@pushary/agent-hooks 0.88.1 → 0.89.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 0.89.0
+
+### Hermes approvals go to the phone, and setup wires it
+
+`setup --agents hermes` now selects Pushary as the Hermes approval transport,
+with `transport_fallback: builtin`. Hermes owns the timeout (300s) and the
+once/session/always/deny choices, and persists the last two, so a repeated
+approval can become a standing rule instead of being asked forever. The
+fallback is what makes selecting it safe: a missing key, an unreachable
+Pushary, or no connected device falls back to the terminal prompt rather than
+blocking work.
+
+The note explaining why setup writes `~/.hermes/config.yaml` directly rather
+than running `hermes plugins enable` was half wrong. Current Hermes does
+resolve pip-installed plugins in both `list` and `enable`; the reason to write
+the file is the rule against executing an agent's binary, and nothing else.
+
+### `pushary upgrade` named a package that does not exist
+
+It printed `pip install --upgrade pushary-hermes`. That package is not on PyPI.
+The real one is `hermes-plugin-pushary`, and the upgrade path for it is setup,
+which installs into the interpreter Hermes actually runs in. Now points there,
+like every other agent in that list.
+
 ## 0.88.1
 
 ### One install, whichever surface writes it

package/dist/bin/pushary-setup.js

@@ -807,7 +807,7 @@ var ensurePip = (python) => {
   }
 };
 var enablePusharyPlugin = (python) => {
-  const snippet = 'from hermes_cli.config import load_config, save_config; c = load_config(); p = c.get("plugins") if isinstance(c.get("plugins"), dict) else {}; e = p.get("enabled") if isinstance(p.get("enabled"), list) else []; p["enabled"] = (e + ["pushary"]) if "pushary" not in e else e; c["plugins"] = p; a = c.get("agent") if isinstance(c.get("agent"), dict) else {}; d = a.get("disabled_toolsets") if isinstance(a.get("disabled_toolsets"), list) else []; a["disabled_toolsets"] = (d + ["clarify"]) if "clarify" not in d else d; c["agent"] = a; save_config(c)';
+  const snippet = 'from hermes_cli.config import load_config, save_config; c = load_config(); s = c.get("security") if isinstance(c.get("security"), dict) else {}; ap = s.get("approval") if isinstance(s.get("approval"), dict) else {}; ap["transport"] = "pushary"; ap["transport_fallback"] = "builtin"; s["approval"] = ap; c["security"] = s; p = c.get("plugins") if isinstance(c.get("plugins"), dict) else {}; e = p.get("enabled") if isinstance(p.get("enabled"), list) else []; p["enabled"] = (e + ["pushary"]) if "pushary" not in e else e; c["plugins"] = p; a = c.get("agent") if isinstance(c.get("agent"), dict) else {}; d = a.get("disabled_toolsets") if isinstance(a.get("disabled_toolsets"), list) else []; a["disabled_toolsets"] = (d + ["clarify"]) if "clarify" not in d else d; c["agent"] = a; save_config(c)';
   const scriptPath = join3(tmpdir(), `pushary-hermes-${process.pid}.py`);
   try {
     writeFileSync(scriptPath, snippet.split("; ").join("\n"), "utf-8");
@@ -847,15 +847,17 @@ var setupHermes = async (_apiKey) => {
   });
   if (!pluginEnabled) {
     console.log(`  ${yellow("!")} Installed the plugin, but could not edit Hermes' config.`);
-    noteManual('Add "pushary" to plugins.enabled in ~/.hermes/config.yaml, and "clarify" to agent.disabled_toolsets');
+    noteManual('Add "pushary" to plugins.enabled and set security.approval.transport to "pushary" (with transport_fallback "builtin") in ~/.hermes/config.yaml, plus "clarify" in agent.disabled_toolsets');
   }
   console.log();
   console.log(`  ${dim("What this configured:")}`);
-  console.log(`  ${dim("\u2022")} Native tools: pushary_notify, pushary_ask, pushary_wait, pushary_cancel`);
+  console.log(`  ${dim("\u2022")} Native tools: pushary_notify, pushary_ask, pushary_wait, pushary_cancel, pushary_propose_scope`);
+  console.log(`  ${dim("\u2022")} Approvals: Hermes' dangerous-command prompts go to your phone with allow once / this session / always / deny`);
+  console.log(`  ${dim("\u2022")} Falls back to the terminal prompt when no device is connected, so work never blocks on us`);
   console.log(`  ${dim("\u2022")} Questions go to your phone: Hermes' terminal ${bold("clarify")} tool is disabled, so pushary_ask handles every question`);
   console.log(`  ${dim("\u2022")} Auto-notifications: push alert when tools return errors`);
-  console.log(`  ${dim("\u2022")} Permission gating: set ${bold("PUSHARY_GATE_TOOLS")} to require lock-screen approval for risky tools`);
-  console.log(`  ${dim("To re-enable terminal prompts:")} remove ${bold("clarify")} from ${dim("agent.disabled_toolsets")} in ~/.hermes/config.yaml`);
+  console.log(`  ${dim("To send approvals back to the terminal:")} remove ${bold("security.approval.transport")} from ~/.hermes/config.yaml`);
+  console.log(`  ${dim("To re-enable terminal questions:")} remove ${bold("clarify")} from ${dim("agent.disabled_toolsets")}`);
 };
 var CODEX_HOOKS_JSON = join3(CODEX_HOME, "hooks.json");
 var CODEX_HOOKS_MIN_VERSION = [0, 122, 0];

package/dist/bin/pushary-upgrade.js

@@ -238,7 +238,7 @@ var detectInstallModes = () => {
     },
     {
       label: "Hermes plugin (pip)",
-      upgrade: "pip install --upgrade pushary-hermes",
+      upgrade: "npx @pushary/agent-hooks@latest setup --agents hermes",
       present: existsSync2(join2(homedir2(), ".hermes"))
     }
   ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.88.1",
+  "version": "0.89.0",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",