@pushary/agent-hooks 0.90.2 → 0.91.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.91.0
+
+### Setup adopts the key the Mac app is already signed in with
+
+The Mac app authenticates through Clerk and writes its API key into every agent
+config it wires, but never into `~/.pushary/config.json`. Setup's key ladder did
+not look there, so a Mac the app had already connected still fell through to the
+pairing QR and minted a second key for an account that was already live.
+
+The ladder gains one rung between the environment and pairing: a key the Mac app
+wrote, probed against the server exactly like the stored and environment rungs
+are, and skipped whenever `--key` was passed or `--connect app` was typed. Both
+of those still mean what they meant.
+
 ## 0.90.2
 
 ### The Mac app and CLI coexist without a hook takeover

package/dist/bin/pushary-clean.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   HERMES_CONFIG_SCRIPT,
+  HERMES_PIP_PACKAGE,
   createGuards,
   hookOwnerOf,
   isHookTakeoverReceipt,
@@ -8,7 +9,7 @@ import {
   restoreHookTakeover,
   restoreMcpServer,
   runHermesPythonScript
-} from "../chunk-ATUUQFDH.js";
+} from "../chunk-B65JGBIZ.js";
 import {
   removeInstructionBlock,
   shortenHome,
@@ -574,7 +575,7 @@ var main = async () => {
     } else {
       console.log(`  ${check} Hermes config ${dim("(setup-owned changes restored)")}`);
       try {
-        guardedExec(`"${hermesPython}" -m pip uninstall -y hermes-plugin-pushary`, { stdio: "pipe", timeout: 6e4 }, "pip uninstall hermes-plugin-pushary");
+        guardedExec(`"${hermesPython}" -m pip uninstall -y ${HERMES_PIP_PACKAGE}`, { stdio: "pipe", timeout: 6e4 }, `pip uninstall ${HERMES_PIP_PACKAGE}`);
         console.log(`  ${check} Hermes plugin ${dim("(pip uninstalled)")}`);
       } catch {
         incompleteClean = true;

package/dist/bin/pushary-setup.js

@@ -13,7 +13,9 @@ import {
   waitForMachineReadiness
 } from "../chunk-YTD6PJM7.js";
 import {
+  AGENT_CHOICES,
   HERMES_CONFIG_SCRIPT,
+  HERMES_PIP_PACKAGE,
   KEEP_HINT,
   captureHookTakeover,
   captureMcpServer,
@@ -29,7 +31,7 @@ import {
   planHooks,
   resolveHermesPython,
   runHermesPythonScript
-} from "../chunk-ATUUQFDH.js";
+} from "../chunk-B65JGBIZ.js";
 import {
   describeDetection,
   detectAllAgents,
@@ -553,6 +555,11 @@ var reportSetupAbortWith = async (deps, reason, exitCode, keyCheck = "unknown")
 });
 var reportSetupAbort = (reason, exitCode, keyCheck) => reportSetupAbortWith(defaultDeps, reason, exitCode, keyCheck);
 
+// src/setup/app-key.ts
+var pickAppKey = (candidates) => candidates.fromAgents.find(
+  (candidate) => typeof candidate === "string" && candidate !== candidates.storedKey && candidate !== candidates.envKey && isValidApiKey(candidate)
+) ?? null;
+
 // bin/pushary-setup.ts
 var CLAUDE_SETTINGS = claudeSettings();
 var CLAUDE_JSON = claudeJson();
@@ -819,16 +826,16 @@ var setupHermes = async (_apiKey) => {
   const python = resolveHermesPython();
   if (!python) {
     console.log(`  ${yellow("!")} Could not locate the Python that Hermes runs in. Skipping.`);
-    noteManual("Install the Hermes plugin by hand: <hermes-python> -m pip install hermes-plugin-pushary");
+    noteManual(`Install the Hermes plugin by hand: <hermes-python> -m pip install ${HERMES_PIP_PACKAGE}`);
     return "skipped";
   }
   const existingReceipt = readJsonSafe(HERMES_CONFIG_RECEIPT);
   if (existingReceipt.kind !== "missing" && (existingReceipt.kind !== "ok" || !isHermesConfigReceipt(existingReceipt.value))) {
     throw new Error(`Cannot safely configure Hermes: ${HERMES_CONFIG_RECEIPT} is unreadable or invalid.`);
   }
-  await spinner("Installing hermes-plugin-pushary into Hermes\u2019 environment", async () => {
+  await spinner(`Installing ${HERMES_PIP_PACKAGE} into Hermes\u2019 environment`, async () => {
     ensurePip(python);
-    execSync2(`"${python}" -m pip install --upgrade hermes-plugin-pushary`, { stdio: "pipe", timeout: 18e4 });
+    execSync2(`"${python}" -m pip install --upgrade ${HERMES_PIP_PACKAGE}`, { stdio: "pipe", timeout: 18e4 });
   });
   let pluginEnabled = false;
   await spinner("Enabling plugin + routing questions to push", async () => {
@@ -1471,6 +1478,13 @@ var appMcpKeyFor = (agent) => {
   const file = agent === "claude_code" ? CLAUDE_JSON : agent === "gemini_cli" ? GEMINI_SETTINGS : agent === "cursor" ? cursorUserMcp() : agent === "vscode" ? VSCODE_PLUGIN_MCP : null;
   return file ? mcpBearerKey(readAgentJson(file), "mcpServers", "headers") : null;
 };
+var appMcpKeyIfReadable = (agent) => {
+  try {
+    return appMcpKeyFor(agent);
+  } catch {
+    return null;
+  }
+};
 var captureTakeoverReceipt = (agent) => {
   const hookFile = HOOK_FILES[agent]?.();
   if (!hookFile) return;
@@ -1806,6 +1820,8 @@ var main = async () => {
   const envCheck = ambientEligible && envKey && isValidApiKey(envKey) ? await usableStoredKey(envKey) : null;
   const storedCheck = ambientEligible && envCheck === null && storedKey !== null && isValidApiKey(storedKey) && // login writes both, so without this the same key is probed twice.
   storedKey !== envKey ? await usableStoredKey(storedKey) : null;
+  const appKey = ambientEligible && envCheck === null && storedCheck === null ? pickAppKey({ fromAgents: AGENT_CHOICES.map(appMcpKeyIfReadable), storedKey, envKey }) : null;
+  const appKeyCheck = appKey === null ? null : await usableStoredKey(appKey);
   let storedKeyCheck = null;
   if (flagKey) {
     const masked = `${flagKey.slice(0, 8)}...${flagKey.slice(-4)}`;
@@ -1831,6 +1847,12 @@ var main = async () => {
       const apiKey = await input({ message: "API key:" });
       trimmedKey = apiKey.trim();
     }
+  } else if (appKey !== null && appKeyCheck !== null) {
+    const masked = `${appKey.slice(0, 8)}...${appKey.slice(-4)}`;
+    console.log(`  ${check} Using the key the Pushary Mac app is signed in with: ${dim(masked)}`);
+    console.log();
+    trimmedKey = appKey;
+    storedKeyCheck = appKeyCheck;
   } else if (options.dryRun) {
     console.log(`  ${dim("No key on this machine. A real run would connect one first.")}`);
     console.log();
@@ -1950,12 +1972,12 @@ var main = async () => {
     return pending;
   };
   const appAccountMatches = async (agent) => {
-    const appKey = appMcpKeyFor(agent);
-    if (!appKey) return false;
-    if (appKey === trimmedKey) return true;
+    const appKey2 = appMcpKeyFor(agent);
+    if (!appKey2) return false;
+    if (appKey2 === trimmedKey) return true;
     const [cliAccount, appAccount] = await Promise.all([
       accountCheckFor(trimmedKey),
-      accountCheckFor(appKey)
+      accountCheckFor(appKey2)
     ]);
     return samePusharyAccount(cliAccount, appAccount);
   };

package/dist/{chunk-ATUUQFDH.js → chunk-B65JGBIZ.js}

@@ -31,6 +31,7 @@ var isHermesConfigReceipt = (value) => {
   if (!isRecord(value)) return false;
   return ["security", "approval", "transport", "fallback", "plugins", "enabled", "agent", "disabled"].every((key) => isSnapshot(value[key])) && typeof value.pushary_enabled === "boolean" && typeof value.clarify_disabled === "boolean";
 };
+var HERMES_PIP_PACKAGE = "hermes-plugin-pushary";
 var HERMES_CONFIG_SCRIPT = String.raw`
 import json, os, sys
 from hermes_cli.config import load_config, save_config
@@ -514,11 +515,13 @@ var describeHookOwnership = (entries, names) => {
 
 export {
   isHermesConfigReceipt,
+  HERMES_PIP_PACKAGE,
   HERMES_CONFIG_SCRIPT,
   resolveHermesPython,
   runHermesPythonScript,
   createGuards,
   describeSetupSideEffects,
+  AGENT_CHOICES,
   effectiveVerify,
   effectiveControlMode,
   parseSetupOptions,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.90.2",
+  "version": "0.91.0",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",