@pushary/agent-hooks 0.74.0 → 0.76.0

package/CHANGELOG.md

@@ -1,5 +1,72 @@
 # Changelog
 
+## 0.76.0
+
+### A phone-supplied field could switch your approval gate off
+
+`pushary claude --remote` sessions started from the phone build their command
+line from fields the request supplies. The wrapper then read that command line
+back to learn what it had been asked to do, and it scanned every position without
+knowing which ones were a flag's **value** rather than a flag.
+
+So a prompt or a model of `--permission-mode=dontAsk` was read as a real
+permission mode. `dontAsk`, `plan` and `auto` all defer to the agent's own prompt
+unconditionally, which means the session stopped asking you for approvals
+entirely, and the decision log recorded a session that was never gated. A clean
+approval history that is not true is worse than a missing one.
+
+Flag values are now consumed with the flag that owns them, so nothing a request
+supplies can be mistaken for an instruction. A `--permission-mode` you passed
+yourself still works, in both the `--permission-mode plan` and
+`--permission-mode=plan` forms.
+
+The server that queues these sessions now also refuses flag-shaped model and
+working-directory values, so an out-of-date CLI is protected against those two.
+It cannot do the same for the prompt, which is free text you are entitled to
+start with a dash, so **updating is what closes this one properly.**
+
+Reaching it needed an authenticated session on your own account, spawning to your
+own machine, with the daemon running. It is not cross-tenant and not remote code
+execution. It matters most where the person spawning is not the person governed:
+Team approval routing, Partner, and any case where a phone session or API key has
+been compromised.
+
+## 0.75.0
+
+### An agent can now run the install
+
+Pasting "install pushary for me" into Claude Code, Codex or Cursor exited 3
+before doing anything:
+
+    ! No API key, and no terminal to sign in from.
+
+The agent runs setup with stdin and stdout piped, so `isTTY` is false, and app
+pairing sat behind the same check as browser login. That check was answering the
+wrong question. Pairing needs a person, not a terminal, and the agent shows its
+output to one, so a QR written to stdout is read just as well as a QR drawn on a
+terminal.
+
+Setup now pairs whenever it is not running in CI. It prints the QR, the tappable
+link and the fingerprint, and waits for the scan, so the whole install is one
+command with nothing to paste:
+
+    npx @pushary/agent-hooks@latest setup
+
+Browser login still requires a real terminal, because it opens a browser on the
+machine and waits for a redirect. CI still declines to pair, so no build hangs
+drawing a QR into a log nobody is watching.
+
+The bundled skill told agents to do the opposite: hand the user a signup link
+and wait for them to paste a key back. It now says to run setup and show the
+user the QR.
+
+The failure message above also had to change, because after this it was naming a
+cause that no longer applies. Reaching that branch now means CI, `--skip-phone`,
+or a connect mode other than `app`, so setup says which of those it hit instead
+of blaming a missing terminal. A headless run with no flags is the one worth
+calling out: it used to be told to drop into a browser login it cannot open.
+
+
 ## 0.74.0
 
 ### The terminal went quiet while your phone was deciding

package/data/SKILL.md

@@ -60,16 +60,24 @@ If the user runs Claude Code with a Claude Max subscription, Anthropic Remote Co
 
 ## Setup
 
-First check for an API key. Look for `PUSHARY_API_KEY` in the environment or an Authorization header in the existing MCP config. If there is no key, the user needs an account: give them this link, then pause until they finish signup from their phone and hand you the key:
+Just run it. No account, no API key, and nothing to paste first:
 
-https://pushary.com/sign-up?utm_source=skill&utm_medium=setup
+```bash
+npx @pushary/agent-hooks@latest setup
+```
+
+It configures MCP, hooks, permissions and the skill in one step, then prints a QR code and waits.
 
-Signup starts a 7-day trial and asks for a card up front. The key format is `pk_xxx.sk_xxx`.
+**Show the user your output and ask them to scan that QR with their phone camera.** Scanning pairs their Pushary app, which is what hands this machine its key. A tappable link and a fingerprint print under the QR for a phone already in hand. Do not ask the user for an API key, and do not send them to a signup page first: that is the old flow and it is strictly worse.
 
-Once the key exists, run the CLI setup (recommended - configures MCP, hooks, permissions, and skill in one step):
+Signup starts a 7-day trial and asks for a card up front, which happens in the app.
+
+If `PUSHARY_API_KEY` is already in the environment or in an existing MCP config, setup uses it and skips pairing entirely.
+
+No app on their phone yet? They can get it at https://pushary.com/download, or approve in a browser tab instead:
 
 ```bash
-npx @pushary/agent-hooks@latest setup
+npx @pushary/agent-hooks@latest setup --connect browser
 ```
 
 Or add Pushary manually to your MCP configuration:
@@ -88,7 +96,7 @@ Or add Pushary manually to your MCP configuration:
 }
 ```
 
-Sign up at https://pushary.com/sign-up?utm_source=skill&utm_medium=setup to get your API key.
+Manual configuration needs a key, so it means signing up first at https://pushary.com/sign-up?utm_source=skill&utm_medium=setup and copying the key from the dashboard. Prefer `setup` above: it needs neither.
 
 After setup, verify with:
 

package/data/cursor-plugin/CHANGELOG.md

@@ -1,10 +1,36 @@
 # Changelog
 
+## 0.1.1
+
+Policy parity with the other agents. The gate matched rules on tool NAME alone, so
+every argument rule was invisible here: a `Bash(rm:*)` deny you had written did
+nothing, and `rm -rf` was auto-approved by a broad `Bash` allow. Cursor was
+strictly less safe than Claude Code for the same dashboard policy.
+
+- Argument rules now match: `Bash(git status)` exact, `Bash(npm test:*)` prefix,
+  and path-style globs, with the same precedence the hook uses.
+- The destructive ceiling applies: a command the classifier flags can no longer
+  auto-approve through a general bare-tool or wildcard rule. An explicit rule you
+  wrote still wins.
+- Repo-scoped rules are honoured. Identity is the normalized git remote, read from
+  `.git/config` as a file; credentials are stripped. `PUSHARY_REPO_KEY` pins it,
+  `PUSHARY_REPO_KEY=off` disables scoping.
+- Approvals now carry the command target and body, so the server can drop the
+  one-tap Approve on a dangerous call and the audit trail records Cursor
+  decisions at the same grain as every other agent.
+- `scripts/pushary-gate.test.mjs` mirrors the monorepo's policy tests, since the
+  matcher is vendored and cannot be imported.
+
+Verified against the canonical matcher over 1512 resolutions: zero cases where
+the gate is less safe. The remaining differences are all the safe-read-only
+allowlist, which is deliberately not vendored because it only ever loosens a
+decision.
+
 ## 0.1.0
 
 Initial release.
 
-- MCP server (`send_notification`, `ask_user`, `wait_for_answer`, `cancel_question`) wired via `mcp.json`, key supplied at runtime through `PUSHARY_API_KEY`.
+- MCP server (`send_notification`, `ask_user`, `wait_for_answer`, `cancel_question`, `list_sessions`) wired via `mcp.json`, key supplied at runtime through `PUSHARY_API_KEY`.
 - Always-on rule and full tool-reference skill so the agent uses Pushary proactively.
 - `beforeShellExecution` gate (`scripts/pushary-gate.mjs`, zero-dependency) that evaluates risky commands against your Pushary dashboard policy — auto-approve, the four approval modes, timeout actions, live mode override, and kill switch, scoped to the Cursor conversation. Falls back to Cursor's own prompt when Pushary is unreachable, and is fail-closed: a broken gate blocks rather than allows.
 - Commands: `/pushary-test`, `/notify-when-done`.

package/data/cursor-plugin/CONTRIBUTING.md

@@ -0,0 +1,28 @@
+# Contributing
+
+Thanks for looking. Please read this before opening a pull request, because of
+where this code lives.
+
+**This repository is a published copy, not the place the code is written.** The
+source is a directory inside Pushary's private monorepo, and it is pushed here
+whenever it changes. Anything committed directly to this repo is overwritten by
+the next publish.
+
+That is not hypothetical. Two pull requests were merged here and then sat
+stranded for a month, because nothing carried them back upstream and the next
+publish would have deleted them.
+
+## So what should you do
+
+**Open an issue.** Bugs, missing behaviour, a patch you have already written and
+want applied: an issue is read and acted on, and the fix is made upstream and
+published here. Paste your diff into the issue if you have one, and it will be
+credited.
+
+**Security issues**: email aadil@pushary.com rather than opening an issue.
+
+## If you do open a pull request
+
+It will not be merged as a pull request, because merging it would guarantee it
+gets erased. It will be treated as a patch submission: applied upstream, and
+this repo updated on the next publish. You will be told when that has happened.

package/data/cursor-plugin/README.md

@@ -75,7 +75,7 @@ macOS GUI apps do not read `.zshrc`. If Settings > MCP shows pushary in red afte
 
 | Part | File | What it does |
 |------|------|--------------|
-| MCP server | `mcp.json` | Connects Cursor to the Pushary tools: `send_notification`, `ask_user`, `wait_for_answer`, `cancel_question` |
+| MCP server | `mcp.json` | Connects Cursor to the Pushary tools: `send_notification`, `ask_user`, `wait_for_answer`, `cancel_question`, `list_sessions` |
 | Rule | `rules/pushary.mdc` | Always on guidance so the agent uses Pushary on its own |
 | Skill | `skills/pushary/SKILL.md` | Full tool reference: parameters, examples, return values |
 | Hook | `hooks/hooks.json` and `scripts/pushary-gate.mjs` | Sends risky commands to your phone for approval |