pushary 1.8.0

package/dist/chunk-CVQYGMSR.js

@@ -0,0 +1,142 @@
+import {
+  CLIENT_REPORT_DISABLE_ENV,
+  isDisabledByEnv
+} from "./chunk-POFBE6ZY.js";
+import {
+  isNetworkFailure
+} from "./chunk-2OY3ZZ5N.js";
+import {
+  clientReportClaims
+} from "./chunk-A2A2YTMG.js";
+import {
+  getApiKey,
+  getBaseUrl
+} from "./chunk-GPEGOGRJ.js";
+import {
+  CLIENT_REPORT_PATH,
+  degradedLine
+} from "./chunk-NQTHFF4W.js";
+
+// src/client-report-claim.ts
+import { createHash } from "crypto";
+import { closeSync, mkdirSync, openSync, readdirSync, unlinkSync } from "fs";
+import { join } from "path";
+var CLIENT_REPORT_WINDOW_MS = 6e4;
+var CLAIM_DIRECTORY_MODE = 448;
+var CLAIM_FILE_MODE = 384;
+var CLAIM_KEY_HASH_LENGTH = 16;
+var CLAIM_FILE_PATTERN = /^[0-9a-f]{16}-(\d+)$/;
+var EXCLUSIVE_CREATE = "wx";
+var ALREADY_EXISTS = "EEXIST";
+var WINDOWS_KEPT_BEHIND = 1;
+var reportWindowOf = (now) => Math.floor(now / CLIENT_REPORT_WINDOW_MS);
+var claimFileName = (key, window) => `${createHash("sha256").update(key).digest("hex").slice(0, CLAIM_KEY_HASH_LENGTH)}-${window}`;
+var errorCodeOf = (error) => typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" ? error.code : null;
+var claimWindowOf = (fileName) => {
+  const match = CLAIM_FILE_PATTERN.exec(fileName);
+  return match ? Number(match[1]) : null;
+};
+var isStaleClaim = (fileName, window) => {
+  const claimedWindow = claimWindowOf(fileName);
+  return claimedWindow !== null && claimedWindow < window - WINDOWS_KEPT_BEHIND;
+};
+var removeQuietly = (filePath) => {
+  try {
+    unlinkSync(filePath);
+  } catch {
+    return;
+  }
+};
+var removeStaleClaims = (claimsDir, window) => {
+  try {
+    for (const fileName of readdirSync(claimsDir)) {
+      if (isStaleClaim(fileName, window)) removeQuietly(join(claimsDir, fileName));
+    }
+  } catch {
+    return;
+  }
+};
+var claimReportWindow = (claimsDir, key, now) => {
+  const window = reportWindowOf(now);
+  try {
+    mkdirSync(claimsDir, { recursive: true, mode: CLAIM_DIRECTORY_MODE });
+    closeSync(openSync(join(claimsDir, claimFileName(key, window)), EXCLUSIVE_CREATE, CLAIM_FILE_MODE));
+  } catch (error) {
+    return errorCodeOf(error) === ALREADY_EXISTS ? "already_claimed" : "unavailable";
+  }
+  removeStaleClaims(claimsDir, window);
+  return "claimed";
+};
+
+// src/client-report.ts
+var CLIENT_REPORT_TIMEOUT_MS = 1e3;
+var readApiKey = () => {
+  try {
+    return getApiKey();
+  } catch {
+    return null;
+  }
+};
+var defaultDeps = () => ({
+  disabled: () => isDisabledByEnv(process.env, CLIENT_REPORT_DISABLE_ENV),
+  fetchImpl: fetch,
+  apiKey: readApiKey,
+  baseUrl: getBaseUrl,
+  now: Date.now,
+  claimsDir: clientReportClaims()
+});
+var reportKey = (event) => `${event.kind}:${event.code}`;
+var createClientErrorReporter = (deps) => {
+  const windowClaimedInProcess = /* @__PURE__ */ new Map();
+  const claimInProcess = (key, now) => {
+    if (windowClaimedInProcess.get(key) === reportWindowOf(now)) return false;
+    windowClaimedInProcess.set(key, reportWindowOf(now));
+    return true;
+  };
+  const claimReport = (key, now) => {
+    const claim = claimReportWindow(deps.claimsDir, key, now);
+    return claim === "unavailable" ? claimInProcess(key, now) : claim === "claimed";
+  };
+  return async (event) => {
+    try {
+      if (deps.disabled()) return;
+      const apiKey = deps.apiKey();
+      const now = deps.now();
+      if (!apiKey || !claimReport(reportKey(event), now)) return;
+      await deps.fetchImpl(`${deps.baseUrl()}${CLIENT_REPORT_PATH}`, {
+        method: "POST",
+        headers: { "Authorization": `Bearer ${apiKey}`, "Content-Type": "application/json" },
+        body: JSON.stringify({ ...event, occurredAt: new Date(now).toISOString() }),
+        signal: AbortSignal.timeout(CLIENT_REPORT_TIMEOUT_MS)
+      });
+    } catch {
+      return;
+    }
+  };
+};
+var processReporter = null;
+var inFlightReports = /* @__PURE__ */ new Set();
+var reportClientError = (event) => {
+  processReporter ??= createClientErrorReporter(defaultDeps());
+  const report = processReporter(event);
+  inFlightReports.add(report);
+  void report.finally(() => inFlightReports.delete(report));
+  return report;
+};
+var exitAfterClientReports = async (code) => {
+  await Promise.all(inFlightReports);
+  return process.exit(code);
+};
+var clientErrorKindOf = (error) => isNetworkFailure(error) ? "network" : "unexpected";
+var writeDegraded = (subsystem, report) => {
+  process.stderr.write(`${degradedLine(subsystem, report)}
+`);
+  void reportClientError({ kind: "degraded", code: `${subsystem}:${report.reason}` });
+};
+
+export {
+  reportClientError,
+  exitAfterClientReports,
+  clientErrorKindOf,
+  writeDegraded
+};

package/dist/chunk-CVWG2N3Y.js

@@ -0,0 +1,16 @@
+// src/wait-ladder.ts
+var HAND_BACK = "then hand back to the agent's own prompt";
+var describeWaitLadder = (p) => {
+  if (p.mode === "terminal_only") return "no approval alerts, the agent's own prompt decides";
+  if (p.mode === "notify_only") return "send an approval alert, then the agent's own prompt decides";
+  if (p.mode === "push_only") {
+    if (p.timeoutAction === "wait") return `wait for your phone, ${HAND_BACK}`;
+    const tail = p.timeoutAction === "approve" ? "then auto-approve" : p.timeoutAction === "deny" ? "then auto-deny" : HAND_BACK;
+    return `wait for your phone up to ${p.timeoutSeconds}s, ${tail}`;
+  }
+  return `when you are away or Pushary cannot tell, ask your phone for ${p.pushFirstSeconds}s, ${HAND_BACK}`;
+};
+
+export {
+  describeWaitLadder
+};

package/dist/chunk-D2FX3EPW.js

@@ -0,0 +1,15 @@
+import {
+  HOOK_HOLD_BUDGET_ENV,
+  hookHoldBudgetProof
+} from "./chunk-NQTHFF4W.js";
+
+// src/hold-budget.ts
+var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {
+  const proof = hookHoldBudgetProof(args, env);
+  delete env[HOOK_HOLD_BUDGET_ENV];
+  return proof;
+};
+
+export {
+  takeHookHoldBudget
+};

package/dist/chunk-DB3ONZB4.js

@@ -0,0 +1,44 @@
+import {
+  configFilePath
+} from "./chunk-GPEGOGRJ.js";
+import {
+  normalizeInstallSource
+} from "./chunk-NQTHFF4W.js";
+
+// src/install-source.ts
+import { readFileSync } from "fs";
+var ENV_OVERRIDE = "PUSHARY_INSTALL_SOURCE";
+var PLUGIN_ROOT = "CLAUDE_PLUGIN_ROOT";
+var EDITOR_PLUGIN_MARKERS = ["cursor-plugin", "vscode-plugin"];
+var detectInstallSource = (env = process.env, argv = process.argv) => {
+  const declared = env[ENV_OVERRIDE]?.trim();
+  if (declared) return normalizeInstallSource(declared);
+  const pluginRoot = env[PLUGIN_ROOT]?.trim();
+  if (pluginRoot) {
+    return EDITOR_PLUGIN_MARKERS.some((marker) => pluginRoot.includes(marker)) ? "editor_plugin" : "claude_plugin";
+  }
+  const entry = argv[1] ?? "";
+  if (entry.includes("_npx")) return "npx";
+  if (entry) return "npm";
+  return "unknown";
+};
+var storedInstallSource = () => {
+  try {
+    const parsed = JSON.parse(readFileSync(configFilePath(), "utf-8"));
+    const stored = parsed.installSource;
+    return typeof stored === "string" && stored ? normalizeInstallSource(stored) : void 0;
+  } catch {
+    return void 0;
+  }
+};
+var resolveInstallSourceFor = (config) => {
+  const stored = config.installSource;
+  if (typeof stored === "string" && stored) return normalizeInstallSource(stored);
+  return detectInstallSource();
+};
+var reportedInstallSource = () => storedInstallSource() ?? detectInstallSource();
+
+export {
+  resolveInstallSourceFor,
+  reportedInstallSource
+};

package/dist/chunk-DE4Y6TCC.js

@@ -0,0 +1,160 @@
+import {
+  detectProviderLiveCapabilities,
+  hasSpawnProvider,
+  resolveControlPolicy
+} from "./chunk-HQ6G3B5R.js";
+import {
+  daemonHasRemoteProof,
+  daemonServiceManagerAvailable,
+  hasDaemonServiceDefinition,
+  readDaemonNeedsLogin,
+  readDaemonStatus
+} from "./chunk-WE2J62NC.js";
+import {
+  readControlMode,
+  readKeySource
+} from "./chunk-P7WQEVWA.js";
+import {
+  getMachineId
+} from "./chunk-LXQ5FBBD.js";
+import {
+  getBaseUrl
+} from "./chunk-GPEGOGRJ.js";
+import {
+  getPackageVersion
+} from "./chunk-NQTHFF4W.js";
+
+// src/machines.ts
+import { hostname } from "os";
+var MACHINES_PATH = "/api/v1/server/machines";
+var HEARTBEAT_INTERVAL_MS = 6e4;
+var sendHeartbeat = async (apiKey, input = {}, deps = {}) => {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const baseUrl = deps.baseUrl ?? getBaseUrl();
+  try {
+    const res = await fetchImpl(`${baseUrl}${MACHINES_PATH}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify({
+        machineId: getMachineId(),
+        hostname: hostname(),
+        cliVersion: getPackageVersion(),
+        repoKey: input.repoKey ?? null,
+        capabilities: input.capabilities ?? []
+      }),
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (res.status === 401 || res.status === 403) return { kind: "unauthorized" };
+    if (!res.ok) return { kind: "failed", detail: `HTTP ${res.status}` };
+    return { kind: "ok" };
+  } catch (err) {
+    return { kind: "failed", detail: err instanceof Error ? err.message : "network error" };
+  }
+};
+var parseMachine = (value) => {
+  if (typeof value !== "object" || value === null) return null;
+  const raw = value;
+  if (typeof raw.machineId !== "string" || typeof raw.hostname !== "string") return null;
+  return {
+    machineId: raw.machineId,
+    hostname: raw.hostname,
+    cliVersion: typeof raw.cliVersion === "string" ? raw.cliVersion : "unknown",
+    repoKey: typeof raw.repoKey === "string" ? raw.repoKey : null,
+    capabilities: Array.isArray(raw.capabilities) ? raw.capabilities.filter((c) => typeof c === "string") : [],
+    lastSeenAt: typeof raw.lastSeenAt === "string" ? raw.lastSeenAt : "",
+    lastControlAt: typeof raw.lastControlAt === "string" ? raw.lastControlAt : raw.lastControlAt === null ? null : void 0,
+    online: raw.online === true
+  };
+};
+var machineReadiness = (machines, machineId, expectedCapabilities, now = Date.now()) => {
+  const machine = machines.find((item) => item.machineId === machineId);
+  if (!machine) return { kind: "not-ready", detail: "this machine has not heartbeated to the server" };
+  if (!machine.online) return { kind: "not-ready", detail: "the server reports this machine offline" };
+  if (machine.lastControlAt === void 0) {
+    return { kind: "unsupported", detail: "the server does not report control readiness yet" };
+  }
+  if (machine.lastControlAt === null || !Number.isFinite(Date.parse(machine.lastControlAt))) {
+    return { kind: "not-ready", detail: "the server has not observed this machine polling the control queue" };
+  }
+  if (!daemonHasRemoteProof({ kind: "running", lastSuccessfulHeartbeatAt: machine.lastSeenAt, lastSuccessfulControlAt: machine.lastControlAt }, now)) {
+    return { kind: "not-ready", detail: "the heartbeat or control-queue proof is stale; wake this machine and retry pushary doctor" };
+  }
+  const missing = expectedCapabilities.filter((capability) => !machine.capabilities.includes(capability));
+  return missing.length === 0 ? { kind: "ready", machine } : { kind: "not-ready", detail: `the server is missing capabilities: ${missing.join(", ")}` };
+};
+var readMachineReadiness = async (apiKey, expectedCapabilities, deps = {}) => {
+  const listed = await listMachines(apiKey, deps);
+  return listed.kind === "ok" ? machineReadiness(listed.machines, deps.machineId ?? getMachineId(), expectedCapabilities, deps.now?.()) : listed.kind === "unsupported" ? { kind: "unsupported", detail: "the server does not report machine readiness yet" } : listed;
+};
+var waitForMachineReadiness = async (apiKey, expectedCapabilities, deps = {}) => {
+  const attempts = deps.attempts ?? 21;
+  const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  let result = { kind: "not-ready", detail: "this machine has not heartbeated to the server" };
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    result = await readMachineReadiness(apiKey, expectedCapabilities, deps);
+    if (result.kind === "ready" || result.kind === "unsupported" || result.kind === "failed" && /^HTTP (?:401|403)$/.test(result.detail)) return result;
+    if (attempt + 1 < attempts) await sleep(250);
+  }
+  return result;
+};
+var listMachines = async (apiKey, deps = {}) => {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const baseUrl = deps.baseUrl ?? getBaseUrl();
+  try {
+    const res = await fetchImpl(`${baseUrl}${MACHINES_PATH}`, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (res.status === 404) return { kind: "unsupported" };
+    if (!res.ok) return { kind: "failed", detail: `HTTP ${res.status}` };
+    const body = await res.json().catch(() => null);
+    const list = body && Array.isArray(body.machines) ? body.machines : [];
+    return { kind: "ok", machines: list.map(parseMachine).filter((m) => m !== null) };
+  } catch (err) {
+    return { kind: "failed", detail: err instanceof Error ? err.message : "network error" };
+  }
+};
+var describeLastSeen = (iso, now = Date.now()) => {
+  const seen = Date.parse(iso);
+  if (!Number.isFinite(seen)) return "unknown";
+  const seconds = Math.max(0, Math.round((now - seen) / 1e3));
+  if (seconds < 60) return "just now";
+  const minutes = Math.round(seconds / 60);
+  if (minutes < 60) return `${minutes}m ago`;
+  const hours = Math.round(minutes / 60);
+  if (hours < 48) return `${hours}h ago`;
+  return `${Math.round(hours / 24)}d ago`;
+};
+var readManagedControlEvidence = (apiKey, providers, serverProof) => {
+  const now = Date.now();
+  const daemon = readDaemonStatus();
+  const capabilities = detectProviderLiveCapabilities(providers);
+  const providerAvailable = hasSpawnProvider(capabilities);
+  const managerAvailable = daemonServiceManagerAvailable();
+  const serviceInstalled = hasDaemonServiceDefinition();
+  const keyCurrent = Boolean(apiKey) && readKeySource().key === apiKey && readDaemonNeedsLogin().kind !== "blocked";
+  const policy = resolveControlPolicy({ mode: readControlMode(), providerAvailable, managerAvailable, servicePresent: serviceInstalled || daemon.kind !== "absent" });
+  const localProof = daemonHasRemoteProof(daemon, now);
+  const remote = serverProof?.kind === "ready" ? machineReadiness([serverProof.machine], daemon.machineId ?? "", ["spawn", ...capabilities], now) : serverProof;
+  return {
+    ready: keyCurrent && policy === "enabled" && providerAvailable && managerAvailable && serviceInstalled && localProof && remote?.kind === "ready",
+    keyCurrent,
+    providerAvailable,
+    managerAvailable,
+    serviceInstalled,
+    policy,
+    localProof,
+    serverProof: remote?.kind ?? "unchecked",
+    checkedAt: new Date(now).toISOString()
+  };
+};
+
+export {
+  HEARTBEAT_INTERVAL_MS,
+  sendHeartbeat,
+  readMachineReadiness,
+  waitForMachineReadiness,
+  listMachines,
+  describeLastSeen,
+  readManagedControlEvidence
+};

package/dist/chunk-E4FJTUH4.js

@@ -0,0 +1,249 @@
+import {
+  SETUP_AGENT_CHOICES
+} from "./chunk-NQTHFF4W.js";
+
+// src/cli/commands.ts
+var NPX_LATEST_COMMAND = "npx @pushary/agent-hooks@latest";
+var COMMAND_LIST = [
+  {
+    name: "cowork",
+    module: "pushary-cowork",
+    summary: "Set up Claude Desktop and Cowork with the Pushary connector"
+  },
+  {
+    name: "setup",
+    module: "pushary-setup",
+    summary: "Configure Claude Code, Codex, Gemini CLI, Hermes, Cursor, VS Code, OpenCode, or fx with Pushary"
+  },
+  {
+    name: "claude",
+    module: "pushary-claude",
+    summary: "Run Claude Code through Pushary, reachable from your phone even when idle",
+    detail: [
+      "Send an instruction and it drives a fully idle agent. Ctrl-] takes the terminal back.",
+      "Add --remote to start headless."
+    ]
+  },
+  {
+    name: "daemon",
+    module: "pushary-daemon",
+    summary: "Keep this machine reachable so your phone can START a new session",
+    detail: [
+      "Install the native per-user service for restart-on-login and restart-on-failure.",
+      "A bare `pushary daemon` remains foreground mode for diagnostics."
+    ]
+  },
+  {
+    name: "status",
+    module: "pushary-status",
+    summary: "One screen: which key is in force, whether the server accepts it, what can receive an approval"
+  },
+  {
+    name: "login",
+    module: "pushary-login",
+    summary: "Sign in from this terminal, no key to copy (--with-token to pipe one in)"
+  },
+  {
+    name: "logout",
+    module: "pushary-logout",
+    summary: "Remove the key this machine stores, and say what it does not remove"
+  },
+  {
+    name: "connect",
+    module: "pushary-connect",
+    summary: "Connect a phone without re-running setup (--app for the Pushary app)"
+  },
+  {
+    name: "bell",
+    module: "pushary-bell",
+    summary: "Free local bell when an agent finishes or needs you. No account, no key, no network",
+    detail: [
+      "A different, smaller product: it makes a noise on this machine and nothing else.",
+      "It cannot tell you which of several agents is asking, and it cannot reach your phone."
+    ]
+  },
+  { name: "doctor", module: "pushary-doctor", summary: "Verify your Pushary installation is working" },
+  { name: "disconnect", module: "pushary-disconnect", summary: "Turn off one agent (claude|codex|gemini|cursor)" },
+  { name: "clean", module: "pushary-clean", summary: "Remove Pushary from this machine (--everything: the Mac app's setup too, --dry-run: preview)" },
+  { name: "mode", module: "pushary-mode", summary: "Choose where approval requests appear" },
+  { name: "wait", module: "pushary-wait", summary: 'Show or set the "wait for your phone" ladder (pushary wait 45)' },
+  { name: "stats", module: "pushary-stats", summary: "Show the approval moments your agents hit while not connected" },
+  {
+    name: "suggestions",
+    module: "pushary-suggestions",
+    summary: "List rules mined from your own approvals",
+    detail: ["Accept one with 'pushary suggestions accept <id>' to always-allow that pattern."]
+  },
+  { name: "upgrade", module: "pushary-upgrade", summary: "Update the globally installed hooks to the latest version" },
+  {
+    name: "hook",
+    module: "pushary-hook",
+    summary: "Run as a PreToolUse hook (reads stdin, writes stdout)"
+  },
+  {
+    name: "transcripts",
+    module: "pushary-transcripts",
+    summary: "Show or re-trust the keys this machine seals transcripts to",
+    detail: [
+      "Sync stops if the phone key or the compliance recovery key changes, because a",
+      "change is either your reinstall or a server handing itself a copy. Compare the",
+      "fingerprint with the app under Settings, then accept it with --rotate."
+    ]
+  }
+];
+var COMMANDS = COMMAND_LIST;
+var findCommand = (name) => COMMANDS.find((command) => command.name === name);
+var isCommandName = (name) => COMMANDS.some((command) => command.name === name);
+var COMMAND_OPTIONS = {
+  cowork: [
+    ["--open", "Also open the setup guide in your browser"],
+    ["--instructions", "Print standing instructions to paste into Cowork"],
+    ["--skill", "Print the packaged Cowork SKILL.md for upload"],
+    ["--json", "Print setup steps and capabilities as JSON; does not claim connection is verified"]
+  ],
+  clean: [
+    ["--dry-run", "List everything it would remove and change nothing"],
+    ["--everything", "Also remove what the Mac app set up: quits it, then its keychain items, local state and editor extension"],
+    ["--yes", "Remove everything without asking"]
+  ],
+  transcripts: [
+    ["status", "Show the pinned keys and their fingerprints (default)"],
+    ["trust --rotate", "Accept the keys the server is offering now and resume syncing"]
+  ],
+  mode: [
+    ["<mode>", "One of: push_only, push_first, terminal_only, notify_only"],
+    ["status", "Show the current override"],
+    ["clear", "Drop the override and go back to per-tool policies"],
+    ["--for <30m|2h>", "Expire the override after this long"]
+  ],
+  wait: [
+    ["<seconds>", `Default push window, 0-300`],
+    ["status", "Show the whole ladder"],
+    ["clear", "Reset the default window"]
+  ],
+  status: [
+    ["--json", "Emit the whole report as one object instead of the screen"],
+    ["--devices", "Also list the machines registered to this site"]
+  ],
+  logout: [
+    ["--revoke", "Also kill the key server-side, so it stops working everywhere"],
+    ["--json", "Emit the result as one object instead of the screen"]
+  ],
+  doctor: [
+    ["--json", "Emit every check as one object instead of the screen"],
+    ["--roundtrip", "Send a synthetic question and report the returned answer; does not test hooks"],
+    ["--activation claude_code --activation-target <path>", "Read correlated evidence for one unique scratch file; sends no test question"],
+    ["--no-push", "Run every check without waking a device"],
+    ["--bundle", "Write a redacted diagnostics file you can attach to a support thread"]
+  ],
+  suggestions: [["accept <id>", "Turn a mined suggestion into an always-allow rule"]],
+  upgrade: [
+    ["--auto=off", "Stop Pushary updating itself in the background"],
+    ["--auto=on", "Update in the background again: once a day at session start, within the same major version"]
+  ],
+  bell: [
+    ["(no flags)", "Turn the bell on for Claude Code"],
+    ["--test", "Ring once, now, so you can hear what it does"],
+    ["--status", "Say whether the bell is on and how many agents are running"],
+    ["--off", "Remove it. Touches nothing else"]
+  ],
+  claude: [
+    ["--remote", "Start headless and drive it entirely from your phone"],
+    ["-p <prompt>", "Initial prompt"]
+  ],
+  daemon: [
+    ["install", "Install and start the native per-user service"],
+    ["start | stop | restart", "Control the installed service"],
+    ["status", "Show local daemon health and PID"],
+    ["uninstall", "Stop and remove the native service"],
+    ["foreground", "Run attached to this terminal for diagnostics"]
+  ]
+};
+var SETUP_OPTIONS = [
+  ["--agents cowork", "Show Claude Desktop/Cowork connector setup without installing CLI hooks"],
+  ["--key <pk_xxx.xxx>", "Use this API key instead of prompting. Visible in the process list; prefer --key-stdin in CI."],
+  ["--key-stdin", "Read the API key from the first line of stdin, so it never appears in argv or shell history"],
+  ["--agents <list>", 'Comma-separated agent ids, or "auto" for everything detected, or "none" to save the key only'],
+  ["--yes, -y", "Accept every default and ask nothing. Implies --agents auto unless --agents is given"],
+  ["--connect app", "Pair the native Pushary app, no key to paste (default)"],
+  ["--connect browser", "Approve in a browser tab instead. For a machine with no app"],
+  ["--connect web", "Legacy browser subscribe page"],
+  ["--connect none", "Skip the phone connect step, same as --skip-phone"],
+  ["--control auto|on|off", "Manage phone-start automatically (default), require it, or disable its background service"],
+  ["--transcripts on|off", "Enable or disable encrypted transcript sync on this machine"],
+  ["--skip-phone", "Skip the phone connect step"],
+  ["--take-over-hooks", "Replace hooks the Pushary Mac app owns with the CLI's. Without it the app's wiring is kept"],
+  ["--verify roundtrip", "Send a real question and wait for you to answer it (default when a human is present)"],
+  ["--verify push", "Only prove a notification was delivered. Automatic when nobody is at the terminal"],
+  ["--verify none", "Skip the final check entirely"],
+  ["--dry-run", "Print what would be written and change nothing"],
+  ["--json", "Emit one machine-readable object instead of the human report"]
+];
+var AGENT_IDS = SETUP_AGENT_CHOICES.join(", ");
+var USAGE_EXAMPLES = [
+  "npx @pushary/agent-hooks@latest setup",
+  "npx @pushary/agent-hooks@latest setup --agents auto --yes --skip-phone",
+  "npx @pushary/agent-hooks@latest setup --key-stdin --agents claude_code --yes < key.txt",
+  "npx @pushary/agent-hooks@latest doctor",
+  "npx @pushary/agent-hooks@latest mode push_only --for 30m",
+  "pushary claude                                    # native terminal, reachable from your phone",
+  'pushary claude --remote -p "start the refactor"   # start headless, drive from your phone',
+  "pushary daemon                                    # keep this machine ready to spawn a session"
+];
+var pad = (text, width) => text + " ".repeat(Math.max(0, width - text.length));
+var renderHelp = (version) => {
+  const width = Math.max(...COMMANDS.map((command) => command.name.length)) + 2;
+  const commandLines = COMMANDS.flatMap((command) => [
+    `  ${pad(command.name, width)}${command.summary}`,
+    ...(command.detail ?? []).map((line) => `  ${" ".repeat(width)}${line}`)
+  ]);
+  const optionWidth = Math.max(...SETUP_OPTIONS.map(([flag]) => flag.length)) + 2;
+  const optionLines = SETUP_OPTIONS.map(([flag, text]) => `  ${pad(flag, optionWidth)}${text}`);
+  return [
+    "",
+    `Pushary Agent Hooks v${version}`,
+    "",
+    "Usage: pushary <command> [options]",
+    "",
+    "Commands:",
+    ...commandLines,
+    "",
+    "Setup options:",
+    ...optionLines,
+    "",
+    `Agent ids: ${AGENT_IDS}`,
+    "",
+    "Examples:",
+    ...USAGE_EXAMPLES.map((line) => `  ${line}`),
+    "",
+    "Run `pushary <command> --help` for a single command.",
+    ""
+  ].join("\n");
+};
+var renderCommandHelp = (name, version) => {
+  const spec = findCommand(name);
+  const options = name === "setup" ? SETUP_OPTIONS : COMMAND_OPTIONS[name] ?? [];
+  const width = options.length > 0 ? Math.max(...options.map(([flag]) => flag.length)) + 2 : 0;
+  return [
+    "",
+    `pushary ${name} ${version ? `(v${version})` : ""}`.trimEnd(),
+    "",
+    ...spec ? [`  ${spec.summary}`, ...(spec.detail ?? []).map((line) => `  ${line}`), ""] : [],
+    ...options.length > 0 ? ["Options:", ...options.map(([flag, text]) => `  ${pad(flag, width)}${text}`), ""] : [],
+    ...name === "setup" ? [
+      `Agent ids: ${AGENT_IDS}`,
+      "",
+      "Non-interactive runs need --agents or --yes. Without a terminal on stdin,",
+      "setup takes the defaults rather than waiting for a keypress that can never arrive.",
+      ""
+    ] : []
+  ].join("\n");
+};
+
+export {
+  NPX_LATEST_COMMAND,
+  COMMANDS,
+  isCommandName,
+  renderHelp,
+  renderCommandHelp
+};

package/dist/chunk-EPCXUP3P.js

@@ -0,0 +1,41 @@
+import {
+  PRETOOLUSE_GATED_TOOLS
+} from "./chunk-NQTHFF4W.js";
+
+// src/claude-tools.ts
+var POSTTOOLUSE_MIRROR_ONLY_TOOLS = ["TodoWrite", "Task", "WebFetch", "WebSearch"];
+var POSTTOOLUSE_MIRRORED_TOOLS = [...PRETOOLUSE_GATED_TOOLS, ...POSTTOOLUSE_MIRROR_ONLY_TOOLS];
+
+// src/claude-notifications.ts
+var IDLE_PROMPT_NOTIFICATION = "idle_prompt";
+var NOTIFICATION_MATCHED_TYPES = [
+  // Blocks. The agent, or one of its workers, is waiting on a person.
+  "permission_prompt",
+  "idle_prompt",
+  "agent_needs_input",
+  "worker_permission_prompt",
+  // An MCP server asking the person for a value. The Elicitation hook answers it;
+  // this is the feed row saying one is open.
+  "elicitation_dialog",
+  "elicitation_url_dialog",
+  // Turn boundary.
+  "agent_completed",
+  // Quota. The island already reads plan usage, and these say when a limit hit,
+  // went stale, or was turned off, which no polling of the usage endpoint reveals.
+  "quota_auto_resume_fired",
+  "quota_auto_resume_stale",
+  "quota_auto_resume_disabled"
+];
+var NOTIFICATION_PUSH_TYPES = /* @__PURE__ */ new Set([
+  "idle_prompt",
+  "agent_needs_input",
+  "worker_permission_prompt"
+]);
+
+export {
+  POSTTOOLUSE_MIRROR_ONLY_TOOLS,
+  POSTTOOLUSE_MIRRORED_TOOLS,
+  IDLE_PROMPT_NOTIFICATION,
+  NOTIFICATION_MATCHED_TYPES,
+  NOTIFICATION_PUSH_TYPES
+};