@pushary/agent-hooks 1.7.1 → 1.7.3

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 1.7.3
+
+- **Approval text never hides part of a command.** The value after a credential name is now hidden only up to the first space, quote or piece of shell syntax. 1.7.2 could still hide a command: `eval TOKEN="x; rm -rf ~"` read `eval TOKEN="[redacted]"`, `password= reboot` read `password= [redacted]`, and `rm -rf {password=x,/}` hid the `,/` that also deletes `/`. A private key block is hidden only when it holds nothing but the key. Tokens, keys and quoted values without spaces are hidden as before. A quoted value with spaces now shows what follows its first word, as in `--password='[redacted] pass'`. Logs and error reports still hide the whole value.
+
+## 1.7.2
+
+- **Approval text shows the whole command again.** A credential name that closes a quoted string, as in `grep -rl "password=" . | xargs rm -f`, made 1.7.1 redact everything after it, so the approval read `grep -rl "password="[redacted]"` and hid the `rm`. The value after a credential name is still redacted, and the rest of the command is shown.
+- **Hermes works again after an uninstall.** When setup found Pushary's own Hermes settings already in `~/.hermes/config.yaml`, left by an earlier install, its record of your config included them, and `pushary clean` put them back: approvals stayed pointed at the plugin clean had just uninstalled, and Hermes' `clarify` tool stayed off, so Hermes could not ask you anything in the terminal. Clean now recognises Pushary's own values in that record, including records older versions wrote, and removes `transport: pushary`, the `pushary` plugin entry, and the `clarify` entry that came with Pushary's transport, while restoring everything else you set. Running clean again, or after the Mac app has disconnected Hermes, no longer fails once Hermes' defaults fill the removed settings back in.
+- `pushary clean` says what it did to Hermes: "Pushary settings removed" only when it changed `config.yaml`, "no Pushary settings" when there was nothing of ours, and it skips the plugin uninstall when the plugin is not installed. `--dry-run` previews the exact change without saving it.
+- `pushary doctor` checks Hermes when Pushary set it up: that the plugin is installed in Hermes' Python and enabled, and whether approvals and questions go through Pushary. A plugin the Mac app left installed but disabled is not reported as a failure.
+- Setup on a machine without npm now says so and asks you to install Node.js, instead of printing `/bin/sh: npm: command not found` and suggesting an `npx` retry that needs npm too. Pushary still needs npm; bun, pnpm and yarn installs are not supported yet.
+- `pushary clean` tells an npm it cannot find, a package that is not installed and a failed uninstall apart, instead of calling each of them "not installed". A failed uninstall no longer ends in "Clean complete".
+- `pushary clean --dry-run` lists only the Mac keychain items and preference domains that exist, and the fx setup record only when there is one. It used to list every candidate it would try. A keychain that cannot be read, for example while locked, still counts as possibly holding Pushary's items, so clean tries them and reports a failure instead of calling the keychain clean.
+- `pushary clean` honours `NO_COLOR`.
+- Setup's agent picker shows only the names you picked once you confirm, instead of repeating every agent's description, and the transcript notice is indented like the lines around it.
+- A message you send from your phone or the Mac notch while Claude Code is running a subagent now waits for Claude Code itself. It used to be handed to the subagent's next tool call, where the main conversation never saw it.
+- When your Pushary workspace has no active subscription, Pushary now steps aside and your agent's own approval prompt decides, as it does when Pushary is not installed. Claude Code, Codex, Gemini CLI and OpenCode used to refuse gated tool calls instead, telling you to retry or that the approval was cancelled, and Claude Code questions, plan approvals and MCP forms stopped the same way. A kill switch and your deny rules still apply.
+- Your agent's terminal says once per session why Pushary stepped aside, with the link to subscribe.
+- A Claude Code or Gemini CLI session started from your phone has no prompt on your machine, so it still refuses the call, now saying the workspace has no active subscription instead of asking you to retry.
+- Pairing your phone during setup now says when your workspace has no active subscription, and to subscribe in the Pushary app or at pushary.com before running setup again. It used to say only that pairing failed.
+
 ## 1.7.1
 
 - **fx asks through Pushary.** Setup now adds `"ask_user_question": "deny"` as the last rule in `~/.fx/settings.json`, which removes fx's own terminal question tool from what its agent can call, so every question goes through `mcp_pushary_ask_user`: to the Mac notch at the Mac, to the phone away from it. fx cannot forward its own prompt, so a question asked there used to wait unseen once you walked away. A rule you already set for `ask_user_question` is kept, and setup names it. The instructions in `~/.fx/AGENTS.md` now tell fx's agent to load `mcp_pushary_ask_user` with `mcp_select_tool` by exact name and to ask there even while you are at the terminal, and to ask in its reply only when Pushary hands the question back or cannot be reached.

package/data/cursor-plugin/CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## 0.2.3
 
+- Approval text never hides part of a command. The value after a credential name is hidden only up to the first space, quote or piece of shell syntax, so `echo "password=" && rm -rf ~` and `eval TOKEN="x; rm -rf ~"` both show the `rm`. A private key block is hidden only when it holds nothing but the key.
 - Updates and Terminal hand an approval back to Cursor promptly. The gate no longer waits for a phone answer that Updates never asks for, and it withdraws the phone question before Cursor decides. An answer that arrives in that moment still counts.
 - A file change that goes back to the agent's own permissions is refused with the reason, because Cursor file hooks cannot show a local approval. Choose Every time for file changes you want to approve from your phone.
 - With no phone or other notification channel connected, a file change is refused with a message that says so. Shell commands and MCP calls still open Cursor's own prompt with "No device connected, approve here."

package/data/cursor-plugin/scripts/pushary-gate.mjs

@@ -295,7 +295,7 @@ export const describeNetworkFailure = (error, env = process.env) => {
 const ACTION_BODY_MAX = 4000
 const ACTION_BODY_TRUNCATION_MARKER = '\n… [truncated]'
 const REDACTION_RULES = [
-  [/-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z0-9 ]*PRIVATE KEY-----/g, '[redacted key]'],
+  [/-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----(?:\r?\n|(?:\\r)?\\n)?(?:(?:Proc-Type|DEK-Info): [A-Za-z0-9,-]+(?:\r?\n|(?:\\r)?\\n))*(?:[A-Za-z0-9+/=\r\n]|\\[rn])*?-----END[A-Z0-9 ]*PRIVATE KEY-----/g, '[redacted key]'],
   [/\bsk-[A-Za-z0-9_-]{16,}\b/g, '[redacted]'],
   [/\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, '[redacted]'],
   [/\bwhsec_[A-Za-z0-9]{16,}\b/g, '[redacted]'],
@@ -309,8 +309,8 @@ const REDACTION_RULES = [
   [/\bxai-[A-Za-z0-9]{16,}\b/g, '[redacted]'],
   [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, '[redacted]'],
   [/\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, 'bearer [redacted]'],
-  [/\bauthorization:\s*\S+/gi, 'authorization: [redacted]'],
-  [/((?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[=:]\s*)(\"[^\"]*\"|'[^']*'|\S+)/gi, '$1[redacted]'],
+  [/\bauthorization:\s*(?:[A-Za-z0-9_\-./+=:@%^!#]|\\[^\s'"])+/gi, 'authorization: [redacted]'],
+  [/((?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)["']?(?:[ \t]*:[ \t]*|[ \t]+=[ \t]*|=))(?:(")(?:[A-Za-z0-9_\-./+=:@%^!#]|\\[^\s'"])*"|(')[A-Za-z0-9_\-./+=:@%^!#\\]*'|(["']?)(?:[A-Za-z0-9_\-./+=:@%^!#]|\\[^\s'"])+)/gi, '$1$2$3$4[redacted]$2$3'],
 ]
 const HIGH_ENTROPY_RULE = [/[A-Za-z0-9+/]{40,}={0,2}/g, '[redacted]']
 export const redactSecrets = (text) => REDACTION_RULES.reduce((acc, [pattern, replacement]) => acc.replace(pattern, replacement), text)

package/data/cursor-plugin/scripts/pushary-gate.test.mjs

@@ -14,7 +14,7 @@
 
 import assert from 'node:assert/strict'
 import { describe, it } from 'node:test'
-import { describeRequest, normalizeRepoRemote } from './pushary-gate.mjs'
+import { describeRequest, normalizeRepoRemote, redactSecrets } from './pushary-gate.mjs'
 
 describe('repo identity', () => {
   it('collapses the forms of one remote', () => {
@@ -113,3 +113,25 @@ describe('what the gate was asked about', () => {
     assert.equal(describeRequest({}), null)
   })
 })
+
+describe('approval text redaction', () => {
+  it('shows a command whole when a credential name only sits next to shell syntax', () => {
+    for (const command of [
+      'echo "password=" && rm -rf ~ && echo "x"',
+      'find / -name "token:" -o -delete -o -name "x"',
+      "grep -rl foo'password=' . | xargs rm -f 'important file'",
+      'grep "authorization:";rm important-file',
+      'echo "-----BEGIN PRIVATE KEY-----" && rm -rf ~ && echo "-----END PRIVATE KEY-----"',
+      'password= reboot',
+    ]) {
+      assert.equal(redactSecrets(command), command)
+    }
+  })
+
+  it('stops a hidden value at the first space, quote or piece of shell syntax', () => {
+    assert.equal(redactSecrets('eval TOKEN="x; rm -rf ~"'), 'eval TOKEN="[redacted]; rm -rf ~"')
+    assert.equal(redactSecrets('TOKEN=abc;rm file'), 'TOKEN=[redacted];rm file')
+    assert.equal(redactSecrets('rm -rf {password=x,/}'), 'rm -rf {password=[redacted],/}')
+    assert.equal(redactSecrets('export API_KEY="abc123" && rm -rf build'), 'export API_KEY="[redacted]" && rm -rf build')
+  })
+})

package/data/vscode-plugin/CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## 0.2.3
 
+- Approval text never hides part of a command. The value after a credential name is hidden only up to the first space, quote or piece of shell syntax, so `echo "password=" && rm -rf ~` and `eval TOKEN="x; rm -rf ~"` both show the `rm`. A private key block is hidden only when it holds nothing but the key.
 - Updates hands an approval back to VS Code promptly. The gate no longer waits for a phone answer that Updates never asks for, and it withdraws the phone question before VS Code asks. An answer that arrives in that moment still counts.
 - With no phone or other notification channel connected, VS Code's prompt says "No device connected, approve here." instead of naming a delivery mode.
 - Approval questions carry the repository and the tool name the gate judged, so routing and repository rules apply to the question as they did to the gate. A file edit is asked about with its full path, so path rules and routing match it. A path longer than 80 characters falls back to the file type instead of making the question fail.

package/data/vscode-plugin/scripts/pushary-gate.mjs

@@ -338,7 +338,7 @@ const ACTION_BODY_TRUNCATION_MARKER = '\n… [truncated]'
 // scrubbed was the action body. The question and the notification body carried
 // the raw command.
 const REDACTION_RULES = [
-  [/-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z0-9 ]*PRIVATE KEY-----/g, '[redacted key]'],
+  [/-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----(?:\r?\n|(?:\\r)?\\n)?(?:(?:Proc-Type|DEK-Info): [A-Za-z0-9,-]+(?:\r?\n|(?:\\r)?\\n))*(?:[A-Za-z0-9+/=\r\n]|\\[rn])*?-----END[A-Z0-9 ]*PRIVATE KEY-----/g, '[redacted key]'],
   [/\bsk-[A-Za-z0-9_-]{16,}\b/g, '[redacted]'],
   [/\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, '[redacted]'],
   [/\bwhsec_[A-Za-z0-9]{16,}\b/g, '[redacted]'],
@@ -352,8 +352,8 @@ const REDACTION_RULES = [
   [/\bxai-[A-Za-z0-9]{16,}\b/g, '[redacted]'],
   [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, '[redacted]'],
   [/\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, 'bearer [redacted]'],
-  [/\bauthorization:\s*\S+/gi, 'authorization: [redacted]'],
-  [/((?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[=:]\s*)("[^"]*"|'[^']*'|\S+)/gi, '$1[redacted]'],
+  [/\bauthorization:\s*(?:[A-Za-z0-9_\-./+=:@%^!#]|\\[^\s'"])+/gi, 'authorization: [redacted]'],
+  [/((?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)["']?(?:[ \t]*:[ \t]*|[ \t]+=[ \t]*|=))(?:(")(?:[A-Za-z0-9_\-./+=:@%^!#]|\\[^\s'"])*"|(')[A-Za-z0-9_\-./+=:@%^!#\\]*'|(["']?)(?:[A-Za-z0-9_\-./+=:@%^!#]|\\[^\s'"])+)/gi, '$1$2$3$4[redacted]$2$3'],
 ]
 const HIGH_ENTROPY_RULE = [/[A-Za-z0-9+/]{40,}={0,2}/g, '[redacted]']
 const redactSecrets = (text) => REDACTION_RULES.reduce((acc, [pattern, replacement]) => acc.replace(pattern, replacement), text)

package/dist/bin/pushary-bell-hook.js

@@ -1,38 +1,38 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-55RO62FV.js";
+} from "../chunk-IWJKSIB4.js";
 import {
   readHookInput
-} from "../chunk-7GI6QC3M.js";
-import "../chunk-7GYGVQBU.js";
+} from "../chunk-7RUJKCR4.js";
+import "../chunk-OTNOANMX.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-SVEMF2VO.js";
-import "../chunk-XMN37YJH.js";
-import "../chunk-MWVCDP64.js";
-import "../chunk-XDASEYRS.js";
-import "../chunk-AAGLDXH4.js";
-import "../chunk-WZWXBTRF.js";
-import "../chunk-XPMOCJHN.js";
-import "../chunk-O5JD7UI5.js";
-import "../chunk-OTZHT34O.js";
-import "../chunk-XPTCPU6V.js";
+import "../chunk-TCVMK6GI.js";
+import "../chunk-BGBLLHZ4.js";
+import "../chunk-3EUBQARL.js";
+import "../chunk-WTJM7PSL.js";
+import "../chunk-ZKJ34T2F.js";
+import "../chunk-MIXWMA73.js";
+import "../chunk-NOI3XTCY.js";
+import "../chunk-P2VIBGXA.js";
+import "../chunk-WPX67AKT.js";
+import "../chunk-LPNJLKBQ.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-4C4NRDIC.js";
-import "../chunk-KSNAAMU5.js";
+import "../chunk-EUGNVLMG.js";
+import "../chunk-N5MZH5A6.js";
 import "../chunk-POFBE6ZY.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-YZKS3ME3.js";
-import "../chunk-JTQDP4ZL.js";
-import "../chunk-P5CBNSYL.js";
+import "../chunk-D6OODZCM.js";
+import "../chunk-DUQO4C4I.js";
+import "../chunk-OVC5QXN5.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-UPKP67TA.js";
-import "../chunk-454KMJHF.js";
+import "../chunk-62CVUUNU.js";
+import "../chunk-MZBRL5H5.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-OAL44FM2.js";
-import "../chunk-EIZW73P5.js";
-import "../chunk-XFNVG3OV.js";
+import "../chunk-R6OYCUNK.js";
+import "../chunk-YYCTF4Q5.js";
+import "../chunk-G4GLCLKK.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,37 +5,37 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-55RO62FV.js";
+} from "../chunk-IWJKSIB4.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-XPMOCJHN.js";
+} from "../chunk-NOI3XTCY.js";
 import {
   createIo
-} from "../chunk-O5PRIYFZ.js";
+} from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-6PV2JQ64.js";
+} from "../chunk-5S2VBSJI.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-YZKS3ME3.js";
+import "../chunk-D6OODZCM.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-UPKP67TA.js";
+import "../chunk-62CVUUNU.js";
 import {
   claudeSettings
-} from "../chunk-454KMJHF.js";
+} from "../chunk-MZBRL5H5.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-T7E75EKA.js";
-import "../chunk-OAL44FM2.js";
-import "../chunk-EIZW73P5.js";
-import "../chunk-XFNVG3OV.js";
+import "../chunk-R6OYCUNK.js";
+import "../chunk-YYCTF4Q5.js";
+import "../chunk-G4GLCLKK.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,58 +8,62 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-SNWNA3MQ.js";
+} from "../chunk-LHC45YUC.js";
 import {
+  announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-YHG74UFF.js";
+} from "../chunk-5OP5MQI7.js";
 import {
   claudeTranscriptPath,
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-7GYGVQBU.js";
+} from "../chunk-OTNOANMX.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-SVEMF2VO.js";
-import "../chunk-XMN37YJH.js";
-import "../chunk-MWVCDP64.js";
-import "../chunk-XDASEYRS.js";
+import "../chunk-TCVMK6GI.js";
+import "../chunk-BGBLLHZ4.js";
+import "../chunk-3EUBQARL.js";
+import "../chunk-WTJM7PSL.js";
 import {
   ensureDaemonRunning
-} from "../chunk-AAGLDXH4.js";
-import "../chunk-WZWXBTRF.js";
-import "../chunk-XPMOCJHN.js";
+} from "../chunk-ZKJ34T2F.js";
+import "../chunk-MIXWMA73.js";
+import "../chunk-NOI3XTCY.js";
 import {
   encryptRecord
-} from "../chunk-O5JD7UI5.js";
-import "../chunk-OTZHT34O.js";
+} from "../chunk-P2VIBGXA.js";
+import "../chunk-WPX67AKT.js";
 import {
   transcriptsEnabled
-} from "../chunk-XPTCPU6V.js";
+} from "../chunk-LPNJLKBQ.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import {
-  DEFAULT_SESSION,
   UNNAMED_ACTION,
   deriveToolTarget,
   describeToolCall,
   fetchModeState,
   getPolicy,
+  phoneDrivenEnv,
+  repoKeyFor,
+  reportEvent,
+  scopePathFor
+} from "../chunk-U6RVDUJ5.js";
+import {
+  DEFAULT_SESSION,
   markPendingCommandDelivered,
   markPendingCommandFailed,
-  phoneDrivenEnv,
   readPendingCommand,
   readPendingCommandById,
   removePendingCommand,
-  repoKeyFor,
-  reportEvent,
-  savePendingCommand,
-  scopePathFor
-} from "../chunk-WM3U2RUK.js";
-import "../chunk-4C4NRDIC.js";
+  savePendingCommand
+} from "../chunk-N6IOSZOE.js";
+import "../chunk-EUGNVLMG.js";
 import {
   DECISION_STOP_REASON,
+  UNVERIFIABLE_APPROVAL_REASON,
   askUser,
   cancelQuestion,
   isDecisionStopped,
@@ -67,33 +71,36 @@ import {
   nextLongPollMs,
   waitForAnswer,
   withdrawQuestion
-} from "../chunk-ZIIYTQHC.js";
-import "../chunk-KSNAAMU5.js";
+} from "../chunk-YC27PROF.js";
+import "../chunk-N5MZH5A6.js";
 import "../chunk-POFBE6ZY.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-YZKS3ME3.js";
-import "../chunk-NQFGVAT6.js";
-import "../chunk-JTQDP4ZL.js";
+import "../chunk-D6OODZCM.js";
+import {
+  SubscriptionRequiredError
+} from "../chunk-VE7TXLR4.js";
+import "../chunk-EEEJ2JIL.js";
+import "../chunk-DUQO4C4I.js";
 import {
   getMachineId
-} from "../chunk-P5CBNSYL.js";
+} from "../chunk-OVC5QXN5.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-UPKP67TA.js";
-import "../chunk-454KMJHF.js";
+import "../chunk-62CVUUNU.js";
+import "../chunk-MZBRL5H5.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-OAL44FM2.js";
+} from "../chunk-R6OYCUNK.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-EIZW73P5.js";
+} from "../chunk-YYCTF4Q5.js";
 import {
   KILL_REASON,
-  redactSecrets,
+  redactSecretsFromContent,
   resolveGate
-} from "../chunk-XFNVG3OV.js";
+} from "../chunk-G4GLCLKK.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {
@@ -154,7 +161,7 @@ var redactDraft = (text, complete = false) => {
     const close = text.indexOf(match[1], match.index + match[0].length);
     if (close < 0 || close >= end) end = Math.min(end, match.index);
   }
-  return redactSecrets(text.slice(0, end));
+  return redactSecretsFromContent(text.slice(0, end));
 };
 var DraftText = class {
   messageId = "";
@@ -425,6 +432,8 @@ var BoundedInputQueue = class {
 
 // src/wrapper/approver.ts
 var DEFAULT_MAX_CONCURRENT = 16;
+var NO_LOCAL_APPROVAL_UI = "This remote session has no local approval UI. Continue in an interactive session or choose a mode that permits remote approval.";
+var SUBSCRIPTION_REQUIRED_NO_LOCAL_APPROVAL_UI = "Your Pushary workspace has no active subscription, so approvals cannot reach your phone, and this remote session has no local approval UI. Continue in an interactive session.";
 var DEFAULT_APPROVAL_WINDOW_MS = 5 * 6e4;
 var MAX_APPROVAL_WINDOW_MS = 30 * 6e4;
 var allow = (input) => ({
@@ -528,8 +537,10 @@ var createRemoteApprover = (deps) => {
           toolTarget,
           repoKey: repoKeyFor(deps.cwd)
         });
-      } catch {
-        return deny("Pushary could not create a verifiable approval. Retry the action.");
+      } catch (error) {
+        if (!(error instanceof SubscriptionRequiredError)) return deny(UNVERIFIABLE_APPROVAL_REASON);
+        announceSubscriptionRequired(error.upgradeUrl, sessionId);
+        return deny(SUBSCRIPTION_REQUIRED_NO_LOCAL_APPROVAL_UI);
       }
       if (isDecisionStopped(question)) return deny(DECISION_STOP_REASON);
       entry.correlationId = question.correlationId;
@@ -546,7 +557,7 @@ var createRemoteApprover = (deps) => {
         if (isDeferAnswer(answer.value)) return deny("Deferred \u2014 handle it on the machine");
         return answer.value === "yes" ? allow(input) : deny("Denied from your phone");
       }
-      if (localHandoff) return deny("This remote session has no local approval UI. Continue in an interactive session or choose a mode that permits remote approval.");
+      if (localHandoff) return deny(NO_LOCAL_APPROVAL_UI);
       return applyTimeout(policy, input);
     } catch {
       return deny("Approval unavailable; denied by default");