@pushary/agent-hooks 0.64.2 → 0.64.4

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## 0.64.4
+
+### The shell you ran setup in still exported the key it replaced
+
+0.64.3 stopped a stale export from hiding the working key on disk, and the rc
+file has been rewritten in place since 0.62. Neither reaches the shell you are
+standing in: the export there is still the old key, the environment wins over the
+config file at hook time, and the agent you start in that terminal a minute later
+talks to whichever workspace that key belongs to.
+
+`--connect app` mints on every run and is the command onboarding prints, so this
+is the ordinary case rather than an exotic one. Setup now says so under "Still to
+do": open a new terminal, or re-export. No key is printed in that line.
+
+## 0.64.3
+
+### A stale shell export hid the working key on disk
+
+`PUSHARY_API_KEY` wins over `~/.pushary/config.json`, which is right and
+unchanged. But the environment used to win on the key's *shape* alone, so a
+well-formed key the server had since revoked shadowed a working one in the config
+file and setup exited "This key was rejected by pushary.com" with a perfectly
+good key sitting on the machine.
+
+That is the state any shell left open across a key rotation is in: the export is
+the old key, the file is the new one, and the terminal you happen to be typing in
+decides whether setup works.
+
+The environment key is checked with the server before it is chosen now, and a
+rejected one falls through to the stored key rather than ending the run. It costs
+no extra call: the verdict is handed to the verification step that was already
+making it.
+
+### `--connect app` on a machine with no terminal named the wrong problem
+
+A headless run that asked to pair said "No API key, and no terminal to sign in
+from" even with a key in the config file, because asking to pair deliberately
+takes the stored key off the table. It now says the flag needs a terminal for the
+QR, and that dropping it uses the key already there.
+
 ## 0.64.2
 
 ### A run that gave up reported nothing, and said it stopped at the start

package/dist/bin/pushary-setup.js

@@ -1180,7 +1180,10 @@ var main = async () => {
   let keyFromPairing = false;
   const storedKey = readConfigFileKey();
   const pairingRequested = connectMode === "app" && options.connectExplicit && !options.skipPhone;
-  const storedCheck = !(flagKey && isValidApiKey(flagKey)) && !pairingRequested && !(envKey && isValidApiKey(envKey)) && storedKey !== null && isValidApiKey(storedKey) ? await usableStoredKey(storedKey) : null;
+  const ambientEligible = !(flagKey && isValidApiKey(flagKey)) && !pairingRequested;
+  const envCheck = ambientEligible && envKey && isValidApiKey(envKey) ? await usableStoredKey(envKey) : null;
+  const storedCheck = ambientEligible && envCheck === null && storedKey !== null && isValidApiKey(storedKey) && // login writes both, so without this the same key is probed twice.
+  storedKey !== envKey ? await usableStoredKey(storedKey) : null;
   let storedKeyCheck = null;
   if (flagKey && isValidApiKey(flagKey)) {
     const masked = `${flagKey.slice(0, 8)}...${flagKey.slice(-4)}`;
@@ -1194,13 +1197,14 @@ var main = async () => {
     console.log();
     trimmedKey = storedKey;
     storedKeyCheck = storedCheck;
-  } else if (!pairingRequested && envKey && isValidApiKey(envKey)) {
+  } else if (envKey && envCheck !== null) {
     const masked = `${envKey.slice(0, 8)}...${envKey.slice(-4)}`;
     console.log(`  ${check} Found API key in environment: ${dim(masked)}`);
     console.log();
     const useExisting = options.nonInteractive ? true : await confirm({ message: "Use this key?", default: true });
     if (useExisting) {
       trimmedKey = envKey;
+      storedKeyCheck = envCheck;
     } else {
       const apiKey = await input({ message: "API key:" });
       trimmedKey = apiKey.trim();
@@ -1231,9 +1235,14 @@ var main = async () => {
     }
     console.log();
   } else if (!canRunBrowserLogin()) {
-    console.log(`  ${yellow("!")} No API key, and no terminal to sign in from.`);
-    console.log(`  ${dim("Pass --key <pk_xxx.xxx>, or --key-stdin, or export PUSHARY_API_KEY.")}`);
-    console.log(`  ${dim("On a machine with a terminal, run")} ${cyan("pushary login")} ${dim("once and re-run this.")}`);
+    if (pairingRequested) {
+      console.log(`  ${yellow("!")} ${cyan("--connect app")} needs a terminal to show the pairing QR in.`);
+      console.log(`  ${dim("Drop the flag to use the key this machine already has, or pass --key <pk_xxx.xxx>.")}`);
+    } else {
+      console.log(`  ${yellow("!")} No API key, and no terminal to sign in from.`);
+      console.log(`  ${dim("Pass --key <pk_xxx.xxx>, or --key-stdin, or export PUSHARY_API_KEY.")}`);
+      console.log(`  ${dim("On a machine with a terminal, run")} ${cyan("pushary login")} ${dim("once and re-run this.")}`);
+    }
     console.log();
     process.exit(await abortWith("no-key", EXIT.NOT_CONFIGURED));
   } else {
@@ -1287,6 +1296,11 @@ var main = async () => {
   markStep("save-key");
   const rc = await saveApiKey(trimmedKey);
   const context = { rc };
+  if (envKey && envKey !== trimmedKey) {
+    noteManual(
+      `This shell still exports the previous key (${keyPrefix(envKey)}), and it wins over the one just saved. Open a new terminal before starting an agent here, or re-export PUSHARY_API_KEY.`
+    );
+  }
   const failed = [];
   const completed = [];
   const skipped = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.64.2",
+  "version": "0.64.4",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",