@pushary/agent-hooks 1.7.0 → 1.7.2

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 1.7.2
+
+- **Approval text shows the whole command again.** A credential name that closes a quoted string, as in `grep -rl "password=" . | xargs rm -f`, made 1.7.1 redact everything after it, so the approval read `grep -rl "password="[redacted]"` and hid the `rm`. The value after a credential name is still redacted, and the rest of the command is shown.
+- **Hermes works again after an uninstall.** When setup found Pushary's own Hermes settings already in `~/.hermes/config.yaml`, left by an earlier install, its record of your config included them, and `pushary clean` put them back: approvals stayed pointed at the plugin clean had just uninstalled, and Hermes' `clarify` tool stayed off, so Hermes could not ask you anything in the terminal. Clean now recognises Pushary's own values in that record, including records older versions wrote, and removes `transport: pushary`, the `pushary` plugin entry, and the `clarify` entry that came with Pushary's transport, while restoring everything else you set. Running clean again, or after the Mac app has disconnected Hermes, no longer fails once Hermes' defaults fill the removed settings back in.
+- `pushary clean` says what it did to Hermes: "Pushary settings removed" only when it changed `config.yaml`, "no Pushary settings" when there was nothing of ours, and it skips the plugin uninstall when the plugin is not installed. `--dry-run` previews the exact change without saving it.
+- `pushary doctor` checks Hermes when Pushary set it up: that the plugin is installed in Hermes' Python and enabled, and whether approvals and questions go through Pushary. A plugin the Mac app left installed but disabled is not reported as a failure.
+- Setup on a machine without npm now says so and asks you to install Node.js, instead of printing `/bin/sh: npm: command not found` and suggesting an `npx` retry that needs npm too. Pushary still needs npm; bun, pnpm and yarn installs are not supported yet.
+- `pushary clean` tells an npm it cannot find, a package that is not installed and a failed uninstall apart, instead of calling each of them "not installed". A failed uninstall no longer ends in "Clean complete".
+- `pushary clean --dry-run` lists only the Mac keychain items and preference domains that exist, and the fx setup record only when there is one. It used to list every candidate it would try. A keychain that cannot be read, for example while locked, still counts as possibly holding Pushary's items, so clean tries them and reports a failure instead of calling the keychain clean.
+- `pushary clean` honours `NO_COLOR`.
+- Setup's agent picker shows only the names you picked once you confirm, instead of repeating every agent's description, and the transcript notice is indented like the lines around it.
+- A message you send from your phone or the Mac notch while Claude Code is running a subagent now waits for Claude Code itself. It used to be handed to the subagent's next tool call, where the main conversation never saw it.
+- When your Pushary workspace has no active subscription, Pushary now steps aside and your agent's own approval prompt decides, as it does when Pushary is not installed. Claude Code, Codex, Gemini CLI and OpenCode used to refuse gated tool calls instead, telling you to retry or that the approval was cancelled, and Claude Code questions, plan approvals and MCP forms stopped the same way. A kill switch and your deny rules still apply.
+- Your agent's terminal says once per session why Pushary stepped aside, with the link to subscribe.
+- A Claude Code or Gemini CLI session started from your phone has no prompt on your machine, so it still refuses the call, now saying the workspace has no active subscription instead of asking you to retry.
+- Pairing your phone during setup now says when your workspace has no active subscription, and to subscribe in the Pushary app or at pushary.com before running setup again. It used to say only that pairing failed.
+
+## 1.7.1
+
+- **fx asks through Pushary.** Setup now adds `"ask_user_question": "deny"` as the last rule in `~/.fx/settings.json`, which removes fx's own terminal question tool from what its agent can call, so every question goes through `mcp_pushary_ask_user`: to the Mac notch at the Mac, to the phone away from it. fx cannot forward its own prompt, so a question asked there used to wait unseen once you walked away. A rule you already set for `ask_user_question` is kept, and setup names it. The instructions in `~/.fx/AGENTS.md` now tell fx's agent to load `mcp_pushary_ask_user` with `mcp_select_tool` by exact name and to ask there even while you are at the terminal, and to ask in its reply only when Pushary hands the question back or cannot be reached.
+- fx's full-access mode (`yolo`, `full-access` or `full access`, from settings, a workspace, or `FX_PERMISSION_MODE`) ignores permission rules, so the terminal question tool stays on there; setup and `pushary doctor` say so instead of claiming questions are routed, and the instructions still steer the agent to Pushary. fx workspaces with their own permission rules replace the global ones, and setup and doctor name how many keep the question tool on. Setup reads the rules the way fx does (globs, last match wins, per-target maps) and leaves a `settings.json` fx would reject, such as one with an unknown action or permission mode, untouched and says fx ignores it.
+- `pushary clean` removes the question rule only when setup recorded adding it and it is still `deny`, so a rule of your own survives.
+- `pushary clean` now removes Pushary entries from every event in `~/.cursor/hooks.json`, not only the events the permission gate uses. The Mac app registers its bridge on session, compaction and stop events too, and those eight entries were left behind under "Clean complete". Other tools' hooks are untouched.
+- `pushary clean` now removes the Pushary block from OpenCode's `~/.config/opencode/AGENTS.md`, as it already did for Codex and Gemini. Setup wrote it and clean left it.
+- `pushary clean` removes temp files that an interrupted config write left next to an agent's config (`.<file>.pushary-<id>` and `.<pid>-<time>.pushary-tmp`), only next to the agent configs clean rewrites (your home folder, Claude Code, Codex, Gemini, Cursor, OpenCode, fx and VS Code settings), never through a symlink, and only once they are over a minute old.
+- Setup's summary no longer says "(others completed successfully)" or "Other agents will continue" when the failed agent was the only one; it names the agents that were configured.
+- Setup's progress lines no longer leave the tail of the previous frame behind ("with Codexex", "tap the notificationon"): setup uses the shared spinner, which clears the line, keeps each frame to one terminal row, and does not animate into a log when colour is forced on.
+
 ## 1.7.0
 
 - **fx.** `npx @pushary/agent-hooks@latest setup --agents fx`, or ticking fx in the picker, connects Vercel Labs' fx coding agent. Setup adds a `pushary` server to `~/.fx/mcp.json` that runs the new `pushary-mcp` command, a local bridge that signs in with the key setup saved in `~/.pushary`. No key is written to fx's files, and a rotated key is used without running setup again. fx has no hooks other tools can register, so Pushary cannot answer fx's own approval prompts; fx's agent asks through Pushary's tools when it chooses to, guided by a managed block setup writes to `~/.fx/AGENTS.md`.

package/dist/bin/pushary-bell-hook.js

@@ -1,38 +1,38 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-6ADZQFVW.js";
+} from "../chunk-ZUKZJQGR.js";
 import {
   readHookInput
-} from "../chunk-UC65FJJT.js";
-import "../chunk-EAQMWJPG.js";
+} from "../chunk-3RO2UWJQ.js";
+import "../chunk-ZMWX5SDA.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-R2XCLT6I.js";
-import "../chunk-CVALVGA7.js";
-import "../chunk-5HLTWFJ6.js";
-import "../chunk-PQ4F64M2.js";
-import "../chunk-73T6MSU5.js";
-import "../chunk-ZQ7IDOKY.js";
-import "../chunk-VKVIAZQO.js";
-import "../chunk-BH2SKSSK.js";
-import "../chunk-KXMZMZD3.js";
-import "../chunk-B76WVEDX.js";
+import "../chunk-E3PLF7YB.js";
+import "../chunk-I7B2DNVU.js";
+import "../chunk-JMSB6CJT.js";
+import "../chunk-L6IF4JOF.js";
+import "../chunk-4S7CCOXB.js";
+import "../chunk-A6WQF7FQ.js";
+import "../chunk-KLXYMPTM.js";
+import "../chunk-R7ZETVNR.js";
+import "../chunk-QSZ37ROP.js";
+import "../chunk-Q7CDBJXU.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-DZURML2D.js";
-import "../chunk-V6QRSU2G.js";
+import "../chunk-RLRDPZG4.js";
+import "../chunk-6QZK4O36.js";
 import "../chunk-POFBE6ZY.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-UOAQ6QMP.js";
-import "../chunk-KW2RRR7D.js";
-import "../chunk-XNCMT7YY.js";
+import "../chunk-VSGKQ3HI.js";
+import "../chunk-UFNBKYWT.js";
+import "../chunk-HOIGXMI7.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-ROQK7IN3.js";
-import "../chunk-DNJUSFBL.js";
+import "../chunk-LI3C2IQY.js";
+import "../chunk-NYBZJ44G.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-V4AQBAVG.js";
-import "../chunk-B3UXMSMW.js";
-import "../chunk-YROGUPOZ.js";
+import "../chunk-SJN64NJX.js";
+import "../chunk-65RN6ZCO.js";
+import "../chunk-WWTLAZQA.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,37 +5,37 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-6ADZQFVW.js";
+} from "../chunk-ZUKZJQGR.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-VKVIAZQO.js";
+} from "../chunk-KLXYMPTM.js";
 import {
   createIo
-} from "../chunk-5RUIFDTP.js";
+} from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-2PS6QWDW.js";
+} from "../chunk-6NHXKTQU.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-UOAQ6QMP.js";
+import "../chunk-VSGKQ3HI.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-ROQK7IN3.js";
+import "../chunk-LI3C2IQY.js";
 import {
   claudeSettings
-} from "../chunk-DNJUSFBL.js";
+} from "../chunk-NYBZJ44G.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-T7E75EKA.js";
-import "../chunk-V4AQBAVG.js";
-import "../chunk-B3UXMSMW.js";
-import "../chunk-YROGUPOZ.js";
+import "../chunk-SJN64NJX.js";
+import "../chunk-65RN6ZCO.js";
+import "../chunk-WWTLAZQA.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,58 +8,62 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-LEZFOTMI.js";
+} from "../chunk-PWNQGITG.js";
 import {
+  announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-YHG74UFF.js";
+} from "../chunk-5OP5MQI7.js";
 import {
   claudeTranscriptPath,
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-EAQMWJPG.js";
+} from "../chunk-ZMWX5SDA.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-R2XCLT6I.js";
-import "../chunk-CVALVGA7.js";
-import "../chunk-5HLTWFJ6.js";
-import "../chunk-PQ4F64M2.js";
+import "../chunk-E3PLF7YB.js";
+import "../chunk-I7B2DNVU.js";
+import "../chunk-JMSB6CJT.js";
+import "../chunk-L6IF4JOF.js";
 import {
   ensureDaemonRunning
-} from "../chunk-73T6MSU5.js";
-import "../chunk-ZQ7IDOKY.js";
-import "../chunk-VKVIAZQO.js";
+} from "../chunk-4S7CCOXB.js";
+import "../chunk-A6WQF7FQ.js";
+import "../chunk-KLXYMPTM.js";
 import {
   encryptRecord
-} from "../chunk-BH2SKSSK.js";
-import "../chunk-KXMZMZD3.js";
+} from "../chunk-R7ZETVNR.js";
+import "../chunk-QSZ37ROP.js";
 import {
   transcriptsEnabled
-} from "../chunk-B76WVEDX.js";
+} from "../chunk-Q7CDBJXU.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import {
-  DEFAULT_SESSION,
   UNNAMED_ACTION,
   deriveToolTarget,
   describeToolCall,
   fetchModeState,
   getPolicy,
+  phoneDrivenEnv,
+  repoKeyFor,
+  reportEvent,
+  scopePathFor
+} from "../chunk-2B4XCMH6.js";
+import {
+  DEFAULT_SESSION,
   markPendingCommandDelivered,
   markPendingCommandFailed,
-  phoneDrivenEnv,
   readPendingCommand,
   readPendingCommandById,
   removePendingCommand,
-  repoKeyFor,
-  reportEvent,
-  savePendingCommand,
-  scopePathFor
-} from "../chunk-IJ6ECPA6.js";
-import "../chunk-DZURML2D.js";
+  savePendingCommand
+} from "../chunk-N6IOSZOE.js";
+import "../chunk-RLRDPZG4.js";
 import {
   DECISION_STOP_REASON,
+  UNVERIFIABLE_APPROVAL_REASON,
   askUser,
   cancelQuestion,
   isDecisionStopped,
@@ -67,33 +71,36 @@ import {
   nextLongPollMs,
   waitForAnswer,
   withdrawQuestion
-} from "../chunk-EGKXSQCY.js";
-import "../chunk-V6QRSU2G.js";
+} from "../chunk-2XOHXZRC.js";
+import "../chunk-6QZK4O36.js";
 import "../chunk-POFBE6ZY.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-UOAQ6QMP.js";
-import "../chunk-JNXVOU6Y.js";
-import "../chunk-KW2RRR7D.js";
+import "../chunk-VSGKQ3HI.js";
+import {
+  SubscriptionRequiredError
+} from "../chunk-D4OGEWLH.js";
+import "../chunk-VQDJ6KB3.js";
+import "../chunk-UFNBKYWT.js";
 import {
   getMachineId
-} from "../chunk-XNCMT7YY.js";
+} from "../chunk-HOIGXMI7.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-ROQK7IN3.js";
-import "../chunk-DNJUSFBL.js";
+import "../chunk-LI3C2IQY.js";
+import "../chunk-NYBZJ44G.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-V4AQBAVG.js";
+} from "../chunk-SJN64NJX.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-B3UXMSMW.js";
+} from "../chunk-65RN6ZCO.js";
 import {
   KILL_REASON,
   redactSecrets,
   resolveGate
-} from "../chunk-YROGUPOZ.js";
+} from "../chunk-WWTLAZQA.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {
@@ -425,6 +432,8 @@ var BoundedInputQueue = class {
 
 // src/wrapper/approver.ts
 var DEFAULT_MAX_CONCURRENT = 16;
+var NO_LOCAL_APPROVAL_UI = "This remote session has no local approval UI. Continue in an interactive session or choose a mode that permits remote approval.";
+var SUBSCRIPTION_REQUIRED_NO_LOCAL_APPROVAL_UI = "Your Pushary workspace has no active subscription, so approvals cannot reach your phone, and this remote session has no local approval UI. Continue in an interactive session.";
 var DEFAULT_APPROVAL_WINDOW_MS = 5 * 6e4;
 var MAX_APPROVAL_WINDOW_MS = 30 * 6e4;
 var allow = (input) => ({
@@ -528,8 +537,10 @@ var createRemoteApprover = (deps) => {
           toolTarget,
           repoKey: repoKeyFor(deps.cwd)
         });
-      } catch {
-        return deny("Pushary could not create a verifiable approval. Retry the action.");
+      } catch (error) {
+        if (!(error instanceof SubscriptionRequiredError)) return deny(UNVERIFIABLE_APPROVAL_REASON);
+        announceSubscriptionRequired(error.upgradeUrl, sessionId);
+        return deny(SUBSCRIPTION_REQUIRED_NO_LOCAL_APPROVAL_UI);
       }
       if (isDecisionStopped(question)) return deny(DECISION_STOP_REASON);
       entry.correlationId = question.correlationId;
@@ -546,7 +557,7 @@ var createRemoteApprover = (deps) => {
         if (isDeferAnswer(answer.value)) return deny("Deferred \u2014 handle it on the machine");
         return answer.value === "yes" ? allow(input) : deny("Denied from your phone");
       }
-      if (localHandoff) return deny("This remote session has no local approval UI. Continue in an interactive session or choose a mode that permits remote approval.");
+      if (localHandoff) return deny(NO_LOCAL_APPROVAL_UI);
       return applyTimeout(policy, input);
     } catch {
       return deny("Approval unavailable; denied by default");