@pushary/agent-hooks 0.89.11 → 0.89.13

package/dist/bin/pushary-transcripts.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/bin/pushary-transcripts.js

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+import {
+  clearPin,
+  fingerprint,
+  loadPin
+} from "../chunk-YKLCWWEI.js";
+import {
+  transcriptsEnabled
+} from "../chunk-M3UABYRT.js";
+import {
+  exitOnHelpFlag
+} from "../chunk-WHDSJ6PD.js";
+import "../chunk-GMJDQDXU.js";
+import "../chunk-DINDL2CF.js";
+import "../chunk-NBDU3R3G.js";
+import "../chunk-BC3VCZ3E.js";
+import "../chunk-KZERVKTD.js";
+import "../chunk-ANMHIZZY.js";
+import "../chunk-4LL6LG5X.js";
+import "../chunk-2UMNXADU.js";
+import "../chunk-QINYXLA5.js";
+
+// bin/pushary-transcripts.ts
+exitOnHelpFlag("transcripts");
+var dim = (text) => `\x1B[2m${text}\x1B[0m`;
+var bold = (text) => `\x1B[1m${text}\x1B[0m`;
+var showStatus = () => {
+  const pin = loadPin();
+  console.log();
+  console.log(`  ${bold("Transcript sync")}  ${transcriptsEnabled() ? "on" : dim("off")}`);
+  console.log();
+  if (!pin) {
+    console.log(`  No keys pinned yet. The first sync on this machine records the keys it`);
+    console.log(`  seals to, and every later change has to be accepted here.`);
+    console.log();
+    return;
+  }
+  console.log(`  ${bold("Phone key")}         ${fingerprint(pin.phonePublicKey)}`);
+  console.log(`  ${dim("Compare this with the fingerprint in the app under Settings.")}`);
+  console.log();
+  if (pin.providerKeyId && pin.providerPublicKey) {
+    console.log(`  ${bold("Recovery key")}      ${pin.providerKeyId.slice(0, 16)}`);
+    console.log(`  ${dim("Pushary can recover a session sealed to this key under a documented")}`);
+    console.log(`  ${dim("legal obligation. Sessions sealed before it existed cannot be recovered.")}`);
+  } else {
+    console.log(`  ${bold("Recovery key")}      ${dim("none")}`);
+    console.log(`  ${dim("Only your phone can read these transcripts. Nobody at Pushary can.")}`);
+  }
+  console.log();
+};
+var rotate = () => {
+  const had = loadPin();
+  clearPin();
+  console.log();
+  if (!had) {
+    console.log(`  Nothing was pinned. The next sync records whatever the server offers.`);
+  } else {
+    console.log(`  Dropped the pinned keys. The next sync records what the server offers now`);
+    console.log(`  and resumes uploading.`);
+    console.log();
+    console.log(`  ${dim("If you did not reinstall the app or rotate a key, stop and check with")}`);
+    console.log(`  ${dim("Pushary before running an agent on this machine.")}`);
+  }
+  console.log();
+};
+var args = process.argv.slice(2);
+var wantsRotate = args.includes("--rotate");
+var verb = args.find((arg) => !arg.startsWith("-"));
+if (verb === "trust" && wantsRotate) {
+  rotate();
+} else if (verb === "trust") {
+  console.error(`Run \`pushary transcripts trust --rotate\` to accept the keys the server is offering now.`);
+  process.exit(1);
+} else if (verb === void 0 || verb === "status") {
+  showStatus();
+} else {
+  console.error(`Unknown: ${verb}. Try \`pushary transcripts status\` or \`pushary transcripts trust --rotate\`.`);
+  process.exit(1);
+}

package/dist/bin/pushary-upgrade.js

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import {
   reapplyAllAgents
-} from "../chunk-PZRWFWSR.js";
-import "../chunk-KVE5RCQL.js";
-import "../chunk-FZ73G2RO.js";
+} from "../chunk-MNTZKFZI.js";
+import "../chunk-5YEF55AX.js";
 import {
   waitForMachineReadiness
-} from "../chunk-TY5HVMXT.js";
-import "../chunk-Q223OM5J.js";
-import "../chunk-6EKQZA6R.js";
-import "../chunk-SYUIXXQW.js";
+} from "../chunk-RAEPAUNJ.js";
+import "../chunk-MSTHT2M7.js";
+import "../chunk-JVLB5CAJ.js";
+import "../chunk-B2HND22S.js";
+import "../chunk-VF3RTVWY.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
@@ -20,12 +20,12 @@ import {
   replaceDaemonService,
   stopDaemonService,
   waitForDaemonRemoteProof
-} from "../chunk-3SQYKLBW.js";
+} from "../chunk-7JZCADBR.js";
 import {
   detectProviderLiveCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "../chunk-6XUABEX2.js";
+} from "../chunk-3OXHYPZG.js";
 import {
   needsShell
 } from "../chunk-XHKBHWLX.js";
@@ -33,33 +33,33 @@ import {
   execNpm,
   npmErrorMessage,
   resolveGlobalBinary
-} from "../chunk-X4ZUUFKV.js";
-import "../chunk-DKWM5T3P.js";
+} from "../chunk-L4ZCFMWW.js";
+import "../chunk-JTBDBKHU.js";
 import {
   claudeJson,
   codexConfigToml,
   cursorPluginDir,
   geminiSettings,
   vscodePluginDir
-} from "../chunk-QA72MKIT.js";
-import {
-  readControlMode
-} from "../chunk-3CUDMTL4.js";
+} from "../chunk-3YGGEDJK.js";
 import {
   exitOnHelpFlag
-} from "../chunk-LURY4WNF.js";
-import "../chunk-3XTFX4CL.js";
-import "../chunk-BC3VCZ3E.js";
+} from "../chunk-WHDSJ6PD.js";
+import "../chunk-GMJDQDXU.js";
 import {
   isNewerVersion
 } from "../chunk-DINDL2CF.js";
-import "../chunk-IUWRVTQK.js";
+import {
+  readControlMode
+} from "../chunk-NBDU3R3G.js";
+import "../chunk-BC3VCZ3E.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-XX2V4QS5.js";
+import "../chunk-ANMHIZZY.js";
+import "../chunk-4LL6LG5X.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
-import "../chunk-X6RXX2NF.js";
+import "../chunk-QINYXLA5.js";
 
 // bin/pushary-upgrade.ts
 import { existsSync } from "fs";

package/dist/bin/pushary-wait.js

@@ -4,8 +4,8 @@ import {
 } from "../chunk-IIENZE2J.js";
 import {
   exitOnFailedResponse
-} from "../chunk-253WC6O5.js";
-import "../chunk-BLODMQKJ.js";
+} from "../chunk-YXT55PYF.js";
+import "../chunk-ZO43JTT3.js";
 import {
   createIo
 } from "../chunk-5RUIFDTP.js";
@@ -14,8 +14,8 @@ import {
 } from "../chunk-GMXKITVA.js";
 import {
   exitOnHelpFlag
-} from "../chunk-LURY4WNF.js";
-import "../chunk-3XTFX4CL.js";
+} from "../chunk-WHDSJ6PD.js";
+import "../chunk-GMJDQDXU.js";
 import "../chunk-DINDL2CF.js";
 import "../chunk-SAF6HGAA.js";
 import {
@@ -28,7 +28,7 @@ import {
   getApiKey,
   getBaseUrl
 } from "../chunk-2UMNXADU.js";
-import "../chunk-X6RXX2NF.js";
+import "../chunk-QINYXLA5.js";
 
 // bin/pushary-wait.ts
 exitOnHelpFlag("wait");

package/dist/bin/pushary.js

@@ -3,7 +3,7 @@ import {
   COMMANDS,
   isCommandName,
   renderHelp
-} from "../chunk-3XTFX4CL.js";
+} from "../chunk-GMJDQDXU.js";
 import {
   getPackageVersion
 } from "../chunk-DINDL2CF.js";
@@ -33,7 +33,8 @@ var LOADERS = {
   stats: () => import("./pushary-stats.js"),
   suggestions: () => import("./pushary-suggestions.js"),
   upgrade: () => import("./pushary-upgrade.js"),
-  hook: () => import("./pushary-hook.js")
+  hook: () => import("./pushary-hook.js"),
+  transcripts: () => import("./pushary-transcripts.js")
 };
 installProxyDispatcher();
 var argv = process.argv.slice(2);

package/dist/{chunk-6XUABEX2.js → chunk-3OXHYPZG.js}

@@ -2,7 +2,7 @@ import {
   resolveBinary,
   resolveGlobalPackageVersion,
   resolvePackageVersionFromBinary
-} from "./chunk-X4ZUUFKV.js";
+} from "./chunk-L4ZCFMWW.js";
 
 // src/live-capabilities.ts
 var CLAUDE_BRIDGE_CAPABILITY = "claude-bridge";

package/dist/{chunk-QA72MKIT.js → chunk-3YGGEDJK.js}

@@ -1,17 +1,17 @@
 import {
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY
-} from "./chunk-X6RXX2NF.js";
+} from "./chunk-QINYXLA5.js";
+
+// src/removal-scope.ts
+var namesAppLocator = (command) => command.includes(HOOK_LOCATOR_BINARY);
+var isProtectedByScope = (command, scope) => scope?.keepAppWiring === true && namesAppLocator(command);
 
 // src/codex-config.ts
 import { createHash } from "crypto";
 import { homedir } from "os";
 import { join } from "path";
 
-// src/removal-scope.ts
-var namesAppLocator = (command) => command.includes(HOOK_LOCATOR_BINARY);
-var isProtectedByScope = (command, scope) => scope?.keepAppWiring === true && namesAppLocator(command);
-
 // src/canonical-json.ts
 var canonicalJson = (value) => {
   if (value === null || typeof value !== "object") return JSON.stringify(value);

package/dist/{chunk-IUN6VOKV.js → chunk-4IPSMEGT.js}

@@ -1,9 +1,6 @@
-import {
-  getBaseUrl
-} from "./chunk-2UMNXADU.js";
 import {
   redactSecrets
-} from "./chunk-X6RXX2NF.js";
+} from "./chunk-QINYXLA5.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";
@@ -36,7 +33,67 @@ var encryptRecord = (plaintext, sessionKey) => {
 };
 
 // src/transcript-capture.ts
-import { createHash } from "crypto";
+import { createHmac } from "crypto";
+
+// src/transcript-budget.ts
+var CIPHERTEXT_BUDGET_CHARS = 64 * 1024;
+var SECRETBOX_OVERHEAD_BYTES = 24 + 16;
+var MAX_PLAINTEXT_BYTES = Math.floor(CIPHERTEXT_BUDGET_CHARS / 4) * 3 - SECRETBOX_OVERHEAD_BYTES;
+var MIN_KEEP_CHARS = 200;
+var note = (dropped) => `
+[Pushary truncated ${dropped} bytes to fit the transcript size limit]`;
+var stringSlots = (value, out = []) => {
+  if (Array.isArray(value)) {
+    value.forEach((inner, index) => {
+      if (typeof inner === "string") {
+        out.push({ get: () => value[index], set: (v) => {
+          value[index] = v;
+        } });
+      } else {
+        stringSlots(inner, out);
+      }
+    });
+  } else if (value && typeof value === "object") {
+    const object = value;
+    for (const key of Object.keys(object)) {
+      const inner = object[key];
+      if (typeof inner === "string") {
+        out.push({ get: () => object[key], set: (v) => {
+          object[key] = v;
+        } });
+      } else {
+        stringSlots(inner, out);
+      }
+    }
+  }
+  return out;
+};
+var jsonBytes = (value) => Buffer.byteLength(JSON.stringify(value), "utf-8");
+var fitWithinPlaintextBudget = (record, budget = MAX_PLAINTEXT_BYTES) => {
+  if (jsonBytes(record) <= budget) return false;
+  const slots = stringSlots(record).map((slot) => ({
+    slot,
+    originalBytes: Buffer.byteLength(slot.get(), "utf-8")
+  }));
+  if (slots.length === 0) return false;
+  let truncated = false;
+  for (let pass = 0; pass < 64 && jsonBytes(record) > budget; pass += 1) {
+    let worst = slots[0];
+    for (const candidate of slots) {
+      if (candidate.slot.get().length > worst.slot.get().length) worst = candidate;
+    }
+    const current = worst.slot.get();
+    const keep = Math.max(MIN_KEEP_CHARS, Math.floor(current.length / 2));
+    const kept = current.slice(0, keep);
+    const replacement = kept + note(worst.originalBytes - Buffer.byteLength(kept, "utf-8"));
+    if (replacement.length >= current.length) break;
+    worst.slot.set(replacement);
+    truncated = true;
+  }
+  return truncated;
+};
+
+// src/transcript-capture.ts
 var INTERNAL_TYPES = /* @__PURE__ */ new Set([
   "file-history-snapshot",
   "change",
@@ -55,7 +112,7 @@ var redactDeep = (value) => {
   }
   return value;
 };
-var localIdFor = (parsed, rawLine) => typeof parsed.uuid === "string" && parsed.uuid.length > 0 ? parsed.uuid : createHash("sha256").update(rawLine).digest("hex").slice(0, 32);
+var localIdFor = (parsed, rawLine, sessionKey) => typeof parsed.uuid === "string" && parsed.uuid.length > 0 ? parsed.uuid : createHmac("sha256", sessionKey).update(rawLine).digest("hex").slice(0, 32);
 var buildTranscriptRecords = (lines, sessionKey, seen = /* @__PURE__ */ new Set()) => {
   const records = [];
   const nextSeen = new Set(seen);
@@ -70,55 +127,20 @@ var buildTranscriptRecords = (lines, sessionKey, seen = /* @__PURE__ */ new Set(
     }
     const type = typeof parsed.type === "string" ? parsed.type : "";
     if (INTERNAL_TYPES.has(type)) continue;
-    const localId = localIdFor(parsed, trimmed);
+    const localId = localIdFor(parsed, trimmed, sessionKey);
     if (nextSeen.has(localId)) continue;
     nextSeen.add(localId);
-    const content = encryptRecord(JSON.stringify(redactDeep(parsed)), sessionKey);
+    const redacted = redactDeep(parsed);
+    fitWithinPlaintextBudget(redacted);
+    const content = encryptRecord(JSON.stringify(redacted), sessionKey);
     records.push({ localId, content });
   }
   return { records, seen: nextSeen };
 };
 
-// src/transcript-api.ts
-var fetchAccountPublicKey = async (apiKey, baseUrl = getBaseUrl()) => {
-  try {
-    const res = await fetch(`${baseUrl}/api/agent/encryption-account`, {
-      headers: { Authorization: `Bearer ${apiKey}` },
-      signal: AbortSignal.timeout(5e3)
-    });
-    if (!res.ok) return null;
-    const data = await res.json();
-    return typeof data.publicKey === "string" && data.publicKey.length > 0 ? data.publicKey : null;
-  } catch {
-    return null;
-  }
-};
-var uploadTranscriptRecords = async (apiKey, params, baseUrl = getBaseUrl()) => {
-  try {
-    const res = await fetch(`${baseUrl}/api/agent/transcript`, {
-      method: "POST",
-      headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
-      body: JSON.stringify(params),
-      signal: AbortSignal.timeout(15e3)
-    });
-    const body = await res.json().catch(() => null);
-    const keyRegistered = body?.keyRegistered === true;
-    const keyConflict = body?.keyConflict === true;
-    return {
-      ok: res.ok && !keyConflict && (params.dataEncryptionKey === void 0 || keyRegistered),
-      keyRegistered,
-      keyConflict
-    };
-  } catch {
-    return { ok: false, keyRegistered: false, keyConflict: false };
-  }
-};
-
 export {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey,
-  buildTranscriptRecords,
-  fetchAccountPublicKey,
-  uploadTranscriptRecords
+  buildTranscriptRecords
 };

package/dist/{chunk-XX2V4QS5.js → chunk-4LL6LG5X.js}

@@ -23,12 +23,12 @@ var backupFile = (filePath) => {
   copyFileSync(filePath, target);
   return target;
 };
-var writeFileAtomic = (filePath, contents, mode) => {
+var writeFileAtomic = (filePath, contents, mode, encoding = "utf-8") => {
   const dir = dirname(filePath);
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
   const temp = join(dir, `.${process.pid}-${stamp()}.pushary-tmp`);
   try {
-    writeFileSync(temp, contents, mode === void 0 ? "utf-8" : { encoding: "utf-8", mode });
+    writeFileSync(temp, contents, mode === void 0 ? encoding : { encoding, mode });
     const handle = openSync(temp, "r+");
     try {
       fsyncSync(handle);

package/dist/{chunk-J4K75V4D.js → chunk-5MNTWAAJ.js}

@@ -1,14 +1,14 @@
 import {
   PRETOOLUSE_HANDLED_TOOLS,
   PRETOOLUSE_PHONE_ANSWERED_TOOLS
-} from "./chunk-6EKQZA6R.js";
+} from "./chunk-B2HND22S.js";
 import {
   defersToNativeMode
-} from "./chunk-NCVIWGVA.js";
+} from "./chunk-S4BLNILH.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-3HFK3UXM.js";
+} from "./chunk-FOGW6O2Y.js";
 import {
   denyReasonFrom,
   isDeferAnswer
@@ -20,7 +20,7 @@ import {
   readLastUserPrompt,
   repoKeyFor,
   throttlePass
-} from "./chunk-FXIL7RCL.js";
+} from "./chunk-OX35BSPV.js";
 import {
   DEFAULT_SESSION,
   askUser,
@@ -30,16 +30,17 @@ import {
   sendNotification
 } from "./chunk-JHJHCMAF.js";
 import {
+  UNNAMED_ACTION,
   deriveAction,
   deriveActionBody,
   deriveBlocker,
   deriveToolTarget,
   describeToolCall,
   scopePathFor
-} from "./chunk-TG3T3M4K.js";
+} from "./chunk-N4QJ3CLX.js";
 import {
   getMachineId
-} from "./chunk-DKWM5T3P.js";
+} from "./chunk-JTBDBKHU.js";
 import {
   getApiKey,
   getBaseUrl
@@ -54,7 +55,7 @@ import {
   parseAgentQuestionAnswers,
   parseAgentQuestions,
   resolveGate
-} from "./chunk-X6RXX2NF.js";
+} from "./chunk-QINYXLA5.js";
 
 // src/decision-episode.ts
 var EPISODE_PATH = "/api/agent/decision-episode";
@@ -100,7 +101,7 @@ var handlePushOnly = async (apiKey, description, projectName, timeoutSeconds, ti
   let result;
   try {
     result = await askUser(apiKey, {
-      question: `Allow ${description}?`,
+      question: `Allow ${description || UNNAMED_ACTION}?`,
       type: "confirm",
       context: `Agent wants to run this in ${projectName}`,
       agentName: `Claude Code - ${projectName}`,
@@ -168,7 +169,7 @@ var handlePushFirst = async (apiKey, description, projectName, pushFirstSeconds,
   let result;
   try {
     result = await askUser(apiKey, {
-      question: `Allow ${description}?`,
+      question: `Allow ${description || UNNAMED_ACTION}?`,
       type: "confirm",
       context: `Agent wants to run this in ${projectName}`,
       agentName: `Claude Code - ${projectName}`,

package/dist/{chunk-KVE5RCQL.js → chunk-5YEF55AX.js}

@@ -1,6 +1,6 @@
 import {
   parseVersion
-} from "./chunk-Q223OM5J.js";
+} from "./chunk-JVLB5CAJ.js";
 
 // src/setup/agent-probe.ts
 import { execSync } from "child_process";