pushary 1.9.22 → 1.9.24

package/dist/chunk-L5MCJNSI.js

@@ -0,0 +1,166 @@
+import {
+  APPROVAL_SETTINGS_PATH
+} from "./chunk-EE357RIP.js";
+import {
+  readMacAppAgentKey
+} from "./chunk-2JTJZ7VI.js";
+import {
+  findExportedKeyLines,
+  isAdoptedMacAppKey,
+  isCliCreatedKey,
+  keyPrefix,
+  readCliCreatedKeyPrefix,
+  readConfigFileKey,
+  readKeySource,
+  readMacAppKeyPrefix
+} from "./chunk-U23XTMBF.js";
+import {
+  absoluteUrl
+} from "./chunk-H2RD5EMR.js";
+import {
+  isValidApiKey
+} from "./chunk-GM2IFDVF.js";
+
+// src/key-revocation.ts
+var SELF_REVOKE_PATH = "/api/v1/server/keys/self/revoke";
+var DEVICE_KEY_PATH = "/api/agent/device-key";
+var FULL_ACCESS_ONLY_STATUS = 403;
+var REVOKE_TIMEOUT_MS = 1e4;
+var readRevokedCount = async (response) => {
+  try {
+    const body = await response.json();
+    const revoked = typeof body === "object" && body !== null && "revoked" in body ? body.revoked : void 0;
+    return typeof revoked === "number" && Number.isInteger(revoked) && revoked >= 0 ? revoked : null;
+  } catch {
+    return null;
+  }
+};
+var revokeAgentKey = async (apiKey, baseUrl, fetchImpl) => {
+  const response = await fetchImpl(`${baseUrl}${DEVICE_KEY_PATH}`, {
+    method: "DELETE",
+    headers: { Authorization: `Bearer ${apiKey}` },
+    signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS)
+  });
+  if (!response.ok) return { kind: "refused", status: response.status };
+  const revoked = await readRevokedCount(response);
+  if (revoked === null) return { kind: "unconfirmed", status: response.status };
+  return revoked > 0 ? { kind: "revoked" } : { kind: "not_accepted" };
+};
+var revokeOwnKey = async (apiKey, baseUrl, fetchImpl = fetch) => {
+  try {
+    const response = await fetchImpl(`${baseUrl}${SELF_REVOKE_PATH}`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
+      signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS)
+    });
+    if (response.status === 401) return { kind: "not_accepted" };
+    if (response.status === FULL_ACCESS_ONLY_STATUS) return await revokeAgentKey(apiKey, baseUrl, fetchImpl);
+    if (!response.ok) return { kind: "refused", status: response.status };
+    return { kind: "revoked" };
+  } catch (err) {
+    return { kind: "unreachable", detail: err instanceof Error ? err.message : "network error" };
+  }
+};
+var REVOKE_DETAIL = {
+  revoked: "Revoked the key on pushary.com.",
+  not_accepted: "pushary.com had already stopped accepting the key.",
+  refused: "pushary.com refused to revoke the key",
+  unconfirmed: "pushary.com did not confirm the key was revoked",
+  unreachable: "Could not reach pushary.com to revoke the key"
+};
+var describeRevokeAttempt = (attempt) => {
+  if (attempt.kind === "refused" || attempt.kind === "unconfirmed") return `${REVOKE_DETAIL[attempt.kind]} (HTTP ${attempt.status}).`;
+  if (attempt.kind === "unreachable") return `${REVOKE_DETAIL.unreachable}: ${attempt.detail}`;
+  return REVOKE_DETAIL[attempt.kind];
+};
+var keyNoLongerAccepted = (attempt) => attempt.kind === "revoked" || attempt.kind === "not_accepted";
+var keyValidityOf = (check) => {
+  switch (check.kind) {
+    case "ok":
+    case "locked":
+      return "valid";
+    case "rejected":
+    case "malformed":
+      return "invalid";
+    case "unreachable":
+      return "unknown";
+  }
+};
+
+// src/cli/held-key-revocation.ts
+var readCliHeldKeys = (profiles) => {
+  const source = readKeySource();
+  return {
+    configKey: readConfigFileKey(),
+    profileKeys: findExportedKeyLines(profiles).map((line) => line.key),
+    envKey: source.kind === "env" ? source.key : null,
+    macAppKey: readMacAppAgentKey(),
+    macAppKeyPrefix: readMacAppKeyPrefix(),
+    cliCreatedKeyPrefix: readCliCreatedKeyPrefix()
+  };
+};
+var isMacAppCurrentOrAdoptedKey = (key, keys) => key === keys.macAppKey || isAdoptedMacAppKey(key, keys.macAppKeyPrefix);
+var revocationOfStoredKey = (key, keys) => {
+  if (isMacAppCurrentOrAdoptedKey(key, keys)) return { kind: "mac_app_key", keyPrefix: keyPrefix(key) };
+  if (!isCliCreatedKey(key, keys.cliCreatedKeyPrefix)) return { kind: "no_creation_record", keyPrefix: keyPrefix(key) };
+  return { kind: "revoke", key };
+};
+var validKeys = (keys) => [...new Set(keys)].filter((key) => key !== null && isValidApiKey(key));
+var environmentOnlyKey = (keys, stored) => validKeys([keys.envKey]).filter((key) => !stored.includes(key)).map((key) => ({ kind: "environment_only", keyPrefix: keyPrefix(key) }));
+var planCliKeyRevocations = (keys) => {
+  const stored = validKeys([keys.configKey, ...keys.profileKeys]);
+  return [...stored.map((key) => revocationOfStoredKey(key, keys)), ...environmentOnlyKey(keys, stored)];
+};
+var keysToRevoke = (revocations) => revocations.flatMap((revocation) => revocation.kind === "revoke" ? [revocation.key] : []);
+var sparedKeys = (revocations) => revocations.flatMap((revocation) => revocation.kind === "revoke" ? [] : [revocation]);
+var runRevocation = async (revocation, run) => {
+  if (revocation.kind !== "revoke") return revocation;
+  if (run.dryRun) return { kind: "would_revoke", keyPrefix: keyPrefix(revocation.key) };
+  return { kind: "attempted", keyPrefix: keyPrefix(revocation.key), attempt: await revokeOwnKey(revocation.key, run.baseUrl) };
+};
+var revokeCliKeys = async (revocations, run) => {
+  const outcomes = [];
+  for (const revocation of revocations) outcomes.push(await runRevocation(revocation, run));
+  return outcomes;
+};
+var SPARED_KEY_WHY = {
+  mac_app_key: "It is the Pushary Mac app's key, and the app may still be using it.",
+  no_creation_record: "This CLI has no record of creating it, so it may be in use by the Mac app or on another machine."
+};
+var localRemovalOf = (dryRun) => dryRun ? "would be removed here" : "removed here";
+var settingsUrlOf = (baseUrl) => absoluteUrl(baseUrl, APPROVAL_SETTINGS_PATH);
+var revokeYourselfHint = (reason, baseUrl) => reason === "no_creation_record" ? `Revoke it at ${settingsUrlOf(baseUrl)} if nothing else uses it.` : null;
+var describeCliKeyRevocation = (outcome, run) => {
+  const label = `API key ${outcome.keyPrefix}`;
+  switch (outcome.kind) {
+    case "would_revoke":
+      return { tone: "skipped", line: `${label} (would revoke it on pushary.com)`, next: null };
+    case "mac_app_key":
+    case "no_creation_record":
+      return {
+        tone: "skipped",
+        line: `${label}: ${localRemovalOf(run.dryRun)}, not revoked. ${SPARED_KEY_WHY[outcome.kind]}`,
+        next: revokeYourselfHint(outcome.kind, run.baseUrl)
+      };
+    case "environment_only":
+      return { tone: "skipped", line: `${label} in PUSHARY_API_KEY (left alone: Pushary did not write it)`, next: null };
+    case "attempted":
+      return keyNoLongerAccepted(outcome.attempt) ? { tone: "done", line: `${label}: ${describeRevokeAttempt(outcome.attempt)}`, next: null } : {
+        tone: "warning",
+        line: `${label}: ${describeRevokeAttempt(outcome.attempt)}`,
+        next: `It may still be valid. Revoke it at ${settingsUrlOf(run.baseUrl)}`
+      };
+  }
+};
+
+export {
+  revokeOwnKey,
+  keyNoLongerAccepted,
+  keyValidityOf,
+  readCliHeldKeys,
+  planCliKeyRevocations,
+  keysToRevoke,
+  sparedKeys,
+  revokeCliKeys,
+  describeCliKeyRevocation
+};

package/dist/{chunk-KCXG2INQ.js → chunk-LHFK5F3T.js}

@@ -8,10 +8,10 @@ import {
   codexHooksJsonIn,
   isPusharyCodexCommand,
   resolvePathBinary
-} from "./chunk-E7EOUEGQ.js";
+} from "./chunk-NQICO3ES.js";
 import {
   getPackageVersion
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/codex-app-server.ts
 import { existsSync, realpathSync } from "fs";

package/dist/{chunk-6TSEEKPL.js → chunk-LOERK6N3.js}

@@ -3,18 +3,18 @@ import {
   addGeminiMcpServer,
   removeGeminiMcpServer,
   supportedClaudeEvents
-} from "./chunk-YGR5PBOF.js";
+} from "./chunk-VFIZFKZY.js";
 import {
   CLAUDE_CODE_AGENT,
   parseApplyPatchFiles
-} from "./chunk-CW3QUV6B.js";
+} from "./chunk-KT5BH6GC.js";
 import {
   guardBinary,
   guardBinaryRefusing,
   holdBudgetOf,
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-E7EOUEGQ.js";
+} from "./chunk-NQICO3ES.js";
 import {
   HOOK_LOCATOR_BINARY,
   PHONE_ANSWERED_TOOLS,
@@ -24,7 +24,7 @@ import {
   refusalOutput,
   toToolLookup,
   withHookHoldBudget
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/claude-config.ts
 import { join } from "path";

package/dist/{chunk-U26CAOZC.js → chunk-NJK4MGXL.js}

@@ -10,7 +10,7 @@ import {
   isSetupConnectMode,
   isValidApiKey,
   normalizeAgentId
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/setup/options.ts
 var AGENT_CHOICES = SETUP_AGENT_CHOICES;

package/dist/{chunk-E7EOUEGQ.js → chunk-NQICO3ES.js}

@@ -13,7 +13,7 @@ import {
   isReleaseVersion,
   ownPackageName,
   withHookHoldBudget
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/setup/paths.ts
 import { homedir as homedir2 } from "os";
@@ -395,9 +395,9 @@ var installGlobally = (options) => {
   }
   const started = (async () => {
     if (!npmIsOnPath()) throw new NpmMissingError();
-    const { withUpgradeLock } = await import("./global-upgrade-F3QY6OHE.js");
-    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-N3G5V2QS.js");
-    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-CBEAZNJR.js");
+    const { withUpgradeLock } = await import("./global-upgrade-DZGLAARJ.js");
+    const { installWithUpgradeLock, ownsUpgradeLock } = await import("./upgrade-lock-LPIDFQEH.js");
+    const { autoUpdateLock: autoUpdateLock2 } = await import("./paths-JATF66FP.js");
     let result = "skipped";
     const install = async () => {
       const platform = process.platform;

package/dist/{chunk-U4OWRGYI.js → chunk-O3RRQTTV.js}

@@ -1,15 +1,15 @@
 import {
   compatibleConfigFile
-} from "./chunk-6TSEEKPL.js";
+} from "./chunk-LOERK6N3.js";
 import {
   hookOwnerOf,
   hookOwnerOfCommands,
   liveBridgeProbe,
   resolveBridgeStub
-} from "./chunk-TSFNX5J2.js";
+} from "./chunk-OSOCONIE.js";
 import {
   AGENT_CHOICES
-} from "./chunk-U26CAOZC.js";
+} from "./chunk-NJK4MGXL.js";
 import {
   claudeSettings,
   codexHooksJson,
@@ -18,7 +18,7 @@ import {
   guardedArgv,
   pusharyDir,
   vscodePluginDir
-} from "./chunk-E7EOUEGQ.js";
+} from "./chunk-NQICO3ES.js";
 import {
   readJsonSafe
 } from "./chunk-AQFEP65J.js";
@@ -29,7 +29,7 @@ import {
   OPENCODE_APPROVAL_EVENT,
   hookCompatibleProfile,
   isRecord
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/opencode-plugin.ts
 var OPENCODE_PLUGIN_MARKER = "pushary-opencode-plugin w1";

package/dist/{chunk-4AO2OVUA.js → chunk-OLWKCDK4.js}

@@ -3,27 +3,27 @@ import {
   expectedLaunchCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "./chunk-UFGU7AK3.js";
+} from "./chunk-KX776UXN.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   hasDaemonServiceDefinition,
   readDaemonNeedsLogin,
   readDaemonStatus
-} from "./chunk-N2JP3RKP.js";
+} from "./chunk-HBR6ZZHN.js";
 import {
   readControlMode,
   readKeySource
-} from "./chunk-6IOLTFNP.js";
+} from "./chunk-U23XTMBF.js";
 import {
   getMachineId
-} from "./chunk-U2IEM5FF.js";
+} from "./chunk-IS737HST.js";
 import {
   getBaseUrl
-} from "./chunk-75MJRC5I.js";
+} from "./chunk-OY6NJWDD.js";
 import {
   getPackageVersion
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/machines.ts
 import { hostname } from "os";

package/dist/{chunk-TSFNX5J2.js → chunk-OSOCONIE.js}

@@ -2,23 +2,23 @@ import {
   CLAUDE_HOOK_EVENTS,
   GEMINI_HOOK_EVENTS,
   hasGeminiHooks
-} from "./chunk-YGR5PBOF.js";
+} from "./chunk-VFIZFKZY.js";
 import {
   AGENT_CHOICES
-} from "./chunk-U26CAOZC.js";
+} from "./chunk-NJK4MGXL.js";
 import {
   BELL_HOOK_BINARY
-} from "./chunk-OZVZGWER.js";
+} from "./chunk-VICG46JC.js";
 import {
   CODEX_HOOK_EVENTS,
   hasCodexHooks,
   holdBudgetOf
-} from "./chunk-E7EOUEGQ.js";
+} from "./chunk-NQICO3ES.js";
 import {
   CURSOR_GATE_EVENTS,
   HOOK_LOCATOR_BINARY,
   hookCommandHoldBudget
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/diagnostics/bridge.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-75MJRC5I.js → chunk-OY6NJWDD.js}

@@ -1,6 +1,6 @@
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-TZWZVAMN.js";
+} from "./chunk-QDKNLNCA.js";
 
 // src/config.ts
 import { readFileSync } from "fs";

package/dist/{chunk-YR3DHPYI.js → chunk-P447F2RB.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-3EGEA4KH.js";
 import {
   getBaseUrl
-} from "./chunk-75MJRC5I.js";
+} from "./chunk-OY6NJWDD.js";
 
 // src/cli/login-ui.ts
 import { hostname } from "os";

package/dist/{chunk-BDGKWUK2.js → chunk-Q7IEFI7V.js}

@@ -1,9 +1,9 @@
 import {
   parseSseMessages
-} from "./chunk-6SFTI7LM.js";
+} from "./chunk-RK7TDMQT.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-TZWZVAMN.js";
+} from "./chunk-QDKNLNCA.js";
 
 // src/mcp-stdio-bridge.ts
 var MCP_BRIDGE_BINARY = "pushary-mcp";

package/dist/{chunk-TZWZVAMN.js → chunk-QDKNLNCA.js}

@@ -2,7 +2,7 @@ import {
   DISCONNECT_AGENT_IDS,
   SETUP_AGENT_CHOICES,
   isApprovalMode
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/cli/mode-request.ts
 var parseDuration = (value) => {
@@ -142,7 +142,7 @@ var COMMAND_OPTIONS = {
   ],
   clean: [
     ["--dry-run", "List everything it would remove and change nothing"],
-    ["--everything", "Also revoke the keys the CLI wrote (config.json and its shell profile export) and remove what the Mac app set up: quits it, then its keychain items, local state and editor extension"],
+    ["--everything", "Also revoke the key this CLI created (any other key is only removed) and remove what the Mac app set up: quits it, then its keychain items, local state and editor extension"],
     ["--yes", "Remove everything without asking"]
   ],
   transcripts: [
@@ -165,7 +165,7 @@ var COMMAND_OPTIONS = {
     ["--devices", "Also list the machines registered to this site"]
   ],
   "sign-out": [
-    ["--revoke", "Also kill the key server-side, so it stops working everywhere"],
+    ["--revoke", "Also revoke the key server-side if this CLI created it; any other key is only removed"],
     ["--json", "Emit the result as one object instead of the screen"]
   ],
   doctor: [

package/dist/{chunk-BDV4WDIA.js → chunk-RFK2WN6S.js}

@@ -1,6 +1,6 @@
 import {
   PRETOOLUSE_GATED_TOOLS
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/claude-tools.ts
 var POSTTOOLUSE_MIRROR_ONLY_TOOLS = ["TodoWrite", "Task", "WebFetch", "WebSearch"];

package/dist/{chunk-E3FSKKTJ.js → chunk-RIBIEQHU.js}

@@ -1,6 +1,6 @@
 import {
   redactSecretsFromContent
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";

package/dist/{chunk-6SFTI7LM.js → chunk-RK7TDMQT.js}

@@ -1,12 +1,12 @@
 import {
   keyCheckFromResponse
-} from "./chunk-NB2PY5JX.js";
+} from "./chunk-H2RD5EMR.js";
 import {
   installNetworkDefaults
-} from "./chunk-WAKQYJ6T.js";
+} from "./chunk-2E6AWHV7.js";
 import {
   getBaseUrl
-} from "./chunk-75MJRC5I.js";
+} from "./chunk-OY6NJWDD.js";
 
 // src/retry.ts
 var isRetryable = (err) => {

package/dist/{chunk-G5YMVGAK.js → chunk-SBQCRQIP.js}

@@ -14,19 +14,19 @@ import {
 } from "./chunk-FO3MDD26.js";
 import {
   callMcpTool
-} from "./chunk-6SFTI7LM.js";
+} from "./chunk-RK7TDMQT.js";
 import {
   reportedInstallSource
-} from "./chunk-5TLRS3AK.js";
+} from "./chunk-GXQVOKHJ.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-TZWZVAMN.js";
+} from "./chunk-QDKNLNCA.js";
 import {
   NO_PAIRING_COMPUTER,
   PAIR_TTL_SECONDS,
   classifyConfirmResponse,
   isAnswerSource
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {

package/dist/{chunk-SGUGGHMC.js → chunk-SH2KK2ED.js}

@@ -1,13 +1,13 @@
 import {
   openCodeConfigDirFrom
-} from "./chunk-U4OWRGYI.js";
+} from "./chunk-O3RRQTTV.js";
 import {
   codexHomeFrom,
   resolvePathBinary
-} from "./chunk-E7EOUEGQ.js";
+} from "./chunk-NQICO3ES.js";
 import {
   HOOK_COMPATIBLE_PROFILES
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/hermes-config.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-E7HOX73X.js → chunk-T5KM7J75.js}

@@ -1,16 +1,16 @@
 import {
   registerTranscript
-} from "./chunk-LH3GTSXC.js";
+} from "./chunk-W5NHIA4Y.js";
 import {
   namedEvent
-} from "./chunk-6TSEEKPL.js";
+} from "./chunk-LOERK6N3.js";
 import {
   writeDegraded
-} from "./chunk-AGIO7SF5.js";
+} from "./chunk-ZVON5PCF.js";
 import {
   claudeShapedHookInput,
   hookCompatibleProfileBySource
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/tool-hook-input.ts
 var OPTIONAL_TEXT_FIELDS = ["hook_event_name", "session_id", "cwd", "transcript_path", "tool_use_id", "permission_mode"];

package/dist/{chunk-DV26ZWUC.js → chunk-T6TJA4RF.js}

@@ -3,11 +3,11 @@ import {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-E3FSKKTJ.js";
+} from "./chunk-RIBIEQHU.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-GNQZY4GL.js";
+} from "./chunk-3WRJU7KN.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;

package/dist/{chunk-6IOLTFNP.js → chunk-U23XTMBF.js}

@@ -1,6 +1,6 @@
 import {
   resolveInstallSourceFor
-} from "./chunk-5TLRS3AK.js";
+} from "./chunk-GXQVOKHJ.js";
 import {
   backupFile,
   readJsonSafe,
@@ -9,11 +9,11 @@ import {
 } from "./chunk-AQFEP65J.js";
 import {
   configFilePath
-} from "./chunk-75MJRC5I.js";
+} from "./chunk-OY6NJWDD.js";
 import {
   API_KEY_PREFIX_PATTERN,
   isRecord
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/shell-alias.ts
 import { homedir } from "os";
@@ -115,6 +115,8 @@ var isDisabledExport = (line) => {
 };
 var keyPrefix = (key) => key.split(".")[0] ?? key;
 var MAC_APP_KEY_PREFIX_FIELD = "macAppKeyPrefix";
+var CLI_CREATED_KEY_PREFIX_FIELD = "cliCreatedKeyPrefix";
+var isCliCreatedKey = (key, createdPrefix) => keyPrefix(key) === createdPrefix;
 var findKeyExport = (contents) => {
   const lines = contents.split("\n");
   for (const [index, line] of lines.entries()) {
@@ -131,6 +133,11 @@ var keepMacAppKeyPrefix = (current, apiKey) => {
   const { [MAC_APP_KEY_PREFIX_FIELD]: recorded, ...rest } = current;
   return recorded === keyPrefix(apiKey) ? { ...rest, [MAC_APP_KEY_PREFIX_FIELD]: recorded } : rest;
 };
+var savedKeyIsCliCreated = (current, apiKey, origin) => origin === "created_by_this_cli" || current[CLI_CREATED_KEY_PREFIX_FIELD] === keyPrefix(apiKey);
+var withKeyRecords = (current, apiKey, origin) => {
+  const { [CLI_CREATED_KEY_PREFIX_FIELD]: _previous, ...rest } = keepMacAppKeyPrefix(current, apiKey);
+  return savedKeyIsCliCreated(current, apiKey, origin) ? { ...rest, [CLI_CREATED_KEY_PREFIX_FIELD]: keyPrefix(apiKey) } : rest;
+};
 var manualKeyStepFor = (kind, platform) => kind === "no-rc" || platform === "win32" ? "config-only" : "paste-export";
 var rcResult = (kind, over = {}) => ({
   kind,
@@ -211,7 +218,7 @@ var resolveRcTarget = () => {
   const fallback = FALLBACK_RCS.map((name) => join2(homedir2(), name)).find(existsSync2);
   return fallback ? { path: fallback, shell: null } : null;
 };
-var writeKey = (apiKey, options = {}) => {
+var writeKey = (apiKey, origin, options = {}) => {
   const configPath = configFilePath();
   const existing = readJsonSafe(configPath);
   let current = {};
@@ -229,7 +236,7 @@ var writeKey = (apiKey, options = {}) => {
   writeJsonAtomic(
     configPath,
     {
-      ...keepMacAppKeyPrefix(current, apiKey),
+      ...withKeyRecords(current, apiKey, origin),
       apiKey,
       installSource: resolveInstallSourceFor(current),
       ...options.controlMode ? { controlMode: options.controlMode } : {},
@@ -248,7 +255,7 @@ var clearKey = (options = {}) => {
   const existing = readConfigRecord(configPath);
   let removedFromConfig = false;
   if (existing !== null && typeof existing.apiKey === "string") {
-    const { apiKey: _dropped, [MAC_APP_KEY_PREFIX_FIELD]: _adopted, ...rest } = existing;
+    const { apiKey: _dropped, [MAC_APP_KEY_PREFIX_FIELD]: _adopted, [CLI_CREATED_KEY_PREFIX_FIELD]: _created, ...rest } = existing;
     writeJsonAtomic(configPath, rest, KEY_FILE_MODE);
     restrictFile(configPath);
     removedFromConfig = true;
@@ -306,11 +313,13 @@ var readKeySource = () => {
   if (fileKey) return { kind: "config", key: fileKey, origin: configPath, drift: null };
   return { kind: "none", key: null, origin: null, drift: null };
 };
-var readMacAppKeyPrefix = (configPath = configFilePath()) => {
-  const recorded = readConfigRecord(configPath)?.[MAC_APP_KEY_PREFIX_FIELD];
+var readRecordedKeyPrefix = (configPath, field) => {
+  const recorded = readConfigRecord(configPath)?.[field];
   return typeof recorded === "string" && API_KEY_PREFIX_PATTERN.test(recorded) ? recorded : null;
 };
+var readMacAppKeyPrefix = (configPath = configFilePath()) => readRecordedKeyPrefix(configPath, MAC_APP_KEY_PREFIX_FIELD);
 var isAdoptedMacAppKey = (key, adoptedPrefix) => keyPrefix(key) === adoptedPrefix;
+var readCliCreatedKeyPrefix = (configPath = configFilePath()) => readRecordedKeyPrefix(configPath, CLI_CREATED_KEY_PREFIX_FIELD);
 var recordMacAppKeyPrefix = (apiKey, configPath = configFilePath()) => {
   const config = readConfigRecord(configPath);
   if (config === null || config.apiKey !== apiKey) return false;
@@ -348,7 +357,9 @@ export {
   exportLine,
   isDisabledExport,
   keyPrefix,
+  isCliCreatedKey,
   manualKeyStepFor,
+  resolveRcTarget,
   writeKey,
   clearKey,
   readConfigFileKey,
@@ -357,7 +368,9 @@ export {
   readKeySource,
   readMacAppKeyPrefix,
   isAdoptedMacAppKey,
+  readCliCreatedKeyPrefix,
   recordMacAppKeyPrefix,
+  shellProfileCandidates,
   findExportedKeyLines,
   findExportedKeyLine
 };

package/dist/{chunk-YI543EKI.js → chunk-URCSJZNU.js}

@@ -1,6 +1,6 @@
 import {
   SETUP_FLAGS
-} from "./chunk-U26CAOZC.js";
+} from "./chunk-NJK4MGXL.js";
 import {
   parseFlags
 } from "./chunk-GMXKITVA.js";
@@ -9,7 +9,7 @@ import {
 } from "./chunk-7QLSKOSU.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-TZWZVAMN.js";
+} from "./chunk-QDKNLNCA.js";
 import {
   CLAUDE_CONNECTOR_GUIDE,
   CLAUDE_CONNECTOR_STEPS,
@@ -17,7 +17,7 @@ import {
   CLAUDE_CONNECTOR_URL,
   COWORK_CONNECTOR_LIMIT,
   COWORK_STANDING_INSTRUCTIONS
-} from "./chunk-GFXZDU4V.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/cli/cowork.ts
 import { readFileSync } from "fs";