  process.stderr.write(`  ! login failed: ${err instanceof Error ? err.message : String(err)}
+`);
+  process.exit(EXIT.FAILED);
+});

package/dist/bin/pushary-logout.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node