@pushary/agent-hooks 1.7.3 → 1.8.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 1.8.1
+
+- The CLI is now also published as `pushary`, from the same build as `@pushary/agent-hooks`, and the commands it prints now show `npx pushary@latest`. `npx @pushary/agent-hooks@latest` keeps working.
+
+## 1.8.0
+
+- **An approval you give after auto mode blocks a call is no longer lost when the agent rewords the call.** Your approval covers only the exact call that was blocked. Claude Code tells the agent only that it may retry, and an agent that sent a changed command was blocked again, so the approval you gave from your phone or the Mac notch did nothing. Pushary now refuses the first changed call and tells the agent to send the blocked call again unchanged. If the agent ends its turn without sending it, Pushary tells it to send it.
+- Claude Code no longer tells your phone and the Mac notch that it is waiting for you while its background tasks are still running. Claude Code reports itself idle after a minute at the prompt even when it will continue by itself once those tasks finish. A question from the agent still reaches you as before.
+- A prompt longer than 500 characters, or a shell command longer than about 490, no longer stops your agent at its next phone approval. The hook sent the whole text and the server refused it, so Claude Code halted with "Pushary could not create a verifiable approval" and Codex and OpenCode denied the call. The question, intent, action, blocker and agent name are now cut to what the card can show, and a cut line ends in "…". The server now does the same for every older CLI, so this fix does not wait for you to update. (#1604)
+- A line cut to fit, including a long diff, never ends on half an emoji. The server stores these lines as JSON, and Postgres refuses a half character, so the approval failed to save.
+- `pushary doctor`, `pushary upgrade`, `pushary clean` and automatic updates recognise a global install under either package name, `@pushary/agent-hooks` or `pushary`. A machine keeps the name it already has, and setup on a new machine installs the name it was run from. Nothing changes for an existing install.
+- `pushary doctor` flags a machine with both names installed globally, because uninstalling either one removes every Pushary command.
+- `pushary upgrade` no longer installs over an automatic update that is still running. It says another upgrade is running, with its process id, and stops.
+
 ## 1.7.3
 
 - **Approval text never hides part of a command.** The value after a credential name is now hidden only up to the first space, quote or piece of shell syntax. 1.7.2 could still hide a command: `eval TOKEN="x; rm -rf ~"` read `eval TOKEN="[redacted]"`, `password= reboot` read `password= [redacted]`, and `rm -rf {password=x,/}` hid the `,/` that also deletes `/`. A private key block is hidden only when it holds nothing but the key. Tokens, keys and quoted values without spaces are hidden as before. A quoted value with spaces now shows what follows its first word, as in `--password='[redacted] pass'`. Logs and error reports still hide the whole value.

package/README.md

@@ -1,15 +1,15 @@
-# @pushary/agent-hooks
+# Pushary
 
-[![npm version](https://img.shields.io/npm/v/@pushary/agent-hooks.svg)](https://www.npmjs.com/package/@pushary/agent-hooks)
-[![npm downloads](https://img.shields.io/npm/dm/@pushary/agent-hooks.svg)](https://www.npmjs.com/package/@pushary/agent-hooks)
-[![license](https://img.shields.io/npm/l/@pushary/agent-hooks.svg)](./LICENSE)
+[![npm version](https://img.shields.io/npm/v/pushary.svg)](https://www.npmjs.com/package/pushary)
+[![npm downloads](https://img.shields.io/npm/dm/pushary.svg)](https://www.npmjs.com/package/pushary)
+[![license](https://img.shields.io/npm/l/pushary.svg)](./LICENSE)
 
 Push notifications, questions, and permission approvals for AI agents. Get a push when your agent finishes work, answer its questions from your phone, and approve risky commands before they run. Works with Claude Code, Codex, Cursor, VS Code, OpenCode, Gemini CLI, Hermes, and fx.
 
 Your agent froze waiting for a yes. This is how it reaches you.
 
 ```bash
-npx @pushary/agent-hooks@latest setup
+npx pushary@latest setup
 ```
 
 One command wires up the MCP server, the permission hooks, and the agent instruction files. Then you close your laptop and the agent still reaches you.
@@ -30,7 +30,7 @@ If your agent runs in front of you and you only need to know when it finishes,
 you do not need any of the above and you should not pay for it:
 
 ```bash
-npx @pushary/agent-hooks@latest bell
+npx pushary@latest bell
 ```
 
 That is the whole thing. It makes a noise in your terminal and raises a desktop
@@ -80,7 +80,7 @@ talking. Set `PUSHARY_BELL_QUIET=1` if you would rather it never mentioned it.
 Run setup:
 
 ```bash
-npx @pushary/agent-hooks@latest setup
+npx pushary@latest setup
 ```
 
 It shows a QR code and short link. Open either in the Pushary app, check that the
@@ -91,15 +91,35 @@ pairing.
 For CI or another non-interactive install, pass an existing key explicitly:
 
 ```bash
-npx @pushary/agent-hooks@latest setup --key pk_xxx.sk_xxx --skip-phone
+npx pushary@latest setup --key pk_xxx.sk_xxx --skip-phone
 ```
 
 Verify it worked:
 
 ```bash
-npx @pushary/agent-hooks@latest doctor
+npx pushary@latest doctor
 ```
 
+Setup installs this package globally with npm, at the version you ran, because the
+hooks run from that install. You never install it by hand.
+
+## Remove it
+
+```bash
+npx pushary@latest clean
+```
+
+It removes the hooks, the MCP entries, the stored key and the background service.
+Add `--dry-run` to see what it would remove first.
+
+## One package, two names
+
+`pushary` and `@pushary/agent-hooks` are the same build, published at the same
+version. Every older command keeps working: `npx @pushary/agent-hooks@latest setup`
+does exactly what `npx pushary@latest setup` does.
+
+`pip install pushary` is a different package: the Pushary Python SDK.
+
 ## Supported agents
 
 | Agent | Notify | Ask | Gate |
@@ -215,19 +235,19 @@ defaults rather than waiting for a keypress that can never arrive.
 
 ```bash
 # Everything detected on this machine, no prompts
-npx @pushary/agent-hooks@latest setup --key-stdin --yes --skip-phone < key.txt
+npx pushary@latest setup --key-stdin --yes --skip-phone < key.txt
 
 # Named agents only
-npx @pushary/agent-hooks@latest setup --agents claude_code,codex --yes --skip-phone
+npx pushary@latest setup --agents claude_code,codex --yes --skip-phone
 
 # Store the key and configure nothing
-npx @pushary/agent-hooks@latest setup --agents none --yes
+npx pushary@latest setup --agents none --yes
 
 # Show what would be written, change nothing
-npx @pushary/agent-hooks@latest setup --agents auto --dry-run
+npx pushary@latest setup --agents auto --dry-run
 
 # One machine-readable object on stdout; every human line goes to stderr
-npx @pushary/agent-hooks@latest setup --agents auto --yes --json
+npx pushary@latest setup --agents auto --yes --json
 ```
 
 Prefer `--key-stdin` over `--key` in CI: `--key` puts the secret in argv, where
@@ -240,9 +260,9 @@ that failed), `130` cancelled with Ctrl-C.
 Examples:
 
 ```bash
-npx @pushary/agent-hooks@latest mode push_only --for 30m
-npx @pushary/agent-hooks@latest wait 45
-npx @pushary/agent-hooks@latest clean
+npx pushary@latest mode push_only --for 30m
+npx pushary@latest wait 45
+npx pushary@latest clean
 ```
 
 ## Updates
@@ -254,7 +274,7 @@ already run from, then refreshes each agent's config the way `pushary upgrade` d
 The session does not wait for it, and the new version runs from the next hook call.
 
 - It stays within the same major version. A new major shows in `pushary doctor`, and
-  you move to it with `npx @pushary/agent-hooks@latest upgrade`.
+  you move to it with `npx pushary@latest upgrade`.
 - It only updates a global npm install. A copy run through `npx`, a plugin, or the Mac
   app updates by its own route.
 - It never uses `sudo`. If npm cannot write to the global folder, the attempt is
@@ -311,7 +331,7 @@ MIT
 
 ## Claude Desktop and Cowork
 
-Run `pushary cowork` (or `npx @pushary/agent-hooks@latest cowork`) for connector setup. `pushary setup --agents cowork` opens the same setup path without storing a CLI key or writing hooks. Add the OAuth URL in Claude and sign in with the account used by your Pushary phone/Mac app.
+Run `pushary cowork` (or `npx pushary@latest cowork`) for connector setup. `pushary setup --agents cowork` opens the same setup path without storing a CLI key or writing hooks. Add the OAuth URL in Claude and sign in with the account used by your Pushary phone/Mac app.
 
 Use `pushary cowork --instructions` for standing instructions or `pushary cowork --skill > SKILL.md` to export the bundled skill for upload. `--json` reports `manual_setup_required`; printing a link does not prove a connection. Ask a test question in Claude, answer it in Pushary, and verify Claude receives it.
 

package/data/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pushary
-version: 0.11.1
+version: 0.11.2
 description: Push notifications and human-in-the-loop for AI agents. Use this whenever a running agent needs a human and nobody is at the terminal, such as before an irreversible or destructive action, before spending money, deploying, force-pushing or deleting, when blocked on a decision outside your authority, when running unattended and you hit a genuine ambiguity, when another skill's workflow says to confirm with the user, and when a long task finishes or fails with nobody watching. Also use it when the user says things like keep going and ping me on my phone if you need anything, notify me when my agent needs me, approve from my phone, ask me questions while I am away from the terminal, run this overnight, keep working while I am in a meeting, I am stepping away, do not wait for me, or wants a long task to run unattended. Send alerts when tasks finish or fail, ask questions (yes/no, multiple choice, or free text) via push, and get answers from their connected devices. Use these tools proactively - do not wait for the user to ask for notifications. Every question and answer is recorded, so an unattended run stays reviewable afterwards. Works with Claude Code, Codex, Cursor, VS Code, Windsurf, Hermes, Lovable, or any MCP client; no Claude Max subscription required. Pushary is a hosted service, $9.99/mo after a 3-day card-first trial.
 metadata:
   hermes:
@@ -203,7 +203,7 @@ into the agent configuration files it wires, not into `~/.pushary/config.json`.
 machine the app set up therefore prints `mac-app` and nothing else. Treat it as
 ready.
 
-Check it with `npx @pushary/agent-hooks@latest status --json`. The exit code is the answer:
+Check it with `npx pushary@latest status --json`. The exit code is the answer:
 
 | Code | Meaning |
 | --- | --- |
@@ -214,7 +214,7 @@ Check it with `npx @pushary/agent-hooks@latest status --json`. The exit code is
 | 6 | No device can answer |
 | 8 | Pushary could not be reached |
 
-On 6, the user needs to connect a phone: `npx @pushary/agent-hooks@latest connect`. That adds a phone and rewrites no agent configuration.
+On 6, the user needs to connect a phone: `npx pushary@latest connect`. That adds a phone and rewrites no agent configuration.
 
 If `mac-app` printed, the Mac app is installed here and it may also own the hooks. Read the hook command to know, because the command is the record:
 
@@ -241,7 +241,7 @@ The command line works on macOS too. Offer it if the user prefers the terminal,
 There is no Mac app for these machines. Use the command line. It is fully supported.
 
 ```bash
-npx @pushary/agent-hooks@latest setup
+npx pushary@latest setup
 ```
 
 Node 20.17+, 22.13+ or 23.5+ is necessary. Then the user needs a phone to answer on:
@@ -258,7 +258,7 @@ Run `setup`. It reads the key the app signed in with, so it mints no second key,
 ### What setup does
 
 ```bash
-npx @pushary/agent-hooks@latest setup
+npx pushary@latest setup
 ```
 
 Setup pairs first and configures MCP, hooks, permissions and the skill only once pairing succeeds. Until someone completes the steps below, nothing is written and this machine has no Pushary. Treat pairing as the task, not as a prompt to wait out.
@@ -281,7 +281,7 @@ If `PUSHARY_API_KEY` is already in the environment or in an existing MCP config,
 No app on their phone yet? They can get it at https://pushary.com/download. Or answer through the browser instead:
 
 ```bash
-npx @pushary/agent-hooks@latest setup --connect browser
+npx pushary@latest setup --connect browser
 ```
 
 This is web push, not a login tab. It prints a QR for the user's own subscribe page, and it waits for a browser on that page to subscribe. On iOS the user must first add that page to the Home Screen, because iOS sends web push only from an installed page.
@@ -291,7 +291,7 @@ Manual MCP configuration also works, but it needs a key, so the user signs up fi
 After setup, verify with:
 
 ```bash
-npx @pushary/agent-hooks@latest doctor
+npx pushary@latest doctor
 ```
 
 ## Answer surfaces and account boundaries
@@ -303,7 +303,7 @@ npx @pushary/agent-hooks@latest doctor
 | Slack | Answer through buttons, menus or text modals when the integration and intended recipient are configured. |
 | Browser | Open the decision page as a fallback; browser notification delivery requires permission. |
 
-Personal setup connects the operator's devices. For a Mac, install from https://pushary.com/download, sign in to the same personal account and connect your agents in the app. Run `npx @pushary/agent-hooks@latest doctor`, then request one harmless test question and verify it reaches the intended surface. Test phone fallback while away from the Mac; do not infer delivery from a successful API call alone.
+Personal setup connects the operator's devices. For a Mac, install from https://pushary.com/download, sign in to the same personal account and connect your agents in the app. Run `npx pushary@latest doctor`, then request one harmless test question and verify it reaches the intended surface. Test phone fallback while away from the Mac; do not infer delivery from a successful API call alone.
 
 Partner customers use scoped enrollment links issued by their application. Do not enroll them into the operator's account or send their decisions through personal tools. The Mac notch currently uses the personal account/session API; do not promise a Partner customer inbox on Mac. See https://pushary.com/docs/agents/embed for Partner setup.
 

package/data/cowork/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pushary-cowork
-version: 0.4.2
+version: 0.4.3
 description: Phone notifications and human-in-the-loop for Claude Cowork through the Pushary connector. Use inside a Cowork session whenever you need a human and nobody is watching the session, such as before an irreversible or destructive action, before spending money, deploying, force-pushing or deleting, when blocked on a decision outside your authority, when running unattended and you hit a genuine ambiguity, when another skill's workflow says to confirm with the user, and when a task finishes or fails with nobody watching. Also use it when the user says things like ping me on my phone when this is done, ask me before doing anything risky, keep me in the loop while I am away, or notify me if you get stuck. Sends completion alerts, asks questions (yes/no, multiple choice, or free text) via push, and gets answers from connected devices. This Pushary connector is cooperative; it does not install native Cowork permission hooks. Pushary is a hosted service, $9.99/mo after a 3-day card-first trial.
 metadata:
   tags: notifications, push, mcp, human-in-the-loop, cowork, claude, alerts, approvals
@@ -55,7 +55,7 @@ Delivery is controlled by the user's policy: `push_first` uses presence, `push_o
 | Slack | Answer through buttons, menus or text modals when the integration and intended recipient are configured. |
 | Browser | Open the decision page as a fallback; browser notification delivery requires permission. |
 
-Personal setup connects the operator's devices. For a Mac, install from https://pushary.com/download, sign in to the same personal account and connect your agents in the app. Run `npx @pushary/agent-hooks@latest cowork` for connector setup, then ask one harmless test question inside Cowork, answer it from Pushary, and verify Cowork receives the answer. CLI doctor checks do not verify a hosted connector. Test phone fallback while away from the Mac; do not infer delivery from a successful API call alone.
+Personal setup connects the operator's devices. For a Mac, install from https://pushary.com/download, sign in to the same personal account and connect your agents in the app. Run `npx pushary@latest cowork` for connector setup, then ask one harmless test question inside Cowork, answer it from Pushary, and verify Cowork receives the answer. CLI doctor checks do not verify a hosted connector. Test phone fallback while away from the Mac; do not infer delivery from a successful API call alone.
 
 Partner customers use scoped enrollment links issued by their application. Do not enroll them into the operator's account or send their decisions through personal tools. The Mac notch currently uses the personal account/session API; do not promise a Partner customer inbox on Mac. See https://pushary.com/docs/agents/embed for Partner setup.
 

package/data/cursor-plugin/README.md

@@ -35,7 +35,7 @@ Open the Marketplace panel in Cursor, search for Pushary, and click install. The
 This also sets up Claude Code, Codex, and Hermes if you use them.
 
 ```bash
-npx @pushary/agent-hooks@latest setup
+npx pushary@latest setup
 ```
 
 ### Option 3: Manual MCP
@@ -94,7 +94,7 @@ Timeout approvals apply only after the configured wait actually elapsed. Short e
 
 ## Development
 
-`skills/pushary/SKILL.md` mirrors the Pushary skill that ships with `@pushary/agent-hooks`. Keep the two the same.
+`skills/pushary/SKILL.md` mirrors the Pushary skill that ships with the Pushary CLI (`pushary` on npm). Keep the two the same.
 
 Test the plugin locally before publishing:
 

package/data/cursor-plugin/scripts/pushary-gate.mjs

@@ -2,6 +2,8 @@
 // Pushary Cursor hooks: server policy, fenced phone approvals, and lifecycle telemetry.
 // Dependency-free for marketplace installs. Regenerate agent-hooks/data after edits.
 
+import { redactSecrets, redactSecretsDeep } from './redaction.mjs'
+export { redactSecrets } from './redaction.mjs'
 import { createHash, randomUUID } from 'node:crypto'
 import { hostname } from 'node:os'
 import { existsSync, readFileSync } from 'node:fs'
@@ -294,27 +296,6 @@ export const describeNetworkFailure = (error, env = process.env) => {
 // line reached the lock screen verbatim.
 const ACTION_BODY_MAX = 4000
 const ACTION_BODY_TRUNCATION_MARKER = '\n… [truncated]'
-const REDACTION_RULES = [
-  [/-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----(?:\r?\n|(?:\\r)?\\n)?(?:(?:Proc-Type|DEK-Info): [A-Za-z0-9,-]+(?:\r?\n|(?:\\r)?\\n))*(?:[A-Za-z0-9+/=\r\n]|\\[rn])*?-----END[A-Z0-9 ]*PRIVATE KEY-----/g, '[redacted key]'],
-  [/\bsk-[A-Za-z0-9_-]{16,}\b/g, '[redacted]'],
-  [/\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, '[redacted]'],
-  [/\bwhsec_[A-Za-z0-9]{16,}\b/g, '[redacted]'],
-  [/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, '[redacted]'],
-  [/\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, '[redacted]'],
-  [/\bglpat-[A-Za-z0-9_-]{20,}\b/g, '[redacted]'],
-  [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, '[redacted]'],
-  [/\bAIza[A-Za-z0-9_-]{35}\b/g, '[redacted]'],
-  [/\bAKIA[0-9A-Z]{16}\b/g, '[redacted]'],
-  [/\bnpm_[A-Za-z0-9]{36}\b/g, '[redacted]'],
-  [/\bxai-[A-Za-z0-9]{16,}\b/g, '[redacted]'],
-  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, '[redacted]'],
-  [/\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, 'bearer [redacted]'],
-  [/\bauthorization:\s*(?:[A-Za-z0-9_\-./+=:@%^!#]|\\[^\s'"])+/gi, 'authorization: [redacted]'],
-  [/((?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)["']?(?:[ \t]*:[ \t]*|[ \t]+=[ \t]*|=))(?:(")(?:[A-Za-z0-9_\-./+=:@%^!#]|\\[^\s'"])*"|(')[A-Za-z0-9_\-./+=:@%^!#\\]*'|(["']?)(?:[A-Za-z0-9_\-./+=:@%^!#]|\\[^\s'"])+)/gi, '$1$2$3$4[redacted]$2$3'],
-]
-const HIGH_ENTROPY_RULE = [/[A-Za-z0-9+/]{40,}={0,2}/g, '[redacted]']
-export const redactSecrets = (text) => REDACTION_RULES.reduce((acc, [pattern, replacement]) => acc.replace(pattern, replacement), text)
-const redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE[0], HIGH_ENTROPY_RULE[1])
 const capActionBody = (text) =>
   text.length <= ACTION_BODY_MAX ? text : `${text.slice(0, ACTION_BODY_MAX - ACTION_BODY_TRUNCATION_MARKER.length)}${ACTION_BODY_TRUNCATION_MARKER}`
 const deriveActionBody = (command) => capActionBody(redactSecretsDeep(command))

package/data/cursor-plugin/scripts/redaction.mjs

@@ -0,0 +1,53 @@
+// Generated by scripts/generate-editor-redaction.mjs.
+const CREDENTIAL_NAME = String.raw `(?:authorization|secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)["']?`;
+const CREDENTIAL_KEY = String.raw `${CREDENTIAL_NAME}\s*[=:]\s*`;
+const DISPLAYED_CREDENTIAL_KEY = String.raw `${CREDENTIAL_NAME}(?:[ \t]*:[ \t]*|[ \t]+=[ \t]*|=)`;
+const SHELL_INERT_UNIT = String.raw `(?:[A-Za-z0-9_\-./+=:@%^!#]|\\[^\s'"])`;
+const SHELL_INERT_SINGLE_QUOTED_UNIT = String.raw `[A-Za-z0-9_\-./+=:@%^!#\\]`;
+const SHELL_INERT_URL_PASSWORD_UNIT = String.raw `(?:[A-Za-z0-9_\-.+=:%^!#]|\\[^\s'"@/])`;
+const PEM_LINE_BREAK = String.raw `(?:\r?\n|(?:\\r)?\\n)`;
+const credentialAssignmentRule = (key, doubleQuoted, singleQuoted, bare) => ({
+    pattern: new RegExp(String.raw `(${key})(?:(")${doubleQuoted}|(')${singleQuoted}|(["']?)${bare})`, 'gi'),
+    replacement: '$1$2$3$4[redacted]$2$3',
+});
+const DISPLAYED_SECRET_SHAPES = {
+    separator: String.raw `[ \t]`,
+    privateKeyBody: String.raw `${PEM_LINE_BREAK}?(?:(?:Proc-Type|DEK-Info): [A-Za-z0-9,-]+${PEM_LINE_BREAK})*(?:[A-Za-z0-9+/=\r\n]|\\[rn])*?`,
+    urlPassword: `${SHELL_INERT_URL_PASSWORD_UNIT}+`,
+    authorizationValue: `${SHELL_INERT_UNIT}+`,
+    credentialAssignment: credentialAssignmentRule(DISPLAYED_CREDENTIAL_KEY, `${SHELL_INERT_UNIT}*"`, `${SHELL_INERT_SINGLE_QUOTED_UNIT}*'`, `${SHELL_INERT_UNIT}+`),
+};
+const CUT_OFF_SECRET_SHAPES = {
+    separator: String.raw `\s`,
+    privateKeyBody: String.raw `[\s\S]*?`,
+    urlPassword: String.raw `[^\s@/]+`,
+    authorizationValue: String.raw `\S+`,
+    credentialAssignment: credentialAssignmentRule(CREDENTIAL_KEY, String.raw `(?:\\[\s\S]|[^"\\])*(?:"|\\?$)`, "[^']*(?:'|$)", String.raw `\S+`),
+};
+const secretRedactionRules = (shapes) => [
+    { pattern: /\bpk_[A-Za-z0-9_]+\.[A-Za-z0-9_]+/g, replacement: '[redacted]' },
+    { pattern: new RegExp(String.raw `-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----${shapes.privateKeyBody}-----END[A-Z0-9 ]*PRIVATE KEY-----`, 'g'), replacement: '[redacted key]' },
+    { pattern: /\bsk-[A-Za-z0-9_-]{16,}\b/g, replacement: '[redacted]' },
+    { pattern: /\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bwhsec_[A-Za-z0-9]{16,}\b/g, replacement: '[redacted]' },
+    { pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bglpat-[A-Za-z0-9_-]{20,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g, replacement: '[redacted]' },
+    { pattern: /\bAKIA[0-9A-Z]{16}\b/g, replacement: '[redacted]' },
+    { pattern: /\bnpm_[A-Za-z0-9]{36}\b/g, replacement: '[redacted]' },
+    { pattern: /\bxai-[A-Za-z0-9]{16,}\b/g, replacement: '[redacted]' },
+    { pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, replacement: '[redacted]' },
+    { pattern: new RegExp(String.raw `\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)${shapes.urlPassword}@`, 'gi'), replacement: '$1[redacted]@' },
+    { pattern: new RegExp(String.raw `\bbearer${shapes.separator}+[A-Za-z0-9._~+/=-]+`, 'gi'), replacement: 'bearer [redacted]' },
+    { pattern: new RegExp(String.raw `\bauthorization:${shapes.separator}*${shapes.authorizationValue}`, 'gi'), replacement: 'authorization: [redacted]' },
+    shapes.credentialAssignment,
+];
+export const SECRET_REDACTION_RULES = secretRedactionRules(DISPLAYED_SECRET_SHAPES);
+const CUT_OFF_TEXT_REDACTION_RULES = secretRedactionRules(CUT_OFF_SECRET_SHAPES);
+const HIGH_ENTROPY_RULE = { pattern: /[A-Za-z0-9+/]{40,}={0,2}/g, replacement: '[redacted]' };
+const applyRedactionRules = (rules, text) => rules.reduce((acc, rule) => acc.replace(rule.pattern, rule.replacement), text);
+export const redactSecrets = (text) => applyRedactionRules(SECRET_REDACTION_RULES, text);
+export const redactSecretsFromContent = (text) => applyRedactionRules(CUT_OFF_TEXT_REDACTION_RULES, text);
+export const redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE.pattern, HIGH_ENTROPY_RULE.replacement);

package/data/cursor-plugin/skills/pushary/SKILL.md

@@ -196,7 +196,7 @@ into the agent configuration files it wires, not into `~/.pushary/config.json`.
 machine the app set up therefore prints `mac-app` and nothing else. Treat it as
 ready.
 
-Check it with `npx @pushary/agent-hooks@latest status --json`. The exit code is the answer:
+Check it with `npx pushary@latest status --json`. The exit code is the answer:
 
 | Code | Meaning |
 | --- | --- |
@@ -207,7 +207,7 @@ Check it with `npx @pushary/agent-hooks@latest status --json`. The exit code is
 | 6 | No device can answer |
 | 8 | Pushary could not be reached |
 
-On 6, the user needs to connect a phone: `npx @pushary/agent-hooks@latest connect`. That adds a phone and rewrites no agent configuration.
+On 6, the user needs to connect a phone: `npx pushary@latest connect`. That adds a phone and rewrites no agent configuration.
 
 If `mac-app` printed, the Mac app is installed here and it may also own the hooks. Read the hook command to know, because the command is the record:
 
@@ -234,7 +234,7 @@ The command line works on macOS too. Offer it if the user prefers the terminal,
 There is no Mac app for these machines. Use the command line. It is fully supported.
 
 ```bash
-npx @pushary/agent-hooks@latest setup
+npx pushary@latest setup
 ```
 
 Node 20.17+, 22.13+ or 23.5+ is necessary. Then the user needs a phone to answer on:
@@ -251,7 +251,7 @@ Run `setup`. It reads the key the app signed in with, so it mints no second key,
 ### What setup does
 
 ```bash
-npx @pushary/agent-hooks@latest setup
+npx pushary@latest setup
 ```
 
 Setup pairs first and configures MCP, hooks, permissions and the skill only once pairing succeeds. Until someone completes the steps below, nothing is written and this machine has no Pushary. Treat pairing as the task, not as a prompt to wait out.
@@ -274,7 +274,7 @@ If `PUSHARY_API_KEY` is already in the environment or in an existing MCP config,
 No app on their phone yet? They can get it at https://pushary.com/download. Or answer through the browser instead:
 
 ```bash
-npx @pushary/agent-hooks@latest setup --connect browser
+npx pushary@latest setup --connect browser
 ```
 
 This is web push, not a login tab. It prints a QR for the user's own subscribe page, and it waits for a browser on that page to subscribe. On iOS the user must first add that page to the Home Screen, because iOS sends web push only from an installed page.
@@ -284,7 +284,7 @@ Manual MCP configuration also works, but it needs a key, so the user signs up fi
 After setup, verify with:
 
 ```bash
-npx @pushary/agent-hooks@latest doctor
+npx pushary@latest doctor
 ```
 
 ## Answer surfaces and account boundaries
@@ -296,7 +296,7 @@ npx @pushary/agent-hooks@latest doctor
 | Slack | Answer through buttons, menus or text modals when the integration and intended recipient are configured. |
 | Browser | Open the decision page as a fallback; browser notification delivery requires permission. |
 
-Personal setup connects the operator's devices. For a Mac, install from https://pushary.com/download, sign in to the same personal account and connect your agents in the app. Run `npx @pushary/agent-hooks@latest doctor`, then request one harmless test question and verify it reaches the intended surface. Test phone fallback while away from the Mac; do not infer delivery from a successful API call alone.
+Personal setup connects the operator's devices. For a Mac, install from https://pushary.com/download, sign in to the same personal account and connect your agents in the app. Run `npx pushary@latest doctor`, then request one harmless test question and verify it reaches the intended surface. Test phone fallback while away from the Mac; do not infer delivery from a successful API call alone.
 
 Partner customers use scoped enrollment links issued by their application. Do not enroll them into the operator's account or send their decisions through personal tools. The Mac notch currently uses the personal account/session API; do not promise a Partner customer inbox on Mac. See https://pushary.com/docs/agents/embed for Partner setup.
 

package/data/vscode-plugin/README.md

@@ -35,13 +35,13 @@ There are three things.
 This installs the plugin, registers it with VS Code, and links your API key. It also sets up Claude Code, Codex, Cursor, and Hermes if you use them.
 
 ```bash
-npx @pushary/agent-hooks@latest setup
+npx pushary@latest setup
 ```
 
 To configure only VS Code:
 
 ```bash
-npx @pushary/agent-hooks@latest setup --agents vscode
+npx pushary@latest setup --agents vscode
 ```
 
 ### Option 2: Install from source
@@ -106,11 +106,11 @@ This repository uses the `.claude-plugin/plugin.json` layout, which VS Code, Git
 
 The layout is portable; this plugin is not meant to be. `hooks/hooks.json` uses VS Code's flat hook form, and the gate speaks VS Code's tool names, so treat this as a VS Code plugin that happens to sit in a portable folder shape.
 
-Claude Code users are served by `npx @pushary/agent-hooks@latest setup --agents claude_code`, which installs a hook built for Claude Code's own tool names and matcher format. Do not install this directory as a Claude Code plugin as well: at best it duplicates the MCP server, and the two installs would fight over the same approvals.
+Claude Code users are served by `npx pushary@latest setup --agents claude_code`, which installs a hook built for Claude Code's own tool names and matcher format. Do not install this directory as a Claude Code plugin as well: at best it duplicates the MCP server, and the two installs would fight over the same approvals.
 
 ## Development
 
-`skills/pushary/SKILL.md` mirrors the Pushary skill that ships with `@pushary/agent-hooks`. Keep the two the same.
+`skills/pushary/SKILL.md` mirrors the Pushary skill that ships with the Pushary CLI (`pushary` on npm). Keep the two the same.
 
 Test the gate without VS Code:
 

package/data/vscode-plugin/scripts/pushary-gate.mjs

@@ -2,6 +2,7 @@
 // Pushary VS Code hooks: server policy, fenced phone approvals, and lifecycle telemetry.
 // Dependency-free for marketplace installs. Regenerate agent-hooks/data after edits.
 
+import { redactSecrets, redactSecretsDeep } from './redaction.mjs'
 import { createHash, randomUUID } from 'node:crypto'
 import { homedir, hostname } from 'node:os'
 import { existsSync, readFileSync } from 'node:fs'
@@ -337,27 +338,6 @@ const ACTION_BODY_TRUNCATION_MARKER = '\n… [truncated]'
 // One combined list used to serve both, which meant the only text this gate
 // scrubbed was the action body. The question and the notification body carried
 // the raw command.
-const REDACTION_RULES = [
-  [/-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----(?:\r?\n|(?:\\r)?\\n)?(?:(?:Proc-Type|DEK-Info): [A-Za-z0-9,-]+(?:\r?\n|(?:\\r)?\\n))*(?:[A-Za-z0-9+/=\r\n]|\\[rn])*?-----END[A-Z0-9 ]*PRIVATE KEY-----/g, '[redacted key]'],
-  [/\bsk-[A-Za-z0-9_-]{16,}\b/g, '[redacted]'],
-  [/\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, '[redacted]'],
-  [/\bwhsec_[A-Za-z0-9]{16,}\b/g, '[redacted]'],
-  [/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, '[redacted]'],
-  [/\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, '[redacted]'],
-  [/\bglpat-[A-Za-z0-9_-]{20,}\b/g, '[redacted]'],
-  [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, '[redacted]'],
-  [/\bAIza[A-Za-z0-9_-]{35}\b/g, '[redacted]'],
-  [/\bAKIA[0-9A-Z]{16}\b/g, '[redacted]'],
-  [/\bnpm_[A-Za-z0-9]{36}\b/g, '[redacted]'],
-  [/\bxai-[A-Za-z0-9]{16,}\b/g, '[redacted]'],
-  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, '[redacted]'],
-  [/\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, 'bearer [redacted]'],
-  [/\bauthorization:\s*(?:[A-Za-z0-9_\-./+=:@%^!#]|\\[^\s'"])+/gi, 'authorization: [redacted]'],
-  [/((?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)["']?(?:[ \t]*:[ \t]*|[ \t]+=[ \t]*|=))(?:(")(?:[A-Za-z0-9_\-./+=:@%^!#]|\\[^\s'"])*"|(')[A-Za-z0-9_\-./+=:@%^!#\\]*'|(["']?)(?:[A-Za-z0-9_\-./+=:@%^!#]|\\[^\s'"])+)/gi, '$1$2$3$4[redacted]$2$3'],
-]
-const HIGH_ENTROPY_RULE = [/[A-Za-z0-9+/]{40,}={0,2}/g, '[redacted]']
-const redactSecrets = (text) => REDACTION_RULES.reduce((acc, [pattern, replacement]) => acc.replace(pattern, replacement), text)
-const redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE[0], HIGH_ENTROPY_RULE[1])
 const capActionBody = (text) =>
   text.length <= ACTION_BODY_MAX ? text : `${text.slice(0, ACTION_BODY_MAX - ACTION_BODY_TRUNCATION_MARKER.length)}${ACTION_BODY_TRUNCATION_MARKER}`
 const deriveActionBody = (command) => capActionBody(redactSecretsDeep(command))
@@ -723,9 +703,9 @@ const main = async () => {
 
   const apiKey = resolveApiKey()
   if (!apiKey) {
-    diag('no API key found (PUSHARY_API_KEY, the plugin .mcp.json, or ~/.pushary/config.json). Run: npx @pushary/agent-hooks@latest setup')
+    diag('no API key found (PUSHARY_API_KEY, the plugin .mcp.json, or ~/.pushary/config.json). Run: npx pushary@latest setup')
     return respond(
-      unresolved(input.tool_name, 'Pushary is not configured: run `npx @pushary/agent-hooks@latest setup` (get a key at https://pushary.com) to route this approval to your phone.')
+      unresolved(input.tool_name, 'Pushary is not configured: run `npx pushary@latest setup` (get a key at https://pushary.com) to route this approval to your phone.')
     )
   }
 

package/data/vscode-plugin/scripts/redaction.mjs

@@ -0,0 +1,53 @@
+// Generated by scripts/generate-editor-redaction.mjs.
+const CREDENTIAL_NAME = String.raw `(?:authorization|secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)["']?`;
+const CREDENTIAL_KEY = String.raw `${CREDENTIAL_NAME}\s*[=:]\s*`;
+const DISPLAYED_CREDENTIAL_KEY = String.raw `${CREDENTIAL_NAME}(?:[ \t]*:[ \t]*|[ \t]+=[ \t]*|=)`;
+const SHELL_INERT_UNIT = String.raw `(?:[A-Za-z0-9_\-./+=:@%^!#]|\\[^\s'"])`;
+const SHELL_INERT_SINGLE_QUOTED_UNIT = String.raw `[A-Za-z0-9_\-./+=:@%^!#\\]`;
+const SHELL_INERT_URL_PASSWORD_UNIT = String.raw `(?:[A-Za-z0-9_\-.+=:%^!#]|\\[^\s'"@/])`;
+const PEM_LINE_BREAK = String.raw `(?:\r?\n|(?:\\r)?\\n)`;
+const credentialAssignmentRule = (key, doubleQuoted, singleQuoted, bare) => ({
+    pattern: new RegExp(String.raw `(${key})(?:(")${doubleQuoted}|(')${singleQuoted}|(["']?)${bare})`, 'gi'),
+    replacement: '$1$2$3$4[redacted]$2$3',
+});
+const DISPLAYED_SECRET_SHAPES = {
+    separator: String.raw `[ \t]`,
+    privateKeyBody: String.raw `${PEM_LINE_BREAK}?(?:(?:Proc-Type|DEK-Info): [A-Za-z0-9,-]+${PEM_LINE_BREAK})*(?:[A-Za-z0-9+/=\r\n]|\\[rn])*?`,
+    urlPassword: `${SHELL_INERT_URL_PASSWORD_UNIT}+`,
+    authorizationValue: `${SHELL_INERT_UNIT}+`,
+    credentialAssignment: credentialAssignmentRule(DISPLAYED_CREDENTIAL_KEY, `${SHELL_INERT_UNIT}*"`, `${SHELL_INERT_SINGLE_QUOTED_UNIT}*'`, `${SHELL_INERT_UNIT}+`),
+};
+const CUT_OFF_SECRET_SHAPES = {
+    separator: String.raw `\s`,
+    privateKeyBody: String.raw `[\s\S]*?`,
+    urlPassword: String.raw `[^\s@/]+`,
+    authorizationValue: String.raw `\S+`,
+    credentialAssignment: credentialAssignmentRule(CREDENTIAL_KEY, String.raw `(?:\\[\s\S]|[^"\\])*(?:"|\\?$)`, "[^']*(?:'|$)", String.raw `\S+`),
+};
+const secretRedactionRules = (shapes) => [
+    { pattern: /\bpk_[A-Za-z0-9_]+\.[A-Za-z0-9_]+/g, replacement: '[redacted]' },
+    { pattern: new RegExp(String.raw `-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----${shapes.privateKeyBody}-----END[A-Z0-9 ]*PRIVATE KEY-----`, 'g'), replacement: '[redacted key]' },
+    { pattern: /\bsk-[A-Za-z0-9_-]{16,}\b/g, replacement: '[redacted]' },
+    { pattern: /\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bwhsec_[A-Za-z0-9]{16,}\b/g, replacement: '[redacted]' },
+    { pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bglpat-[A-Za-z0-9_-]{20,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g, replacement: '[redacted]' },
+    { pattern: /\bAKIA[0-9A-Z]{16}\b/g, replacement: '[redacted]' },
+    { pattern: /\bnpm_[A-Za-z0-9]{36}\b/g, replacement: '[redacted]' },
+    { pattern: /\bxai-[A-Za-z0-9]{16,}\b/g, replacement: '[redacted]' },
+    { pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, replacement: '[redacted]' },
+    { pattern: new RegExp(String.raw `\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)${shapes.urlPassword}@`, 'gi'), replacement: '$1[redacted]@' },
+    { pattern: new RegExp(String.raw `\bbearer${shapes.separator}+[A-Za-z0-9._~+/=-]+`, 'gi'), replacement: 'bearer [redacted]' },
+    { pattern: new RegExp(String.raw `\bauthorization:${shapes.separator}*${shapes.authorizationValue}`, 'gi'), replacement: 'authorization: [redacted]' },
+    shapes.credentialAssignment,
+];
+export const SECRET_REDACTION_RULES = secretRedactionRules(DISPLAYED_SECRET_SHAPES);
+const CUT_OFF_TEXT_REDACTION_RULES = secretRedactionRules(CUT_OFF_SECRET_SHAPES);
+const HIGH_ENTROPY_RULE = { pattern: /[A-Za-z0-9+/]{40,}={0,2}/g, replacement: '[redacted]' };
+const applyRedactionRules = (rules, text) => rules.reduce((acc, rule) => acc.replace(rule.pattern, rule.replacement), text);
+export const redactSecrets = (text) => applyRedactionRules(SECRET_REDACTION_RULES, text);
+export const redactSecretsFromContent = (text) => applyRedactionRules(CUT_OFF_TEXT_REDACTION_RULES, text);
+export const redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE.pattern, HIGH_ENTROPY_RULE.replacement);

package/data/vscode-plugin/skills/pushary/SKILL.md

@@ -196,7 +196,7 @@ into the agent configuration files it wires, not into `~/.pushary/config.json`.
 machine the app set up therefore prints `mac-app` and nothing else. Treat it as
 ready.
 
-Check it with `npx @pushary/agent-hooks@latest status --json`. The exit code is the answer:
+Check it with `npx pushary@latest status --json`. The exit code is the answer:
 
 | Code | Meaning |
 | --- | --- |
@@ -207,7 +207,7 @@ Check it with `npx @pushary/agent-hooks@latest status --json`. The exit code is
 | 6 | No device can answer |
 | 8 | Pushary could not be reached |
 
-On 6, the user needs to connect a phone: `npx @pushary/agent-hooks@latest connect`. That adds a phone and rewrites no agent configuration.
+On 6, the user needs to connect a phone: `npx pushary@latest connect`. That adds a phone and rewrites no agent configuration.
 
 If `mac-app` printed, the Mac app is installed here and it may also own the hooks. Read the hook command to know, because the command is the record:
 
@@ -234,7 +234,7 @@ The command line works on macOS too. Offer it if the user prefers the terminal,
 There is no Mac app for these machines. Use the command line. It is fully supported.
 
 ```bash
-npx @pushary/agent-hooks@latest setup
+npx pushary@latest setup
 ```
 
 Node 20.17+, 22.13+ or 23.5+ is necessary. Then the user needs a phone to answer on:
@@ -251,7 +251,7 @@ Run `setup`. It reads the key the app signed in with, so it mints no second key,
 ### What setup does
 
 ```bash
-npx @pushary/agent-hooks@latest setup
+npx pushary@latest setup
 ```
 
 Setup pairs first and configures MCP, hooks, permissions and the skill only once pairing succeeds. Until someone completes the steps below, nothing is written and this machine has no Pushary. Treat pairing as the task, not as a prompt to wait out.
@@ -274,7 +274,7 @@ If `PUSHARY_API_KEY` is already in the environment or in an existing MCP config,
 No app on their phone yet? They can get it at https://pushary.com/download. Or answer through the browser instead:
 
 ```bash
-npx @pushary/agent-hooks@latest setup --connect browser
+npx pushary@latest setup --connect browser
 ```
 
 This is web push, not a login tab. It prints a QR for the user's own subscribe page, and it waits for a browser on that page to subscribe. On iOS the user must first add that page to the Home Screen, because iOS sends web push only from an installed page.
@@ -284,7 +284,7 @@ Manual MCP configuration also works, but it needs a key, so the user signs up fi
 After setup, verify with:
 
 ```bash
-npx @pushary/agent-hooks@latest doctor
+npx pushary@latest doctor
 ```
 
 ## Answer surfaces and account boundaries
@@ -296,7 +296,7 @@ npx @pushary/agent-hooks@latest doctor
 | Slack | Answer through buttons, menus or text modals when the integration and intended recipient are configured. |
 | Browser | Open the decision page as a fallback; browser notification delivery requires permission. |
 
-Personal setup connects the operator's devices. For a Mac, install from https://pushary.com/download, sign in to the same personal account and connect your agents in the app. Run `npx @pushary/agent-hooks@latest doctor`, then request one harmless test question and verify it reaches the intended surface. Test phone fallback while away from the Mac; do not infer delivery from a successful API call alone.
+Personal setup connects the operator's devices. For a Mac, install from https://pushary.com/download, sign in to the same personal account and connect your agents in the app. Run `npx pushary@latest doctor`, then request one harmless test question and verify it reaches the intended surface. Test phone fallback while away from the Mac; do not infer delivery from a successful API call alone.
 
 Partner customers use scoped enrollment links issued by their application. Do not enroll them into the operator's account or send their decisions through personal tools. The Mac notch currently uses the personal account/session API; do not promise a Partner customer inbox on Mac. See https://pushary.com/docs/agents/embed for Partner setup.