@pushary/agent-hooks 0.62.2 → 0.62.3

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 0.62.3
+
+### `setup --connect app --key ...` discarded your key
+
+Pairing was checked before the supplied key, so passing `--key` or `--key-stdin`
+alongside `--connect app` silently threw that key away and minted a new one. The
+key you named stayed live on the account with nothing pointing at it. An
+explicitly supplied key now wins, and pairing is only the key source when there
+is no key to use.
+
+Pairing still mints a key each time it runs, which is inherent to the protocol.
+When that replaces a key this machine was already using, setup now says so and
+names the old key, rather than leaving you to find it in the dashboard later. It
+does not revoke it for you: the same key may be in use on another machine.
+
+### The update banner offered downgrades
+
+Setup compared its version to the registry with `!==`, so it announced an update
+whenever the two merely differed. A machine running a build ahead of npm was told
+`Update available: 0.62.3 -> 0.62.2` and pointed at a command that would have
+downgraded it. It now prompts only when the registry is genuinely ahead, using
+the same comparison `pushary upgrade` already used. There is one implementation
+of that comparison now instead of two.
+
+### A reused key skipped its own verification
+
+Setup skipped the server key check whenever `--connect app` was passed, on the
+assumption the key had just been minted. That is only true when pairing actually
+produced it, so a key reused on an `--connect app` run was never verified. The
+skip now follows where the key came from.
+
+
 ## 0.62.2
 
 ### An ignored `--dry-run` made real changes

package/dist/bin/pushary-clean.js

@@ -24,8 +24,8 @@ import {
 } from "../chunk-MUEW424A.js";
 import {
   exitOnHelpFlag
-} from "../chunk-WXFEK7KD.js";
-import "../chunk-7OXIC7E3.js";
+} from "../chunk-674M3JQF.js";
+import "../chunk-KVUBLB6K.js";
 import "../chunk-DQAN3JQP.js";
 import "../chunk-KZERVKTD.js";
 

package/dist/bin/pushary-connect.js

@@ -24,8 +24,8 @@ import {
 import "../chunk-BC3VCZ3E.js";
 import {
   exitOnHelpFlag
-} from "../chunk-WXFEK7KD.js";
-import "../chunk-7OXIC7E3.js";
+} from "../chunk-674M3JQF.js";
+import "../chunk-KVUBLB6K.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import {

package/dist/bin/pushary-daemon.js

@@ -7,8 +7,8 @@ import {
 } from "../chunk-MUEW424A.js";
 import {
   exitOnHelpFlag
-} from "../chunk-WXFEK7KD.js";
-import "../chunk-7OXIC7E3.js";
+} from "../chunk-674M3JQF.js";
+import "../chunk-KVUBLB6K.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";

package/dist/bin/pushary-doctor.js

@@ -50,10 +50,10 @@ import {
 } from "../chunk-MUEW424A.js";
 import {
   exitOnHelpFlag
-} from "../chunk-WXFEK7KD.js";
+} from "../chunk-674M3JQF.js";
 import {
   getPackageVersion
-} from "../chunk-7OXIC7E3.js";
+} from "../chunk-KVUBLB6K.js";
 import {
   readLedgerSummary
 } from "../chunk-WLGEY4UX.js";

package/dist/bin/pushary-hook.js

@@ -5,8 +5,8 @@ import {
 import "../chunk-CAJZAFVS.js";
 import {
   exitOnHelpFlag
-} from "../chunk-WXFEK7KD.js";
-import "../chunk-7OXIC7E3.js";
+} from "../chunk-674M3JQF.js";
+import "../chunk-KVUBLB6K.js";
 import "../chunk-YHG74UFF.js";
 import "../chunk-5ZDYDU2Q.js";
 import "../chunk-WLGEY4UX.js";

package/dist/bin/pushary-login.js

@@ -21,10 +21,10 @@ import {
 import "../chunk-BC3VCZ3E.js";
 import {
   exitOnHelpFlag
-} from "../chunk-WXFEK7KD.js";
+} from "../chunk-674M3JQF.js";
 import {
   getPackageVersion
-} from "../chunk-7OXIC7E3.js";
+} from "../chunk-KVUBLB6K.js";
 import "../chunk-SAF6HGAA.js";
 import {
   UsageError

package/dist/bin/pushary-logout.js

@@ -16,8 +16,8 @@ import {
 import "../chunk-BC3VCZ3E.js";
 import {
   exitOnHelpFlag
-} from "../chunk-WXFEK7KD.js";
-import "../chunk-7OXIC7E3.js";
+} from "../chunk-674M3JQF.js";
+import "../chunk-KVUBLB6K.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-mode.js

@@ -11,8 +11,8 @@ import {
 } from "../chunk-GMXKITVA.js";
 import {
   exitOnHelpFlag
-} from "../chunk-WXFEK7KD.js";
-import "../chunk-7OXIC7E3.js";
+} from "../chunk-674M3JQF.js";
+import "../chunk-KVUBLB6K.js";
 import "../chunk-SAF6HGAA.js";
 import {
   UsageError

package/dist/bin/pushary-setup.js

@@ -40,6 +40,8 @@ import "../chunk-3EGEA4KH.js";
 import {
   KEY_FILE_MODE,
   exportLine,
+  keyPrefix,
+  readKeySource,
   writeKey
 } from "../chunk-COC6NPWG.js";
 import {
@@ -68,8 +70,9 @@ import {
 } from "../chunk-MUEW424A.js";
 import {
   getPackageVersion,
+  isNewerVersion,
   renderCommandHelp
-} from "../chunk-7OXIC7E3.js";
+} from "../chunk-KVUBLB6K.js";
 import {
   reportEvent
 } from "../chunk-5ZDYDU2Q.js";
@@ -385,7 +388,7 @@ var checkForUpdates = async (current) => {
     });
     const data = await res.json();
     const latest = data.version;
-    if (latest && latest !== current) {
+    if (latest && isNewerVersion(latest, current)) {
       console.log(`  ${yellow("!")} Update available: ${dim(current)} \u2192 ${green(latest)}`);
       console.log(`  ${dim("Run:")} npx @pushary/agent-hooks@latest upgrade`);
       console.log();
@@ -1065,8 +1068,15 @@ var main = async () => {
   const flagKey = await readKeyFromStdin(options) ?? options.key ?? void 0;
   const envKey = process.env.PUSHARY_API_KEY?.trim();
   let trimmedKey;
-  if (connectMode === "app") {
+  let keyFromPairing = false;
+  if (flagKey && isValidApiKey(flagKey)) {
+    const masked = `${flagKey.slice(0, 8)}...${flagKey.slice(-4)}`;
+    console.log(`  ${check} Using API key: ${dim(masked)}`);
+    console.log();
+    trimmedKey = flagKey;
+  } else if (connectMode === "app") {
     console.log(`  ${dim("Pairing with your Pushary app.")}`);
+    const previous = readKeySource();
     const paired = await connectViaAppPairing();
     if (!paired) {
       console.log();
@@ -1075,15 +1085,15 @@ var main = async () => {
       process.exit(1);
     }
     trimmedKey = paired.apiKey;
+    keyFromPairing = true;
     if (paired.handle) {
       console.log(`  ${check} Connected to ${cyan("@" + paired.handle)}`);
     }
+    if (previous.key && previous.key !== trimmedKey) {
+      console.log(`  ${yellow("!")} The key this machine used before (${keyPrefix(previous.key)}) is still active.`);
+      console.log(`  ${dim("Revoke it at")} ${cyan("pushary.com/dashboard/agent/settings")} ${dim("if nothing else uses it.")}`);
+    }
     console.log();
-  } else if (flagKey && isValidApiKey(flagKey)) {
-    const masked = `${flagKey.slice(0, 8)}...${flagKey.slice(-4)}`;
-    console.log(`  ${check} Using API key: ${dim(masked)}`);
-    console.log();
-    trimmedKey = flagKey;
   } else if (envKey && isValidApiKey(envKey)) {
     const masked = `${envKey.slice(0, 8)}...${envKey.slice(-4)}`;
     console.log(`  ${check} Found API key in environment: ${dim(masked)}`);
@@ -1138,7 +1148,7 @@ var main = async () => {
 `);
     process.exit(EXIT.USAGE);
   }
-  const keyCheck = connectMode === "app" ? null : await verifyKeyOrExit(trimmedKey, options);
+  const keyCheck = keyFromPairing ? null : await verifyKeyOrExit(trimmedKey, options);
   const agents = await resolveAgents(options);
   if (options.dryRun) {
     reportDryRun(trimmedKey, agents, keyCheck);

package/dist/bin/pushary-stats.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   exitOnHelpFlag
-} from "../chunk-WXFEK7KD.js";
-import "../chunk-7OXIC7E3.js";
+} from "../chunk-674M3JQF.js";
+import "../chunk-KVUBLB6K.js";
 import {
   readLedgerSummary
 } from "../chunk-WLGEY4UX.js";

package/dist/bin/pushary-status.js

@@ -22,8 +22,8 @@ import {
 import "../chunk-BC3VCZ3E.js";
 import {
   exitOnHelpFlag
-} from "../chunk-WXFEK7KD.js";
-import "../chunk-7OXIC7E3.js";
+} from "../chunk-674M3JQF.js";
+import "../chunk-KVUBLB6K.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import {

package/dist/bin/pushary-suggestions.js

@@ -7,8 +7,8 @@ import {
 } from "../chunk-GMXKITVA.js";
 import {
   exitOnHelpFlag
-} from "../chunk-WXFEK7KD.js";
-import "../chunk-7OXIC7E3.js";
+} from "../chunk-674M3JQF.js";
+import "../chunk-KVUBLB6K.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";

package/dist/bin/pushary-upgrade.js

@@ -31,8 +31,10 @@ import {
 } from "../chunk-MUEW424A.js";
 import {
   exitOnHelpFlag
-} from "../chunk-WXFEK7KD.js";
-import "../chunk-7OXIC7E3.js";
+} from "../chunk-674M3JQF.js";
+import {
+  isNewerVersion
+} from "../chunk-KVUBLB6K.js";
 import "../chunk-DQAN3JQP.js";
 import {
   getApiKey
@@ -239,15 +241,6 @@ var fetchLatestVersion = async () => {
     return void 0;
   }
 };
-var isNewer = (a, b) => {
-  const pa = a.split(".").map((n) => parseInt(n, 10) || 0);
-  const pb = b.split(".").map((n) => parseInt(n, 10) || 0);
-  for (let i = 0; i < 3; i++) {
-    if ((pa[i] ?? 0) > (pb[i] ?? 0)) return true;
-    if ((pa[i] ?? 0) < (pb[i] ?? 0)) return false;
-  }
-  return false;
-};
 var main = async () => {
   const installed = getInstalledVersion();
   if (!installed) {
@@ -268,7 +261,7 @@ var main = async () => {
     return;
   }
   const latest = await fetchLatestVersion();
-  if (latest && !isNewer(latest, installed)) {
+  if (latest && !isNewerVersion(latest, installed)) {
     console.log(`Already on the latest version (${installed}).`);
     return;
   }

package/dist/bin/pushary-wait.js

@@ -14,8 +14,8 @@ import {
 } from "../chunk-GMXKITVA.js";
 import {
   exitOnHelpFlag
-} from "../chunk-WXFEK7KD.js";
-import "../chunk-7OXIC7E3.js";
+} from "../chunk-674M3JQF.js";
+import "../chunk-KVUBLB6K.js";
 import "../chunk-SAF6HGAA.js";
 import {
   UsageError

package/dist/bin/pushary.js

@@ -4,7 +4,7 @@ import {
   getPackageVersion,
   isCommandName,
   renderHelp
-} from "../chunk-7OXIC7E3.js";
+} from "../chunk-KVUBLB6K.js";
 import {
   installProxyDispatcher
 } from "../chunk-SAF6HGAA.js";

package/dist/{chunk-WXFEK7KD.js → chunk-674M3JQF.js}

@@ -1,7 +1,7 @@
 import {
   getPackageVersion,
   renderCommandHelp
-} from "./chunk-7OXIC7E3.js";
+} from "./chunk-KVUBLB6K.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";

package/dist/{chunk-7OXIC7E3.js → chunk-KVUBLB6K.js}

@@ -200,11 +200,21 @@ var getPackageVersion = () => {
     return "0.0.0";
   }
 };
+var isNewerVersion = (candidate, current) => {
+  const a = candidate.split(".").map((part) => parseInt(part, 10) || 0);
+  const b = current.split(".").map((part) => parseInt(part, 10) || 0);
+  for (let i = 0; i < 3; i++) {
+    if ((a[i] ?? 0) > (b[i] ?? 0)) return true;
+    if ((a[i] ?? 0) < (b[i] ?? 0)) return false;
+  }
+  return false;
+};
 
 export {
   COMMANDS,
   isCommandName,
   renderHelp,
   renderCommandHelp,
-  getPackageVersion
+  getPackageVersion,
+  isNewerVersion
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.62.2",
+  "version": "0.62.3",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",