@pushary/agent-hooks 0.80.1 → 0.82.0

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## 0.82.0
+
+### Setup reads properly when an agent is the one running it
+
+An agent that runs `setup` relays its output to you, and two things in
+that output were written for a terminal that was not there.
+
+Colour was unconditional. Piped into an agent's transcript, ten raw
+escape sequences arrived as literal text around the parts you needed to
+read. Colour now follows the same rule the rest of the CLI already used,
+so it is on at a terminal and off everywhere else.
+
+The app download was unreachable until you gave up. "No app?" was
+answered with the command for approving in a browser, which sends you
+away from the phone at the moment you were being asked to install it,
+and the download link appeared only after the fifteen minute wait
+expired. The header now names https://pushary.com/download first and
+says the wait continues while you install.
+
+### The pairing QR is smaller
+
+The QR encodes a link, and the link's length decides the QR's size. It
+carried the pairing id and the public key, 114 characters, which drew 22
+rows of blocks. Against a server that offers one, the CLI now uses a
+short link instead: 33 characters, 16 rows, and small enough to survive
+being relayed through something that truncates.
+
+Nothing depends on it. Against an older server, or if the short link
+cannot be issued, setup uses the long one exactly as before, and the
+`pushary://` link is never shortened at all.
+
+
+## 0.81.0
+
+### The idle ping now honours a Terminal mode set in the dashboard
+
+"Your agent is waiting" pushes checked your delivery mode by reading the
+temporary override only. Choosing Terminal in the dashboard or the app
+does not write an override, it writes a standing rule, so the check never
+fired and the ping buzzed a phone whose owner had asked not to be reached.
+
+The ping now declares itself a task update, which puts it behind the same
+server-side gate as everything else the agent sends unprompted. That gate
+sees the standing rule, the kill switch and a mute. It also means your
+updates dial governs idle pings: set updates to Off and they stop.
+
 ## 0.80.1
 
 ### The bell's heartbeat directory is private to you now

package/data/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: pushary
-version: 0.9.0
-description: Push notifications and human-in-the-loop for AI agents. Use this whenever a running agent needs a human and nobody is at the terminal: before an irreversible or destructive action, before spending money, deploying, force-pushing or deleting, when blocked on a decision outside your authority, when running unattended and you hit a genuine ambiguity, when another skill's workflow says to confirm with the user, and when a long task finishes or fails with nobody watching. Also use it when the user says things like keep going and ping me on my phone if you need anything, notify me when my agent needs me, approve from my phone, ask me questions while I am away from the terminal, run this overnight, keep working while I am in a meeting, I am stepping away, do not wait for me, or wants a long task to run unattended. Send alerts when tasks finish or fail, ask questions (yes/no, multiple choice, or free text) via push, and get answers from the user's lock screen. Use these tools proactively - do not wait for the user to ask for notifications. Every question and answer is recorded, so an unattended run stays reviewable afterwards. Works with Claude Code, Codex, Cursor, VS Code, Windsurf, Hermes, Lovable, or any MCP client; no Claude Max subscription required. Pushary is a hosted service, $9.99/mo after a 3-day card-first trial.
+version: 0.9.2
+description: Push notifications and human-in-the-loop for AI agents. Use this whenever a running agent needs a human and nobody is at the terminal, such as before an irreversible or destructive action, before spending money, deploying, force-pushing or deleting, when blocked on a decision outside your authority, when running unattended and you hit a genuine ambiguity, when another skill's workflow says to confirm with the user, and when a long task finishes or fails with nobody watching. Also use it when the user says things like keep going and ping me on my phone if you need anything, notify me when my agent needs me, approve from my phone, ask me questions while I am away from the terminal, run this overnight, keep working while I am in a meeting, I am stepping away, do not wait for me, or wants a long task to run unattended. Send alerts when tasks finish or fail, ask questions (yes/no, multiple choice, or free text) via push, and get answers from the user's lock screen. Use these tools proactively - do not wait for the user to ask for notifications. Every question and answer is recorded, so an unattended run stays reviewable afterwards. Works with Claude Code, Codex, Cursor, VS Code, Windsurf, Hermes, Lovable, or any MCP client; no Claude Max subscription required. Pushary is a hosted service, $9.99/mo after a 3-day card-first trial.
 metadata:
   hermes:
     tags: [notifications, push, human-in-the-loop, alerts, permissions, mcp]
@@ -92,11 +92,20 @@ Just run it. No account, no API key, and nothing to paste first:
 npx @pushary/agent-hooks@latest setup
 ```
 
-It configures MCP, hooks, permissions and the skill in one step, then prints a QR code and waits.
+Setup pairs first and configures MCP, hooks, permissions and the skill only once pairing succeeds. Until someone completes the steps below, nothing is written and this machine has no Pushary. Treat pairing as the task, not as a prompt to wait out.
 
-**Show the user your output and ask them to scan that QR with their phone camera.** Scanning pairs their Pushary app, which is what hands this machine its key. A tappable link and a fingerprint print under the QR for a phone already in hand. Do not ask the user for an API key, and do not send them to a signup page first: that is the old flow and it is strictly worse.
+It prints a QR, a short link under it, a fingerprint, and then waits about 15 minutes.
 
-Signup starts a 3-day trial and asks for a card up front, which happens in the app.
+**Do not summarise that output. Show it, and walk the user through all four steps:**
+
+1. **Show them the QR and the short link.** Both point at the same pairing. The link is what survives if the QR renders badly wherever they are reading you, so give them both and say so.
+2. **They need the Pushary app.** It is the thing that receives approvals. If they do not have it: https://pushary.com/download. Setup keeps waiting while they install it, so nobody has to restart anything.
+3. **They scan the QR, or open the link on the phone.** The app shows a fingerprint. Tell them it must match the one in your output before they approve. On a first install the app will also ask them to sign in and start a plan: $9.99/mo after a 3-day trial, card up front, all inside the app. Say this before they scan rather than letting them discover it mid-flow.
+4. **They approve.** Setup finishes on its own, and from then on your `ask_user` and `send_notification` calls arrive on their lock screen with answer buttons.
+
+Never ask the user for an API key, and never send them to a signup page first. Both are the old flow and both are worse.
+
+If setup exits without pairing, nothing was configured. Say that plainly and offer the two fallbacks below rather than pretending the tools are available.
 
 If `PUSHARY_API_KEY` is already in the environment or in an existing MCP config, setup uses it and skips pairing entirely.
 

package/data/cursor-plugin/skills/pushary/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pushary
-description: Push notifications and human-in-the-loop for AI agents. Use this whenever a running agent needs a human and nobody is at the terminal: before an irreversible or destructive action, before spending money, deploying, force-pushing or deleting, when blocked on a decision outside your authority, when running unattended and you hit a genuine ambiguity, when another skill's workflow says to confirm with the user, and when a long task finishes or fails with nobody watching. Also use it when the user says things like keep going and ping me on my phone if you need anything, notify me when my agent needs me, approve from my phone, ask me questions while I am away from the terminal, run this overnight, keep working while I am in a meeting, I am stepping away, do not wait for me, or wants a long task to run unattended. Send alerts when tasks finish or fail, ask questions (yes/no, multiple choice, or free text) via push, and get answers from the user's lock screen. Use these tools proactively - do not wait for the user to ask for notifications. Every question and answer is recorded, so an unattended run stays reviewable afterwards. Works with Claude Code, Codex, Cursor, VS Code, Windsurf, Hermes, Lovable, or any MCP client; no Claude Max subscription required. Pushary is a hosted service, $9.99/mo after a 3-day card-first trial.
+description: Push notifications and human-in-the-loop for AI agents. Use this whenever a running agent needs a human and nobody is at the terminal, such as before an irreversible or destructive action, before spending money, deploying, force-pushing or deleting, when blocked on a decision outside your authority, when running unattended and you hit a genuine ambiguity, when another skill's workflow says to confirm with the user, and when a long task finishes or fails with nobody watching. Also use it when the user says things like keep going and ping me on my phone if you need anything, notify me when my agent needs me, approve from my phone, ask me questions while I am away from the terminal, run this overnight, keep working while I am in a meeting, I am stepping away, do not wait for me, or wants a long task to run unattended. Send alerts when tasks finish or fail, ask questions (yes/no, multiple choice, or free text) via push, and get answers from the user's lock screen. Use these tools proactively - do not wait for the user to ask for notifications. Every question and answer is recorded, so an unattended run stays reviewable afterwards. Works with Claude Code, Codex, Cursor, VS Code, Windsurf, Hermes, Lovable, or any MCP client; no Claude Max subscription required. Pushary is a hosted service, $9.99/mo after a 3-day card-first trial.
 ---
 
 # Pushary - Push Notifications for AI Agents
@@ -85,11 +85,20 @@ Just run it. No account, no API key, and nothing to paste first:
 npx @pushary/agent-hooks@latest setup
 ```
 
-It configures MCP, hooks, permissions and the skill in one step, then prints a QR code and waits.
+Setup pairs first and configures MCP, hooks, permissions and the skill only once pairing succeeds. Until someone completes the steps below, nothing is written and this machine has no Pushary. Treat pairing as the task, not as a prompt to wait out.
 
-**Show the user your output and ask them to scan that QR with their phone camera.** Scanning pairs their Pushary app, which is what hands this machine its key. A tappable link and a fingerprint print under the QR for a phone already in hand. Do not ask the user for an API key, and do not send them to a signup page first: that is the old flow and it is strictly worse.
+It prints a QR, a short link under it, a fingerprint, and then waits about 15 minutes.
 
-Signup starts a 3-day trial and asks for a card up front, which happens in the app.
+**Do not summarise that output. Show it, and walk the user through all four steps:**
+
+1. **Show them the QR and the short link.** Both point at the same pairing. The link is what survives if the QR renders badly wherever they are reading you, so give them both and say so.
+2. **They need the Pushary app.** It is the thing that receives approvals. If they do not have it: https://pushary.com/download. Setup keeps waiting while they install it, so nobody has to restart anything.
+3. **They scan the QR, or open the link on the phone.** The app shows a fingerprint. Tell them it must match the one in your output before they approve. On a first install the app will also ask them to sign in and start a plan: $9.99/mo after a 3-day trial, card up front, all inside the app. Say this before they scan rather than letting them discover it mid-flow.
+4. **They approve.** Setup finishes on its own, and from then on your `ask_user` and `send_notification` calls arrive on their lock screen with answer buttons.
+
+Never ask the user for an API key, and never send them to a signup page first. Both are the old flow and both are worse.
+
+If setup exits without pairing, nothing was configured. Say that plainly and offer the two fallbacks below rather than pretending the tools are available.
 
 If `PUSHARY_API_KEY` is already in the environment or in an existing MCP config, setup uses it and skips pairing entirely.
 

package/data/vscode-plugin/skills/pushary/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pushary
-description: Push notifications and human-in-the-loop for AI agents. Use this whenever a running agent needs a human and nobody is at the terminal: before an irreversible or destructive action, before spending money, deploying, force-pushing or deleting, when blocked on a decision outside your authority, when running unattended and you hit a genuine ambiguity, when another skill's workflow says to confirm with the user, and when a long task finishes or fails with nobody watching. Also use it when the user says things like keep going and ping me on my phone if you need anything, notify me when my agent needs me, approve from my phone, ask me questions while I am away from the terminal, run this overnight, keep working while I am in a meeting, I am stepping away, do not wait for me, or wants a long task to run unattended. Send alerts when tasks finish or fail, ask questions (yes/no, multiple choice, or free text) via push, and get answers from the user's lock screen. Use these tools proactively - do not wait for the user to ask for notifications. Every question and answer is recorded, so an unattended run stays reviewable afterwards. Works with Claude Code, Codex, Cursor, VS Code, Windsurf, Hermes, Lovable, or any MCP client; no Claude Max subscription required. Pushary is a hosted service, $9.99/mo after a 3-day card-first trial.
+description: Push notifications and human-in-the-loop for AI agents. Use this whenever a running agent needs a human and nobody is at the terminal, such as before an irreversible or destructive action, before spending money, deploying, force-pushing or deleting, when blocked on a decision outside your authority, when running unattended and you hit a genuine ambiguity, when another skill's workflow says to confirm with the user, and when a long task finishes or fails with nobody watching. Also use it when the user says things like keep going and ping me on my phone if you need anything, notify me when my agent needs me, approve from my phone, ask me questions while I am away from the terminal, run this overnight, keep working while I am in a meeting, I am stepping away, do not wait for me, or wants a long task to run unattended. Send alerts when tasks finish or fail, ask questions (yes/no, multiple choice, or free text) via push, and get answers from the user's lock screen. Use these tools proactively - do not wait for the user to ask for notifications. Every question and answer is recorded, so an unattended run stays reviewable afterwards. Works with Claude Code, Codex, Cursor, VS Code, Windsurf, Hermes, Lovable, or any MCP client; no Claude Max subscription required. Pushary is a hosted service, $9.99/mo after a 3-day card-first trial.
 ---
 
 # Pushary - Push Notifications for AI Agents
@@ -85,11 +85,20 @@ Just run it. No account, no API key, and nothing to paste first:
 npx @pushary/agent-hooks@latest setup
 ```
 
-It configures MCP, hooks, permissions and the skill in one step, then prints a QR code and waits.
+Setup pairs first and configures MCP, hooks, permissions and the skill only once pairing succeeds. Until someone completes the steps below, nothing is written and this machine has no Pushary. Treat pairing as the task, not as a prompt to wait out.
 
-**Show the user your output and ask them to scan that QR with their phone camera.** Scanning pairs their Pushary app, which is what hands this machine its key. A tappable link and a fingerprint print under the QR for a phone already in hand. Do not ask the user for an API key, and do not send them to a signup page first: that is the old flow and it is strictly worse.
+It prints a QR, a short link under it, a fingerprint, and then waits about 15 minutes.
 
-Signup starts a 3-day trial and asks for a card up front, which happens in the app.
+**Do not summarise that output. Show it, and walk the user through all four steps:**
+
+1. **Show them the QR and the short link.** Both point at the same pairing. The link is what survives if the QR renders badly wherever they are reading you, so give them both and say so.
+2. **They need the Pushary app.** It is the thing that receives approvals. If they do not have it: https://pushary.com/download. Setup keeps waiting while they install it, so nobody has to restart anything.
+3. **They scan the QR, or open the link on the phone.** The app shows a fingerprint. Tell them it must match the one in your output before they approve. On a first install the app will also ask them to sign in and start a plan: $9.99/mo after a 3-day trial, card up front, all inside the app. Say this before they scan rather than letting them discover it mid-flow.
+4. **They approve.** Setup finishes on its own, and from then on your `ask_user` and `send_notification` calls arrive on their lock screen with answer buttons.
+
+Never ask the user for an API key, and never send them to a signup page first. Both are the old flow and both are worse.
+
+If setup exits without pairing, nothing was configured. Say that plainly and offer the two fallbacks below rather than pretending the tools are available.
 
 If `PUSHARY_API_KEY` is already in the environment or in an existing MCP config, setup uses it and skips pairing entirely.
 

package/dist/bin/pushary-bell.js

@@ -11,7 +11,7 @@ import {
 } from "../chunk-Q4QULGAV.js";
 import {
   createIo
-} from "../chunk-TX7KBKT7.js";
+} from "../chunk-5RUIFDTP.js";
 import "../chunk-E6I3DBJW.js";
 import {
   readJsonSafe,

package/dist/bin/pushary-claude.js

@@ -3,7 +3,7 @@ import {
   KILL_REASON,
   isDeferAnswer,
   resolveGate
-} from "../chunk-A5DAEWBZ.js";
+} from "../chunk-PVSCRRPA.js";
 import {
   askUser,
   cancelQuestion,
@@ -15,7 +15,7 @@ import {
   reportEvent,
   scopePathFor,
   waitForAnswer
-} from "../chunk-DUYM5SHH.js";
+} from "../chunk-FVVJ3FOW.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-PPD3HHNJ.js";

package/dist/bin/pushary-codex-hook.js

@@ -8,7 +8,7 @@ import {
   denyReasonFrom,
   isDeferAnswer,
   resolveGate
-} from "../chunk-A5DAEWBZ.js";
+} from "../chunk-PVSCRRPA.js";
 import {
   CODEX_AGENT,
   DEFAULT_SESSION,
@@ -39,7 +39,7 @@ import {
   toPolicyLookup,
   toPolicyLookups,
   waitForAnswer
-} from "../chunk-DUYM5SHH.js";
+} from "../chunk-FVVJ3FOW.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-PPD3HHNJ.js";

package/dist/bin/pushary-codex.js

@@ -3,7 +3,7 @@ import {
   askUser,
   reportEvent,
   waitForAnswer
-} from "../chunk-DUYM5SHH.js";
+} from "../chunk-FVVJ3FOW.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-PPD3HHNJ.js";

package/dist/bin/pushary-connect.js

@@ -3,17 +3,17 @@ import {
   confirmAppConnection,
   connectDevice,
   printConnectInstructions
-} from "../chunk-BOMF4C2Q.js";
+} from "../chunk-DFTD6W5B.js";
 import "../chunk-3EGEA4KH.js";
 import {
   printKeyCheck
-} from "../chunk-U2PZKYZM.js";
+} from "../chunk-MWZZ5G7B.js";
 import {
   checkApiKey
 } from "../chunk-EBP4YG75.js";
 import {
   createIo
-} from "../chunk-TX7KBKT7.js";
+} from "../chunk-5RUIFDTP.js";
 import {
   readKeySource
 } from "../chunk-E6I3DBJW.js";

package/dist/bin/pushary-doctor.js

@@ -49,7 +49,7 @@ import {
   fetchChannels,
   reachVerdict,
   verifyRoundTrip
-} from "../chunk-BOMF4C2Q.js";
+} from "../chunk-DFTD6W5B.js";
 import "../chunk-3EGEA4KH.js";
 import {
   checkApiKey,
@@ -57,7 +57,7 @@ import {
 } from "../chunk-EBP4YG75.js";
 import {
   createIo
-} from "../chunk-TX7KBKT7.js";
+} from "../chunk-5RUIFDTP.js";
 import {
   keyPrefix,
   readKeySource

package/dist/bin/pushary-gemini-hook.js

@@ -8,7 +8,7 @@ import {
   denyReasonFrom,
   isDeferAnswer,
   resolveGate
-} from "../chunk-A5DAEWBZ.js";
+} from "../chunk-PVSCRRPA.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -30,7 +30,7 @@ import {
   scopePathFor,
   sendNotification,
   waitForAnswer
-} from "../chunk-DUYM5SHH.js";
+} from "../chunk-FVVJ3FOW.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-PPD3HHNJ.js";

package/dist/bin/pushary-hook.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   handlePreToolUse
-} from "../chunk-ULITFWLG.js";
+} from "../chunk-JU72KNUB.js";
 import "../chunk-R6AYBATA.js";
 import "../chunk-MHA2WB7S.js";
-import "../chunk-A5DAEWBZ.js";
-import "../chunk-DUYM5SHH.js";
+import "../chunk-PVSCRRPA.js";
+import "../chunk-FVVJ3FOW.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-PPD3HHNJ.js";

package/dist/bin/pushary-login.js

@@ -9,7 +9,7 @@ import {
 } from "../chunk-EBP4YG75.js";
 import {
   createIo
-} from "../chunk-TX7KBKT7.js";
+} from "../chunk-5RUIFDTP.js";
 import {
   readKeySource,
   writeKey

package/dist/bin/pushary-logout.js

@@ -7,7 +7,7 @@ import {
 } from "../chunk-Q4QULGAV.js";
 import {
   createIo
-} from "../chunk-TX7KBKT7.js";
+} from "../chunk-5RUIFDTP.js";
 import {
   clearKey,
   readKeySource

package/dist/bin/pushary-mode.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   exitOnFailedResponse
-} from "../chunk-U2PZKYZM.js";
+} from "../chunk-MWZZ5G7B.js";
 import "../chunk-EBP4YG75.js";
 import {
   createIo
-} from "../chunk-TX7KBKT7.js";
+} from "../chunk-5RUIFDTP.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";

package/dist/bin/pushary-notification-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handleNotification
-} from "../chunk-DUYM5SHH.js";
+} from "../chunk-FVVJ3FOW.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-PPD3HHNJ.js";

package/dist/bin/pushary-permission-denied-hook.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   handlePermissionDenied
-} from "../chunk-ULITFWLG.js";
+} from "../chunk-JU72KNUB.js";
 import "../chunk-R6AYBATA.js";
 import "../chunk-MHA2WB7S.js";
-import "../chunk-A5DAEWBZ.js";
-import "../chunk-DUYM5SHH.js";
+import "../chunk-PVSCRRPA.js";
+import "../chunk-FVVJ3FOW.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-PPD3HHNJ.js";

package/dist/bin/pushary-permission-hook.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   handlePermissionRequest
-} from "../chunk-ULITFWLG.js";
+} from "../chunk-JU72KNUB.js";
 import "../chunk-R6AYBATA.js";
 import "../chunk-MHA2WB7S.js";
-import "../chunk-A5DAEWBZ.js";
-import "../chunk-DUYM5SHH.js";
+import "../chunk-PVSCRRPA.js";
+import "../chunk-FVVJ3FOW.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-PPD3HHNJ.js";

package/dist/bin/pushary-post-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handlePostToolUse
-} from "../chunk-DUYM5SHH.js";
+} from "../chunk-FVVJ3FOW.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-PPD3HHNJ.js";

package/dist/bin/pushary-prompt-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handleUserPrompt
-} from "../chunk-DUYM5SHH.js";
+} from "../chunk-FVVJ3FOW.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-PPD3HHNJ.js";

package/dist/bin/pushary-session-end-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handleSessionEnd
-} from "../chunk-DUYM5SHH.js";
+} from "../chunk-FVVJ3FOW.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-PPD3HHNJ.js";

package/dist/bin/pushary-session-start-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handleSessionStart
-} from "../chunk-DUYM5SHH.js";
+} from "../chunk-FVVJ3FOW.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-PPD3HHNJ.js";

package/dist/bin/pushary-setup.js

@@ -49,7 +49,7 @@ import {
 } from "../chunk-Q4QULGAV.js";
 import {
   reportEvent
-} from "../chunk-DUYM5SHH.js";
+} from "../chunk-FVVJ3FOW.js";
 import {
   confirmAppConnection,
   connectDevice,
@@ -58,12 +58,15 @@ import {
   printConnectInstructions,
   setHumanStream,
   verifyRoundTrip
-} from "../chunk-BOMF4C2Q.js";
+} from "../chunk-DFTD6W5B.js";
 import "../chunk-3EGEA4KH.js";
 import {
   checkApiKey,
   describeKeyCheck
 } from "../chunk-EBP4YG75.js";
+import {
+  useColor
+} from "../chunk-5RUIFDTP.js";
 import {
   KEY_FILE_MODE,
   exportLine,
@@ -526,11 +529,12 @@ var writeHuman = (text) => {
   humanStream.write(text);
 };
 var jsonMode = false;
-var dim = (s) => `\x1B[2m${s}\x1B[0m`;
-var bold = (s) => `\x1B[1m${s}\x1B[0m`;
-var green = (s) => `\x1B[32m${s}\x1B[0m`;
-var cyan = (s) => `\x1B[36m${s}\x1B[0m`;
-var yellow = (s) => `\x1B[33m${s}\x1B[0m`;
+var paint = (open) => (s) => useColor({ json: jsonMode }) ? `${open}${s}\x1B[0m` : s;
+var dim = paint("\x1B[2m");
+var bold = paint("\x1B[1m");
+var green = paint("\x1B[32m");
+var cyan = paint("\x1B[36m");
+var yellow = paint("\x1B[33m");
 var check = green("\u2713");
 var abortWith = async (reason, code, keyCheck) => {
   await reportSetupAbort(reason, code, keyCheck);
@@ -1627,7 +1631,8 @@ var main = async () => {
     process.exit(EXIT.OK);
   } else if (connectMode === "app" && canShowPairingQr() && !options.skipPhone) {
     console.log(`  ${dim("Pairing with your Pushary app.")}`);
-    console.log(`  ${dim("No app? Ctrl-C, then:")} ${cyan("npx @pushary/agent-hooks setup --connect browser")}`);
+    console.log(`  ${dim("No app yet? Get it at")} ${cyan("https://pushary.com/download")}${dim(", this keeps waiting.")}`);
+    console.log(`  ${dim("No phone? Ctrl-C, then:")} ${cyan("npx @pushary/agent-hooks setup --connect browser")}`);
     markStep("pair");
     const previous = readKeySource();
     const paired = await connectViaAppPairing({

package/dist/bin/pushary-status.js

@@ -3,7 +3,7 @@ import {
   describeReach,
   fetchChannels,
   reachVerdict
-} from "../chunk-BOMF4C2Q.js";
+} from "../chunk-DFTD6W5B.js";
 import "../chunk-3EGEA4KH.js";
 import {
   checkApiKey,
@@ -11,7 +11,7 @@ import {
 } from "../chunk-EBP4YG75.js";
 import {
   createIo
-} from "../chunk-TX7KBKT7.js";
+} from "../chunk-5RUIFDTP.js";
 import {
   readKeySource
 } from "../chunk-E6I3DBJW.js";

package/dist/bin/pushary-stop-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handleStop
-} from "../chunk-DUYM5SHH.js";
+} from "../chunk-FVVJ3FOW.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-PPD3HHNJ.js";

package/dist/bin/pushary-stopfailure-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handleStopFailure
-} from "../chunk-DUYM5SHH.js";
+} from "../chunk-FVVJ3FOW.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-PPD3HHNJ.js";

package/dist/bin/pushary-suggestions.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   createIo
-} from "../chunk-TX7KBKT7.js";
+} from "../chunk-5RUIFDTP.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";

package/dist/bin/pushary-wait.js

@@ -4,11 +4,11 @@ import {
 } from "../chunk-IIENZE2J.js";
 import {
   exitOnFailedResponse
-} from "../chunk-U2PZKYZM.js";
+} from "../chunk-MWZZ5G7B.js";
 import "../chunk-EBP4YG75.js";
 import {
   createIo
-} from "../chunk-TX7KBKT7.js";
+} from "../chunk-5RUIFDTP.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";

package/dist/{chunk-TX7KBKT7.js → chunk-5RUIFDTP.js}

@@ -75,5 +75,6 @@ var createIo = (stream = process.stdout, context = {}) => {
 };
 
 export {
+  useColor,
   createIo
 };

package/dist/{chunk-BOMF4C2Q.js → chunk-DFTD6W5B.js}

@@ -3,6 +3,9 @@ import {
   openSealedKey,
   publicKeyFingerprint
 } from "./chunk-3EGEA4KH.js";
+import {
+  useColor
+} from "./chunk-5RUIFDTP.js";
 import {
   callMcpTool
 } from "./chunk-BSZYIAZL.js";
@@ -263,11 +266,12 @@ var humanIsTty = () => stream === process.stdout && process.stdout.isTTY === tru
 
 // src/onboarding.ts
 import qrcodeTerminal from "qrcode-terminal";
-var dim = (s) => `\x1B[2m${s}\x1B[0m`;
-var bold = (s) => `\x1B[1m${s}\x1B[0m`;
-var green = (s) => `\x1B[32m${s}\x1B[0m`;
-var cyan = (s) => `\x1B[36m${s}\x1B[0m`;
-var yellow = (s) => `\x1B[33m${s}\x1B[0m`;
+var paint = (open) => (s) => useColor() ? `${open}${s}\x1B[0m` : s;
+var dim = paint("\x1B[2m");
+var bold = paint("\x1B[1m");
+var green = paint("\x1B[32m");
+var cyan = paint("\x1B[36m");
+var yellow = paint("\x1B[33m");
 var check = green("\u2713");
 var apiBase = () => process.env.PUSHARY_API_URL?.trim() || process.env.PUSHARY_BASE_URL?.trim() || "https://pushary.com";
 var EXIT_ABORTED = 130;
@@ -631,7 +635,8 @@ var startPairing = async (cliPublicKey) => {
     });
     if (!res.ok) return null;
     const data = await res.json().catch(() => null);
-    return data && typeof data.pairId === "string" ? data.pairId : null;
+    if (!data || typeof data.pairId !== "string") return null;
+    return { pairId: data.pairId, code: typeof data.code === "string" ? data.code : null };
   } catch {
     return null;
   }
@@ -682,22 +687,28 @@ var ackPairing = async (pairId) => {
   } catch {
   }
 };
-var buildPairLinks = (pairId, publicKeyB64, baseUrl = apiBase()) => {
+var buildPairLinks = (pairId, publicKeyB64, baseUrl = apiBase(), code = null) => {
   const id = encodeURIComponent(pairId);
   const pk = encodeURIComponent(publicKeyB64);
+  const origin = baseUrl.replace(/\/+$/, "");
   return {
-    universalLink: `${baseUrl.replace(/\/+$/, "")}/pair?id=${id}&pk=${pk}`,
+    // 33 characters against 114, so 16 rows of QR against 22. Without a code this
+    // is the exact URL every published CLI already encodes.
+    universalLink: code ? `${origin}/pair/${encodeURIComponent(code)}` : `${origin}/pair?id=${id}&pk=${pk}`,
+    // Never shortened: the scheme reaches an installed app with no server round
+    // trip, which is the path that has to survive the short code failing.
     deepLink: `pushary://pair?pk=${pk}&id=${id}`
   };
 };
 var connectViaAppPairing = async (options = {}) => {
   const keypair = generateKeypair();
-  const pairId = await startPairing(keypair.publicKeyB64);
-  if (!pairId) {
+  const started = await startPairing(keypair.publicKeyB64);
+  if (!started) {
     console.log(`  ${yellow("!")} Couldn't start pairing. Check your connection and try again.`);
     return null;
   }
-  const { universalLink, deepLink } = buildPairLinks(pairId, keypair.publicKeyB64);
+  const { pairId, code } = started;
+  const { universalLink, deepLink } = buildPairLinks(pairId, keypair.publicKeyB64, apiBase(), code);
   console.log();
   console.log(`  ${bold("Connect your Pushary app")}`);
   console.log(`  ${dim("Scan this with your phone camera:")}`);

package/dist/{chunk-DUYM5SHH.js → chunk-FVVJ3FOW.js}

@@ -1264,7 +1264,10 @@ var handleNotification = async (input, agent = CLAUDE_CODE_AGENT) => {
         title: `${agent.label} is waiting`,
         body: (input.message ?? "Your agent is waiting for you.").slice(0, 200),
         agentName: `${agent.label} - ${projectName}`,
-        sessionId: input.session_id
+        sessionId: input.session_id,
+        // Makes this an `update` server-side, so resolveSiteMode gates it on
+        // the wildcard policy too. `info` because nothing finished.
+        context: { type: "info" }
       }, 4e3).catch(() => {
       });
       return;

package/dist/{chunk-ULITFWLG.js → chunk-JU72KNUB.js}

@@ -9,7 +9,7 @@ import {
   denyReasonFrom,
   isDeferAnswer,
   resolveGate
-} from "./chunk-A5DAEWBZ.js";
+} from "./chunk-PVSCRRPA.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -29,7 +29,7 @@ import {
   sendNotification,
   throttlePass,
   waitForAnswer
-} from "./chunk-DUYM5SHH.js";
+} from "./chunk-FVVJ3FOW.js";
 import {
   buildDecisionEpisodeFeatures,
   effectiveWaitSeconds,

package/dist/{chunk-U2PZKYZM.js → chunk-MWZZ5G7B.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-EBP4YG75.js";
 import {
   createIo
-} from "./chunk-TX7KBKT7.js";
+} from "./chunk-5RUIFDTP.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";

package/dist/{chunk-A5DAEWBZ.js → chunk-PVSCRRPA.js}

@@ -4,7 +4,7 @@ import {
   isModeStateDegraded,
   resolveAutoResolveOrigin,
   resolvePolicyAcross
-} from "./chunk-DUYM5SHH.js";
+} from "./chunk-FVVJ3FOW.js";
 import {
   evaluateScope,
   scopeChangeReason,

package/dist/src/index.js

@@ -1,9 +1,9 @@
 import {
   handlePreToolUse
-} from "../chunk-ULITFWLG.js";
+} from "../chunk-JU72KNUB.js";
 import "../chunk-R6AYBATA.js";
 import "../chunk-MHA2WB7S.js";
-import "../chunk-A5DAEWBZ.js";
+import "../chunk-PVSCRRPA.js";
 import {
   askUser,
   cancelQuestion,
@@ -16,7 +16,7 @@ import {
   reportEvent,
   resolvePolicy,
   waitForAnswer
-} from "../chunk-DUYM5SHH.js";
+} from "../chunk-FVVJ3FOW.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-PPD3HHNJ.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.80.1",
+  "version": "0.82.0",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",