@pushary/agent-hooks 0.64.4 → 0.66.0

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## 0.66.0
+
+### Setup waited three minutes for a step that takes longer than three minutes
+
+If you already had the app installed and signed in, pairing resolved in seconds
+and this never came up. If you did not, it could not work at all.
+
+Scanning the QR without the app opens a page that sends you to the store. Install
+it, sign in, subscribe, come back, scan: that is never three minutes. The CLI had
+given up and cancelled the pairing long before, so a first-time user's first scan
+was guaranteed to fail, and the only route through was to notice the terminal had
+stopped waiting and run setup again.
+
+Setup now waits as long as the code is actually valid, and after the first
+45 seconds the spinner says what to do if the app is not installed yet. Ctrl-C
+still exits cleanly and cancels the pairing, so nothing holds you there.
+
+The window itself is unchanged in what protects it: a pairing id is 128 bits,
+single use, deleted the moment it is claimed, and authorising one requires a
+signed-in session for the owning account and the public key you physically
+scanned.
+
+## 0.65.0
+
+### The pairing QR now works when you scan it with your phone camera
+
+It did not. Scanning it opened the app on "Unmatched Route", and the only way
+through was the in-app scanner, which parses the QR itself and never routes.
+
+The QR encoded `https://pushary.com/app/pair`, and `/app/*` is claimed by the
+app: the AASA lists it and so does the Android manifest. The OS therefore handed
+the link to the app before the page could load, which was the intent. What it
+handed over was the path `/app/pair`, and the app's pairing screen is `/pair`.
+Nothing matched, on every build ever shipped.
+
+The QR points at `/pair` now. Nothing claims it, so the browser always opens it,
+and the page hands off to `pushary://pair`, which every shipped build already
+routes correctly. That is the whole reason for the move: the Android claim is
+compiled into the installed app, so no amount of server or app-store work fixes
+the phones already out there, and this does, today.
+
+`/app/pair` still serves the same page, so a link from an older CLI is not dead.
+
 ## 0.64.4
 
 ### The shell you ran setup in still exported the key it replaced

package/dist/bin/pushary-connect.js

@@ -6,7 +6,7 @@ import {
   confirmAppConnection,
   connectDevice,
   printConnectInstructions
-} from "../chunk-GFHQ26ST.js";
+} from "../chunk-QTC7SR6A.js";
 import "../chunk-3EGEA4KH.js";
 import {
   readKeySource

package/dist/bin/pushary-doctor.js

@@ -34,7 +34,7 @@ import {
   describeReach,
   fetchChannels,
   reachVerdict
-} from "../chunk-GFHQ26ST.js";
+} from "../chunk-QTC7SR6A.js";
 import "../chunk-3EGEA4KH.js";
 import {
   keyPrefix,

package/dist/bin/pushary-setup.js

@@ -45,7 +45,7 @@ import {
   connectViaAppPairing,
   printConnectInstructions,
   setHumanStream
-} from "../chunk-GFHQ26ST.js";
+} from "../chunk-QTC7SR6A.js";
 import "../chunk-3EGEA4KH.js";
 import {
   KEY_FILE_MODE,

package/dist/bin/pushary-status.js

@@ -7,7 +7,7 @@ import {
   describeReach,
   fetchChannels,
   reachVerdict
-} from "../chunk-GFHQ26ST.js";
+} from "../chunk-QTC7SR6A.js";
 import "../chunk-3EGEA4KH.js";
 import {
   readKeySource

package/dist/{chunk-GFHQ26ST.js → chunk-QTC7SR6A.js}

@@ -448,7 +448,8 @@ var printConnectInstructions = async (apiKey) => {
   return phoneFailure("no_device");
 };
 var PAIR_POLL_INTERVAL_MS = 2e3;
-var PAIR_TIMEOUT_MS = 18e4;
+var PAIR_TIMEOUT_MS = 9e5;
+var PAIR_HINT_AFTER_MS = 45e3;
 var startPairing = async (cliPublicKey) => {
   try {
     const res = await fetch(`${apiBase()}/api/mobile/pair/start`, {
@@ -490,7 +491,7 @@ var buildPairLinks = (pairId, publicKeyB64, baseUrl = apiBase()) => {
   const id = encodeURIComponent(pairId);
   const pk = encodeURIComponent(publicKeyB64);
   return {
-    universalLink: `${baseUrl.replace(/\/+$/, "")}/app/pair?id=${id}&pk=${pk}`,
+    universalLink: `${baseUrl.replace(/\/+$/, "")}/pair?id=${id}&pk=${pk}`,
     deepLink: `pushary://pair?pk=${pk}&id=${id}`
   };
 };
@@ -511,10 +512,14 @@ var connectViaAppPairing = async (options = {}) => {
   console.log(`  ${dim("Confirm the app shows fingerprint")} ${cyan(publicKeyFingerprint(keypair.publicKeyB64))}`);
   console.log(`  ${dim("Already have the app and it opened a browser? Use")} ${cyan(deepLink)}`);
   console.log();
-  const deadline = Date.now() + PAIR_TIMEOUT_MS;
+  const startedAt = Date.now();
+  const deadline = startedAt + PAIR_TIMEOUT_MS;
   const stop = startSpinner(() => {
-    const left = Math.max(0, Math.ceil((deadline - Date.now()) / 1e3));
-    return `Waiting for the app to authorize ${dim(`(${left}s)`)}`;
+    const left = Math.max(0, Math.ceil((deadline - Date.now()) / 6e4));
+    if (Date.now() - startedAt < PAIR_HINT_AFTER_MS) {
+      return "Waiting for the app to authorize";
+    }
+    return `Waiting for the app ${dim(`(${left}m left. No app yet? Install it, sign in with this account, then scan. Ctrl-C to stop)`)}`;
   });
   let cancelled = false;
   const onInterrupt = () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.64.4",
+  "version": "0.66.0",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",