@pushary/agent-hooks 0.60.0 → 0.62.0

package/dist/bin/pushary.js

@@ -1,65 +1,47 @@
 #!/usr/bin/env node
+import {
+  COMMANDS,
+  EXIT,
+  getPackageVersion,
+  isCommandName,
+  renderHelp
+} from "../chunk-SP7OZXCQ.js";
 
 // bin/pushary.ts
-var command = process.argv[2];
-if (command === "setup") {
-  await import("./pushary-setup.js");
-} else if (command === "hook") {
-  await import("./pushary-hook.js");
-} else if (command === "clean") {
-  await import("./pushary-clean.js");
-} else if (command === "doctor") {
-  await import("./pushary-doctor.js");
-} else if (command === "mode") {
-  await import("./pushary-mode.js");
-} else if (command === "wait") {
-  await import("./pushary-wait.js");
-} else if (command === "stats") {
-  await import("./pushary-stats.js");
-} else if (command === "suggestions") {
-  await import("./pushary-suggestions.js");
-} else if (command === "upgrade") {
-  await import("./pushary-upgrade.js");
-} else if (command === "claude") {
-  await import("./pushary-claude.js");
-} else if (command === "daemon") {
-  await import("./pushary-daemon.js");
-} else {
-  console.log(`
-Pushary Agent Hooks
-
-Commands:
-  setup    Configure Claude Code, Codex, Gemini CLI, Hermes, or Cursor with Pushary
-  claude   Run Claude Code through Pushary \u2014 the native terminal, and reachable from
-           your phone: send an instruction and it drives even a fully idle agent
-           (press Ctrl-] to take the terminal back). Add --remote to start headless.
-  daemon   Keep this machine reachable to START a new session from your phone, even
-           with nothing running. Leave it in a project dir; it launches a headless
-           'pushary claude --remote' when you send a prompt from the app.
-  doctor   Verify your Pushary installation is working
-  clean    Remove all Pushary configuration (--yes for non-interactive)
-  mode     Switch approval mode (push_only, push_first, terminal_only)
-  wait     Show or set the "wait for your phone" ladder (pushary wait 45)
-  stats    Show the approval moments your agents hit while not connected
-  suggestions  List rules mined from your own approvals; accept one with
-               'pushary suggestions accept <id>' to always-allow that pattern
-  upgrade  Update the globally installed hooks to the latest version
-  hook     Run as a PreToolUse hook (reads stdin, writes stdout)
-
-Setup options:
-  --key <pk_xxx.xxx>   Use this API key instead of prompting for one
-  --connect web        Connect your phone via the PWA QR code (default)
-  --connect app        Pair the native Pushary app, no key to paste
-  --skip-phone         Skip the phone connect step (CI or non-interactive shells)
-
-Usage:
-  npx @pushary/agent-hooks@latest setup
-  npx @pushary/agent-hooks@latest setup --key pk_xxx.xxx --skip-phone
-  npx @pushary/agent-hooks@latest doctor
-  npx @pushary/agent-hooks@latest mode push_only --for 30m
-  npx @pushary/agent-hooks@latest wait 45
-  pushary claude                                    # native terminal, reachable from your phone when idle
-  pushary claude --remote -p "start the refactor"   # start headless, drive entirely from your phone
-  pushary daemon                                    # keep this machine ready to spawn a session from your phone
+var LOADERS = {
+  setup: () => import("./pushary-setup.js"),
+  claude: () => import("./pushary-claude.js"),
+  daemon: () => import("./pushary-daemon.js"),
+  status: () => import("./pushary-status.js"),
+  login: () => import("./pushary-login.js"),
+  logout: () => import("./pushary-logout.js"),
+  connect: () => import("./pushary-connect.js"),
+  doctor: () => import("./pushary-doctor.js"),
+  clean: () => import("./pushary-clean.js"),
+  mode: () => import("./pushary-mode.js"),
+  wait: () => import("./pushary-wait.js"),
+  stats: () => import("./pushary-stats.js"),
+  suggestions: () => import("./pushary-suggestions.js"),
+  upgrade: () => import("./pushary-upgrade.js"),
+  hook: () => import("./pushary-hook.js")
+};
+var argv = process.argv.slice(2);
+var command = argv[0] ?? "";
+var wants = (...names) => argv.some((arg) => names.includes(arg));
+if (!command || wants("--help", "-h") && !isCommandName(command)) {
+  process.stdout.write(renderHelp(getPackageVersion()));
+  process.exit(EXIT.OK);
+}
+if (wants("--version", "-v") && !isCommandName(command)) {
+  process.stdout.write(`${getPackageVersion()}
+`);
+  process.exit(EXIT.OK);
+}
+if (!isCommandName(command)) {
+  process.stderr.write(`Unknown command: ${command}
+`);
+  process.stderr.write(`Run \`pushary --help\`. Available: ${COMMANDS.map((c) => c.name).join(", ")}
 `);
+  process.exit(EXIT.USAGE);
 }
+await LOADERS[command]();

package/dist/chunk-247C4RE5.js

@@ -0,0 +1,236 @@
+import {
+  resolveShellRc
+} from "./chunk-BC3VCZ3E.js";
+import {
+  configFilePath
+} from "./chunk-2UMNXADU.js";
+
+// src/cli/fsx.ts
+import { copyFileSync, existsSync, fsyncSync, mkdirSync, openSync, closeSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+var readJsonSafe = (filePath) => {
+  let raw;
+  try {
+    raw = readFileSync(filePath, "utf-8");
+  } catch (err) {
+    const error = err;
+    if (error.code === "ENOENT") return { kind: "missing" };
+    return { kind: "unreadable", error };
+  }
+  if (raw.trim() === "") return { kind: "ok", value: {} };
+  try {
+    return { kind: "ok", value: JSON.parse(raw) };
+  } catch (err) {
+    return { kind: "unparseable", error: err, raw };
+  }
+};
+var stamp = () => (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+var backupFile = (filePath) => {
+  const target = `${filePath}.pushary-backup-${stamp()}`;
+  copyFileSync(filePath, target);
+  return target;
+};
+var writeFileAtomic = (filePath, contents, mode) => {
+  const dir = dirname(filePath);
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  const temp = join(dir, `.${process.pid}-${stamp()}.pushary-tmp`);
+  try {
+    writeFileSync(temp, contents, mode === void 0 ? "utf-8" : { encoding: "utf-8", mode });
+    const handle = openSync(temp, "r+");
+    try {
+      fsyncSync(handle);
+    } finally {
+      closeSync(handle);
+    }
+    renameSync(temp, filePath);
+  } catch (err) {
+    try {
+      if (existsSync(temp)) unlinkSync(temp);
+    } catch {
+    }
+    throw err;
+  }
+};
+var writeJsonAtomic = (filePath, data, mode) => writeFileAtomic(filePath, `${JSON.stringify(data, null, 2)}
+`, mode);
+
+// src/keystore.ts
+import { chmodSync, existsSync as existsSync2, readFileSync as readFileSync2, realpathSync, writeFileSync as writeFileSync2 } from "fs";
+import { homedir } from "os";
+import { join as join2 } from "path";
+var KEY_FILE_MODE = 384;
+var FALLBACK_RCS = [".zshrc", ".zprofile", ".bashrc", ".bash_profile"];
+var OUR_EXPORT = /^[ \t]*export[ \t]+PUSHARY_API_KEY=(['"]?)(pk_[a-f0-9]+\.[a-f0-9]+)\1[ \t]*$/;
+var MENTIONS_KEY = /PUSHARY_API_KEY/;
+var isComment = (line) => line.trimStart().startsWith("#");
+var exportLine = (apiKey) => `export PUSHARY_API_KEY='${apiKey}'`;
+var keyPrefix = (key) => key.split(".")[0] ?? key;
+var rcResult = (kind, over = {}) => ({
+  kind,
+  path: null,
+  shell: null,
+  previousKeyPrefix: null,
+  declinedLine: null,
+  backupPath: null,
+  detail: null,
+  ...over
+});
+var realPathOf = (filePath) => {
+  try {
+    return realpathSync(filePath);
+  } catch {
+    return filePath;
+  }
+};
+var rewriteRcExport = (rcPath, apiKey, shell = null) => {
+  const target = realPathOf(rcPath);
+  let content = "";
+  try {
+    content = readFileSync2(target, "utf-8");
+  } catch (err) {
+    const error = err;
+    if (error.code !== "ENOENT") {
+      return rcResult("unavailable", { path: target, shell, detail: error.message });
+    }
+  }
+  const lines = content.split("\n");
+  const foreign = lines.findIndex((line) => !isComment(line) && MENTIONS_KEY.test(line) && !OUR_EXPORT.test(line));
+  if (foreign >= 0) {
+    const match = /pk_[a-f0-9]+/.exec(lines[foreign] ?? "");
+    return rcResult("declined", {
+      path: target,
+      shell,
+      declinedLine: foreign + 1,
+      previousKeyPrefix: match?.[0] ?? null
+    });
+  }
+  const ours = lines.map((line, index) => ({ line, index })).filter((entry) => OUR_EXPORT.test(entry.line));
+  if (ours.length > 0) {
+    const previous = OUR_EXPORT.exec(ours[ours.length - 1].line)?.[2] ?? null;
+    if (ours.every((entry) => OUR_EXPORT.exec(entry.line)?.[2] === apiKey)) {
+      return rcResult("unchanged", {
+        path: target,
+        shell,
+        previousKeyPrefix: previous ? keyPrefix(previous) : null
+      });
+    }
+    const next = [...lines];
+    for (const entry of ours) next[entry.index] = exportLine(apiKey);
+    try {
+      const backupPath = backupFile(target);
+      writeFileAtomic(target, next.join("\n"), KEY_FILE_MODE);
+      return rcResult("updated", {
+        path: target,
+        shell,
+        previousKeyPrefix: previous ? keyPrefix(previous) : null,
+        backupPath
+      });
+    } catch (err) {
+      return rcResult("unavailable", { path: target, shell, detail: err.message });
+    }
+  }
+  const gap = content.length === 0 ? "" : content.endsWith("\n") ? "" : "\n";
+  try {
+    writeFileAtomic(target, `${content}${gap}${exportLine(apiKey)}
+`, KEY_FILE_MODE);
+  } catch (err) {
+    return rcResult("unavailable", { path: target, shell, detail: err.message });
+  }
+  return rcResult("written", { path: target, shell });
+};
+var resolveRcTarget = () => {
+  const resolved = resolveShellRc();
+  if (resolved) return { path: resolved.path, shell: resolved.shell };
+  const fallback = FALLBACK_RCS.map((name) => join2(homedir(), name)).find(existsSync2);
+  return fallback ? { path: fallback, shell: null } : null;
+};
+var writeKey = (apiKey, options = {}) => {
+  const configPath = configFilePath();
+  const existing = readJsonSafe(configPath);
+  let current = {};
+  let configBackupPath = null;
+  if (existing.kind === "unreadable") {
+    throw new Error(
+      `${configPath} exists but could not be read (${existing.error.message}). Fix its permissions or remove it, then re-run setup. Nothing was changed.`
+    );
+  }
+  if (existing.kind === "ok") {
+    current = existing.value;
+  } else if (existing.kind === "unparseable") {
+    configBackupPath = backupFile(configPath);
+  }
+  writeJsonAtomic(configPath, { ...current, apiKey }, KEY_FILE_MODE);
+  restrictFile(configPath);
+  const target = (options.resolveRc ?? resolveRcTarget)();
+  const rc = target ? rewriteRcExport(target.path, apiKey, target.shell) : rcResult("no-rc");
+  process.env.PUSHARY_API_KEY = apiKey;
+  return { configPath, rc, configBackupPath };
+};
+var clearKey = (options = {}) => {
+  const configPath = configFilePath();
+  const existing = readJsonSafe(configPath);
+  let removedFromConfig = false;
+  if (existing.kind === "ok" && typeof existing.value.apiKey === "string") {
+    const { apiKey: _dropped, ...rest } = existing.value;
+    writeJsonAtomic(configPath, rest, KEY_FILE_MODE);
+    restrictFile(configPath);
+    removedFromConfig = true;
+  }
+  const target = (options.resolveRc ?? resolveRcTarget)();
+  let rcLinesDisabled = 0;
+  if (target) {
+    try {
+      const real = realpathSync(target.path);
+      const lines = readFileSync2(real, "utf8").split("\n");
+      const next = lines.map((line) => {
+        if (!OUR_EXPORT.test(line)) return line;
+        rcLinesDisabled += 1;
+        return `# ${line.trim()}   # removed by pushary logout`;
+      });
+      if (rcLinesDisabled > 0) writeFileSync2(real, next.join("\n"));
+    } catch {
+      rcLinesDisabled = 0;
+    }
+  }
+  delete process.env.PUSHARY_API_KEY;
+  return {
+    removedFromConfig,
+    configPath,
+    rcPath: target?.path ?? null,
+    rcLinesDisabled
+  };
+};
+var restrictFile = (filePath) => {
+  try {
+    chmodSync(filePath, KEY_FILE_MODE);
+  } catch {
+  }
+};
+var readConfigKey = (configPath) => {
+  const result = readJsonSafe(configPath);
+  if (result.kind !== "ok") return null;
+  const key = typeof result.value.apiKey === "string" ? result.value.apiKey.trim() : "";
+  return key || null;
+};
+var readKeySource = () => {
+  const configPath = configFilePath();
+  const envKey = process.env.PUSHARY_API_KEY?.trim() || null;
+  const fileKey = readConfigKey(configPath);
+  const drift = envKey && fileKey && envKey !== fileKey ? { envPrefix: keyPrefix(envKey), configPrefix: keyPrefix(fileKey), configPath } : null;
+  if (envKey) return { kind: "env", key: envKey, origin: "PUSHARY_API_KEY", drift };
+  if (fileKey) return { kind: "config", key: fileKey, origin: configPath, drift: null };
+  return { kind: "none", key: null, origin: null, drift: null };
+};
+
+export {
+  readJsonSafe,
+  backupFile,
+  writeFileAtomic,
+  writeJsonAtomic,
+  KEY_FILE_MODE,
+  exportLine,
+  keyPrefix,
+  writeKey,
+  clearKey,
+  readKeySource
+};

package/dist/{chunk-NKXSILEW.js → chunk-2UMNXADU.js}

@@ -12,18 +12,34 @@ var readKeyFromConfigFile = () => {
     return void 0;
   }
 };
+var driftChecked = false;
+var warnOnKeyDrift = (envKey) => {
+  if (driftChecked || process.env.PUSHARY_SUPPRESS_KEY_DRIFT_WARNING === "1") return;
+  driftChecked = true;
+  const fileKey = readKeyFromConfigFile();
+  if (!fileKey || fileKey === envKey) return;
+  const short = (key) => key.split(".")[0] ?? key;
+  process.stderr.write(
+    `[pushary] PUSHARY_API_KEY in your environment (${short(envKey)}) differs from ${configFilePath()} (${short(fileKey)}). The environment one is being used. Run 'pushary doctor' for details, or set PUSHARY_SUPPRESS_KEY_DRIFT_WARNING=1 if this is deliberate.
+`
+  );
+};
 var getApiKey = () => {
   const envKey = process.env.PUSHARY_API_KEY?.trim();
-  if (envKey) return envKey;
+  if (envKey) {
+    warnOnKeyDrift(envKey);
+    return envKey;
+  }
   const fileKey = readKeyFromConfigFile();
   if (fileKey) return fileKey;
   throw new Error(
     "PUSHARY_API_KEY is not set and no key was found in ~/.pushary/config.json. Run `npx @pushary/agent-hooks setup`, or get your API key at https://pushary.com/sign-up?from=ai-coding"
   );
 };
-var getBaseUrl = () => process.env.PUSHARY_BASE_URL ?? "https://pushary.com";
+var getBaseUrl = () => process.env.PUSHARY_BASE_URL?.trim() || process.env.PUSHARY_API_URL?.trim() || "https://pushary.com";
 
 export {
+  configFilePath,
   getApiKey,
   getBaseUrl
 };

package/dist/chunk-3EGEA4KH.js

@@ -0,0 +1,44 @@
+// src/pairing.ts
+import crypto from "crypto";
+var X25519_SPKI_PREFIX = Buffer.from("302a300506032b656e032100", "hex");
+var HKDF_INFO = Buffer.from("pushary-pair-v1");
+var HEADER_BYTES = 32 + 12 + 16;
+var rawToPublicKey = (raw) => crypto.createPublicKey({
+  key: Buffer.concat([X25519_SPKI_PREFIX, raw]),
+  format: "der",
+  type: "spki"
+});
+var publicKeyToRaw = (key) => key.export({ format: "der", type: "spki" }).subarray(-32);
+var generateKeypair = () => {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync("x25519");
+  const publicKeyRaw = publicKeyToRaw(publicKey);
+  return { publicKeyB64: publicKeyRaw.toString("base64"), publicKeyRaw, privateKey };
+};
+var publicKeyFingerprint = (b64) => {
+  const raw = Buffer.from(b64, "base64");
+  const digest = crypto.createHash("sha256").update(raw).digest("hex");
+  return (digest.slice(0, 8).match(/.{2}/g) ?? []).join(" ").toUpperCase();
+};
+var openSealedKey = (blobB64, keypair) => {
+  const blob = Buffer.from(blobB64, "base64");
+  if (blob.length <= HEADER_BYTES) throw new Error("sealed payload too short");
+  const ephemeralRaw = blob.subarray(0, 32);
+  const nonce = blob.subarray(32, 44);
+  const tag = blob.subarray(44, 60);
+  const ciphertext = blob.subarray(60);
+  const shared = crypto.diffieHellman({
+    privateKey: keypair.privateKey,
+    publicKey: rawToPublicKey(ephemeralRaw)
+  });
+  const salt = Buffer.concat([ephemeralRaw, keypair.publicKeyRaw]);
+  const key = Buffer.from(crypto.hkdfSync("sha256", shared, salt, HKDF_INFO, 32));
+  const decipher = crypto.createDecipheriv("aes-256-gcm", key, nonce);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+};
+
+export {
+  generateKeypair,
+  publicKeyFingerprint,
+  openSealedKey
+};