pushary 1.8.0

package/dist/bin/pushary-setup.js

@@ -0,0 +1,2660 @@
+#!/usr/bin/env node
+import {
+  codexTrustOutcome,
+  describeCodexTrustConfirmation
+} from "../chunk-TY4JT7W3.js";
+import {
+  runBrowserLogin
+} from "../chunk-JYG4B33G.js";
+import {
+  coworkOutput,
+  coworkSelection
+} from "../chunk-7Z7Q4GGS.js";
+import "../chunk-PUZZELE6.js";
+import {
+  detectClaudeVersion
+} from "../chunk-SIFVFP6T.js";
+import {
+  describeVersionManagerPin,
+  versionManagerOf
+} from "../chunk-GU3EJCVV.js";
+import {
+  ensureCodexTrustsPusharyHooks
+} from "../chunk-RHR6NARM.js";
+import {
+  readManagedControlEvidence,
+  waitForMachineReadiness
+} from "../chunk-DE4Y6TCC.js";
+import {
+  describeSetupSideEffects,
+  installAgentSkill,
+  installSkillViaSkillsCli,
+  registerCursorGate
+} from "../chunk-KVQBWI5T.js";
+import {
+  AgentConfigError,
+  FX_PUSHARY_TOOLS_RULE,
+  FX_QUESTION_TOOL,
+  FX_TOOL_DISCOVERY_NOTE,
+  HERMES_PIP_PACKAGE,
+  SHARED_AGENTS_MD_LABEL,
+  afterAgentFailureNote,
+  agentFailureFromError,
+  agentFailureWire,
+  configFailureKind,
+  configureFxSettings,
+  describeDetection,
+  describedAgentFailure,
+  detectAllAgents,
+  failedAgentsContext,
+  fxIgnoresInstructionsFile,
+  fxPusharyEntry,
+  inspectFxInstallation,
+  isDetected,
+  isHermesConfigReceipt,
+  pluginLocationSnippet,
+  readFxProfileForSetup,
+  registerPluginLocation,
+  renderAgentInstructions,
+  renderProjectAgentInstructions,
+  resolveHermesPython,
+  retryAgentCommand,
+  runHermesConfigScript,
+  shortenHome,
+  vscodeSettingsTargets,
+  withFxPusharyServer,
+  writeFxProfile,
+  writeInstructionBlock
+} from "../chunk-MDEPU45E.js";
+import {
+  MCP_BRIDGE_BINARY
+} from "../chunk-SLFABHW3.js";
+import {
+  OPENCODE_HOOK_BINARY,
+  addOpenCodeMcpServer,
+  installOpenCodePlugin,
+  openCodeConfigDir,
+  openCodeConfigFile,
+  openCodeInstructionsFile,
+  openCodePluginDir,
+  openCodePluginFile,
+  openCodeWired
+} from "../chunk-AHV4LNB5.js";
+import {
+  addCompatibleHooks,
+  addCompatibleMcpServer,
+  addCompatibleToolPermissions,
+  compatibleConfigFile,
+  compatibleHookEvents,
+  compatibleInstructionsFile,
+  compatibleMcpFile,
+  compatiblePermissionRuleFile,
+  hasCompatibleHooks
+} from "../chunk-J5TIV3J6.js";
+import {
+  addClaudeMcpServer,
+  addPusharyHooks,
+  addPusharyToolPermissions,
+  captureClaudeMcpServer,
+  isClaudeMcpSnapshot,
+  updateClaudeMcpSnapshot
+} from "../chunk-AXPCESYO.js";
+import {
+  detectProviderLiveCapabilities,
+  hasSpawnProvider,
+  resolveControlPolicy
+} from "../chunk-HQ6G3B5R.js";
+import {
+  describeAutoUpdateAnnouncement,
+  takeAutoUpdateAnnouncement
+} from "../chunk-UI36QSBI.js";
+import {
+  KEEP_HINT,
+  captureHookTakeover,
+  captureMcpServer,
+  describeAppOwnership,
+  describeHookOwnership,
+  hookOwnerOf,
+  mcpBearerKey,
+  planHooks
+} from "../chunk-EYK3GSRH.js";
+import {
+  AGENT_CHOICES,
+  effectiveControlMode,
+  effectiveVerify,
+  parseSetupOptions
+} from "../chunk-ZVSKMPBZ.js";
+import {
+  liveBridgeProbe,
+  resolveBridgeStub
+} from "../chunk-C2WCPBF7.js";
+import {
+  claudeWired,
+  codexWired,
+  geminiWired,
+  pusharyHookExecutable
+} from "../chunk-6J2JC2RT.js";
+import {
+  clearDaemonNeedsLogin,
+  daemonHasRemoteProof,
+  daemonServiceDefinitionPath,
+  daemonServiceManagerAvailable,
+  disableDaemonService,
+  ensureDaemonRunning,
+  hasDaemonServiceDefinition,
+  readDaemonStatus,
+  replaceDaemonService,
+  stopDaemonService,
+  waitForDaemonRemoteProof
+} from "../chunk-WE2J62NC.js";
+import {
+  GEMINI_HOOK_BINARY,
+  addGeminiHooks,
+  addGeminiMcpServer,
+  compareVersion,
+  parseVersion
+} from "../chunk-3EVPNIBE.js";
+import "../chunk-OKXS7WDZ.js";
+import {
+  transcriptPreferenceForSetup
+} from "../chunk-OLQRRFBX.js";
+import "../chunk-XHKBHWLX.js";
+import {
+  reportEvent
+} from "../chunk-CULUZTWQ.js";
+import "../chunk-N6IOSZOE.js";
+import "../chunk-EPCXUP3P.js";
+import "../chunk-NGDD6TXY.js";
+import "../chunk-CVQYGMSR.js";
+import "../chunk-POFBE6ZY.js";
+import {
+  BROWSER_CONNECT_COMMAND,
+  confirmAppConnection,
+  connectDevice,
+  connectViaAppPairing,
+  describeRoundTrip,
+  pairingEscapeApplies,
+  printConnectInstructions,
+  roundTripEvidence,
+  verifyRoundTrip
+} from "../chunk-M5JDZ45W.js";
+import "../chunk-3EGEA4KH.js";
+import {
+  setHumanStream
+} from "../chunk-QCGNGEGE.js";
+import {
+  ansiPainter,
+  createIo,
+  useColor
+} from "../chunk-U4TMAANR.js";
+import "../chunk-GMXKITVA.js";
+import {
+  KEY_FILE_MODE,
+  exportLine,
+  installClaudeAlias,
+  keyPrefix,
+  readConfigFileKey,
+  readControlMode,
+  readKeySource,
+  resolveShellRc,
+  writeKey
+} from "../chunk-P7WQEVWA.js";
+import "../chunk-M5ICYGHT.js";
+import {
+  checkApiKey,
+  describeKeyCheck,
+  samePusharyAccount
+} from "../chunk-2ABTSGFT.js";
+import "../chunk-2OY3ZZ5N.js";
+import "../chunk-LXQ5FBBD.js";
+import {
+  UsageError
+} from "../chunk-7QLSKOSU.js";
+import {
+  EXIT
+} from "../chunk-KZERVKTD.js";
+import "../chunk-DB3ONZB4.js";
+import {
+  NpmMissingError,
+  addCodexHookTrust,
+  addCodexHooks,
+  addCodexMcpServer,
+  autoUpdateState,
+  captureCodexHookTrust,
+  claudeJson,
+  claudeMcpReceipt,
+  claudeSettings,
+  claudeSkillDir,
+  codexAgentsMd2 as codexAgentsMd,
+  codexConfigToml,
+  codexHome,
+  codexHookPositions,
+  codexSkillDir2 as codexSkillDir,
+  codexVacatedIndexes,
+  cursorPluginDir,
+  cursorUserHooks,
+  cursorUserMcp,
+  dropVacatedCodexHookTrust,
+  fetchLatestPublishedVersion,
+  fxAgentsMd,
+  fxConfigDir,
+  fxMcpProfile,
+  fxQuestionRuleReceipt,
+  fxSettings,
+  geminiMd,
+  geminiSettings,
+  guardBinary,
+  guardCursorGate,
+  guardedArgv,
+  hermesConfigReceipt,
+  hookTakeoverReceipt,
+  installGlobally,
+  npmErrorMessage,
+  plannedGlobalPackage,
+  pusharyConfigFile,
+  pusharyDir,
+  readCodexMcpAuth,
+  resolveGlobalBinDir,
+  resolveGlobalBinary,
+  vscodePluginDir,
+  vscodePluginMcp
+} from "../chunk-A2A2YTMG.js";
+import {
+  backupFile,
+  readJsonSafe,
+  writeFileAtomic,
+  writeJsonAtomic
+} from "../chunk-T7E75EKA.js";
+import "../chunk-GPEGOGRJ.js";
+import {
+  NPX_LATEST_COMMAND,
+  renderCommandHelp
+} from "../chunk-E4FJTUH4.js";
+import {
+  HOOK_COMPATIBLE_PROFILES,
+  HOOK_LOCATOR_BINARY,
+  PRETOOLUSE_GATED_TOOLS,
+  SUPPORT_EMAIL,
+  compatibleTargetFiles,
+  getPackageVersion,
+  hookCompatibleProfile,
+  isNewerVersion,
+  isValidApiKey,
+  launchedPackage,
+  ownPackageName
+} from "../chunk-NQTHFF4W.js";
+
+// bin/pushary-setup.ts
+import { existsSync, readFileSync, writeFileSync, mkdirSync, cpSync, rmSync, renameSync, realpathSync, readdirSync, statSync, openSync, readSync, closeSync } from "fs";
+import { join as join3, dirname as dirname2, basename } from "path";
+import { homedir } from "os";
+import { execSync } from "child_process";
+import { checkbox, input, confirm } from "@inquirer/prompts";
+import { fileURLToPath } from "url";
+import { parse as parseTOML, stringify as stringifyTOML } from "smol-toml";
+
+// src/cli/exit.ts
+var isExitPromptError = (err) => err instanceof Error && (err.name === "ExitPromptError" || err.message.includes("User force closed") || /force closed the prompt/i.test(err.message));
+
+// src/setup/phone-check.ts
+var planPhoneCheck = (context) => {
+  if (context.locked) return "locked";
+  if (context.skipPhone) return "skip-phone";
+  if (context.verify === "none") return "verify-none";
+  if (!context.stdoutIsTty) return "instructions";
+  if (context.paired) return "confirm-pairing";
+  if (context.connectMode === "app") return "reuse-app";
+  return "connect";
+};
+
+// src/setup/closing.ts
+var ACTIVITY_URL = "pushary.com/dashboard/agent/activity";
+var COMMAND_SURFACE = [
+  { command: "pushary status", summary: "what this machine is connected to" },
+  { command: "pushary mode", summary: "choose where approval requests appear" },
+  { command: "pushary wait", summary: "block until a pending question is answered" },
+  { command: "pushary stats", summary: "what your agents have been asking" },
+  { command: "pushary claude", summary: "run Claude Code with encrypted transcript support" },
+  { command: "pushary doctor", summary: "check the install" }
+];
+var SURFACE_COLUMN = Math.max(...COMMAND_SURFACE.map((entry) => entry.command.length)) + 2;
+var renderCommandSurface = () => COMMAND_SURFACE.map((entry) => `${entry.command.padEnd(SURFACE_COLUMN)}${entry.summary}`);
+var nextSteps = (facts, reachable) => {
+  const lines = ["Delivery follows the current approval mode, recipient rules and presence. pushary mode status shows the workspace setting.", facts.managedControlReady === true ? "Phone-start and steering: local and server checks passed just now. Recheck after sleep or network changes." : "Phone-start and steering: unverified. Run pushary doctor to check the provider, background service and server route."];
+  if (facts.staleEnvironmentKey) {
+    lines.push("Open a new terminal or unset PUSHARY_API_KEY, then run pushary doctor before starting an agent.");
+  }
+  if (facts.transcriptSync === false) {
+    lines.push("Transcripts: disabled on this machine.");
+    lines.push("pushary setup --transcripts on    enable encrypted transcript sync");
+  } else {
+    lines.push("Transcripts: Pushary-launched Claude, Codex and Gemini sessions sync redacted, encrypted content. Your phone can decrypt it; authorized Pushary compliance admins can recover it for documented legal obligations.");
+    lines.push("pushary setup --transcripts off   disable transcript sync on this machine");
+  }
+  if (facts.completed.includes("claude_code")) {
+    lines.push("pushary claude          launch a managed Claude Code session");
+  }
+  if (!reachable) {
+    lines.push("pushary connect         connect a phone without re-running setup");
+  }
+  lines.push("pushary doctor          re-check everything");
+  return lines;
+};
+var describeClosing = (facts) => {
+  const reachable = facts.reachChecked && facts.reachesYou;
+  if (facts.configuredNothing) {
+    return {
+      ok: false,
+      headline: "Setup failed.",
+      next: ["Nothing was configured. Run pushary doctor to see why."],
+      exitCode: EXIT.FAILED,
+      reason: "configured-nothing"
+    };
+  }
+  if (facts.failed.length > 0) {
+    const count = facts.failed.length;
+    return {
+      ok: false,
+      headline: `Setup finished with ${count} problem${count === 1 ? "" : "s"}.`,
+      next: [
+        ...nextSteps(facts, reachable),
+        "",
+        `Approvals: ${ACTIVITY_URL}`
+      ],
+      exitCode: EXIT.PROBLEMS_FOUND,
+      reason: "agents-failed"
+    };
+  }
+  if (facts.staleEnvironmentKey) {
+    return {
+      ok: false,
+      headline: "Agents configured. This terminal still selects the previous key.",
+      next: nextSteps(facts, reachable),
+      exitCode: EXIT.PROBLEMS_FOUND,
+      reason: "stale-environment-key"
+    };
+  }
+  if (facts.daemonReady === false) {
+    return {
+      ok: false,
+      headline: "Setup finished with 1 problem.",
+      next: [
+        "Agent configuration and managed control are separate. Phone-start and steering could not be verified.",
+        "pushary daemon install   install or repair the background service",
+        "pushary doctor           verify it became reachable"
+      ],
+      exitCode: EXIT.PROBLEMS_FOUND,
+      reason: "control-unready"
+    };
+  }
+  if (facts.roundTripAnswered === true) {
+    return {
+      ok: true,
+      headline: "Agents configured. Synthetic answer returned.",
+      next: ["Agent hook activation remains unverified.", ...nextSteps(facts, reachable), "", `Approvals: ${ACTIVITY_URL}`],
+      exitCode: EXIT.OK,
+      reason: "synthetic-answer"
+    };
+  }
+  if (facts.reachChecked && !facts.reachesYou) {
+    return {
+      ok: false,
+      headline: "Agents configured. Phone delivery is unverified.",
+      next: [
+        "Approval routing depends on your mode, presence and recipients. Check the phone and its notification settings.",
+        "",
+        ...nextSteps(facts, false)
+      ],
+      exitCode: EXIT.NO_DEVICE,
+      reason: "phone-unverified"
+    };
+  }
+  if (facts.roundTripAnswered === false) {
+    return {
+      ok: false,
+      headline: "Agents configured. Nobody answered the test question.",
+      next: [
+        "No answer returned from the synthetic test. Delivery acceptance does not prove a visible notification.",
+        "",
+        "Check the notification opened something you could tap, then:",
+        "pushary doctor --roundtrip   send another one",
+        "",
+        "If you simply were not looking, re-run setup or pass --verify push to skip this check."
+      ],
+      exitCode: EXIT.PROBLEMS_FOUND,
+      reason: "roundtrip-unanswered"
+    };
+  }
+  if (!facts.reachChecked) {
+    return {
+      ok: true,
+      headline: "Setup complete.",
+      next: [
+        "The phone check was skipped, so nothing here proves an approval reaches you.",
+        "",
+        ...nextSteps(facts, false)
+      ],
+      exitCode: EXIT.OK,
+      reason: "phone-skipped"
+    };
+  }
+  return {
+    ok: true,
+    headline: "Setup complete.",
+    next: [...nextSteps(facts, true), "", `Approvals: ${ACTIVITY_URL}`],
+    exitCode: EXIT.OK,
+    reason: "complete"
+  };
+};
+var RETRY_AGENT_LABEL = "Retry just this agent:";
+var INSTALL_NODE_STEP = "Install the current Node.js LTS, which includes npm, then run setup again.";
+var nextStepFor = (failure) => failure.remedy === "install-node" ? { kind: "install-node", instruction: INSTALL_NODE_STEP } : { kind: "retry-agent", command: retryAgentCommand(failure.agent) };
+var describeAgentFailures = (failures, agentName) => failures.map((failure) => ({
+  summary: `${agentName(failure.agent)}: ${failure.detail}`,
+  next: nextStepFor(failure)
+}));
+var agentFailureFollowUps = (failures) => [
+  ...failures.some((failure) => failure.remedy === "install-node") ? ["install-node"] : [],
+  ...failures.some((failure) => failure.remedy === "retry-agent") ? ["run-doctor"] : []
+];
+var unverifiedKeyClosingReason = (facts) => {
+  if (facts.failedCount > 0) return "agents-failed";
+  if (facts.controlLifecycleFailed) return "control-unready";
+  return facts.keyCheck === "locked" ? "plan-inactive" : "key-unverified";
+};
+
+// src/setup/codex-version.ts
+import { dirname, join } from "path";
+var parseCodexVersion = parseVersion;
+var compareCodexVersion = compareVersion;
+var versionFromManifest = (probe, binPath) => {
+  const readVersion = (path) => {
+    const raw = probe.readFile(path);
+    if (!raw) return null;
+    try {
+      const { version } = JSON.parse(raw);
+      return typeof version === "string" ? parseCodexVersion(version) : null;
+    } catch {
+      return null;
+    }
+  };
+  let dir = dirname(binPath);
+  const shimVersion = readVersion(join(dir, "node_modules", "@openai", "codex", "package.json"));
+  if (shimVersion) return shimVersion;
+  for (let depth = 0; depth < 4; depth++) {
+    const version = readVersion(join(dir, "package.json"));
+    if (version) return version;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+};
+var readCodexVersion = (probe) => {
+  const onPath = probe.resolveOnPath();
+  if (onPath) {
+    const fromManifest = versionFromManifest(probe, probe.realpath(onPath) ?? onPath);
+    if (fromManifest) return fromManifest;
+  }
+  const brew = probe.brewVersions();
+  if (brew) {
+    const parsed = parseCodexVersion(brew);
+    if (parsed) return parsed;
+  }
+  const bundled = probe.bundledVersion?.();
+  return bundled ? parseCodexVersion(bundled) : null;
+};
+
+// src/setup/codex-install.ts
+var NATIVE_BINARY_MIN_BYTES = 20 * 1024 * 1024;
+var packageRootFor = (probe, binPath) => {
+  let dir = probe.dirname(binPath);
+  for (let depth = 0; depth < 4; depth++) {
+    if (probe.exists(probe.join(dir, "package.json"))) return dir;
+    const parent = probe.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+};
+var holdsNativeBinary = (probe, dir, depth = 0) => {
+  if (depth > 4) return false;
+  const entries = probe.listDir(dir);
+  if (!entries) return false;
+  return entries.some((entry) => {
+    const path = probe.join(dir, entry);
+    const size = probe.fileSize(path);
+    if (size !== null) return size >= NATIVE_BINARY_MIN_BYTES;
+    return holdsNativeBinary(probe, path, depth + 1);
+  });
+};
+var platformPackages = (probe, packageRoot) => {
+  const scopes = [probe.join(packageRoot, "node_modules", "@openai"), probe.dirname(packageRoot)];
+  return scopes.flatMap(
+    (scope) => (probe.listDir(scope) ?? []).filter((entry) => entry.startsWith("codex-")).map((entry) => probe.join(scope, entry))
+  );
+};
+var checkCodexInstall = (probe) => {
+  const onPath = probe.resolveOnPath();
+  if (!onPath) return { kind: "unknown" };
+  const packageRoot = packageRootFor(probe, probe.realpath(onPath) ?? onPath);
+  if (!packageRoot) return { kind: "unknown" };
+  const vendors = platformPackages(probe, packageRoot).map((pkg) => probe.join(pkg, "vendor")).filter((vendor) => probe.exists(vendor));
+  if (vendors.length === 0) return { kind: "unknown" };
+  if (vendors.some((vendor) => holdsNativeBinary(probe, vendor))) return { kind: "ok" };
+  return { kind: "binary-missing", vendorDir: vendors[0] };
+};
+
+// src/setup/codex-bundled.ts
+import { join as join2 } from "path";
+var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+var codexCliPathFromConfig = (config) => {
+  const servers = asRecord(config.mcp_servers);
+  if (!servers) return null;
+  for (const server of Object.values(servers)) {
+    const declared = asRecord(asRecord(server)?.env)?.CODEX_CLI_PATH;
+    if (typeof declared === "string" && declared.trim()) return declared.trim();
+  }
+  return null;
+};
+var bundledCodexCandidates = (home, platform) => platform === "darwin" ? [
+  "/Applications/ChatGPT.app/Contents/Resources/codex",
+  join2(home, "Applications", "ChatGPT.app", "Contents", "Resources", "codex")
+] : [];
+var findBundledCodex = (probe) => {
+  const config = probe.config();
+  const declared = config ? codexCliPathFromConfig(config) : null;
+  if (declared && probe.exists(declared)) return declared;
+  return bundledCodexCandidates(probe.home, probe.platform).find(probe.exists) ?? null;
+};
+var parseEmbeddedCodexVersion = (haystack) => haystack.match(/cli_version(\d+\.\d+\.\d+)/)?.[1] ?? null;
+
+// src/setup/telemetry.ts
+var roundTripOutcome = (outcome) => {
+  switch (outcome?.kind) {
+    case "answered":
+      return "answered";
+    case "notify-only":
+      return "delivered";
+    case "unanswered":
+      return "delivered";
+    case "no-recipients":
+      return "unreachable";
+    default:
+      return null;
+  }
+};
+var currentStep = "start";
+var markStep = (step) => {
+  currentStep = step;
+};
+var recordedOptions = null;
+var recordSetupOptions = (options) => {
+  recordedOptions = options;
+};
+var recordedKey = null;
+var recordSetupKey = (apiKey) => {
+  recordedKey = apiKey;
+};
+var recordedCodexTrust = null;
+var recordCodexTrust = (outcome) => {
+  recordedCodexTrust = outcome;
+};
+var emitted = false;
+var SETUP_COMPLETED_EVENT = "agent_setup_completed";
+var SETUP_AGENT_TYPE = "setup";
+var defaultDeps = { report: reportEvent };
+var completeBeacon = (run) => ({
+  ...run,
+  codexTrust: recordedCodexTrust,
+  cliVersion: getPackageVersion()
+});
+var emit = async (deps, run) => {
+  if (emitted) return;
+  emitted = true;
+  try {
+    await deps.report(
+      { event: SETUP_COMPLETED_EVENT, agentType: SETUP_AGENT_TYPE, ...completeBeacon(run) },
+      { maxAttempts: 1, timeoutMs: 2e3, ...recordedKey ? { apiKey: recordedKey } : {} }
+    );
+  } catch {
+  }
+};
+var reportSetupOutcomeWith = async (deps, outcome) => emit(deps, {
+  agents: outcome.completed,
+  connectMode: outcome.options.connectMode,
+  connectOutcome: outcome.connectOutcome,
+  failedAgents: outcome.failures.length,
+  agentFailures: agentFailureWire(outcome.failures),
+  closingReason: outcome.closingReason,
+  skippedAgents: outcome.skipped,
+  nonInteractive: outcome.options.nonInteractive,
+  keyCheck: outcome.keyCheck,
+  exitCode: outcome.exitCode,
+  // Where the run stopped. On a completed run this is the closing step, so the
+  // interesting values are the ones that are not.
+  abandonedAt: outcome.exitCode === 0 ? null : currentStep,
+  // Always present, so a query can separate "ended" from "gave up" on the
+  // property rather than on the absence of one.
+  abortReason: null
+});
+var reportSetupOutcome = (outcome) => reportSetupOutcomeWith(defaultDeps, outcome);
+var reportSetupAbortWith = async (deps, reason, exitCode, keyCheck = "unknown") => emit(deps, {
+  agents: [],
+  connectMode: recordedOptions?.connectMode ?? null,
+  connectOutcome: "skipped",
+  failedAgents: 0,
+  agentFailures: [],
+  closingReason: null,
+  skippedAgents: [],
+  nonInteractive: recordedOptions?.nonInteractive ?? null,
+  keyCheck,
+  exitCode,
+  abandonedAt: currentStep,
+  abortReason: reason
+});
+var reportSetupAbort = (reason, exitCode, keyCheck) => reportSetupAbortWith(defaultDeps, reason, exitCode, keyCheck);
+
+// src/setup/app-key.ts
+var pickAppKey = (candidates) => candidates.fromAgents.find(
+  (candidate) => typeof candidate === "string" && candidate !== candidates.storedKey && candidate !== candidates.envKey && isValidApiKey(candidate)
+) ?? null;
+
+// bin/pushary-setup.ts
+var CLAUDE_SETTINGS = claudeSettings();
+var CLAUDE_JSON = claudeJson();
+var CLAUDE_MCP_RECEIPT = claudeMcpReceipt();
+var HERMES_CONFIG_RECEIPT = hermesConfigReceipt();
+var CURSOR_PLUGIN_DIR = cursorPluginDir();
+var CURSOR_USER_HOOKS = cursorUserHooks();
+var VSCODE_PLUGIN_DIR = vscodePluginDir();
+var VSCODE_PLUGIN_MCP = vscodePluginMcp();
+var CLAUDE_SKILL_DIR = claudeSkillDir();
+var CODEX_HOME = codexHome();
+var CODEX_SKILL_DIR = codexSkillDir();
+var CODEX_AGENTS_MD = codexAgentsMd();
+var GEMINI_SETTINGS = geminiSettings();
+var GEMINI_MD = geminiMd();
+var PUSHARY_CONFIG_FILE = pusharyConfigFile();
+var manualSteps = [];
+var noteManual = (step) => {
+  manualSteps.push(step);
+};
+var humanStream = process.stdout;
+var writeHuman = (text) => {
+  humanStream.write(text);
+};
+var jsonMode = false;
+var paint = ansiPainter(() => useColor({ json: jsonMode }));
+var dim = paint("\x1B[2m");
+var bold = paint("\x1B[1m");
+var green = paint("\x1B[32m");
+var cyan = paint("\x1B[36m");
+var yellow = paint("\x1B[33m");
+var check = green("\u2713");
+var abortWith = async (reason, code, keyCheck) => {
+  await reportSetupAbort(reason, code, keyCheck);
+  if (jsonMode) {
+    process.stdout.write(`${JSON.stringify({ ok: false, reason, exitCode: code, ...keyCheck ? { keyCheck } : {} }, null, 2)}
+`);
+  }
+  return code;
+};
+var readKeyFromStdin = async (options) => {
+  if (!options.keyStdin) return void 0;
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  const first = Buffer.concat(chunks).toString("utf-8").split("\n", 1)[0]?.trim();
+  if (!first) {
+    console.log(`
+  ${yellow("!")} --key-stdin was passed but stdin was empty.`);
+    process.exit(EXIT.USAGE);
+  }
+  if (!isValidApiKey(first)) {
+    console.log(`
+  ${yellow("!")} The key on stdin is not a valid Pushary key. Expected: ${dim("pk_xxx.xxx")}`);
+    console.log(`  ${dim("Copy your key from")} ${cyan("https://pushary.com/dashboard/agent/settings")}
+`);
+    process.exit(EXIT.USAGE);
+  }
+  return first;
+};
+var isInstalled = (command) => {
+  const whichCmd = process.platform === "win32" ? "where" : "which";
+  try {
+    execSync(`${whichCmd} ${command}`, { stdio: "ignore", timeout: 5e3 });
+    return true;
+  } catch {
+    return false;
+  }
+};
+var readJson = (filePath) => {
+  try {
+    return JSON.parse(readFileSync(filePath, "utf-8"));
+  } catch {
+    return {};
+  }
+};
+var readAgentJson = (filePath) => {
+  const result = readJsonSafe(filePath);
+  if (result.kind === "ok") return result.value;
+  if (result.kind === "missing") return {};
+  const backup = backupFile(filePath);
+  const reason = result.kind === "unparseable" ? "is not valid JSON" : "could not be read";
+  throw new AgentConfigError(
+    configFailureKind(result.kind),
+    filePath,
+    `${filePath} ${reason}, so it was left untouched. A copy is at ${backup}. Fix or remove the original, then re-run setup.`
+  );
+};
+var writeJson = (filePath, data) => {
+  const dir = dirname2(filePath);
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n", "utf-8");
+};
+var readAgentToml = (filePath) => {
+  let raw;
+  try {
+    raw = readFileSync(filePath, "utf-8");
+  } catch (err) {
+    if (err.code === "ENOENT") return {};
+    throw new AgentConfigError("config-unreadable", filePath, `${filePath} could not be read, so it was left untouched.`);
+  }
+  if (raw.trim() === "") return {};
+  try {
+    return parseTOML(raw);
+  } catch {
+    const backup = backupFile(filePath);
+    throw new AgentConfigError(
+      "config-unparseable",
+      filePath,
+      `${filePath} is not valid TOML, so it was left untouched. A copy is at ${backup}. Fix or remove the original, then re-run setup.`
+    );
+  }
+};
+var formatError = (err) => {
+  if (err instanceof Error) {
+    const errWithSignal = err;
+    if (errWithSignal.killed && errWithSignal.signal === "SIGTERM") {
+      return "timed out \u2014 check your network connection";
+    }
+    return err.message;
+  }
+  return String(err);
+};
+var spinner = (label, fn, options = {}) => createIo(humanStream, { json: jsonMode }).spinner(label, fn, options);
+var checkForUpdates = async (current, markAnnounced) => {
+  const announcement = takeAutoUpdateAnnouncement(autoUpdateState(), markAnnounced);
+  if (announcement) {
+    console.log(`  ${check} ${describeAutoUpdateAnnouncement(announcement)}`);
+    console.log();
+  }
+  const latest = await fetchLatestPublishedVersion({ packageName: launchedPackage(ownPackageName()), timeoutMs: 3e3 });
+  if (latest && isNewerVersion(latest, current)) {
+    console.log(`  ${yellow("!")} Update available: ${dim(current)} \u2192 ${green(latest)}`);
+    console.log(`  ${dim("Run:")} ${NPX_LATEST_COMMAND} upgrade`);
+    console.log();
+  }
+};
+var globalInstallReady = false;
+var warnVersionManagerPin = (execPath) => {
+  const manager = versionManagerOf(execPath);
+  if (manager) console.log(`  ${yellow("!")} ${describeVersionManagerPin(execPath, manager)}`);
+};
+var installGlobally2 = async () => {
+  if (globalInstallReady) return;
+  const version = getPackageVersion();
+  await spinner(`Installing pushary-hook globally (${version})`, async () => {
+    try {
+      await installGlobally({ version });
+    } catch (err) {
+      throw err instanceof NpmMissingError ? err : new Error(npmErrorMessage(err));
+    }
+  });
+  globalInstallReady = true;
+};
+var _cachedSkillContent = null;
+var fetchSkillContent = async () => {
+  if (_cachedSkillContent) return _cachedSkillContent;
+  const __dirname = dirname2(fileURLToPath(import.meta.url));
+  const candidates = [
+    join3(__dirname, "..", "..", "data", "SKILL.md"),
+    join3(__dirname, "..", "data", "SKILL.md")
+  ];
+  const source = candidates.find((path) => existsSync(path));
+  if (!source) throw new Error("packaged skill not found");
+  _cachedSkillContent = readFileSync(source, "utf-8");
+  return _cachedSkillContent;
+};
+var writePackagedSkill = async (dir) => {
+  const content = await fetchSkillContent();
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  writeFileSync(join3(dir, "SKILL.md"), content, "utf-8");
+};
+var skillsCliInUse = () => isInstalled("skills") || existsSync(join3(homedir(), ".agents", "skills"));
+var skillInstallEffects = {
+  runSkillsCli: installSkillViaSkillsCli,
+  skillModifiedAt: (dir) => statSync(join3(dir, "SKILL.md"), { throwIfNoEntry: false })?.mtimeMs ?? null,
+  writePackagedSkill,
+  now: () => Date.now()
+};
+var installSkill = async (agent, agentSkillDir) => {
+  await spinner("Installing Pushary skill", async () => {
+    await installAgentSkill({ agent, agentSkillDir, skillsCliInUse: skillsCliInUse() }, skillInstallEffects);
+  }, { optional: true });
+};
+var setupClaudeCode = async (apiKey) => {
+  console.log(`
+  ${bold("Setting up Claude Code")}
+`);
+  await installGlobally2();
+  const claudeJson2 = readAgentJson(CLAUDE_JSON);
+  const settings = readAgentJson(CLAUDE_SETTINGS);
+  const mcpReceipt = readJsonSafe(CLAUDE_MCP_RECEIPT);
+  let mcpSnapshot;
+  if (mcpReceipt.kind === "missing") {
+    mcpSnapshot = captureClaudeMcpServer(claudeJson2, apiKey);
+  } else {
+    if (mcpReceipt.kind !== "ok" || !isClaudeMcpSnapshot(mcpReceipt.value)) {
+      throw new Error(`Cannot safely replace Claude's Pushary MCP entry: ${CLAUDE_MCP_RECEIPT} is unreadable or invalid.`);
+    }
+    mcpSnapshot = updateClaudeMcpSnapshot(mcpReceipt.value, apiKey);
+  }
+  writeJsonAtomic(CLAUDE_MCP_RECEIPT, mcpSnapshot, 384);
+  await spinner("Adding MCP server (type: http)", async () => {
+    addClaudeMcpServer(claudeJson2, apiKey);
+  });
+  await spinner("Auto-allowing Pushary tools", async () => {
+    addPusharyToolPermissions(settings);
+  });
+  await spinner("Adding hooks (approvals, activity, presence, and lifecycle events)", async () => {
+    addPusharyHooks(settings, resolveGlobalBinDir("pushary-hook"), detectClaudeVersion());
+  });
+  await spinner(`Writing ${CLAUDE_JSON}`, async () => {
+    writeJsonAtomic(CLAUDE_JSON, claudeJson2, 384);
+  });
+  await spinner(`Writing ${CLAUDE_SETTINGS}`, async () => {
+    writeJsonAtomic(CLAUDE_SETTINGS, settings);
+  });
+  await installSkill("claude-code", CLAUDE_SKILL_DIR);
+  console.log();
+  console.log(`  ${dim("What this configured:")}`);
+  console.log(`  ${dim("\u2022")} MCP server: your agent can send notifications and ask questions`);
+  console.log(`  ${dim("\u2022")} Skill: teaches your agent when and how to use Pushary`);
+  console.log(`  ${dim("\u2022")} Hooks: route permission approvals through push notifications`);
+  console.log(`  ${dim("\u2022")} Auto-allowed tools: no permission prompts for Pushary MCP calls`);
+};
+var IS_WINDOWS = process.platform === "win32";
+var ensurePip = (python) => {
+  try {
+    execSync(`"${python}" -m pip --version`, { stdio: "ignore", timeout: 15e3 });
+    return;
+  } catch {
+  }
+  try {
+    execSync(`"${python}" -m ensurepip --upgrade`, { stdio: "pipe", timeout: 6e4 });
+  } catch {
+  }
+};
+var enablePusharyPlugin = (python) => {
+  return runHermesConfigScript(python, "setup", HERMES_CONFIG_RECEIPT) !== "failed";
+};
+var setupHermes = async (_apiKey) => {
+  console.log(`
+  ${bold("Setting up Hermes Agent")}
+`);
+  if (!isInstalled("hermes")) {
+    console.log(`  ${yellow("!")} Hermes CLI not found. Skipping.`);
+    console.log(`  ${dim("Install Hermes and re-run setup to configure.")}`);
+    return "skipped";
+  }
+  const python = resolveHermesPython();
+  if (!python) {
+    console.log(`  ${yellow("!")} Could not locate the Python that Hermes runs in. Skipping.`);
+    noteManual(`Install the Hermes plugin by hand: <hermes-python> -m pip install ${HERMES_PIP_PACKAGE}`);
+    return "skipped";
+  }
+  const existingReceipt = readJsonSafe(HERMES_CONFIG_RECEIPT);
+  if (existingReceipt.kind !== "missing" && (existingReceipt.kind !== "ok" || !isHermesConfigReceipt(existingReceipt.value))) {
+    throw new Error(`Cannot safely configure Hermes: ${HERMES_CONFIG_RECEIPT} is unreadable or invalid.`);
+  }
+  await spinner(`Installing ${HERMES_PIP_PACKAGE} into Hermes\u2019 environment`, async () => {
+    ensurePip(python);
+    execSync(`"${python}" -m pip install --upgrade ${HERMES_PIP_PACKAGE}`, { stdio: "pipe", timeout: 18e4 });
+  });
+  let pluginEnabled = false;
+  await spinner("Enabling plugin + routing questions to push", async () => {
+    pluginEnabled = enablePusharyPlugin(python);
+  });
+  if (!pluginEnabled) {
+    console.log(`  ${yellow("!")} Installed the plugin, but could not edit Hermes' config.`);
+    noteManual('Add "pushary" to plugins.enabled and set security.approval.transport to "pushary" (with transport_fallback "builtin") in ~/.hermes/config.yaml, plus "clarify" in agent.disabled_toolsets');
+  }
+  console.log();
+  console.log(`  ${dim("What this configured:")}`);
+  console.log(`  ${dim("\u2022")} Native tools: pushary_notify, pushary_ask, pushary_wait, pushary_cancel, pushary_propose_scope`);
+  console.log(`  ${dim("\u2022")} Approvals: Hermes' dangerous-command prompts go to your phone with allow once / this session / always / deny`);
+  console.log(`  ${dim("\u2022")} Falls back to the terminal prompt when no device is connected, so work never blocks on us`);
+  console.log(`  ${dim("\u2022")} Questions go to your phone: Hermes' terminal ${bold("clarify")} tool is disabled, so pushary_ask handles every question`);
+  console.log(`  ${dim("\u2022")} Auto-notifications: push alert when tools return errors`);
+  console.log(`  ${dim("To send approvals back to the terminal:")} remove ${bold("security.approval.transport")} from ~/.hermes/config.yaml`);
+  console.log(`  ${dim("To re-enable terminal questions:")} remove ${bold("clarify")} from ${dim("agent.disabled_toolsets")}`);
+};
+var CODEX_HOOKS_JSON = join3(CODEX_HOME, "hooks.json");
+var CODEX_HOOKS_MIN_VERSION = [0, 122, 0];
+var codexOnPath = () => {
+  const whichCmd = IS_WINDOWS ? "where" : "which";
+  try {
+    const found = execSync(`${whichCmd} codex`, { encoding: "utf-8", stdio: "pipe", timeout: 5e3 }).split("\n")[0].trim();
+    return found || null;
+  } catch {
+    return null;
+  }
+};
+var codexRealpath = (path) => {
+  try {
+    return realpathSync(path);
+  } catch {
+    return null;
+  }
+};
+var EMBEDDED_SCAN_CHUNK_BYTES = 4 * 1024 * 1024;
+var EMBEDDED_SCAN_MAX_BYTES = 320 * 1024 * 1024;
+var readEmbeddedCodexVersion = (path) => {
+  let fd;
+  try {
+    fd = openSync(path, "r");
+    const chunk = Buffer.allocUnsafe(EMBEDDED_SCAN_CHUNK_BYTES);
+    let carry = "";
+    let scanned = 0;
+    while (scanned < EMBEDDED_SCAN_MAX_BYTES) {
+      const bytes = readSync(fd, chunk, 0, chunk.length, null);
+      if (bytes <= 0) return null;
+      scanned += bytes;
+      const text = carry + chunk.toString("latin1", 0, bytes);
+      const found = parseEmbeddedCodexVersion(text);
+      if (found) return found;
+      carry = text.slice(-32);
+    }
+    return null;
+  } catch {
+    return null;
+  } finally {
+    if (fd !== void 0) {
+      try {
+        closeSync(fd);
+      } catch {
+        fd = void 0;
+      }
+    }
+  }
+};
+var bundledCodex = () => findBundledCodex({
+  config: () => {
+    try {
+      return parseTOML(readFileSync(codexConfigToml(), "utf-8"));
+    } catch {
+      return null;
+    }
+  },
+  exists: existsSync,
+  home: homedir(),
+  platform: process.platform
+});
+var detectCodexVersion = () => readCodexVersion({
+  resolveOnPath: codexOnPath,
+  realpath: codexRealpath,
+  readFile: (path) => {
+    try {
+      return readFileSync(path, "utf-8");
+    } catch {
+      return null;
+    }
+  },
+  bundledVersion: () => {
+    const path = bundledCodex();
+    return path ? readEmbeddedCodexVersion(path) : null;
+  },
+  brewVersions: () => {
+    try {
+      return execSync("brew list --versions codex", {
+        encoding: "utf-8",
+        stdio: "pipe",
+        timeout: 1e4
+      }).trim() || null;
+    } catch {
+      return null;
+    }
+  }
+});
+var detectCodexInstall = () => checkCodexInstall({
+  resolveOnPath: codexOnPath,
+  realpath: codexRealpath,
+  exists: existsSync,
+  listDir: (path) => {
+    try {
+      return readdirSync(path);
+    } catch {
+      return null;
+    }
+  },
+  fileSize: (path) => {
+    try {
+      const stat = statSync(path);
+      return stat.isFile() ? stat.size : null;
+    } catch {
+      return null;
+    }
+  },
+  join: join3,
+  dirname: dirname2
+});
+var codexSupportsHooks = (version) => version !== null && compareCodexVersion(version, CODEX_HOOKS_MIN_VERSION) >= 0;
+var removeCodexNotifyEntry = (codexConfig) => {
+  let raw = "";
+  try {
+    raw = readFileSync(codexConfig, "utf-8");
+  } catch {
+    return;
+  }
+  if (!raw.includes("pushary-codex")) return;
+  const config = parseTOML(raw);
+  if (!Array.isArray(config.notify)) return;
+  const filtered = config.notify.filter((entry) => typeof entry !== "string" || !entry.includes("pushary-codex"));
+  if (filtered.length === config.notify.length) return;
+  if (filtered.length === 0) {
+    delete config.notify;
+  } else {
+    config.notify = filtered;
+  }
+  writeFileSync(codexConfig, stringifyTOML(config), "utf-8");
+};
+var addCodexNotifyEntry = (codexConfig) => {
+  const pusharyCodexPath = resolveGlobalBinary("pushary-codex") ?? "pushary-codex";
+  let raw = "";
+  try {
+    raw = readFileSync(codexConfig, "utf-8");
+  } catch {
+  }
+  const config = raw ? parseTOML(raw) : {};
+  const notify = Array.isArray(config.notify) ? config.notify : [];
+  if (!notify.some((n) => typeof n === "string" && n.includes("pushary-codex"))) {
+    notify.push(pusharyCodexPath);
+    config.notify = notify;
+    writeFileSync(codexConfig, stringifyTOML(config), "utf-8");
+  }
+};
+var confirmCodexTrust = async () => {
+  let confirmation = { kind: "unavailable", reason: "setup could not ask Codex" };
+  await spinner("Checking the Pushary hook's trust with Codex", async () => {
+    confirmation = await ensureCodexTrustsPusharyHooks();
+  }, { optional: true });
+  return confirmation;
+};
+var setupCodex = async (apiKey) => {
+  console.log(`
+  ${bold("Setting up Codex")}
+`);
+  const onPath = isInstalled("codex");
+  const bundled = onPath ? null : bundledCodex();
+  if (!onPath && !bundled) {
+    console.log(`  ${yellow("!")} Codex not found. Skipping.`);
+    console.log(`  ${dim("Install the Codex CLI or the ChatGPT desktop app, then re-run setup.")}`);
+    return "skipped";
+  }
+  if (bundled) {
+    console.log(`  ${dim("Using the Codex inside the ChatGPT desktop app.")}`);
+    console.log(`  ${dim(shortenHome(bundled))}`);
+    console.log();
+  }
+  if (onPath && detectCodexInstall().kind === "binary-missing") {
+    console.log(`  ${yellow("!")} Your Codex install is missing the binary it runs.`);
+    console.log(`  ${dim("A Pushary setup before 0.71.0 asked Codex its version. On macOS that hands")}`);
+    console.log(`  ${dim("the binary to XProtect, which quarantines the Codex CLI and moves it to the")}`);
+    console.log(`  ${dim("Trash. Setup no longer runs it. Reinstall Codex to get it back:")}`);
+    console.log(`  ${cyan("npm install -g @openai/codex")}`);
+    console.log(`  ${dim("Configuring anyway, so it is ready when Codex is.")}`);
+    console.log();
+    noteManual("Reinstall Codex: a Pushary setup before 0.71.0 got its binary quarantined by macOS");
+  }
+  await installGlobally2();
+  const codexConfig = codexConfigToml();
+  await spinner("Adding Pushary MCP server (key embedded, auto-allowed)", async () => {
+    const config = readAgentToml(codexConfig);
+    addCodexMcpServer(config, apiKey);
+    writeFileAtomic(codexConfig, stringifyTOML(config), KEY_FILE_MODE);
+  });
+  const codexVersion = detectCodexVersion();
+  const hooksSupported = codexSupportsHooks(codexVersion);
+  let portedTrustWritten = false;
+  if (hooksSupported) {
+    const hookCommand = guardBinary(resolveGlobalBinary("pushary-codex-hook") ?? "pushary-codex-hook");
+    let hookPositions = {};
+    let vacated = {};
+    await spinner("Adding native hooks (~/.codex/hooks.json)", async () => {
+      const hooksConfig = readAgentJson(CODEX_HOOKS_JSON);
+      vacated = codexVacatedIndexes(hooksConfig);
+      addCodexHooks(hooksConfig, hookCommand);
+      writeJson(CODEX_HOOKS_JSON, hooksConfig);
+      hookPositions = codexHookPositions(hooksConfig);
+    });
+    await spinner("Writing trust entries for the Pushary hook", async () => {
+      let raw = "";
+      try {
+        raw = readFileSync(codexConfig, "utf-8");
+      } catch {
+      }
+      const config = raw ? parseTOML(raw) : {};
+      dropVacatedCodexHookTrust(config, CODEX_HOOKS_JSON, vacated);
+      addCodexHookTrust(config, CODEX_HOOKS_JSON, hookCommand, hookPositions);
+      writeFileSync(codexConfig, stringifyTOML(config), "utf-8");
+      portedTrustWritten = true;
+    }, { optional: true });
+    await spinner("Removing legacy notify handler", async () => {
+      removeCodexNotifyEntry(codexConfig);
+    });
+  } else {
+    if (codexVersion !== null) {
+      console.log(`  ${yellow("!")} This Codex version predates native hooks (needs ${CODEX_HOOKS_MIN_VERSION.join(".")}+).`);
+      console.log(`  ${dim("Installing the deprecated notify handler instead. Upgrade Codex and re-run setup")}`);
+      console.log(`  ${dim("to get policy enforcement, phone approvals, and session tracking.")}`);
+    } else {
+      console.log(`  ${yellow("!")} Could not read your Codex version from its install, so hooks were skipped.`);
+      console.log(`  ${dim("Deliberately not run: asking the binary its version is what macOS quarantines.")}`);
+      console.log(`  ${dim(`Installing the notify handler, which works on every version. If Codex is ${CODEX_HOOKS_MIN_VERSION.join(".")}+,`)}`);
+      console.log(`  ${dim("re-run setup after installing it through npm or Homebrew to get native hooks.")}`);
+    }
+    await spinner("Adding notify handler for Codex events (deprecated)", async () => {
+      addCodexNotifyEntry(codexConfig);
+    });
+  }
+  await installSkill("codex", CODEX_SKILL_DIR);
+  await spinner("Teaching Codex to ask via push (~/.codex/AGENTS.md)", async () => {
+    writeInstructionBlock(CODEX_AGENTS_MD, renderAgentInstructions("Codex"));
+  });
+  const confirmation = hooksSupported ? await confirmCodexTrust() : null;
+  const trustOutcome = confirmation === null ? null : codexTrustOutcome(confirmation, portedTrustWritten);
+  if (trustOutcome !== null) recordCodexTrust(trustOutcome);
+  console.log();
+  console.log(`  ${dim("What this configured:")}`);
+  console.log(`  ${dim("\u2022")} MCP server: Codex can send notifications and ask questions`);
+  console.log(`  ${dim("\u2022")} API key embedded in config.toml: works without a shell reload or export`);
+  console.log(`  ${dim("\u2022")} Proactive instructions: ~/.codex/AGENTS.md tells Codex to ask via push, not the terminal`);
+  console.log(`  ${dim("\u2022")} Auto-allowed tools: no permission prompts for Pushary MCP calls`);
+  if (hooksSupported) {
+    console.log(`  ${dim("\u2022")} Native hooks: phone approvals, policy enforcement, kill switch, session tracking`);
+    if (trustOutcome === "verified") {
+      console.log(`  ${dim("\u2022")} Hook trusted, and Codex confirmed it: no ${cyan("/hooks")} step`);
+    } else if (trustOutcome === "unverified" && confirmation) {
+      console.log(`  ${dim("\u2022")} Hook pre-trusted: no ${cyan("/hooks")} step. If approvals never arrive, ${cyan("/hooks")} re-trusts it`);
+      console.log(`    ${dim(describeCodexTrustConfirmation(confirmation))}`);
+    } else {
+      if (confirmation) {
+        console.log(`  ${yellow("!")} ${describeCodexTrustConfirmation(confirmation)}`);
+      }
+      console.log();
+      console.log(`  ${bold("One step left, and it happens inside Codex")}`);
+      console.log(`  ${dim("Codex makes you trust any hook before it runs. This is Codex's own")}`);
+      console.log(`  ${dim("security check, not a Pushary thing, and you only do it once.")}`);
+      console.log();
+      if (bundled) {
+        console.log(`  ${cyan("1.")} Open ChatGPT, then Settings and ${cyan("Hooks")}`);
+        console.log(`  ${cyan("2.")} You will see the Pushary hook commands. Trust them.`);
+      } else {
+        console.log(`  ${cyan("1.")} Open Codex and type ${cyan("/hooks")}`);
+        console.log(`  ${cyan("2.")} You will see the Pushary hook commands. Trust them.`);
+      }
+      console.log();
+      console.log(`  ${dim("Until you do, Codex just runs as usual without the phone approvals.")}`);
+      console.log(`  ${dim("To confirm:")} run a command that needs approval and watch your phone.`);
+      console.log(`  ${dim("Pushary updates keep the same trust, so Codex will not ask again.")}`);
+      noteManual(bundled ? "Open ChatGPT, then Settings and Hooks, and trust the Pushary hook. Until then Codex runs without phone approvals." : "Open Codex, type /hooks, and trust the Pushary hook. Until then Codex runs without phone approvals.");
+    }
+  } else {
+    console.log(`  ${dim("\u2022")} Notify handler (deprecated): captures turn completions and approval requests`);
+  }
+};
+var resolveBundledPlugin = () => {
+  const dir = dirname2(fileURLToPath(import.meta.url));
+  const candidates = [
+    join3(dir, "..", "..", "data", "cursor-plugin"),
+    join3(dir, "..", "data", "cursor-plugin"),
+    join3(dir, "..", "..", "..", "cursor-plugin"),
+    join3(dir, "..", "..", "cursor-plugin")
+  ];
+  return candidates.find((p) => existsSync(join3(p, ".cursor-plugin", "plugin.json"))) ?? null;
+};
+var installCursorUserHooks = (gateScript) => {
+  const bundled = readJson(join3(CURSOR_PLUGIN_DIR, "hooks", "hooks.json")).hooks ?? {};
+  let userHooks = {};
+  if (existsSync(CURSOR_USER_HOOKS)) {
+    const result = readJsonSafe(CURSOR_USER_HOOKS);
+    if (result.kind === "ok") userHooks = result.value;
+    else if (result.kind !== "missing") {
+      let backup = "";
+      try {
+        backup = backupFile(CURSOR_USER_HOOKS);
+      } catch {
+      }
+      throw new AgentConfigError(
+        configFailureKind(result.kind),
+        CURSOR_USER_HOOKS,
+        `Could not parse or read Cursor hooks.json; left it untouched${backup ? ` and backed it up at ${backup}` : ""}. Fix the file, then re-run setup.`
+      );
+    }
+  }
+  const hooks = userHooks.hooks ?? {};
+  for (const event of Object.keys(bundled)) {
+    const template = bundled[event]?.[0];
+    if (!template) throw new Error(`bundled Cursor hooks.json missing a ${event} entry`);
+    const existing = Array.isArray(hooks[event]) ? hooks[event] : [];
+    hooks[event] = registerCursorGate(existing, { ...template, command: guardCursorGate(gateScript) });
+  }
+  writeJson(CURSOR_USER_HOOKS, { ...userHooks, version: userHooks.version ?? 1, hooks });
+};
+var neutralizePluginGate = () => {
+  const path = join3(CURSOR_PLUGIN_DIR, "hooks", "hooks.json");
+  if (!existsSync(path)) return;
+  const data = readJson(path);
+  if (!data.hooks) return;
+  let changed = false;
+  for (const [event, hooks] of Object.entries(data.hooks)) {
+    if (!Array.isArray(hooks)) continue;
+    const others = hooks.filter((hook) => pusharyHookExecutable(String(hook?.command ?? "")) === null);
+    if (others.length === hooks.length) continue;
+    changed = true;
+    if (others.length) data.hooks[event] = others;
+    else delete data.hooks[event];
+  }
+  if (!changed) return;
+  writeJson(path, { version: data.version ?? 1, hooks: data.hooks });
+};
+var setupCursor = async (apiKey) => {
+  console.log(`
+  ${bold("Setting up Cursor")}
+`);
+  const source = resolveBundledPlugin();
+  if (!source) throw new Error("bundled Cursor plugin not found in this package");
+  await spinner("Installing Pushary plugin", async () => {
+    const staging = join3(dirname2(CURSOR_PLUGIN_DIR), `.pushary-staging-${process.pid}`);
+    const backup = `${CURSOR_PLUGIN_DIR}.pushary-backup-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+    rmSync(staging, { recursive: true, force: true });
+    try {
+      cpSync(source, staging, {
+        recursive: true,
+        filter: (p) => !["tools", "node_modules", ".git", ".DS_Store"].includes(basename(p))
+      });
+      const staged = readJsonSafe(join3(staging, ".cursor-plugin", "plugin.json"));
+      if (staged.kind !== "ok") {
+        throw new Error("staged Cursor plugin is missing or has an unreadable plugin.json");
+      }
+      const hadExisting = existsSync(CURSOR_PLUGIN_DIR);
+      if (hadExisting) renameSync(CURSOR_PLUGIN_DIR, backup);
+      try {
+        renameSync(staging, CURSOR_PLUGIN_DIR);
+      } catch (err) {
+        if (hadExisting) renameSync(backup, CURSOR_PLUGIN_DIR);
+        throw err;
+      }
+      if (hadExisting) rmSync(backup, { recursive: true, force: true });
+    } finally {
+      rmSync(staging, { recursive: true, force: true });
+    }
+  });
+  await spinner("Linking your API key", async () => {
+    const mcpPath = join3(CURSOR_PLUGIN_DIR, "mcp.json");
+    const mcp = readAgentJson(mcpPath);
+    const servers = mcp.mcpServers ?? {};
+    if (servers.pushary) {
+      servers.pushary.headers = { ...servers.pushary.headers, Authorization: `Bearer ${apiKey}` };
+      mcp.mcpServers = servers;
+      writeJsonAtomic(mcpPath, mcp, KEY_FILE_MODE);
+    }
+  });
+  await spinner("Registering permission gate (~/.cursor/hooks.json)", async () => {
+    installCursorUserHooks(join3(CURSOR_PLUGIN_DIR, "scripts", "pushary-gate.mjs"));
+    neutralizePluginGate();
+  });
+  console.log();
+  console.log(`  ${dim("What this configured:")}`);
+  console.log(`  ${dim("\u2022")} Plugin installed to ~/.cursor/plugins/local/pushary (MCP tools, rule, skill)`);
+  console.log(`  ${dim("\u2022")} Permission gate registered once in ~/.cursor/hooks.json`);
+  console.log(`  ${dim("\u2022")} Risky shell commands route to push approval before they run`);
+  console.log(`  ${dim("\u2022")} Fully quit and reopen Cursor to load it (a Reload Window may not be enough)`);
+  noteManual("Fully quit and reopen Cursor. A Reload Window may not be enough.");
+};
+var resolveBundledVsCodePlugin = () => {
+  const dir = dirname2(fileURLToPath(import.meta.url));
+  const candidates = [
+    join3(dir, "..", "..", "data", "vscode-plugin"),
+    join3(dir, "..", "data", "vscode-plugin"),
+    join3(dir, "..", "..", "..", "vscode-plugin"),
+    join3(dir, "..", "..", "vscode-plugin")
+  ];
+  return candidates.find((p) => existsSync(join3(p, ".claude-plugin", "plugin.json"))) ?? null;
+};
+var pinVsCodeGatePath = (pluginDir) => {
+  const hooksPath = join3(pluginDir, "hooks", "hooks.json");
+  const data = readJson(hooksPath);
+  const entries = data.hooks?.PreToolUse;
+  if (!Array.isArray(entries) || entries.length === 0) {
+    throw new Error("bundled VS Code hooks.json is missing a PreToolUse entry");
+  }
+  const gate = join3(pluginDir, "scripts", "pushary-gate.mjs");
+  data.hooks.PreToolUse = entries.map((entry) => ({ ...entry, command: `node "${gate}"` }));
+  writeJson(hooksPath, data);
+};
+var registerVsCodePlugin = (pluginDir) => {
+  const written = [];
+  const manual = [];
+  for (const settingsPath of vscodeSettingsTargets(existsSync)) {
+    const current = existsSync(settingsPath) ? readFileSync(settingsPath, "utf-8") : null;
+    const result = registerPluginLocation(current, pluginDir);
+    if (result.kind === "already") continue;
+    if (result.kind === "manual") {
+      manual.push(settingsPath);
+      continue;
+    }
+    if (current !== null) backupFile(settingsPath);
+    mkdirSync(dirname2(settingsPath), { recursive: true });
+    writeFileAtomic(settingsPath, result.content);
+    written.push(settingsPath);
+  }
+  return { written, manual };
+};
+var setupVsCode = async (apiKey) => {
+  console.log(`
+  ${bold("Setting up VS Code")}
+`);
+  const source = resolveBundledVsCodePlugin();
+  if (!source) throw new Error("bundled VS Code plugin not found in this package");
+  await spinner("Installing Pushary plugin", async () => {
+    const staging = join3(dirname2(VSCODE_PLUGIN_DIR), `.pushary-staging-vscode-${process.pid}`);
+    const backup = `${VSCODE_PLUGIN_DIR}.pushary-backup-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+    mkdirSync(dirname2(VSCODE_PLUGIN_DIR), { recursive: true });
+    rmSync(staging, { recursive: true, force: true });
+    try {
+      cpSync(source, staging, {
+        recursive: true,
+        filter: (p) => !["tools", "node_modules", ".git", ".DS_Store"].includes(basename(p))
+      });
+      const staged = readJsonSafe(join3(staging, ".claude-plugin", "plugin.json"));
+      if (staged.kind !== "ok") {
+        throw new Error("staged VS Code plugin is missing or has an unreadable plugin.json");
+      }
+      const hadExisting = existsSync(VSCODE_PLUGIN_DIR);
+      if (hadExisting) renameSync(VSCODE_PLUGIN_DIR, backup);
+      try {
+        renameSync(staging, VSCODE_PLUGIN_DIR);
+      } catch (err) {
+        if (hadExisting) renameSync(backup, VSCODE_PLUGIN_DIR);
+        throw err;
+      }
+      if (hadExisting) rmSync(backup, { recursive: true, force: true });
+    } finally {
+      rmSync(staging, { recursive: true, force: true });
+    }
+  });
+  await spinner("Linking your API key", async () => {
+    const mcpPath = VSCODE_PLUGIN_MCP;
+    const mcp = readAgentJson(mcpPath);
+    const servers = mcp.mcpServers ?? {};
+    if (servers.pushary) {
+      servers.pushary.headers = { ...servers.pushary.headers, Authorization: `Bearer ${apiKey}` };
+      mcp.mcpServers = servers;
+      writeJsonAtomic(mcpPath, mcp, KEY_FILE_MODE);
+    }
+    pinVsCodeGatePath(VSCODE_PLUGIN_DIR);
+  });
+  let registration = { written: [], manual: [] };
+  await spinner("Registering the plugin with VS Code", async () => {
+    registration = registerVsCodePlugin(VSCODE_PLUGIN_DIR);
+  });
+  console.log();
+  console.log(`  ${dim("What this configured:")}`);
+  console.log(`  ${dim("\u2022")} Plugin installed to ${shortenHome(VSCODE_PLUGIN_DIR)} (MCP tools, skill, commands)`);
+  for (const path of registration.written) {
+    console.log(`  ${dim("\u2022")} Registered in ${shortenHome(path)} under chat.pluginLocations`);
+  }
+  console.log(`  ${dim("\u2022")} Risky shell commands route to push approval before they run`);
+  if (registration.manual.length > 0) {
+    console.log();
+    console.log(`  ${yellow("!")} ${bold("One step left, by hand")}`);
+    console.log(`  ${dim("These settings files already have a chat.pluginLocations block, and")}`);
+    console.log(`  ${dim("they contain comments, so they were left untouched rather than rewritten.")}`);
+    console.log(`  ${dim("Add this entry inside that block:")}`);
+    console.log();
+    console.log(`  ${cyan(`${JSON.stringify(VSCODE_PLUGIN_DIR)}: true`)}`);
+    console.log();
+    for (const path of registration.manual) {
+      console.log(`  ${dim("in")} ${path}`);
+    }
+    noteManual(
+      `Add ${JSON.stringify(VSCODE_PLUGIN_DIR)}: true to the chat.pluginLocations block in ${registration.manual.join(" and ")}. Full snippet:
+${pluginLocationSnippet(VSCODE_PLUGIN_DIR)}`
+    );
+  }
+  console.log(`  ${dim("\u2022")} Fully quit and reopen VS Code to load the plugin`);
+  noteManual("Fully quit and reopen VS Code. A Reload Window may not pick up a new plugin location.");
+};
+var saveApiKey = async (apiKey, controlMode, transcriptSync) => {
+  let result;
+  await spinner("Saving your API key", async () => {
+    result = writeKey(apiKey, {
+      ...controlMode === null ? {} : { controlMode },
+      transcriptsEnabled: transcriptSync
+    });
+  });
+  if (!result) throw new Error("Could not save the API key");
+  if (result.configBackupPath) {
+    console.log(`  ${yellow("!")} ${PUSHARY_CONFIG_FILE} did not parse. Saved a copy at ${dim(result.configBackupPath)}`);
+  }
+  const rc = result.rc;
+  switch (rc.kind) {
+    case "updated":
+      console.log(`  ${check} Replaced the old key in ${dim(rc.path ?? "")}${rc.previousKeyPrefix ? dim(` (was ${rc.previousKeyPrefix})`) : ""}`);
+      break;
+    case "declined":
+      console.log(`  ${yellow("!")} ${rc.path}:${rc.declinedLine} already sets ${cyan("PUSHARY_API_KEY")} in a form Pushary did not write.`);
+      console.log(`  ${dim("It was left alone, and it will shadow the new key in new shells. Update it to:")}`);
+      console.log(`  ${cyan(exportLine(apiKey))}`);
+      break;
+    case "unavailable":
+      console.log(`  ${yellow("!")} Could not update ${rc.path}${rc.detail ? dim(` (${rc.detail})`) : ""}. Add this line yourself:`);
+      console.log(`  ${cyan(exportLine(apiKey))}`);
+      break;
+    case "no-rc":
+      console.log(`  ${yellow("!")} No shell profile found for this shell. Add this line yourself:`);
+      console.log(`  ${cyan(exportLine(apiKey))}`);
+      break;
+    case "written":
+    case "unchanged":
+      break;
+  }
+  return rc;
+};
+var FX_SETTINGS_RULES_SNIPPET = `"permission": { "${FX_PUSHARY_TOOLS_RULE}": "allow", "${FX_QUESTION_TOOL}": "deny" }`;
+var FX_QUESTION_ROUTING_REPORTS = {
+  "full-access": "fx runs in full-access mode, which ignores permission rules, so its terminal question tool stays on. Its instructions tell it to ask through Pushary instead; leave full-access mode with /permissions to turn the tool off for certain.",
+  overridden: `A rule in ${fxSettings()} keeps fx's terminal question tool on, so fx can still ask there instead of through Pushary.`
+};
+var FX_QUESTION_SUMMARIES = {
+  routed: "fx's agent asks through Pushary, which reaches your phone, or the Mac notch while the Pushary Mac app runs",
+  "full-access": "fx's agent is told to ask through Pushary, but full-access mode keeps fx's terminal prompt available to it",
+  overridden: "fx's terminal prompt stays available, so fx's agent is only told to ask through Pushary"
+};
+var reportFxSettings = (outcome) => {
+  if (outcome.kind === "refused") {
+    console.log(`  ${yellow("!")} ${outcome.detail}, so Pushary tools were not auto-allowed and fx's terminal question tool stays on.`);
+    noteManual(`Add ${FX_SETTINGS_RULES_SNIPPET} to ${fxSettings()} so fx runs Pushary tools without a prompt and asks through Pushary.`);
+    return;
+  }
+  if (outcome.toolsChange === "user-rule-kept") {
+    console.log(`  ${yellow("!")} ${fxSettings()} already has a ${FX_PUSHARY_TOOLS_RULE} rule, so it was left as you set it.`);
+  } else {
+    console.log(`  ${check} Auto-allowing Pushary tools (${fxSettings()})`);
+  }
+  if (outcome.questionRouting === "routed") {
+    console.log(`  ${check} Turning off fx's terminal question tool, so its questions go through Pushary`);
+  } else if (outcome.questionChange === "user-rule-kept") {
+    console.log(`  ${yellow("!")} ${fxSettings()} already has a ${FX_QUESTION_TOOL} rule, so it was left as you set it and fx can still ask in the terminal.`);
+  } else {
+    console.log(`  ${yellow("!")} ${FX_QUESTION_ROUTING_REPORTS[outcome.questionRouting]}`);
+  }
+  if (!outcome.ruleRecorded) {
+    console.log(`  ${yellow("!")} ${fxQuestionRuleReceipt()} could not be written, so pushary clean will treat the ${FX_QUESTION_TOOL} rule as yours and leave it.`);
+  }
+  if (outcome.workspacesWithOwnRules.length > 0) {
+    console.log(`  ${yellow("!")} ${outcome.workspacesWithOwnRules.length} fx workspace(s) set their own permission rules, which replace the global ones there. Add "${FX_PUSHARY_TOOLS_RULE}": "allow" and "${FX_QUESTION_TOOL}": "deny" to each to route them through Pushary.`);
+  }
+};
+var teachFxToAskViaPush = () => {
+  if (fxIgnoresInstructionsFile(fxAgentsMd(), fxConfigDir())) return false;
+  writeInstructionBlock(fxAgentsMd(), `${renderAgentInstructions("fx")}
+
+${FX_TOOL_DISCOVERY_NOTE}`);
+  return true;
+};
+var fxWired = () => inspectFxInstallation(fxMcpProfile(), fxSettings(), process.env).configured;
+var setupFx = async () => {
+  console.log(`
+  ${bold("Setting up fx")}
+`);
+  if (process.platform === "win32") {
+    console.log(`  ${yellow("!")} fx does not run on Windows. Skipping.`);
+    return "skipped";
+  }
+  if (!existsSync(fxConfigDir())) {
+    console.log(`  ${yellow("!")} fx not found (${fxConfigDir()} does not exist). Skipping.`);
+    console.log(`  ${dim("Install fx from https://fx.sh, run it once, then re-run setup.")}`);
+    return "skipped";
+  }
+  await installGlobally2();
+  await spinner(`Adding the Pushary MCP server (${fxMcpProfile()})`, async () => {
+    const profile = readFxProfileForSetup(fxMcpProfile());
+    const bridge = resolveGlobalBinary(MCP_BRIDGE_BINARY) ?? MCP_BRIDGE_BINARY;
+    const entry = fxPusharyEntry(guardedArgv({ kind: "binary", path: bridge, runtime: "node" }));
+    writeFxProfile(fxMcpProfile(), withFxPusharyServer(profile, entry));
+  });
+  const settingsOutcome = configureFxSettings(fxSettings(), fxQuestionRuleReceipt(), process.env);
+  reportFxSettings(settingsOutcome);
+  if (teachFxToAskViaPush()) {
+    console.log(`  ${check} Teaching fx to ask via push (${fxAgentsMd()})`);
+  } else {
+    console.log(`  ${yellow("!")} ${fxAgentsMd()} links outside ${fxConfigDir()}, and fx ignores such a file, so no instructions were written.`);
+    noteManual(`Replace the ${fxAgentsMd()} symlink with a file so fx loads Pushary's instructions, then run ${retryAgentCommand("fx")}.`);
+  }
+  console.log();
+  console.log(`  ${dim("What this configured:")}`);
+  console.log(`  ${dim("\u2022")} MCP server ${bold("pushary")} in ${fxMcpProfile()}, which runs ${MCP_BRIDGE_BINARY} and signs in with the key saved in ~/.pushary, so no key is written to fx's config`);
+  console.log(`  ${dim("\u2022")} Questions: ${FX_QUESTION_SUMMARIES[settingsOutcome.kind === "written" ? settingsOutcome.questionRouting : "overridden"]}`);
+  console.log(`  ${dim("\u2022")} fx cannot hand its own approval prompts to Pushary, so those still wait in the terminal`);
+  console.log(`  ${dim("Restart fx, or run /mcp reload in a running session.")}`);
+  noteManual("Restart fx, or run /mcp reload in a running session.");
+  return "configured";
+};
+var setupCustom = async (apiKey, context) => {
+  console.log(`
+  ${bold("Connect any other agent (MCP or HTTP)")}
+`);
+  const wroteExport = context ? ["written", "updated", "unchanged"].includes(context.rc.kind) : true;
+  if (wroteExport) {
+    console.log(`  ${dim("Your key is saved as")} ${cyan("$PUSHARY_API_KEY")} ${dim("in your shell profile.")}`);
+  } else {
+    console.log(`  ${dim("Add this to your shell profile so")} ${cyan("$PUSHARY_API_KEY")} ${dim("resolves:")}`);
+    console.log(`  ${cyan(exportLine(apiKey))}`);
+  }
+  console.log();
+  console.log(`  ${dim("MCP clients (Windsurf, LangChain, custom) \u2014 add this server:")}`);
+  console.log(`  ${cyan("https://pushary.com/api/mcp/mcp")} ${dim("with header")} ${cyan("Authorization: Bearer $PUSHARY_API_KEY")}`);
+  console.log();
+  console.log(`  ${dim("No-code / HTTP (n8n, Zapier, scripts) \u2014 ask a human and wait:")}`);
+  console.log(`  ${dim("POST")} ${cyan("https://pushary.com/api/v1/server/ask")} ${dim("body")} ${cyan('{"question":"Approve?","type":"confirm","wait":true}')}`);
+  console.log();
+  console.log(`  ${dim("Full guide:")} ${cyan("https://pushary.com/docs/agents/connect-any-agent")}`);
+};
+var setupGemini = async (apiKey) => {
+  console.log(`
+  ${bold("Setting up Gemini CLI")}
+`);
+  if (!isInstalled("gemini")) {
+    console.log(`  ${yellow("!")} Gemini CLI not found. Skipping.`);
+    console.log(`  ${dim("Install Gemini CLI and re-run setup to configure.")}`);
+    return "skipped";
+  }
+  await installGlobally2();
+  const settings = readAgentJson(GEMINI_SETTINGS);
+  await spinner("Adding MCP server (~/.gemini/settings.json)", async () => {
+    addGeminiMcpServer(settings, apiKey);
+  });
+  await spinner("Adding hooks (BeforeTool, AfterTool, BeforeAgent, SessionStart, SessionEnd)", async () => {
+    addGeminiHooks(settings, guardBinary(resolveGlobalBinary(GEMINI_HOOK_BINARY) ?? GEMINI_HOOK_BINARY));
+  });
+  await spinner(`Writing ${GEMINI_SETTINGS}`, async () => {
+    writeJsonAtomic(GEMINI_SETTINGS, settings, KEY_FILE_MODE);
+  });
+  await spinner("Teaching Gemini to ask via push (~/.gemini/GEMINI.md)", async () => {
+    writeInstructionBlock(GEMINI_MD, renderAgentInstructions("Gemini"));
+  });
+  console.log();
+  console.log(`  ${dim("What this configured:")}`);
+  console.log(`  ${dim("\u2022")} MCP server: Gemini can send notifications and ask questions`);
+  console.log(`  ${dim("\u2022")} Proactive instructions: ~/.gemini/GEMINI.md tells Gemini to ask via push, not the terminal`);
+  console.log(`  ${dim("\u2022")} Hooks: phone approvals, policy enforcement, kill switch, session tracking`);
+  console.log(`  ${dim("\u2022")} Gate covers ${bold("run_shell_command")}, ${bold("write_file")}, and ${bold("replace")}`);
+  console.log(`  ${dim("\u2022")} Auto-allowed tools: Pushary MCP calls run without a confirmation prompt`);
+  console.log(`  ${dim("Restart Gemini CLI to load the new config.")}`);
+  noteManual("Restart Gemini CLI to load the new config.");
+};
+var OPENCODE_INSTRUCTIONS = openCodeInstructionsFile;
+var setupOpenCode = async (apiKey) => {
+  console.log(`
+  ${bold("Setting up OpenCode")}
+`);
+  if (!isInstalled("opencode") && !existsSync(openCodeConfigDir())) {
+    console.log(`  ${yellow("!")} OpenCode not found. Skipping.`);
+    console.log(`  ${dim("Install OpenCode and re-run setup to configure.")}`);
+    return "skipped";
+  }
+  await installGlobally2();
+  await spinner(`Writing the Pushary plugin (${openCodePluginFile()})`, async () => {
+    const target = resolveGlobalBinary(OPENCODE_HOOK_BINARY) ?? OPENCODE_HOOK_BINARY;
+    installOpenCodePlugin(
+      guardedArgv({ kind: "binary", path: target, runtime: "node" }, ["--source", "opencode"]),
+      openCodePluginDir()
+    );
+  });
+  await spinner(`Adding MCP server (${openCodeConfigFile()})`, async () => {
+    const config = readAgentJson(openCodeConfigFile());
+    addOpenCodeMcpServer(config, apiKey);
+    writeJsonAtomic(openCodeConfigFile(), config, KEY_FILE_MODE);
+  });
+  await spinner("Teaching OpenCode to ask via push", async () => {
+    writeInstructionBlock(OPENCODE_INSTRUCTIONS(), renderAgentInstructions("OpenCode"));
+  });
+  console.log();
+  console.log(`  ${dim("What this configured:")}`);
+  console.log(`  ${dim("\u2022")} Plugin: ${openCodePluginFile()}`);
+  console.log(`  ${dim("\u2022")} MCP server: OpenCode can send notifications and ask questions`);
+  console.log(`  ${dim("\u2022")} Approvals: a permission OpenCode raises is answered from your phone`);
+  console.log(`  ${dim("\u2022")} Gate covers ${bold("bash")}, ${bold("edit")}, ${bold("write")} and ${bold("webfetch")}`);
+  console.log(`  ${dim("\u2022")} Receipts: tool results, prompts and turn boundaries reach your account`);
+  console.log(`  ${dim("Restart OpenCode to load the plugin.")}`);
+  noteManual("Restart OpenCode to load the plugin.");
+  return "configured";
+};
+var compatibleRecord = (of) => HOOK_COMPATIBLE_PROFILES.reduce(
+  (record, profile) => ({ ...record, [profile.agentType]: of(profile) }),
+  {}
+);
+var HOOK_FILES = {
+  claude_code: () => CLAUDE_SETTINGS,
+  codex: () => CODEX_HOOKS_JSON,
+  gemini_cli: () => GEMINI_SETTINGS,
+  cursor: () => CURSOR_USER_HOOKS,
+  vscode: () => join3(VSCODE_PLUGIN_DIR, "hooks", "hooks.json"),
+  ...compatibleRecord((profile) => () => compatibleConfigFile(profile))
+};
+var hookOwnerFor = (agent, appAvailable = true) => {
+  const file = HOOK_FILES[agent]?.();
+  if (!file) return "none";
+  const document = readJsonSafe(file);
+  const profile = hookCompatibleProfile(agent);
+  return hookOwnerOf(
+    document.kind === "ok" ? document.value : null,
+    appAvailable,
+    profile ? profile.hooksKeyPath : void 0
+  );
+};
+var appMcpKeyFor = (agent) => {
+  if (agent === "codex") {
+    const auth = readCodexMcpAuth(readAgentToml(codexConfigToml()));
+    return auth?.method === "embedded" ? auth.key : null;
+  }
+  const file = agent === "claude_code" ? CLAUDE_JSON : agent === "gemini_cli" ? GEMINI_SETTINGS : agent === "cursor" ? cursorUserMcp() : agent === "vscode" ? VSCODE_PLUGIN_MCP : null;
+  return file ? mcpBearerKey(readAgentJson(file), "mcpServers", "headers") : null;
+};
+var appMcpKeyIfReadable = (agent) => {
+  try {
+    return appMcpKeyFor(agent);
+  } catch {
+    return null;
+  }
+};
+var captureTakeoverReceipt = (agent) => {
+  const hookFile = HOOK_FILES[agent]?.();
+  if (!hookFile) return;
+  const document = readAgentJson(hookFile);
+  const captured = captureHookTakeover(agent, document);
+  if (!captured) throw new Error(`Cannot safely take over ${AGENT_NAMES[agent]}'s hooks: no Mac app wiring was found.`);
+  const codexConfig = agent === "codex" ? readAgentToml(codexConfigToml()) : null;
+  const mcp = agent === "claude_code" ? [readAgentJson(CLAUDE_JSON), "mcpServers"] : agent === "codex" ? [codexConfig, "mcp_servers"] : agent === "gemini_cli" ? [document, "mcpServers"] : agent === "vscode" ? [readAgentJson(VSCODE_PLUGIN_MCP), "mcpServers"] : null;
+  const receipt = {
+    ...captured,
+    ...codexConfig ? {
+      codexTrust: captureCodexHookTrust(codexConfig, hookFile, codexHookPositions(document))
+    } : {},
+    ...mcp ? { mcpServer: captureMcpServer(mcp[0], mcp[1]) } : {}
+  };
+  writeJsonAtomic(hookTakeoverReceipt(agent), receipt, 384);
+};
+var agentIsWired = (agent) => {
+  const readJson2 = (path) => {
+    try {
+      return JSON.parse(readFileSync(path, "utf-8"));
+    } catch {
+      return null;
+    }
+  };
+  switch (agent) {
+    case "claude_code":
+      return claudeWired({
+        claudeJson: readJson2(CLAUDE_JSON),
+        settings: readJson2(CLAUDE_SETTINGS),
+        skillExists: existsSync(join3(CLAUDE_SKILL_DIR, "SKILL.md"))
+      });
+    case "codex": {
+      let config = null;
+      try {
+        config = parseTOML(readFileSync(join3(CODEX_HOME, "config.toml"), "utf-8"));
+      } catch {
+        config = null;
+      }
+      return codexWired({
+        config,
+        hooks: readJson2(CODEX_HOOKS_JSON),
+        skillExists: existsSync(join3(CODEX_SKILL_DIR, "SKILL.md"))
+      });
+    }
+    case "gemini_cli":
+      return geminiWired({ settings: readJson2(GEMINI_SETTINGS) });
+    case "cursor":
+      return existsSync(join3(CURSOR_PLUGIN_DIR, "mcp.json"));
+    case "vscode":
+      return existsSync(VSCODE_PLUGIN_MCP);
+    case "opencode":
+      return openCodeWired();
+    case "fx":
+      return fxWired();
+    default: {
+      const profile = hookCompatibleProfile(agent);
+      if (!profile) return true;
+      const config = readJson2(compatibleConfigFile(profile));
+      return config !== null && hasCompatibleHooks(config, profile);
+    }
+  }
+};
+var compatibleGateSummary = (profile) => {
+  const gated = PRETOOLUSE_GATED_TOOLS.map((canonical) => Object.entries(profile.toolAliases).find(([, target]) => target === canonical)?.[0] ?? canonical);
+  return gated.slice(0, 3).map((name) => bold(name)).join(", ");
+};
+var setupCompatibleAgent = (profile) => async (apiKey) => {
+  const configFile = compatibleConfigFile(profile);
+  const mcpFile = compatibleMcpFile(profile);
+  const permissionFile = compatiblePermissionRuleFile(profile);
+  const instructionsFile = compatibleInstructionsFile(profile);
+  console.log(`
+  ${bold(`Setting up ${profile.label}`)}
+`);
+  if (!isInstalled(profile.binary) && !existsSync(dirname2(configFile))) {
+    console.log(`  ${yellow("!")} ${profile.label} not found. Skipping.`);
+    console.log(`  ${dim(`Install ${profile.label} and re-run setup to configure.`)}`);
+    return "skipped";
+  }
+  await installGlobally2();
+  const documents = /* @__PURE__ */ new Map();
+  const open = (path) => {
+    const existing = documents.get(path);
+    if (existing) return existing;
+    const document = readAgentJson(path);
+    documents.set(path, document);
+    return document;
+  };
+  const declined = [];
+  const record = (path, write) => {
+    if (!write.ok) declined.push(`${shortenHome(path)} \u2192 ${write.conflictAt}`);
+  };
+  const events = compatibleHookEvents(profile).map((hook) => hook.event);
+  await spinner(`Adding hooks (${events.slice(0, 4).join(", ")}${events.length > 4 ? `, +${events.length - 4} more` : ""})`, async () => {
+    record(configFile, addCompatibleHooks(open(configFile), profile, resolveGlobalBinDir("pushary-hook")));
+  });
+  if (mcpFile) {
+    await spinner(`Adding MCP server (${shortenHome(mcpFile)})`, async () => {
+      addCompatibleMcpServer(open(mcpFile), profile, apiKey);
+    });
+  }
+  if (permissionFile) {
+    await spinner("Auto-allowing Pushary MCP tools", async () => {
+      record(permissionFile, addCompatibleToolPermissions(open(permissionFile)));
+    });
+  }
+  if (declined.length > 0) {
+    console.log(`
+  ${yellow("!")} ${profile.label} keeps something unexpected where Pushary writes. Nothing was changed.`);
+    for (const conflict of declined) console.log(`  ${dim(`\u2022 ${conflict}`)}`);
+    console.log(`  ${dim("Pushary expects a list of hook entries there. Move that key and re-run setup.")}`);
+    return "skipped";
+  }
+  for (const [path, document] of documents) {
+    await spinner(`Writing ${shortenHome(path)}`, async () => {
+      writeJsonAtomic(path, document, KEY_FILE_MODE);
+    });
+  }
+  if (instructionsFile && profile.instructions) {
+    await spinner(`Teaching ${profile.label} to ask via push (${shortenHome(instructionsFile)})`, async () => {
+      writeInstructionBlock(instructionsFile, renderAgentInstructions(profile.instructions.label));
+    });
+  }
+  console.log();
+  console.log(`  ${dim("What this configured:")}`);
+  console.log(`  ${dim("\u2022")} Hooks: phone approvals, policy enforcement, kill switch, session tracking`);
+  console.log(`  ${dim("\u2022")} Gate covers ${compatibleGateSummary(profile)}`);
+  if (mcpFile) console.log(`  ${dim("\u2022")} MCP server: ${profile.label} can send notifications and ask questions`);
+  else console.log(`  ${dim("\u2022")} ${dim(`No MCP server: ${profile.label} documents no remote-server config shape, so approvals work and agent-initiated questions do not`)}`);
+  if (instructionsFile) console.log(`  ${dim("\u2022")} Proactive instructions: ${shortenHome(instructionsFile)}`);
+  console.log(`  ${dim(`Restart ${profile.label} to load the new config.`)}`);
+  noteManual(`Restart ${profile.label} to load the new config.`);
+  return "configured";
+};
+var COMPATIBLE_SETUP = HOOK_COMPATIBLE_PROFILES.reduce((installers, profile) => ({
+  ...installers,
+  [profile.agentType]: setupCompatibleAgent(profile)
+}), {});
+var AGENT_SETUP = {
+  claude_code: setupClaudeCode,
+  codex: setupCodex,
+  gemini_cli: setupGemini,
+  hermes: setupHermes,
+  cursor: setupCursor,
+  vscode: setupVsCode,
+  opencode: setupOpenCode,
+  fx: setupFx,
+  ...COMPATIBLE_SETUP,
+  custom: setupCustom
+};
+var PROJECT_INSTRUCTION_TARGETS = {
+  claude_code: { file: "CLAUDE.md", label: "Claude Code" },
+  codex: { file: "AGENTS.md", label: SHARED_AGENTS_MD_LABEL }
+};
+var offerProjectInstructions = async (agents, options) => {
+  const targets = agents.map((agent) => PROJECT_INSTRUCTION_TARGETS[agent]).filter((target) => target !== void 0);
+  if (targets.length === 0 || !process.stdout.isTTY || options.nonInteractive) return;
+  console.log();
+  const wanted = await confirm({
+    message: "Add Pushary instructions to this project's CLAUDE.md/AGENTS.md so your whole team's agents can use phone approvals?",
+    default: false
+  });
+  if (!wanted) return;
+  for (const target of targets) {
+    await spinner(`Writing managed block to ${join3(process.cwd(), target.file)}`, async () => {
+      writeInstructionBlock(join3(process.cwd(), target.file), renderProjectAgentInstructions(target.label));
+    }, { optional: true });
+  }
+  console.log(`  ${dim("Commit the file to share it. Teammates without a key fall back to the terminal.")}`);
+};
+var offerClaudeAlias = async (options) => {
+  if (!process.stdout.isTTY || options.nonInteractive) return;
+  const rc = resolveShellRc();
+  console.log();
+  if (!rc) {
+    console.log(`  ${dim("Tip: alias")} ${cyan("claude='pushary claude'")} ${dim("in your shell to make plain")} ${cyan("claude")} ${dim("reachable from your phone.")}`);
+    return;
+  }
+  const wanted = await confirm({
+    message: `Make plain ${bold("claude")} reachable from your phone by default? (adds an alias to ${basename(rc.path)}, reversible)`,
+    default: false
+  });
+  if (!wanted) return;
+  const result = installClaudeAlias();
+  if (result.installed) {
+    console.log(`  ${check} Aliased ${cyan("claude")} \u2192 ${cyan("pushary claude")} in ${dim(result.path ?? rc.path)}`);
+    console.log(`  ${dim("Open a new terminal (or")} ${cyan(`source ${rc.path}`)}${dim(") to use it. Undo any time with")} ${cyan("pushary clean")}${dim(".")}`);
+  } else if (result.reason === "exists") {
+    console.log(`  ${check} ${dim("The")} ${cyan("claude")} ${dim("alias is already set.")}`);
+  }
+};
+var verifyKeyOrExit = async (apiKey, options, precomputed) => {
+  const live = process.stdout.isTTY === true && !options.json && precomputed === void 0;
+  if (live) writeHuman(`  ${dim("...")} Verifying your key with pushary.com`);
+  let result;
+  if (precomputed !== void 0) {
+    result = precomputed;
+  } else {
+    try {
+      result = await checkApiKey(apiKey);
+    } catch (err) {
+      result = { kind: "unreachable", detail: formatError(err) };
+    }
+  }
+  if (live) writeHuman("\r\x1B[2K");
+  const report = describeKeyCheck(result);
+  if (report.fatal) {
+    console.log(`  ${yellow("!")} ${report.message}`);
+    for (const line of report.next) console.log(`  ${dim(line)}`);
+    console.log();
+    process.exit(await abortWith("key-refused", report.exitCode, result.kind));
+  }
+  if (result.kind === "ok") {
+    const { siteSlug, siteName, plan } = result.identity;
+    console.log(`  ${check} Key verified ${dim(`(${siteSlug || siteName} \xB7 plan ${plan})`)}`);
+  } else {
+    console.log(`  ${yellow("!")} ${report.message}`);
+    for (const line of report.next) console.log(`  ${dim(line)}`);
+  }
+  return result;
+};
+var printPairingEscape = () => {
+  console.log();
+  console.log(`  ${yellow("!")} No app? Two ways to finish without one:`);
+  console.log();
+  console.log(`    ${cyan(BROWSER_CONNECT_COMMAND)}`);
+  console.log(`    ${dim("Approve in a browser tab. No phone needed.")}`);
+  console.log();
+  console.log(`    ${cyan(`${NPX_LATEST_COMMAND} setup --key pk_...`)}`);
+  console.log(`    ${dim("Paste a key from")} ${cyan("pushary.com/dashboard/agent/settings")}`);
+  console.log();
+  console.log(`  ${dim("Or get the app at")} ${cyan("https://pushary.com/download")} ${dim("and re-run setup.")}`);
+  console.log();
+};
+var usableStoredKey = async (apiKey) => {
+  let result;
+  try {
+    result = await checkApiKey(apiKey);
+  } catch (err) {
+    result = { kind: "unreachable", detail: formatError(err) };
+  }
+  return result.kind === "rejected" || result.kind === "malformed" ? null : result;
+};
+var AGENT_NAMES = {
+  claude_code: "Claude Code",
+  codex: "Codex",
+  gemini_cli: "Gemini CLI",
+  hermes: "Hermes",
+  cursor: "Cursor",
+  vscode: "VS Code",
+  opencode: "OpenCode",
+  fx: "fx",
+  ...compatibleRecord((profile) => profile.label),
+  custom: "Other"
+};
+var AGENT_CAPABILITIES = {
+  claude_code: "MCP + hooks + auto-allowed tools",
+  codex: "MCP + native hooks + auto-allowed tools",
+  gemini_cli: "MCP + native hooks + auto-allowed tools",
+  hermes: "native plugin + auto-error notifications",
+  cursor: "plugin + permission gate",
+  vscode: "agent plugin + permission gate",
+  opencode: "generated plugin + permission gate",
+  fx: "MCP through a local bridge + questions via push",
+  ...compatibleRecord((profile) => profile.mcp ? "MCP + native hooks" : "native hooks"),
+  custom: "any MCP or HTTP agent (Windsurf, n8n, custom)"
+};
+var failedAgentNames = (failures) => failures.map((failure) => AGENT_NAMES[failure.agent]);
+var agentFailureNextLine = (next) => next.kind === "retry-agent" ? `${dim(RETRY_AGENT_LABEL)} ${cyan(next.command)}` : next.instruction;
+var printAgentFailures = (failures) => {
+  for (const failure of describeAgentFailures(failures, (agent) => AGENT_NAMES[agent])) {
+    console.log(`  ${yellow("!")} ${failure.summary}`);
+    console.log(`    ${agentFailureNextLine(failure.next)}`);
+  }
+};
+var NAME_COLUMN = Math.max(...Object.values(AGENT_NAMES).map((name) => name.length)) + 2;
+var AGENT_LABELS = Object.fromEntries(
+  Object.keys(AGENT_NAMES).map((agent) => [
+    agent,
+    `${AGENT_NAMES[agent].padEnd(NAME_COLUMN)}${dim(AGENT_CAPABILITIES[agent])}`
+  ])
+);
+var detectAgents = () => {
+  const map = {};
+  for (const entry of detectAllAgents()) {
+    map[entry.agent] = { found: isDetected(entry.result), evidence: describeDetection(entry.result) };
+  }
+  return map;
+};
+var canRunBrowserLogin = () => process.stdout.isTTY === true && !process.env.CI;
+var canShowPairingQr = () => !process.env.CI;
+var resolveAgents = async (options) => {
+  if (options.agents.kind === "none") return [];
+  if (options.agents.kind === "explicit") {
+    const detected2 = detectAgents();
+    for (const agent of options.agents.agents) {
+      if (agent !== "custom" && !detected2[agent].found) {
+        console.log(`  ${yellow("!")} ${AGENT_NAMES[agent]} was not detected on this machine.`);
+        console.log(`  ${dim("Continuing anyway. The steps below say what was configured.")}`);
+      }
+    }
+    return options.agents.agents;
+  }
+  const detected = detectAgents();
+  const wantsAuto = options.agents.kind === "auto" || options.nonInteractive;
+  if (wantsAuto) {
+    const picked = Object.keys(detected).filter((agent) => detected[agent].found);
+    if (picked.length === 0) {
+      console.log(`  ${yellow("!")} No agents detected, so nothing was configured. Your key is saved.`);
+      console.log(`  ${dim("Install an agent and re-run, name one with --agents <id>, or pass --agents none to accept this.")}`);
+      console.log();
+      process.exit(await abortWith("no-agents-detected", EXIT.PROBLEMS_FOUND));
+    }
+    console.log(`  ${check} Selected automatically: ${picked.map((a) => AGENT_NAMES[a]).join(", ")} ${dim("(--agents to choose)")}`);
+    return picked;
+  }
+  const hint = Object.values(detected).some((entry) => entry.found) ? "(detected agents pre-selected)" : "(space = toggle, enter = confirm)";
+  return checkbox({
+    message: "Which agents do you use? " + dim(hint),
+    choices: Object.keys(AGENT_LABELS).map((agent) => ({
+      // The evidence rides along so a detection the user disagrees with is
+      // visible and correctable, rather than an unexplained pre-tick.
+      name: detected[agent].evidence ? `${AGENT_LABELS[agent]} ${dim(`[${detected[agent].evidence}]`)}` : AGENT_LABELS[agent],
+      value: agent,
+      short: AGENT_NAMES[agent],
+      checked: detected[agent].found
+    })),
+    // Today an empty selection skips the loop and still prints "Setup complete."
+    validate: (picked) => picked.length > 0 || "Select at least one agent, or re-run with --agents none."
+  });
+};
+var AGENT_TARGETS = {
+  claude_code: [CLAUDE_JSON, CLAUDE_SETTINGS, join3(CLAUDE_SKILL_DIR, "SKILL.md")],
+  codex: [join3(CODEX_HOME, "config.toml"), CODEX_HOOKS_JSON, join3(CODEX_SKILL_DIR, "SKILL.md"), CODEX_AGENTS_MD],
+  gemini_cli: [GEMINI_SETTINGS, GEMINI_MD],
+  hermes: ["the Hermes virtualenv (pip install pushary-hermes)"],
+  cursor: [join3(CURSOR_PLUGIN_DIR, "mcp.json"), CURSOR_USER_HOOKS],
+  vscode: [VSCODE_PLUGIN_MCP, ...vscodeSettingsTargets(existsSync)],
+  opencode: [
+    openCodePluginFile(),
+    join3(openCodePluginDir(), "package.json"),
+    openCodeConfigFile(),
+    OPENCODE_INSTRUCTIONS()
+  ],
+  fx: [fxMcpProfile(), fxSettings(), fxAgentsMd()],
+  ...compatibleRecord((profile) => compatibleTargetFiles(profile).map((file) => join3(homedir(), ...file))),
+  custom: ["nothing (prints connection details only)"]
+};
+var reportDryRun = (apiKey, agents, keyCheck, controlMode) => {
+  console.log();
+  console.log(`  ${bold("Dry run")} ${dim("\u2014 nothing below has been written")}`);
+  console.log();
+  console.log(
+    apiKey ? `  ${dim("Key:")}        ${dim(`${apiKey.slice(0, 8)}...${apiKey.slice(-4)}`)} ${dim(`(${keyCheck?.kind ?? "not verified"})`)}` : `  ${dim("Key:")}        ${dim("none on this machine \u2014 a real run would acquire one")}`
+  );
+  console.log(`  ${dim("Key store:")}  ${PUSHARY_CONFIG_FILE}`);
+  console.log(`  ${dim("Control:")}    ${controlMode ?? "unchanged (legacy install)"}`);
+  const rc = resolveShellRc();
+  console.log(`  ${dim("Shell rc:")}   ${rc ? rc.path : dim("none for this shell; the export line would be printed instead")}`);
+  console.log();
+  console.log(`  ${bold("Also, on a real run")}`);
+  for (const line of describeSetupSideEffects({
+    globalPackage: plannedGlobalPackage(),
+    version: getPackageVersion(),
+    configFile: PUSHARY_CONFIG_FILE,
+    rcPath: rc?.path ?? null,
+    controlMode,
+    serviceDefinitionPath: daemonServiceDefinitionPath()
+  })) console.log(`    ${dim(line)}`);
+  console.log();
+  if (agents.length === 0) {
+    console.log(`  ${dim("Agents:")}     ${dim("none")}`);
+  } else {
+    console.log(`  ${dim("Agents:")}     ${agents.map((agent) => AGENT_NAMES[agent]).join(", ")}`);
+    for (const agent of agents) {
+      console.log();
+      console.log(`  ${bold(AGENT_NAMES[agent])}`);
+      for (const target of AGENT_TARGETS[agent]) console.log(`    ${dim("would write")} ${target}`);
+    }
+  }
+  console.log();
+  console.log(`  ${dim("Re-run without --dry-run to apply.")}`);
+  console.log();
+};
+var printManualSteps = () => {
+  if (manualSteps.length === 0) return;
+  console.log(`  ${bold("Still to do")}`);
+  for (const step of manualSteps) console.log(`  ${dim("\u2022")} ${step}`);
+  console.log();
+};
+var emitJson = (options, payload) => {
+  if (!options.json) return;
+  process.stdout.write(`${JSON.stringify(payload, null, 2)}
+`);
+};
+var main = async () => {
+  const connector = coworkSelection(process.argv.slice(2));
+  if (connector) {
+    process.stdout.write(coworkOutput(connector.json ? "json" : "guide"));
+    return;
+  }
+  const options = parseSetupOptions({
+    argv: process.argv.slice(2),
+    stdinIsTty: process.stdin.isTTY === true
+  });
+  if (options.help) {
+    process.stdout.write(`${renderCommandHelp("setup", getPackageVersion())}
+`);
+    process.exit(EXIT.OK);
+  }
+  const controlMode = effectiveControlMode(options, readControlMode(), existsSync(PUSHARY_CONFIG_FILE));
+  recordSetupOptions(options);
+  if (options.json) {
+    jsonMode = true;
+    humanStream = process.stderr;
+    setHumanStream(process.stderr);
+    console.log = (...args) => {
+      process.stderr.write(`${args.map((a) => typeof a === "string" ? a : String(a)).join(" ")}
+`);
+    };
+  }
+  const version = getPackageVersion();
+  console.log();
+  console.log(`  ${bold("Pushary")} ${dim("v" + version)}`);
+  console.log(`  ${dim("Push notifications for AI agents")}`);
+  console.log();
+  await checkForUpdates(version, !options.dryRun);
+  markStep("resolve-key");
+  const connectMode = options.connectMode;
+  const flagKey = await readKeyFromStdin(options) ?? options.key ?? void 0;
+  const envKey = process.env.PUSHARY_API_KEY?.trim();
+  let trimmedKey;
+  let keyFromPairing = false;
+  const storedKey = readConfigFileKey();
+  const pairingRequested = connectMode === "app" && options.connectExplicit && !options.skipPhone;
+  const ambientEligible = flagKey === void 0 && !pairingRequested;
+  const envCheck = ambientEligible && envKey && isValidApiKey(envKey) ? await usableStoredKey(envKey) : null;
+  const storedCheck = ambientEligible && envCheck === null && storedKey !== null && isValidApiKey(storedKey) && // login writes both, so without this the same key is probed twice.
+  storedKey !== envKey ? await usableStoredKey(storedKey) : null;
+  const appKey = ambientEligible && envCheck === null && storedCheck === null ? pickAppKey({ fromAgents: AGENT_CHOICES.map(appMcpKeyIfReadable), storedKey, envKey }) : null;
+  const appKeyCheck = appKey === null ? null : await usableStoredKey(appKey);
+  let storedKeyCheck = null;
+  if (flagKey) {
+    const masked = `${flagKey.slice(0, 8)}...${flagKey.slice(-4)}`;
+    console.log(`  ${check} Using API key: ${dim(masked)}`);
+    console.log();
+    trimmedKey = flagKey;
+  } else if (storedKey !== null && storedCheck !== null) {
+    const masked = `${storedKey.slice(0, 8)}...${storedKey.slice(-4)}`;
+    console.log(`  ${check} Using the key already on this machine: ${dim(masked)}`);
+    console.log(`  ${dim(PUSHARY_CONFIG_FILE)}`);
+    console.log();
+    trimmedKey = storedKey;
+    storedKeyCheck = storedCheck;
+  } else if (envKey && envCheck !== null) {
+    const masked = `${envKey.slice(0, 8)}...${envKey.slice(-4)}`;
+    console.log(`  ${check} Found API key in environment: ${dim(masked)}`);
+    console.log();
+    const useExisting = options.nonInteractive || options.dryRun ? true : await confirm({ message: "Use this key?", default: true });
+    if (useExisting) {
+      trimmedKey = envKey;
+      storedKeyCheck = envCheck;
+    } else {
+      const apiKey = await input({ message: "API key:" });
+      trimmedKey = apiKey.trim();
+    }
+  } else if (appKey !== null && appKeyCheck !== null) {
+    const masked = `${appKey.slice(0, 8)}...${appKey.slice(-4)}`;
+    console.log(`  ${check} Using the key the Pushary Mac app is signed in with: ${dim(masked)}`);
+    console.log();
+    trimmedKey = appKey;
+    storedKeyCheck = appKeyCheck;
+  } else if (options.dryRun) {
+    console.log(`  ${dim("No key on this machine. A real run would connect one first.")}`);
+    console.log();
+    markStep("resolve-agents");
+    const plannedAgents = await resolveAgents(options);
+    reportDryRun(null, plannedAgents, null, controlMode);
+    emitJson(options, { ok: true, dryRun: true, agents: plannedAgents, control: controlMode, keyCheck: "skipped", key: "none" });
+    return;
+  } else if (connectMode === "app" && canShowPairingQr() && !options.skipPhone) {
+    console.log(`  ${dim("Pairing with your Pushary app.")}`);
+    console.log(`  ${dim("No app yet? Get it at")} ${cyan("https://pushary.com/download")}${dim(", this keeps waiting.")}`);
+    console.log(`  ${dim("No phone? Ctrl-C, then:")} ${cyan(BROWSER_CONNECT_COMMAND)}`);
+    markStep("pair");
+    const previous = readKeySource();
+    const paired = await connectViaAppPairing({
+      onCancelled: async () => {
+        printPairingEscape();
+        await reportSetupAbort("pairing-cancelled", 130);
+      }
+    });
+    if (paired.kind === "failed") {
+      if (pairingEscapeApplies(paired)) printPairingEscape();
+      process.exit(await abortWith(paired.reason === "cancelled" ? "pairing-cancelled" : "pairing-failed", EXIT.NOT_CONFIGURED));
+    }
+    trimmedKey = paired.apiKey;
+    keyFromPairing = true;
+    if (paired.handle) {
+      console.log(`  ${check} Connected to ${cyan("@" + paired.handle)}`);
+    }
+    if (previous.key && previous.key !== trimmedKey) {
+      console.log(`  ${yellow("!")} The key this machine used before (${keyPrefix(previous.key)}) is still active.`);
+      console.log(`  ${dim("Revoke it at")} ${cyan("pushary.com/dashboard/agent/settings")} ${dim("if nothing else uses it.")}`);
+    }
+    console.log();
+  } else if (!canRunBrowserLogin()) {
+    if (pairingRequested) {
+      console.log(`  ${yellow("!")} ${cyan("--connect app")} will not draw a pairing QR in CI.`);
+      console.log(`  ${dim("Pass --key <pk_xxx.xxx> or --key-stdin here. Outside CI, setup pairs with no terminal needed.")}`);
+    } else if (process.env.CI) {
+      console.log(`  ${yellow("!")} No API key, and setup does not pair in CI.`);
+      console.log(`  ${dim("Pass --key <pk_xxx.xxx>, or --key-stdin, or export PUSHARY_API_KEY.")}`);
+    } else {
+      console.log(`  ${yellow("!")} No API key, and nothing here can acquire one.`);
+      console.log(`  ${dim("Pass --key <pk_xxx.xxx>, or --key-stdin, or export PUSHARY_API_KEY.")}`);
+      console.log(`  ${dim("Or drop")} ${cyan("--connect browser")}${dim("/")}${cyan("--skip-phone")} ${dim("and setup will pair with your phone instead.")}`);
+    }
+    console.log();
+    process.exit(await abortWith("no-key", EXIT.NOT_CONFIGURED));
+  } else {
+    markStep("browser-login");
+    const outcome = await runBrowserLogin(
+      { say: (line) => console.log(line), bold, dim, cyan, yellow },
+      { cliVersion: version }
+    );
+    if (outcome.kind === "ok") {
+      trimmedKey = outcome.apiKey;
+      console.log();
+      console.log(`  ${check} Signed in${outcome.siteSlug ? ` ${dim(`(${outcome.siteSlug})`)}` : ""}`);
+      console.log();
+    } else if (outcome.kind === "rejected") {
+      console.log();
+      console.log(`  ${yellow("!")} That request was rejected in the browser. Nothing was written.`);
+      console.log();
+      process.exit(await abortWith("login-rejected", EXIT.NOT_CONFIGURED));
+    } else {
+      console.log();
+      if (outcome.kind === "unavailable") {
+        console.log(`  ${yellow("!")} Couldn't reach the login service ${dim(`(${outcome.detail})`)}`);
+      } else {
+        console.log(`  ${yellow("!")} The code expired before it was approved.`);
+      }
+      console.log(`  ${dim("Paste a key instead, or press Ctrl-C and re-run setup for a fresh code.")}`);
+      console.log(`  ${dim("Keys live at")} ${cyan("pushary.com/dashboard/agent/settings")}`);
+      console.log();
+      const apiKey = await input({ message: "API key:" });
+      trimmedKey = apiKey.trim();
+    }
+  }
+  if (!trimmedKey || !isValidApiKey(trimmedKey)) {
+    console.log(`
+  ${yellow("!")} Invalid key format. Expected: ${dim("pk_xxx.xxx")}`);
+    console.log(`  ${dim("Copy your key from")} ${cyan("https://pushary.com/dashboard/agent/settings")}`);
+    console.log(`  ${dim("Or sign up at")} ${cyan("https://pushary.com/sign-up?from=ai-coding")}
+`);
+    process.exit(await abortWith("invalid-key", EXIT.USAGE));
+  }
+  if (!options.dryRun) recordSetupKey(trimmedKey);
+  markStep("verify-key");
+  const keyCheck = await verifyKeyOrExit(trimmedKey, options, storedKeyCheck ?? void 0);
+  markStep("resolve-agents");
+  const agents = await resolveAgents(options);
+  if (options.dryRun) {
+    reportDryRun(trimmedKey, agents, keyCheck, controlMode);
+    emitJson(options, { ok: true, dryRun: true, agents, control: controlMode, keyCheck: keyCheck?.kind ?? "skipped" });
+    return;
+  }
+  markStep("save-key");
+  const transcriptSync = transcriptPreferenceForSetup(options.transcripts);
+  if (transcriptSync) {
+    console.log();
+    console.log("  Transcript sync: enabling locally redacted, encrypted sync for Pushary-launched sessions. Your phone can decrypt it; authorized Pushary compliance admins can recover it for documented legal obligations. Disable with pushary setup --transcripts off.");
+  }
+  const rc = await saveApiKey(trimmedKey, controlMode, transcriptSync);
+  if (keyCheck.kind === "ok") clearDaemonNeedsLogin();
+  const context = { rc };
+  const appBridgeAvailable = resolveBridgeStub(
+    join3(pusharyDir(), "bin", HOOK_LOCATOR_BINARY),
+    liveBridgeProbe()
+  ).kind === "bundle";
+  const accountChecks = /* @__PURE__ */ new Map();
+  if (keyCheck) accountChecks.set(trimmedKey, Promise.resolve(keyCheck));
+  const accountCheckFor = (key) => {
+    const existing = accountChecks.get(key);
+    if (existing) return existing;
+    const pending = checkApiKey(key);
+    accountChecks.set(key, pending);
+    return pending;
+  };
+  const appAccountMatches = async (agent) => {
+    const appKey2 = appMcpKeyFor(agent);
+    if (!appKey2) return false;
+    if (appKey2 === trimmedKey) return true;
+    const [cliAccount, appAccount] = await Promise.all([
+      accountCheckFor(trimmedKey),
+      accountCheckFor(appKey2)
+    ]);
+    return samePusharyAccount(cliAccount, appAccount);
+  };
+  const staleEnvironmentKey = Boolean(envKey && envKey !== trimmedKey);
+  if (envKey && staleEnvironmentKey) {
+    noteManual(
+      `This shell still exports the previous key (${keyPrefix(envKey)}), and it wins over the one just saved. Open a new terminal before starting an agent here, or re-export PUSHARY_API_KEY.`
+    );
+  }
+  const failures = [];
+  const completed = [];
+  const skipped = [];
+  const hookOwners = [];
+  let controlLifecycleFailure = null;
+  if (agents.length === 0) {
+    console.log(`
+  ${check} API key saved. No agents configured.`);
+    console.log(`  ${dim("Run setup again with --agents <id> when you want one wired up.")}`);
+  } else {
+    for (const [index, agent] of agents.entries()) {
+      markStep(`configure:${agent}`);
+      try {
+        const ownerBefore = hookOwnerFor(agent, appBridgeAvailable);
+        const plan = planHooks({ owner: ownerBefore, takeOverHooks: options.takeOverHooks, nonInteractive: options.nonInteractive });
+        const keepAppWiring = plan === "keep";
+        if (keepAppWiring) {
+          if (!await appAccountMatches(agent)) {
+            hookOwners.push({ agent, owner: "app", kept: true });
+            const failure = describedAgentFailure(agent, "app-account-mismatch");
+            failures.push(failure);
+            console.log(`
+  ${yellow("!")} ${AGENT_NAMES[agent]}: ${failure.detail}`);
+            console.log(`  ${dim("Sign the Mac app into the same account and repair this agent, then re-run setup.")}`);
+            console.log(`  ${dim("Or pass --take-over-hooks if you intentionally want the CLI to own these hooks.")}`);
+            continue;
+          }
+          console.log(`
+  ${check} ${AGENT_NAMES[agent]}: ${describeAppOwnership(AGENT_NAMES[agent])} ${dim(KEEP_HINT)}`);
+          hookOwners.push({ agent, owner: "app", kept: true });
+          completed.push(agent);
+          continue;
+        }
+        if (ownerBefore === "app") captureTakeoverReceipt(agent);
+        const outcome = await AGENT_SETUP[agent](trimmedKey, context);
+        if (outcome === "skipped") {
+          skipped.push(agent);
+        } else if (agentIsWired(agent)) {
+          completed.push(agent);
+          hookOwners.push({ agent, owner: hookOwnerFor(agent, appBridgeAvailable), kept: false });
+        } else {
+          const failure = describedAgentFailure(agent, "not-wired");
+          failures.push(failure);
+          console.log(`  ${yellow("!")} ${AGENT_NAMES[agent]} ${failure.detail}`);
+          console.log(`  ${dim("Re-run setup, then")} ${cyan("npx @pushary/agent-hooks@latest doctor")} ${dim("to see what is missing.")}`);
+        }
+      } catch (err) {
+        const failure = agentFailureFromError(agent, err, formatError);
+        failures.push(failure);
+        console.log(`  ${yellow("!")} ${AGENT_NAMES[agent]} setup failed: ${failure.detail}`);
+        const continuation = afterAgentFailureNote(agents.length - index - 1);
+        if (continuation) console.log(`  ${dim(continuation)}`);
+      }
+    }
+    if (skipped.length > 0) {
+      console.log();
+      console.log(`  ${yellow("!")} Not configured: ${skipped.map((a) => a.replace("_", " ")).join(", ")} ${dim("(not installed on this machine)")}`);
+    }
+    if (failures.length > 0) {
+      console.log();
+      const configured = failedAgentsContext(completed.map((agent) => AGENT_NAMES[agent]));
+      console.log(`  ${yellow("!")} Failed: ${failedAgentNames(failures).join(", ")}${configured ? ` ${dim(configured)}` : ""}`);
+      for (const followUp of agentFailureFollowUps(failures)) {
+        if (followUp === "install-node") console.log(`  ${INSTALL_NODE_STEP}`);
+        else console.log(`  ${dim("Run")} npx @pushary/agent-hooks@latest doctor ${dim("for the reason, or send it to")} ${SUPPORT_EMAIL}`);
+      }
+    }
+    markStep("project-instructions");
+    await offerProjectInstructions(agents, options);
+    if (completed.includes("claude_code")) {
+      await offerClaudeAlias(options);
+    }
+  }
+  if (controlMode === "off") {
+    markStep("control:disable");
+    const disabled = await disableDaemonService();
+    if (disabled.kind !== "ok") {
+      controlLifecycleFailure = disabled.detail;
+      console.log(`  ${yellow("!")} Could not fully disable phone-start: ${controlLifecycleFailure}`);
+    } else {
+      console.log(`  ${check} Phone-start background service disabled.`);
+    }
+  }
+  markStep("connect-phone");
+  const skipPhone = options.skipPhone;
+  let phone = null;
+  const verifyMode = effectiveVerify(options, { paired: keyFromPairing });
+  const phoneCheck = keyCheck.kind === "unreachable" ? "unverified" : planPhoneCheck({
+    locked: keyCheck?.kind === "locked",
+    skipPhone,
+    verify: verifyMode,
+    stdoutIsTty: process.stdout.isTTY === true,
+    paired: keyFromPairing,
+    connectMode
+  });
+  switch (phoneCheck) {
+    case "unverified":
+      console.log();
+      console.log(`  ${dim("Skipping the delivery check: account readiness could not be verified. Re-run setup once online.")}`);
+      break;
+    case "locked":
+      console.log();
+      console.log(`  ${dim("Skipping the delivery check: no approval can be delivered until the plan is active.")}`);
+      break;
+    case "skip-phone":
+      console.log();
+      console.log(`  ${dim("Skipping the phone check (--skip-phone).")}`);
+      break;
+    case "verify-none":
+      console.log();
+      console.log(`  ${dim("Skipping the delivery check (--verify none). Nothing here proves an approval reaches you.")}`);
+      break;
+    case "instructions":
+      phone = await printConnectInstructions(trimmedKey);
+      break;
+    case "confirm-pairing":
+      phone = await confirmAppConnection(trimmedKey);
+      break;
+    case "reuse-app":
+      phone = await printConnectInstructions(trimmedKey);
+      break;
+    case "connect":
+      phone = await connectDevice(trimmedKey, { showCapabilities: !options.connectExplicit });
+      break;
+  }
+  let roundTrip = null;
+  if (verifyMode === "roundtrip" && keyCheck.kind === "ok" && !skipPhone && // Reaching nobody is already reported by the delivery check above, in copy
+  // that names the fix. Asking a question nobody can receive would repeat it
+  // 55 seconds later and add nothing.
+  //
+  // `unattributable` is the exception and the case this is best at. It means
+  // the push landed on a multi-member site through a channel that carries no
+  // owner, so nothing in the counts can say whether it was THIS user's device.
+  // A tap settles it, which is why describeVerifyOutcome already tells people
+  // to run `doctor --roundtrip` here. Doing it inline saves the round trip
+  // being a thing they have to know to run.
+  (phone?.reachesYou || phone?.outcome?.kind === "unattributable")) {
+    console.log();
+    console.log(`  ${dim("Test delivery and answer return. Agent hooks are a separate check.")}`);
+    await spinner("Waiting for you to tap the notification", async () => {
+      roundTrip = await verifyRoundTrip(trimmedKey);
+    });
+    const report = describeRoundTrip(roundTrip);
+    console.log(`  ${report.ok ? check : yellow("!")} ${report.message}`);
+    for (const line of report.next) console.log(`  ${dim(line)}`);
+  } else if (verifyMode === "roundtrip" && keyCheck.kind === "ok") {
+    console.log();
+    console.log(`  ${dim("Skipped the round trip: nothing is connected that could answer it.")}`);
+  }
+  console.log();
+  if (keyCheck.kind === "locked" || keyCheck.kind === "unreachable") {
+    const report = describeKeyCheck(keyCheck);
+    const next = [...report.next, "Finish activation: pushary setup (reuses the saved key)."];
+    const exitCode2 = failures.length > 0 || controlLifecycleFailure ? EXIT.PROBLEMS_FOUND : report.exitCode;
+    printManualSteps();
+    console.log(`  ${yellow(bold(keyCheck.kind === "locked" ? "Agents configured, approvals inactive." : "Configuration saved, activation unverified."))}`);
+    if (failures.length > 0) {
+      console.log();
+      printAgentFailures(failures);
+    }
+    console.log();
+    console.log(`  ${report.message}`);
+    for (const line of next) console.log(`  ${dim(line)}`);
+    console.log();
+    emitJson(options, {
+      ok: false,
+      next,
+      reason: keyCheck.kind === "locked" ? "plan_inactive" : "readiness_unverified",
+      configured: completed,
+      skipped,
+      manualSteps,
+      failed: failedAgentNames(failures),
+      agentFailures: failures,
+      keyCheck: keyCheck.kind,
+      rc: rc.kind,
+      control: controlMode,
+      daemon: controlLifecycleFailure ? "unavailable" : "skipped",
+      exitCode: exitCode2
+    });
+    await reportSetupOutcome({
+      options,
+      completed,
+      skipped,
+      failures,
+      closingReason: unverifiedKeyClosingReason({
+        failedCount: failures.length,
+        controlLifecycleFailed: controlLifecycleFailure !== null,
+        keyCheck: keyCheck.kind
+      }),
+      connectOutcome: "skipped",
+      keyCheck: keyCheck.kind,
+      exitCode: exitCode2
+    });
+    process.exit(exitCode2);
+  }
+  printManualSteps();
+  const configuredNothing = agents.length > 0 && completed.length === 0;
+  const agentsOk = failures.length === 0 && !configuredNothing;
+  const reachChecked = phone !== null;
+  const reachesYou = phone?.reachesYou ?? true;
+  markStep("closing");
+  const keyIsTrusted = keyCheck.kind === "ok";
+  const managedControlAgents = ["claude_code", "codex", "gemini_cli"];
+  const configuredControlAgents = managedControlAgents.filter((agent) => agentIsWired(agent));
+  const configuredControlProviders = configuredControlAgents.map(
+    (agent) => agent === "claude_code" ? "claude" : agent === "gemini_cli" ? "gemini" : agent
+  );
+  const controlCapabilities = detectProviderLiveCapabilities(configuredControlProviders);
+  const providerAvailable = hasSpawnProvider(controlCapabilities);
+  const managerAvailable = daemonServiceManagerAvailable();
+  const servicePresent = readDaemonStatus().kind !== "absent" || hasDaemonServiceDefinition();
+  let controlPolicy = resolveControlPolicy({
+    mode: controlMode,
+    providerAvailable,
+    managerAvailable,
+    servicePresent
+  });
+  if (controlPolicy === "legacy") {
+    let legacyRuntimeFailure = null;
+    try {
+      await installGlobally2();
+      const replaced = await replaceDaemonService();
+      if (replaced.kind !== "ok") throw new Error(replaced.detail);
+    } catch (err) {
+      legacyRuntimeFailure = formatError(err);
+    }
+    let retired = legacyRuntimeFailure !== null;
+    let stopped = retired ? await disableDaemonService() : await stopDaemonService();
+    if (!retired && stopped.kind !== "ok") {
+      legacyRuntimeFailure = stopped.detail;
+      retired = true;
+      stopped = await disableDaemonService();
+    }
+    if (stopped.kind !== "ok") {
+      controlLifecycleFailure = [legacyRuntimeFailure, stopped.detail].filter(Boolean).join("; ");
+      console.log(`  ${yellow("!")} Could not make the legacy phone-start service safe: ${controlLifecycleFailure}`);
+    } else if (retired) {
+      controlPolicy = resolveControlPolicy({
+        mode: controlMode,
+        providerAvailable,
+        managerAvailable,
+        servicePresent: false
+      });
+      console.log(`  ${yellow("!")} Retired the legacy phone-start service because it could not be safely repinned: ${legacyRuntimeFailure}`);
+    }
+    if (!retired && stopped.kind === "ok") warnVersionManagerPin(process.execPath);
+  }
+  if (controlMode === "on" && controlPolicy !== "enabled") {
+    console.log(`  ${yellow("!")} Phone-start was required: ${!providerAvailable ? "install a supported Claude Code, Codex or Gemini provider" : "no native background-service manager is available in this OS session"}.`);
+  } else if (controlPolicy === "legacy") {
+    console.log(`  ${yellow("!")} A legacy phone-start service cannot be safely adopted in this session. Disable it with --control off or restore its provider and native service manager.`);
+  }
+  const daemon = keyIsTrusted && controlPolicy === "enabled" ? await (async () => {
+    try {
+      await installGlobally2();
+      const service = await replaceDaemonService();
+      if (service.kind === "ok") warnVersionManagerPin(process.execPath);
+      return service.kind === "ok" ? ensureDaemonRunning({ spawnDaemon: () => {
+      } }) : { kind: "unavailable", detail: service.detail };
+    } catch (err) {
+      return { kind: "unavailable", detail: formatError(err) };
+    }
+  })() : controlMode === "on" || controlPolicy === "legacy" ? { kind: "unavailable", detail: "Managed control is required but no usable provider/service-manager pair is available" } : null;
+  const localControlProof = daemon?.kind === "running" || daemon?.kind === "started" ? await waitForDaemonRemoteProof() : null;
+  const serverControlProof = localControlProof && daemonHasRemoteProof(localControlProof) ? await waitForMachineReadiness(trimmedKey, ["spawn", ...controlCapabilities]) : null;
+  const daemonReady = daemon === null ? null : localControlProof !== null && daemonHasRemoteProof(localControlProof) && (serverControlProof?.kind === "ready" || serverControlProof?.kind === "unsupported");
+  if (serverControlProof?.kind === "unsupported") {
+    console.log(`  ${yellow("!")} This server predates control-readiness reporting; local heartbeat and queue checks passed.`);
+  } else if (serverControlProof && serverControlProof.kind !== "ready") {
+    console.log(`  ${yellow("!")} Managed control could not be verified by the server: ${serverControlProof.detail}`);
+  }
+  const managedControl = readManagedControlEvidence(trimmedKey, configuredControlProviders, controlLifecycleFailure ? null : serverControlProof);
+  const closing = describeClosing({
+    staleEnvironmentKey,
+    agentsOk,
+    configuredNothing,
+    completed,
+    failed: failedAgentNames(failures),
+    reachChecked,
+    reachesYou,
+    managedControlReady: !controlLifecycleFailure && managedControl.ready,
+    daemonReady: controlLifecycleFailure ? false : daemonReady,
+    transcriptSync,
+    // null when the check did not run, so it changes nothing. Only an outright
+    // `false` is allowed to hold back "Setup complete.".
+    roundTripAnswered: roundTrip === null ? null : roundTrip.kind === "answered" ? true : roundTrip.kind === "unanswered" ? false : null
+  });
+  console.log(`  ${closing.ok ? green(bold(closing.headline)) : yellow(bold(closing.headline))}`);
+  if (failures.length > 0) {
+    console.log();
+    for (const agent of completed) console.log(`  ${check} ${AGENT_NAMES[agent] ?? agent}`);
+    printAgentFailures(failures);
+  }
+  const ownershipLine = describeHookOwnership(hookOwners, AGENT_NAMES);
+  if (ownershipLine) console.log(`  ${dim(ownershipLine)}`);
+  console.log();
+  for (const line of closing.next) console.log(`  ${line}`);
+  console.log();
+  console.log(`  ${dim("Useful:")}`);
+  for (const line of renderCommandSurface()) console.log(`  ${dim(line)}`);
+  console.log();
+  const exitCode = closing.exitCode;
+  await reportSetupOutcome({
+    options,
+    completed,
+    skipped,
+    failures,
+    closingReason: closing.reason,
+    // 'answered' is finally reachable. It was in the enum from the start and
+    // nothing produced it, because setup stopped at a delivered notification, so
+    // the one value meaning "a human tapped" was never emitted by the command
+    // whose job is to prove a human can.
+    connectOutcome: roundTripOutcome(roundTrip) ?? (phone === null ? "skipped" : phone.reachesYou ? "delivered" : "unreachable"),
+    keyCheck: keyCheck?.kind ?? "skipped",
+    exitCode
+  });
+  emitJson(options, {
+    ok: closing.ok,
+    configured: completed,
+    skipped,
+    manualSteps,
+    failed: failedAgentNames(failures),
+    agentFailures: failures,
+    hookOwners,
+    keyCheck: keyCheck?.kind ?? "skipped",
+    reach: phone === null ? "skipped" : phone.reachesYou ? "yours" : phone.outcome?.kind ?? phone.detail ?? "unreachable",
+    // Named separately from `reach` so a caller can tell "a push landed" from
+    // "a person answered" without inferring it. 'skipped' means the check did
+    // not run, never that it failed.
+    roundTrip: roundTrip === null ? "skipped" : roundTrip.kind,
+    roundTripEvidence: roundTripEvidence(roundTrip),
+    hookActivation: "unverified",
+    rc: rc.kind,
+    rcPath: rc.path,
+    daemon: controlLifecycleFailure ? "unavailable" : daemon?.kind ?? "skipped",
+    control: controlMode,
+    controlPolicy,
+    controlCapabilities,
+    managedControl,
+    exitCode
+  });
+  if (exitCode !== EXIT.OK) {
+    if (configuredNothing && failures.length === 0) {
+      console.log(`  ${yellow("!")} Nothing was configured: none of the agents you asked for are installed here.`);
+      console.log(`  ${dim("Your key is saved. Install one and re-run, or pass --agents none to accept this.")}`);
+      console.log();
+    }
+    process.exit(exitCode);
+  }
+};
+main().catch(async (err) => {
+  if (err instanceof UsageError) {
+    console.log();
+    console.log(`  ${yellow("!")} ${err.message}`);
+    console.log(`  ${dim("Run")} ${cyan("pushary setup --help")} ${dim("for the full list.")}`);
+    console.log();
+    process.exit(EXIT.USAGE);
+  }
+  if (isExitPromptError(err)) {
+    console.log();
+    console.log(`  ${dim("Cancelled. Nothing further was changed.")}`);
+    console.log();
+    process.exit(await abortWith("interrupted", 130));
+  }
+  console.log();
+  console.log(`  ${yellow("!")} Setup failed: ${formatError(err)}`);
+  console.log(`  ${dim("Run")} ${cyan(`${NPX_LATEST_COMMAND} doctor`)} ${dim("after fixing the issue, then rerun setup.")}`);
+  console.log();
+  process.exit(await abortWith("crashed", EXIT.FAILED));
+});