@pushary/agent-hooks 0.22.0 → 0.23.0

package/data/cursor-plugin/README.md

@@ -48,7 +48,7 @@ Add this to `.cursor/mcp.json` in your project, or `~/.cursor/mcp.json` for ever
     "pushary": {
       "type": "http",
       "url": "https://pushary.com/api/mcp/mcp",
-      "headers": { "Authorization": "Bearer ${PUSHARY_API_KEY}" }
+      "headers": { "Authorization": "Bearer ${env:PUSHARY_API_KEY}" }
     }
   }
 }
@@ -67,6 +67,10 @@ source ~/.zshrc
 
 Install the Pushary app on your phone (or turn on web push) so the agent can reach you.
 
+## Troubleshooting
+
+macOS GUI apps do not read `.zshrc`. If Settings > MCP shows pushary in red after you set the env var, launch Cursor from a terminal where `PUSHARY_API_KEY` is exported, or set the variable system-wide so GUI apps see it.
+
 ## What is in the plugin
 
 | Part | File | What it does |

package/data/cursor-plugin/mcp.json

@@ -4,7 +4,7 @@
       "type": "http",
       "url": "https://pushary.com/api/mcp/mcp",
       "headers": {
-        "Authorization": "Bearer ${PUSHARY_API_KEY}"
+        "Authorization": "Bearer ${env:PUSHARY_API_KEY}"
       }
     }
   }

package/dist/bin/pushary-clean.js

@@ -8,7 +8,7 @@ import {
   removeCodexHooks,
   removeGeminiSettings,
   removeInstructionBlock
-} from "../chunk-BHAMEPOP.js";
+} from "../chunk-JPRRYC5X.js";
 
 // bin/pushary-clean.ts
 import { existsSync, readFileSync, writeFileSync, rmSync } from "fs";

package/dist/bin/pushary-doctor.js

@@ -8,7 +8,7 @@ import {
   missingCodexHookEvents,
   missingGeminiHookEvents,
   untrustedCodexHookEvents
-} from "../chunk-BHAMEPOP.js";
+} from "../chunk-JPRRYC5X.js";
 import {
   callMcpTool,
   sendMcpRequest
@@ -283,7 +283,7 @@ var main = async () => {
     const cursorAuth = cursorServers.pushary?.headers?.Authorization;
     if (!cursorAuth) {
       check(false, "Cursor: API key linked", "no Authorization in plugin mcp.json \u2014 re-run setup");
-    } else if (cursorAuth.includes("${PUSHARY_API_KEY}")) {
+    } else if (cursorAuth.includes("PUSHARY_API_KEY")) {
       check(false, "Cursor: API key linked", "plugin relies on $PUSHARY_API_KEY; re-run setup to embed the key so the gate works when Cursor is launched from the GUI");
     } else {
       check(true, "Cursor: API key linked", "embedded in plugin mcp.json");

package/dist/bin/pushary-setup.js

@@ -13,8 +13,9 @@ import {
   execNpm,
   npmErrorMessage,
   renderAgentInstructions,
+  renderProjectAgentInstructions,
   writeInstructionBlock
-} from "../chunk-BHAMEPOP.js";
+} from "../chunk-JPRRYC5X.js";
 import {
   isValidApiKey
 } from "../chunk-WPVL6VIT.js";
@@ -857,6 +858,26 @@ var AGENT_SETUP = {
   cursor: setupCursor,
   custom: setupCustom
 };
+var PROJECT_INSTRUCTION_TARGETS = {
+  claude_code: { file: "CLAUDE.md", label: "Claude Code" },
+  codex: { file: "AGENTS.md", label: "Codex" }
+};
+var offerProjectInstructions = async (agents) => {
+  const targets = agents.map((agent) => PROJECT_INSTRUCTION_TARGETS[agent]).filter((target) => target !== void 0);
+  if (targets.length === 0 || !process.stdout.isTTY) return;
+  console.log();
+  const wanted = await confirm({
+    message: "Add Pushary instructions to this project's CLAUDE.md/AGENTS.md so your whole team's agents can use phone approvals?",
+    default: false
+  });
+  if (!wanted) return;
+  for (const target of targets) {
+    await spinner(`Writing managed block to ${join(process.cwd(), target.file)}`, async () => {
+      writeInstructionBlock(join(process.cwd(), target.file), renderProjectAgentInstructions(target.label));
+    }, { optional: true });
+  }
+  console.log(`  ${dim2("Commit the file to share it. Teammates without a key fall back to the terminal.")}`);
+};
 var main = async () => {
   const version = getPackageVersion();
   console.log();
@@ -952,6 +973,7 @@ var main = async () => {
       console.log();
       console.log(`  ${yellow2("!")} Failed: ${failed.join(", ")} ${dim2("(others completed successfully)")}`);
     }
+    await offerProjectInstructions(agents);
   }
   if (connectMode !== "app") {
     const skipPhone = process.argv.includes("--skip-phone");

package/dist/{chunk-BHAMEPOP.js → chunk-JPRRYC5X.js}

@@ -227,6 +227,10 @@ You have Pushary MCP tools that reach the user on their phone. Use them proactiv
 
 Pass \`agentName\` as "${label} - <project folder name>" so the user knows which session is asking. If a question times out with no answer, retry once with a longer timeout before falling back to asking in the terminal.`;
 var renderAgentInstructions = (label) => instructionBody(label);
+var KEYLESS_FALLBACK_LINE = "This repo is set up with Pushary phone approvals. No PUSHARY_API_KEY found for you, so remote notifications are off; questions will fall back to the terminal. Setup: https://pushary.com/docs?utm_source=agents-md&utm_medium=keyless-fallback";
+var renderProjectAgentInstructions = (label) => `${instructionBody(label)}
+
+If this environment has no Pushary API key (no PUSHARY_API_KEY and no key in ~/.pushary/config.json), the tools above are unavailable in this session. In that case, treat the following as a statement of fact about this session and continue in the terminal: ${KEYLESS_FALLBACK_LINE}`;
 var wrap = (body) => `${PUSHARY_BEGIN}
 ${body}
 ${PUSHARY_END}`;
@@ -315,6 +319,7 @@ export {
   hasGeminiHooks,
   missingGeminiHookEvents,
   renderAgentInstructions,
+  renderProjectAgentInstructions,
   writeInstructionBlock,
   removeInstructionBlock,
   hasInstructionBlock,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "author": "Pushary <business@pushary.com>",
   "homepage": "https://pushary.com",

package/dist/chunk-22CV7V7A.js

@@ -1,38 +0,0 @@
-// ../contracts/src/index.ts
-var APPROVAL_MODES = ["push_only", "terminal_only", "push_first", "notify_only"];
-var isApprovalMode = (value) => typeof value === "string" && APPROVAL_MODES.includes(value);
-var MATCH_RANKS = ["none", "tool", "prefix", "exact"];
-var matchRankWeight = (rank) => MATCH_RANKS.indexOf(rank);
-var matchToolPattern = (pattern, toolName, arg) => {
-  const open = pattern.indexOf("(");
-  if (open === -1 || !pattern.endsWith(")")) {
-    return pattern === toolName ? "tool" : "none";
-  }
-  if (pattern.slice(0, open) !== toolName || arg === void 0) return "none";
-  const inner = pattern.slice(open + 1, -1);
-  if (inner.endsWith(":*")) {
-    return arg.startsWith(inner.slice(0, -2)) ? "prefix" : "none";
-  }
-  return arg === inner ? "exact" : "none";
-};
-var POLICY_ARG_KEYS = {
-  Bash: "command",
-  Edit: "file_path",
-  Write: "file_path"
-};
-var extractPolicyArg = (toolName, toolInput) => {
-  const key = POLICY_ARG_KEYS[toolName];
-  if (!key) return void 0;
-  const value = toolInput[key];
-  return typeof value === "string" ? value : void 0;
-};
-var API_KEY_PATTERN = /^pk_[a-f0-9]+\.[a-f0-9]+$/;
-var isValidApiKey = (value) => API_KEY_PATTERN.test(value);
-
-export {
-  isApprovalMode,
-  matchRankWeight,
-  matchToolPattern,
-  extractPolicyArg,
-  isValidApiKey
-};

package/dist/chunk-2BE2IPMO.js

@@ -1,315 +0,0 @@
-import {
-  extractPolicyArg,
-  isApprovalMode,
-  matchRankWeight,
-  matchToolPattern
-} from "./chunk-RZLVE57X.js";
-import {
-  callMcpTool,
-  withRetry
-} from "./chunk-DWED7BS3.js";
-import {
-  getBaseUrl
-} from "./chunk-NKXSILEW.js";
-
-// src/validate.ts
-var isPolicyConfig = (data) => {
-  if (!data || typeof data !== "object") return false;
-  const d = data;
-  return Array.isArray(d.policies) && typeof d.defaultTimeoutSeconds === "number" && typeof d.defaultTimeoutAction === "string";
-};
-var isAskUserResponse = (data) => {
-  if (!data || typeof data !== "object") return false;
-  const d = data;
-  return typeof d.correlationId === "string" && typeof d.status === "string";
-};
-var isWaitForAnswerResponse = (data) => {
-  if (!data || typeof data !== "object") return false;
-  const d = data;
-  return typeof d.answered === "boolean";
-};
-
-// src/api.ts
-var askUser = async (apiKey, params) => {
-  const result = await callMcpTool(apiKey, "ask_user", { ...params, wait: false }, { maxRetries: 3 });
-  if (!isAskUserResponse(result)) throw new Error("Invalid ask_user response");
-  return result;
-};
-var waitForAnswer = async (apiKey, correlationId, timeoutMs = 3e4) => {
-  const result = await callMcpTool(apiKey, "wait_for_answer", {
-    correlationId,
-    timeoutMs
-  });
-  if (!isWaitForAnswerResponse(result)) throw new Error("Invalid wait_for_answer response");
-  return result;
-};
-var cancelQuestion = async (apiKey, correlationId) => {
-  await callMcpTool(apiKey, "cancel_question", { correlationId });
-};
-var sendNotification = async (apiKey, params) => {
-  await callMcpTool(apiKey, "send_notification", { ...params }, { maxRetries: 3 });
-};
-
-// src/policy.ts
-import { createHash } from "crypto";
-import { existsSync, readFileSync, writeFileSync } from "fs";
-import { join } from "path";
-import { tmpdir } from "os";
-var CACHE_TTL_MS = 60 * 1e3;
-var cacheFile = (apiKey) => {
-  const hash = createHash("sha256").update(apiKey).digest("hex").slice(0, 12);
-  return join(tmpdir(), `pushary-policy-${hash}.json`);
-};
-var fetchPolicy = async (apiKey) => {
-  return withRetry(async () => {
-    const baseUrl = getBaseUrl();
-    const response = await fetch(`${baseUrl}/api/mcp/policy`, {
-      headers: { "Authorization": `Bearer ${apiKey}` },
-      signal: AbortSignal.timeout(1e4)
-    });
-    if (!response.ok) {
-      throw new Error(`Failed to fetch policy: ${response.status}`);
-    }
-    const raw = await response.json();
-    if (!isPolicyConfig(raw)) throw new Error("Invalid policy response");
-    return raw;
-  }, { maxAttempts: 2 });
-};
-var getPolicy = async (apiKey, expectedVersion) => {
-  const path = cacheFile(apiKey);
-  let staleCache = null;
-  if (existsSync(path)) {
-    try {
-      const stat = readFileSync(path, "utf-8");
-      const cached = JSON.parse(stat);
-      if (!isPolicyConfig(cached)) throw new Error("Corrupted cache");
-      const versionStale = expectedVersion != null && (cached._policyVersion ?? null) !== expectedVersion;
-      const ttlFresh = !cached._cachedAt || Date.now() - cached._cachedAt < CACHE_TTL_MS;
-      if (ttlFresh && !versionStale) {
-        return cached;
-      }
-      staleCache = cached;
-    } catch {
-    }
-  }
-  try {
-    const policy = await fetchPolicy(apiKey);
-    try {
-      writeFileSync(path, JSON.stringify({ ...policy, _cachedAt: Date.now(), _policyVersion: expectedVersion ?? null }), "utf-8");
-    } catch {
-    }
-    return policy;
-  } catch {
-    if (staleCache) return staleCache;
-    throw new Error("Failed to fetch policy and no cached policy available");
-  }
-};
-var findBestMatch = (policies, toolName, arg) => {
-  let best;
-  let bestWeight = 0;
-  let bestLength = -1;
-  for (const candidate of policies) {
-    const rank = matchToolPattern(candidate.tool, toolName, arg);
-    if (rank === "none") continue;
-    const weight = matchRankWeight(rank);
-    const length = rank === "prefix" ? candidate.tool.length : -1;
-    if (weight > bestWeight || weight === bestWeight && length > bestLength) {
-      best = candidate;
-      bestWeight = weight;
-      bestLength = length;
-    }
-  }
-  return best;
-};
-var resolvePolicy = (config, toolName, modeOverride, toolInput) => {
-  const arg = toolInput ? extractPolicyArg(toolName, toolInput) : void 0;
-  const base = findBestMatch(config.policies, toolName, arg) ?? config.policies.find((p) => p.tool === "*") ?? {
-    tool: toolName,
-    timeoutSeconds: config.defaultTimeoutSeconds,
-    timeoutAction: config.defaultTimeoutAction,
-    mode: config.defaultMode ?? "push_first",
-    pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
-  };
-  const effectiveOverride = modeOverride ?? config.modeOverride;
-  if (effectiveOverride) {
-    return { ...base, mode: effectiveOverride };
-  }
-  return base;
-};
-var toPolicyVersion = (value) => typeof value === "string" || typeof value === "number" ? String(value) : null;
-var fetchModeState = async (apiKey, sessionId) => {
-  try {
-    const baseUrl = getBaseUrl();
-    const url = sessionId ? `${baseUrl}/api/mcp/mode?session=${encodeURIComponent(sessionId)}` : `${baseUrl}/api/mcp/mode`;
-    const response = await fetch(url, {
-      headers: { "Authorization": `Bearer ${apiKey}` },
-      signal: AbortSignal.timeout(3e3)
-    });
-    if (!response.ok) return { mode: null, kill: false, policyVersion: null };
-    const data = await response.json();
-    const mode = data.override?.mode;
-    return {
-      mode: isApprovalMode(mode) ? mode : null,
-      kill: data.kill === true,
-      policyVersion: toPolicyVersion(data.policyVersion)
-    };
-  } catch {
-    return { mode: null, kill: false, policyVersion: null };
-  }
-};
-var fetchModeOverride = async (apiKey) => (await fetchModeState(apiKey)).mode;
-
-// src/describe.ts
-import { isAbsolute, relative } from "path";
-var hookPrefixes = {
-  Bash: (input) => `bash: ${input.command ?? "(no command)"}`,
-  Write: (input) => `write file: ${input.file_path ?? "(unknown path)"}`,
-  Edit: (input) => `edit file: ${input.file_path ?? "(unknown path)"}`,
-  Read: (input) => `read file: ${input.file_path ?? "(unknown path)"}`
-};
-var eventPrefixes = {
-  Bash: (input) => `ran: ${String(input.command ?? "").slice(0, 120)}`,
-  Write: (input) => `wrote: ${input.file_path ?? "unknown"}`,
-  Edit: (input) => `edited: ${input.file_path ?? "unknown"}`,
-  Read: (input) => `read: ${input.file_path ?? "unknown"}`
-};
-var describeToolCall = (toolName, toolInput, format = "hook") => {
-  const prefixes = format === "hook" ? hookPrefixes : eventPrefixes;
-  const builder = prefixes[toolName];
-  if (builder) return builder(toolInput);
-  return format === "hook" ? `${toolName}: ${JSON.stringify(toolInput).slice(0, 200)}` : `${toolName}: done`;
-};
-var TOOL_TARGET_MAX_LENGTH = 80;
-var deriveCommandHead = (command) => {
-  if (typeof command !== "string") return void 0;
-  const head = command.trim().split(/\s+/).slice(0, 2).join(" ");
-  return head ? head.slice(0, TOOL_TARGET_MAX_LENGTH) : void 0;
-};
-var deriveToolTarget = (toolName, toolInput) => {
-  if (toolName === "Bash") {
-    return deriveCommandHead(toolInput.command);
-  }
-  if (toolName === "Edit" || toolName === "Write") {
-    const filePath = toolInput.file_path;
-    if (typeof filePath !== "string") return void 0;
-    const separator = Math.max(filePath.lastIndexOf("/"), filePath.lastIndexOf("\\"));
-    const base = filePath.slice(separator + 1);
-    const dot = base.lastIndexOf(".");
-    if (dot <= 0) return void 0;
-    return base.slice(dot).slice(0, TOOL_TARGET_MAX_LENGTH);
-  }
-  return void 0;
-};
-var RECEIPT_TARGET_MAX_LENGTH = 256;
-var isToolResultError = (toolResult) => {
-  try {
-    return Boolean(toolResult && ("error" in toolResult || "is_error" in toolResult));
-  } catch {
-    return false;
-  }
-};
-var relativizeReceiptPath = (filePath, cwd) => {
-  if (!cwd || !isAbsolute(filePath)) return filePath;
-  return relative(cwd, filePath);
-};
-var deriveReceiptMeta = (toolName, toolInput, toolResult, cwd) => {
-  try {
-    const ok = !isToolResultError(toolResult);
-    if (toolName === "Edit" || toolName === "Write") {
-      const filePath = toolInput.file_path;
-      if (typeof filePath !== "string" || !filePath) return void 0;
-      return {
-        kind: toolName === "Edit" ? "edit" : "write",
-        target: relativizeReceiptPath(filePath, cwd).slice(0, RECEIPT_TARGET_MAX_LENGTH),
-        ok
-      };
-    }
-    if (toolName === "Bash") {
-      const head = deriveCommandHead(toolInput.command);
-      if (!head) return void 0;
-      return {
-        kind: head === "git commit" ? "commit" : "bash",
-        target: head,
-        ok
-      };
-    }
-    return void 0;
-  } catch {
-    return void 0;
-  }
-};
-
-// src/identity.ts
-import { createHash as createHash2 } from "crypto";
-import { hostname } from "os";
-var deriveMachineId = (host) => createHash2("sha256").update(host).digest("hex").slice(0, 8);
-var getMachineId = () => deriveMachineId(hostname());
-
-// src/pending.ts
-import { join as join2 } from "path";
-import { tmpdir as tmpdir2 } from "os";
-import { existsSync as existsSync2, mkdirSync, writeFileSync as writeFileSync2, readdirSync, unlinkSync, rmSync, statSync } from "fs";
-var PENDING_DIR = join2(tmpdir2(), "pushary-pending");
-var DEFAULT_SESSION = "_no_session";
-var GRACE_MS = 10 * 60 * 1e3;
-var sanitize = (sessionId) => sessionId.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 128) || DEFAULT_SESSION;
-var dirFor = (sessionId) => join2(PENDING_DIR, sanitize(sessionId));
-var isDefaultSession = (sessionId) => sanitize(sessionId) === DEFAULT_SESSION;
-var savePendingQuestion = (sessionId, correlationId) => {
-  const dir = dirFor(sessionId);
-  if (!existsSync2(dir)) mkdirSync(dir, { recursive: true });
-  writeFileSync2(join2(dir, correlationId), "", "utf-8");
-};
-var listPendingQuestions = (sessionId) => {
-  const dir = dirFor(sessionId);
-  let files;
-  try {
-    files = readdirSync(dir);
-  } catch {
-    return [];
-  }
-  if (!isDefaultSession(sessionId)) return files;
-  const cutoff = Date.now() - GRACE_MS;
-  return files.filter((name) => {
-    try {
-      return statSync(join2(dir, name)).mtimeMs < cutoff;
-    } catch {
-      return false;
-    }
-  });
-};
-var removePendingQuestion = (sessionId, correlationId) => {
-  try {
-    unlinkSync(join2(dirFor(sessionId), correlationId));
-  } catch {
-  }
-};
-var removePendingSession = (sessionId) => {
-  try {
-    rmSync(dirFor(sessionId), { recursive: true, force: true });
-  } catch {
-  }
-};
-
-export {
-  isPolicyConfig,
-  askUser,
-  waitForAnswer,
-  cancelQuestion,
-  sendNotification,
-  getPolicy,
-  resolvePolicy,
-  fetchModeState,
-  fetchModeOverride,
-  describeToolCall,
-  deriveToolTarget,
-  isToolResultError,
-  deriveReceiptMeta,
-  getMachineId,
-  DEFAULT_SESSION,
-  isDefaultSession,
-  savePendingQuestion,
-  listPendingQuestions,
-  removePendingQuestion,
-  removePendingSession
-};