@pushary/agent-hooks 1.9.9 → 1.9.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (103) hide show
  1. package/CHANGELOG.md +15 -0
  2. package/README.md +1 -1
  3. package/dist/bin/pushary-bell-hook.js +25 -21
  4. package/dist/bin/pushary-bell.js +9 -9
  5. package/dist/bin/pushary-claude.js +31 -34
  6. package/dist/bin/pushary-clean.js +108 -34
  7. package/dist/bin/pushary-codex-bridge.js +20 -22
  8. package/dist/bin/pushary-codex-hook.js +33 -36
  9. package/dist/bin/pushary-codex.js +12 -14
  10. package/dist/bin/pushary-connect.js +27 -29
  11. package/dist/bin/pushary-cowork.js +5 -5
  12. package/dist/bin/pushary-daemon.js +31 -33
  13. package/dist/bin/pushary-disconnect.js +29 -29
  14. package/dist/bin/pushary-doctor.js +60 -50
  15. package/dist/bin/pushary-elicitation-hook.js +26 -26
  16. package/dist/bin/pushary-gemini-bridge.js +13 -13
  17. package/dist/bin/pushary-gemini-hook.js +30 -33
  18. package/dist/bin/pushary-hook.js +31 -33
  19. package/dist/bin/pushary-login.js +12 -12
  20. package/dist/bin/pushary-logout.js +18 -78
  21. package/dist/bin/pushary-mcp.js +9 -9
  22. package/dist/bin/pushary-mode.js +12 -12
  23. package/dist/bin/pushary-notification-hook.js +24 -26
  24. package/dist/bin/pushary-opencode-hook.js +29 -32
  25. package/dist/bin/pushary-permission-denied-hook.js +29 -31
  26. package/dist/bin/pushary-permission-hook.js +28 -30
  27. package/dist/bin/pushary-post-hook.js +24 -26
  28. package/dist/bin/pushary-prompt-hook.js +24 -26
  29. package/dist/bin/pushary-session-end-hook.js +24 -26
  30. package/dist/bin/pushary-session-start-hook.js +28 -30
  31. package/dist/bin/pushary-setup.js +62 -46
  32. package/dist/bin/pushary-stats.js +5 -5
  33. package/dist/bin/pushary-status.js +30 -32
  34. package/dist/bin/pushary-stop-hook.js +24 -26
  35. package/dist/bin/pushary-stopfailure-hook.js +24 -26
  36. package/dist/bin/pushary-suggestions.js +12 -12
  37. package/dist/bin/pushary-transcript-register.js +17 -17
  38. package/dist/bin/pushary-transcripts.js +7 -7
  39. package/dist/bin/pushary-upgrade.js +30 -32
  40. package/dist/bin/pushary-wait.js +12 -12
  41. package/dist/bin/pushary.js +6 -6
  42. package/dist/{chunk-IIVZZMSO.js → chunk-2AQ4VZSA.js} +1 -1
  43. package/dist/{chunk-APP43AW7.js → chunk-2GG77ADC.js} +1 -1
  44. package/dist/{chunk-KOWFRUIT.js → chunk-2NAQRPZQ.js} +1 -1
  45. package/dist/{chunk-Z23ZBYDW.js → chunk-4FWWHCYM.js} +4 -4
  46. package/dist/{chunk-ZGADIZDS.js → chunk-4HR2ICME.js} +1 -1
  47. package/dist/{chunk-E5HOHIUV.js → chunk-4RENRBSB.js} +4 -4
  48. package/dist/{chunk-RQ32ADJP.js → chunk-5WAYSUWV.js} +2 -2
  49. package/dist/{chunk-BYLKCZ2G.js → chunk-7RWQZQV2.js} +14 -14
  50. package/dist/{chunk-KQFTBQ66.js → chunk-A6J5Z2HO.js} +514 -313
  51. package/dist/{chunk-EIAEUG7G.js → chunk-AIWZRRSK.js} +2 -2
  52. package/dist/{chunk-H5T27W7M.js → chunk-BDRXDO25.js} +2 -2
  53. package/dist/{chunk-UAP5DS6P.js → chunk-BMP2BLIR.js} +3 -3
  54. package/dist/{chunk-VIIHC42X.js → chunk-BZI7EBTB.js} +1 -1
  55. package/dist/{chunk-TO3PS646.js → chunk-C6QM5SJR.js} +2 -2
  56. package/dist/{chunk-BNSKVIAW.js → chunk-CBDJ2X5P.js} +2 -2
  57. package/dist/{chunk-COQ64C4F.js → chunk-CHDAH4HP.js} +8 -8
  58. package/dist/{chunk-M3STIAGU.js → chunk-CZYMYM7X.js} +3 -3
  59. package/dist/{chunk-MD4SVNT6.js → chunk-E6YQW43K.js} +1 -1
  60. package/dist/{chunk-5N5L6DNN.js → chunk-EJVYEOKC.js} +3 -3
  61. package/dist/{chunk-AI7RMFVV.js → chunk-ERXY2SIW.js} +19 -16
  62. package/dist/{chunk-IRHABAQT.js → chunk-FJCOOFT7.js} +1 -1
  63. package/dist/{chunk-NGKUXZID.js → chunk-GA4J6YFN.js} +2 -2
  64. package/dist/{chunk-WRPYCIV2.js → chunk-GUNZHSTL.js} +136 -8
  65. package/dist/{chunk-T6ZN4TEF.js → chunk-HX5TI6DP.js} +1 -1
  66. package/dist/{chunk-QRXPWW3M.js → chunk-I4I4UH62.js} +3 -3
  67. package/dist/{chunk-6AYSKVLL.js → chunk-KBN3UP2R.js} +3 -3
  68. package/dist/{chunk-UF6RBP5V.js → chunk-KEV2MOJH.js} +46 -21
  69. package/dist/{chunk-BZLHTMT6.js → chunk-KIVFWGG6.js} +12 -10
  70. package/dist/{chunk-HBWYMRR5.js → chunk-LBAMPNDM.js} +5 -4
  71. package/dist/{chunk-LENBKYRB.js → chunk-LUHNNZSH.js} +2 -2
  72. package/dist/{chunk-R5RIVOPL.js → chunk-LX6EWNRK.js} +15 -3
  73. package/dist/{chunk-5DCDQ5VW.js → chunk-M54ATCOZ.js} +2 -2
  74. package/dist/{chunk-6W5M3MSE.js → chunk-MHHXR7DT.js} +4 -4
  75. package/dist/{chunk-NUVGDBZC.js → chunk-MITMDERZ.js} +1 -1
  76. package/dist/{chunk-QTIUJZRX.js → chunk-MJLTABWF.js} +3 -3
  77. package/dist/{chunk-QIOIO7VN.js → chunk-MX3LPP3K.js} +6 -6
  78. package/dist/{chunk-F7R3SZ4Q.js → chunk-N6GEI3PK.js} +2 -2
  79. package/dist/{chunk-462EQA6K.js → chunk-N7HXP4PZ.js} +1 -1
  80. package/dist/{chunk-Q6C6ILUS.js → chunk-OKSU74QH.js} +2 -2
  81. package/dist/{chunk-AZOKPWVI.js → chunk-P2EJN7UB.js} +1 -1
  82. package/dist/{chunk-OAYWO5NP.js → chunk-P7N7FJ7W.js} +1 -1
  83. package/dist/{chunk-DP3WX7FW.js → chunk-PRJNUNCV.js} +2 -2
  84. package/dist/{chunk-SZ4Q6ZVS.js → chunk-PTGUJZSD.js} +5 -5
  85. package/dist/chunk-SB2GN6OP.js +71 -0
  86. package/dist/{chunk-DCCSULXK.js → chunk-STUJXZC2.js} +4 -4
  87. package/dist/{chunk-MLGIVVSG.js → chunk-TVVUJTUW.js} +1 -1
  88. package/dist/{chunk-5OP5MQI7.js → chunk-V6IW5WMK.js} +1 -1
  89. package/dist/{chunk-5RGA636G.js → chunk-VOP5U2VX.js} +145 -9
  90. package/dist/{chunk-K545B734.js → chunk-WCELLK4P.js} +2 -2
  91. package/dist/{chunk-VHPFNLRS.js → chunk-WHRYW4P2.js} +5 -5
  92. package/dist/{chunk-G7RIDXAT.js → chunk-XYCTS3WP.js} +1 -1
  93. package/dist/{chunk-6EBGOHDJ.js → chunk-YETKAI5Q.js} +6 -6
  94. package/dist/{chunk-REU2VQPH.js → chunk-Z4AOR6RZ.js} +15 -13
  95. package/dist/{chunk-B5NMSP3V.js → chunk-ZTSMQYST.js} +3 -5
  96. package/dist/{global-upgrade-H272QOGD.js → global-upgrade-VT2JS7DR.js} +6 -6
  97. package/dist/{paths-HMVOTFUN.js → paths-WRBEUNEY.js} +2 -2
  98. package/dist/{reapply-Q5NHDTVU.js → reapply-BCR6U7HO.js} +20 -22
  99. package/dist/src/index.js +19 -21
  100. package/dist/{upgrade-lock-L3GHFIRW.js → upgrade-lock-VRYMTPZQ.js} +3 -3
  101. package/package.json +1 -1
  102. package/dist/chunk-N6IOSZOE.js +0 -185
  103. package/dist/chunk-UPIZSCYD.js +0 -142
package/CHANGELOG.md CHANGED
@@ -1,5 +1,20 @@
1
1
  # Changelog
2
2
 
3
+ ## 1.9.11
4
+
5
+ - `pushary setup` connects Antigravity CLI (`agy`). Pick it in setup or pass `--agents antigravity_cli`. Setup adds a hook named `pushary` to `~/.gemini/config/hooks.json` for `PreToolUse`, `PostToolUse` and `Stop`, and the Pushary MCP server to `~/.gemini/config/mcp_config.json`. Before agy runs a shell command, writes or edits a file, or calls an MCP tool, your policy decides, and the risky ones wait for your answer on your phone or your Mac. Pushary answers agy only with allow or deny: a denial, or no answer before your policy's wait ends, blocks the call with a reason the model sees.
6
+ - Approvals for Antigravity CLI take effect only when agy runs with `--dangerously-skip-permissions` or with `"toolPermission": "always-proceed"` in `~/.gemini/antigravity-cli/settings.json`, because agy ignores a hook's allow in its other modes. Setup prints this and does not change agy's mode. Pushary is then the only gate: if the hook cannot reach Pushary, agy runs the call.
7
+ - Setup skips Antigravity CLI when `agy` is not installed, even when `~/.gemini` exists for Gemini CLI.
8
+ - While agy waits for your answer, its terminal shows "If nobody answers, it does not run." instead of saying the terminal takes over, which agy has no way to do.
9
+ - `pushary disconnect antigravity` removes the `pushary` hook and the Pushary MCP server and leaves your other hooks and servers alone.
10
+
11
+ ## 1.9.10
12
+
13
+ - `pushary setup` no longer reports Qwen Code, CodeBuddy, Qoder, Droid and Devin as an account mismatch when the Pushary Mac app connected them and the CLI's key is in the same account. Setup compares the account of the key in their MCP entry for Qwen Code, CodeBuddy and Qoder, and the account of the Mac app's own key for Droid and Devin, whose hooks run through the app. They are kept and listed as kept for the Mac app. If the app is in a different account, setup reports it and changes nothing. The CLI does not copy or save the app's key.
14
+ - `pushary doctor` no longer fails "Global package installed" on a computer the Pushary Mac app connects, for example when run with npx. The app runs the hooks there, so doctor prints that the global package is not installed and not needed. It still fails when the CLI has its own key or owns any agent's hooks, because those hooks run the global package.
15
+ - `pushary clean --everything` revokes the keys the CLI wrote on pushary.com before removing them: the key in `~/.pushary/config.json`, and a different key in the `export PUSHARY_API_KEY=...` line setup writes to your shell profile. It says whether each key was revoked. A key that is only in the `PUSHARY_API_KEY` environment variable is left alone and named, because Pushary did not write it and it may be a server key you use elsewhere. If pushary.com cannot be reached, the clean still finishes and tells you where to revoke the key. `--dry-run` revokes nothing and lists the keys it would revoke. The Mac app's key is never revoked, and a plain `clean`, `disconnect` and `sign-out` without `--revoke` behave as before.
16
+ - `pushary setup --take-over-hooks` takes over Droid's hooks from the Pushary Mac app. It used to fail with "no Mac app wiring was found", because Droid keeps its hooks at the top of `~/.factory/hooks.json`.
17
+
3
18
  ## 1.9.9
4
19
 
5
20
  - The VS Code hooks setup writes now run the gate through the same shell guard as every other agent. Before, a missing Node or a deleted plugin folder made the VS Code hooks fail on every tool call; now they stay silent and VS Code carries on as if Pushary were not installed. Run setup again for VS Code to get the guarded hooks.
package/README.md CHANGED
@@ -214,7 +214,7 @@ sign-out Sign out: remove the key this machine stores, and say what it does
214
214
  pair Pair a phone without re-running setup (--app for the Pushary app; also: connect)
215
215
  bell Free local bell when an agent finishes or needs you. No account, no key, no network
216
216
  doctor Verify your Pushary installation is working
217
- disconnect Turn off one agent (claude|codex|gemini|cursor|opencode|qwen|codebuddy|qoder|droid|devin|fx)
217
+ disconnect Turn off one agent (claude|codex|gemini|cursor|opencode|qwen|codebuddy|qoder|droid|devin|antigravity|fx)
218
218
  clean Remove Pushary from this machine (--everything: the Mac app's setup too, --dry-run: preview)
219
219
  mode Choose where approval requests appear
220
220
  wait Show or set the "wait for your phone" ladder (pushary wait 45)
@@ -1,37 +1,41 @@
1
1
  #!/usr/bin/env node
2
2
  import {
3
3
  handleBell
4
- } from "../chunk-G7RIDXAT.js";
4
+ } from "../chunk-XYCTS3WP.js";
5
5
  import {
6
6
  readHookInput
7
- } from "../chunk-R5RIVOPL.js";
8
- import "../chunk-COQ64C4F.js";
7
+ } from "../chunk-LX6EWNRK.js";
8
+ import "../chunk-CHDAH4HP.js";
9
9
  import "../chunk-SGZJ5LYH.js";
10
- import "../chunk-SZ4Q6ZVS.js";
11
- import "../chunk-APP43AW7.js";
12
- import "../chunk-462EQA6K.js";
13
- import "../chunk-VIIHC42X.js";
10
+ import "../chunk-PTGUJZSD.js";
11
+ import "../chunk-2GG77ADC.js";
12
+ import "../chunk-N7HXP4PZ.js";
13
+ import "../chunk-BZI7EBTB.js";
14
14
  import "../chunk-XHKBHWLX.js";
15
- import "../chunk-BYLKCZ2G.js";
16
- import "../chunk-M3STIAGU.js";
17
- import "../chunk-ZGADIZDS.js";
18
- import "../chunk-MLGIVVSG.js";
15
+ import "../chunk-KEV2MOJH.js";
16
+ import "../chunk-7RWQZQV2.js";
17
+ import "../chunk-CZYMYM7X.js";
18
+ import "../chunk-4HR2ICME.js";
19
+ import "../chunk-TVVUJTUW.js";
19
20
  import "../chunk-GMXKITVA.js";
20
21
  import "../chunk-6ICPEJY5.js";
21
- import "../chunk-REU2VQPH.js";
22
- import "../chunk-MD4SVNT6.js";
23
- import "../chunk-UPIZSCYD.js";
22
+ import "../chunk-Z4AOR6RZ.js";
23
+ import "../chunk-A6J5Z2HO.js";
24
+ import "../chunk-E6YQW43K.js";
25
+ import "../chunk-GUNZHSTL.js";
24
26
  import "../chunk-POFBE6ZY.js";
25
- import "../chunk-5N5L6DNN.js";
26
- import "../chunk-KOWFRUIT.js";
27
+ import "../chunk-KBN3UP2R.js";
28
+ import "../chunk-I4I4UH62.js";
29
+ import "../chunk-EJVYEOKC.js";
30
+ import "../chunk-2NAQRPZQ.js";
27
31
  import "../chunk-7QLSKOSU.js";
28
32
  import "../chunk-KZERVKTD.js";
29
- import "../chunk-BNSKVIAW.js";
30
- import "../chunk-Z23ZBYDW.js";
33
+ import "../chunk-CBDJ2X5P.js";
34
+ import "../chunk-4FWWHCYM.js";
31
35
  import "../chunk-T7E75EKA.js";
32
- import "../chunk-IRHABAQT.js";
33
- import "../chunk-5DCDQ5VW.js";
34
- import "../chunk-5RGA636G.js";
36
+ import "../chunk-FJCOOFT7.js";
37
+ import "../chunk-M54ATCOZ.js";
38
+ import "../chunk-VOP5U2VX.js";
35
39
 
36
40
  // bin/pushary-bell-hook.ts
37
41
  var main = async () => {
@@ -5,37 +5,37 @@ import {
5
5
  liveAgentCount,
6
6
  ring,
7
7
  upgradeThreshold
8
- } from "../chunk-G7RIDXAT.js";
8
+ } from "../chunk-XYCTS3WP.js";
9
9
  import {
10
10
  createIo
11
11
  } from "../chunk-U4TMAANR.js";
12
12
  import {
13
13
  exitOnHelpFlag
14
- } from "../chunk-TO3PS646.js";
14
+ } from "../chunk-C6QM5SJR.js";
15
15
  import {
16
16
  addBellHooks,
17
17
  bellInstalled,
18
18
  removeBellHooks
19
- } from "../chunk-MLGIVVSG.js";
19
+ } from "../chunk-TVVUJTUW.js";
20
20
  import {
21
21
  parseFlags
22
22
  } from "../chunk-GMXKITVA.js";
23
- import "../chunk-REU2VQPH.js";
23
+ import "../chunk-Z4AOR6RZ.js";
24
24
  import "../chunk-7QLSKOSU.js";
25
25
  import {
26
26
  EXIT
27
27
  } from "../chunk-KZERVKTD.js";
28
- import "../chunk-BNSKVIAW.js";
28
+ import "../chunk-CBDJ2X5P.js";
29
29
  import {
30
30
  claudeSettings
31
- } from "../chunk-Z23ZBYDW.js";
31
+ } from "../chunk-4FWWHCYM.js";
32
32
  import {
33
33
  readJsonSafe,
34
34
  writeJsonAtomic
35
35
  } from "../chunk-T7E75EKA.js";
36
- import "../chunk-IRHABAQT.js";
37
- import "../chunk-5DCDQ5VW.js";
38
- import "../chunk-5RGA636G.js";
36
+ import "../chunk-FJCOOFT7.js";
37
+ import "../chunk-M54ATCOZ.js";
38
+ import "../chunk-VOP5U2VX.js";
39
39
 
40
40
  // bin/pushary-bell.ts
41
41
  exitOnHelpFlag("bell");
@@ -8,60 +8,58 @@ import {
8
8
  describeIdleWindow,
9
9
  startProcessOwnership,
10
10
  withSpawnProcessOwnership
11
- } from "../chunk-NUVGDBZC.js";
11
+ } from "../chunk-MITMDERZ.js";
12
12
  import {
13
13
  announceSubscriptionRequired,
14
14
  isDeferAnswer
15
- } from "../chunk-5OP5MQI7.js";
15
+ } from "../chunk-V6IW5WMK.js";
16
16
  import {
17
17
  claudeTranscriptPath,
18
18
  loadSessionKey,
19
19
  registerTranscript,
20
20
  registeredTranscriptEnabled
21
- } from "../chunk-COQ64C4F.js";
21
+ } from "../chunk-CHDAH4HP.js";
22
22
  import "../chunk-SGZJ5LYH.js";
23
23
  import {
24
24
  ensureDaemonRunning
25
- } from "../chunk-SZ4Q6ZVS.js";
25
+ } from "../chunk-PTGUJZSD.js";
26
26
  import {
27
27
  encryptRecord
28
- } from "../chunk-APP43AW7.js";
29
- import "../chunk-462EQA6K.js";
28
+ } from "../chunk-2GG77ADC.js";
29
+ import "../chunk-N7HXP4PZ.js";
30
30
  import {
31
31
  transcriptsEnabled
32
- } from "../chunk-VIIHC42X.js";
32
+ } from "../chunk-BZI7EBTB.js";
33
33
  import {
34
34
  needsShell,
35
35
  spawnClaude
36
36
  } from "../chunk-XHKBHWLX.js";
37
- import "../chunk-BYLKCZ2G.js";
38
- import "../chunk-M3STIAGU.js";
39
- import "../chunk-ZGADIZDS.js";
40
- import "../chunk-MLGIVVSG.js";
37
+ import "../chunk-7RWQZQV2.js";
38
+ import "../chunk-CZYMYM7X.js";
39
+ import "../chunk-4HR2ICME.js";
40
+ import "../chunk-TVVUJTUW.js";
41
41
  import "../chunk-GMXKITVA.js";
42
42
  import "../chunk-6ICPEJY5.js";
43
- import "../chunk-REU2VQPH.js";
43
+ import "../chunk-Z4AOR6RZ.js";
44
44
  import {
45
+ DEFAULT_SESSION,
45
46
  UNNAMED_ACTION,
46
47
  deriveToolTarget,
47
48
  describeToolCall,
48
49
  fetchModeState,
49
50
  getPolicy,
50
- phoneDrivenEnv,
51
- repoKeyFor,
52
- reportEvent,
53
- scopePathFor
54
- } from "../chunk-KQFTBQ66.js";
55
- import {
56
- DEFAULT_SESSION,
57
51
  markPendingCommandDelivered,
58
52
  markPendingCommandFailed,
53
+ phoneDrivenEnv,
59
54
  readPendingCommand,
60
55
  readPendingCommandById,
61
56
  removePendingCommand,
62
- savePendingCommand
63
- } from "../chunk-N6IOSZOE.js";
64
- import "../chunk-MD4SVNT6.js";
57
+ repoKeyFor,
58
+ reportEvent,
59
+ savePendingCommand,
60
+ scopePathFor
61
+ } from "../chunk-A6J5Z2HO.js";
62
+ import "../chunk-E6YQW43K.js";
65
63
  import {
66
64
  askUser,
67
65
  cancelQuestion,
@@ -70,36 +68,35 @@ import {
70
68
  nextLongPollMs,
71
69
  waitForAnswer,
72
70
  withdrawQuestion
73
- } from "../chunk-WRPYCIV2.js";
71
+ } from "../chunk-GUNZHSTL.js";
72
+ import "../chunk-POFBE6ZY.js";
74
73
  import {
75
74
  SubscriptionRequiredError
76
- } from "../chunk-6AYSKVLL.js";
77
- import "../chunk-QRXPWW3M.js";
78
- import "../chunk-UPIZSCYD.js";
79
- import "../chunk-POFBE6ZY.js";
80
- import "../chunk-5N5L6DNN.js";
75
+ } from "../chunk-KBN3UP2R.js";
76
+ import "../chunk-I4I4UH62.js";
77
+ import "../chunk-EJVYEOKC.js";
81
78
  import {
82
79
  getMachineId
83
- } from "../chunk-KOWFRUIT.js";
80
+ } from "../chunk-2NAQRPZQ.js";
84
81
  import "../chunk-7QLSKOSU.js";
85
82
  import "../chunk-KZERVKTD.js";
86
- import "../chunk-BNSKVIAW.js";
87
- import "../chunk-Z23ZBYDW.js";
83
+ import "../chunk-CBDJ2X5P.js";
84
+ import "../chunk-4FWWHCYM.js";
88
85
  import "../chunk-T7E75EKA.js";
89
86
  import {
90
87
  getApiKey,
91
88
  getBaseUrl
92
- } from "../chunk-IRHABAQT.js";
89
+ } from "../chunk-FJCOOFT7.js";
93
90
  import {
94
91
  NPX_LATEST_COMMAND
95
- } from "../chunk-5DCDQ5VW.js";
92
+ } from "../chunk-M54ATCOZ.js";
96
93
  import {
97
94
  DECISION_STOP_REASON,
98
95
  KILL_REASON,
99
96
  UNVERIFIABLE_APPROVAL_REASON,
100
97
  redactSecretsFromContent,
101
98
  resolveGate
102
- } from "../chunk-5RGA636G.js";
99
+ } from "../chunk-VOP5U2VX.js";
103
100
 
104
101
  // src/wrapper/localPassthrough.ts
105
102
  var SIGNAL_NUMBERS = {
@@ -4,10 +4,15 @@ import {
4
4
  PUSHARY_SKILL_SOURCE,
5
5
  createGuards
6
6
  } from "../chunk-EUW7JL2K.js";
7
+ import {
8
+ describeRevokeAttempt,
9
+ keyNoLongerAccepted,
10
+ revokeOwnKey
11
+ } from "../chunk-SB2GN6OP.js";
7
12
  import {
8
13
  isCursorPluginLeftover,
9
14
  withoutPusharyCursorHooks
10
- } from "../chunk-LENBKYRB.js";
15
+ } from "../chunk-LUHNNZSH.js";
11
16
  import {
12
17
  HERMES_PIP_PACKAGE,
13
18
  readHermesStatus,
@@ -16,23 +21,27 @@ import {
16
21
  shortenHome,
17
22
  unregisterPluginLocation,
18
23
  vscodeSettingsTargets
19
- } from "../chunk-UAP5DS6P.js";
24
+ } from "../chunk-BMP2BLIR.js";
20
25
  import {
21
26
  planFxRemoval,
22
27
  removeInstructionBlock
23
- } from "../chunk-6W5M3MSE.js";
24
- import "../chunk-H5T27W7M.js";
28
+ } from "../chunk-MHHXR7DT.js";
29
+ import "../chunk-BDRXDO25.js";
25
30
  import {
26
31
  disableDaemonService
27
- } from "../chunk-SZ4Q6ZVS.js";
32
+ } from "../chunk-PTGUJZSD.js";
28
33
  import "../chunk-XHKBHWLX.js";
34
+ import {
35
+ APPROVAL_SETTINGS_PATH
36
+ } from "../chunk-LBAMPNDM.js";
29
37
  import {
30
38
  macAppKeepsMcpEntry,
31
39
  mcpServerBearer,
32
40
  pusharyKey,
33
41
  readMacAppAgentKey,
34
42
  setupReceiptKey
35
- } from "../chunk-E5HOHIUV.js";
43
+ } from "../chunk-4RENRBSB.js";
44
+ import "../chunk-OKSU74QH.js";
36
45
  import {
37
46
  OPENCODE_PLUGIN_SIBLING,
38
47
  OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -44,7 +53,14 @@ import {
44
53
  openCodePluginDir,
45
54
  openCodePluginFile,
46
55
  removeOpenCodeMcpServer
47
- } from "../chunk-BZLHTMT6.js";
56
+ } from "../chunk-KIVFWGG6.js";
57
+ import {
58
+ ansiPainter,
59
+ useColor
60
+ } from "../chunk-U4TMAANR.js";
61
+ import {
62
+ exitOnHelpFlag
63
+ } from "../chunk-C6QM5SJR.js";
48
64
  import {
49
65
  compatibleConfigFile,
50
66
  compatibleInstructionsFile,
@@ -57,14 +73,7 @@ import {
57
73
  removePusharySettings,
58
74
  removePusharyToolPermissions,
59
75
  restoreClaudeMcpServer
60
- } from "../chunk-UF6RBP5V.js";
61
- import {
62
- ansiPainter,
63
- useColor
64
- } from "../chunk-U4TMAANR.js";
65
- import {
66
- exitOnHelpFlag
67
- } from "../chunk-TO3PS646.js";
76
+ } from "../chunk-KEV2MOJH.js";
68
77
  import {
69
78
  hookOwnerOf,
70
79
  isHookTakeoverReceipt,
@@ -72,36 +81,40 @@ import {
72
81
  resolveBridgeStub,
73
82
  restoreHookTakeover,
74
83
  restoreMcpServer
75
- } from "../chunk-BYLKCZ2G.js";
84
+ } from "../chunk-7RWQZQV2.js";
76
85
  import {
77
86
  removeGeminiSettings
78
- } from "../chunk-M3STIAGU.js";
79
- import "../chunk-ZGADIZDS.js";
80
- import "../chunk-MLGIVVSG.js";
87
+ } from "../chunk-CZYMYM7X.js";
88
+ import "../chunk-4HR2ICME.js";
89
+ import "../chunk-TVVUJTUW.js";
81
90
  import {
82
91
  rejectUnknownFlags
83
92
  } from "../chunk-GMXKITVA.js";
84
93
  import "../chunk-6ICPEJY5.js";
85
94
  import {
86
95
  CANDIDATE_RCS,
96
+ findExportedKeyLines,
87
97
  isDisabledExport,
98
+ keyPrefix,
99
+ readConfigFileKey,
100
+ readMacAppKeyPrefix,
88
101
  removeClaudeAlias
89
- } from "../chunk-REU2VQPH.js";
90
- import "../chunk-KQFTBQ66.js";
91
- import "../chunk-N6IOSZOE.js";
92
- import "../chunk-MD4SVNT6.js";
93
- import "../chunk-WRPYCIV2.js";
94
- import "../chunk-6AYSKVLL.js";
95
- import "../chunk-QRXPWW3M.js";
96
- import "../chunk-UPIZSCYD.js";
102
+ } from "../chunk-Z4AOR6RZ.js";
103
+ import "../chunk-A6J5Z2HO.js";
104
+ import "../chunk-E6YQW43K.js";
105
+ import "../chunk-GUNZHSTL.js";
97
106
  import "../chunk-POFBE6ZY.js";
98
- import "../chunk-5N5L6DNN.js";
99
- import "../chunk-KOWFRUIT.js";
107
+ import "../chunk-KBN3UP2R.js";
108
+ import {
109
+ absoluteUrl
110
+ } from "../chunk-I4I4UH62.js";
111
+ import "../chunk-EJVYEOKC.js";
112
+ import "../chunk-2NAQRPZQ.js";
100
113
  import "../chunk-7QLSKOSU.js";
101
114
  import {
102
115
  EXIT
103
116
  } from "../chunk-KZERVKTD.js";
104
- import "../chunk-BNSKVIAW.js";
117
+ import "../chunk-CBDJ2X5P.js";
105
118
  import {
106
119
  claudeJson,
107
120
  claudeMcpReceipt,
@@ -138,12 +151,14 @@ import {
138
151
  restoreCodexHookTrust,
139
152
  vscodePluginDir,
140
153
  vscodePluginMcp
141
- } from "../chunk-Z23ZBYDW.js";
154
+ } from "../chunk-4FWWHCYM.js";
142
155
  import "../chunk-T7E75EKA.js";
143
- import "../chunk-IRHABAQT.js";
156
+ import {
157
+ getBaseUrl
158
+ } from "../chunk-FJCOOFT7.js";
144
159
  import {
145
160
  NPX_LATEST_COMMAND
146
- } from "../chunk-5DCDQ5VW.js";
161
+ } from "../chunk-M54ATCOZ.js";
147
162
  import {
148
163
  CLI_PACKAGE_NAMES,
149
164
  HOOK_COMPATIBLE_PROFILES,
@@ -155,7 +170,7 @@ import {
155
170
  globalRootFor,
156
171
  isValidApiKey,
157
172
  redactSecrets
158
- } from "../chunk-5RGA636G.js";
173
+ } from "../chunk-VOP5U2VX.js";
159
174
 
160
175
  // bin/pushary-clean.ts
161
176
  import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync4 } from "fs";
@@ -575,6 +590,43 @@ var cleanCompatibleAgent = (profile, scope, io, home) => {
575
590
  return { profile, files, mcpKeptForApp, instructions: cleanInstructions(profile, scope, io, home) };
576
591
  };
577
592
 
593
+ // src/cli/clean-key-revocation.ts
594
+ var isMacAppKey = (key, keys) => key === keys.macAppKey || keyPrefix(key) === keys.macAppKeyPrefix;
595
+ var revocationFor = (keys) => (key) => isMacAppKey(key, keys) ? { kind: "mac_app_key", keyPrefix: keyPrefix(key) } : { kind: "revoke", key };
596
+ var validKeys = (keys) => [...new Set(keys)].filter((key) => key !== null && isValidApiKey(key));
597
+ var environmentOnlyKey = (keys, written) => validKeys([keys.envKey]).filter((key) => !written.includes(key)).map((key) => ({ kind: "environment_only", keyPrefix: keyPrefix(key) }));
598
+ var planCliKeyRevocations = (keys) => {
599
+ const written = validKeys([keys.configKey, ...keys.profileKeys]);
600
+ return [...written.map(revocationFor(keys)), ...environmentOnlyKey(keys, written)];
601
+ };
602
+ var runRevocation = async (revocation, run) => {
603
+ if (revocation.kind !== "revoke") return revocation;
604
+ if (run.dryRun) return { kind: "would_revoke", keyPrefix: keyPrefix(revocation.key) };
605
+ return { kind: "attempted", keyPrefix: keyPrefix(revocation.key), attempt: await revokeOwnKey(revocation.key, run.baseUrl) };
606
+ };
607
+ var revokeCliKeys = async (revocations, run) => {
608
+ const outcomes = [];
609
+ for (const revocation of revocations) outcomes.push(await runRevocation(revocation, run));
610
+ return outcomes;
611
+ };
612
+ var describeCliKeyRevocation = (outcome, baseUrl) => {
613
+ const label = `API key ${outcome.keyPrefix}`;
614
+ switch (outcome.kind) {
615
+ case "would_revoke":
616
+ return { tone: "skipped", line: `${label} (would revoke it on pushary.com)`, next: null };
617
+ case "mac_app_key":
618
+ return { tone: "skipped", line: `${label} (not revoked: it is the Pushary Mac app's key)`, next: null };
619
+ case "environment_only":
620
+ return { tone: "skipped", line: `${label} in PUSHARY_API_KEY (left alone: Pushary did not write it)`, next: null };
621
+ case "attempted":
622
+ return keyNoLongerAccepted(outcome.attempt) ? { tone: "done", line: `${label}: ${describeRevokeAttempt(outcome.attempt)}`, next: null } : {
623
+ tone: "warning",
624
+ line: `${label}: ${describeRevokeAttempt(outcome.attempt)}`,
625
+ next: `It may still be valid. Revoke it at ${absoluteUrl(baseUrl, APPROVAL_SETTINGS_PATH)}`
626
+ };
627
+ }
628
+ };
629
+
578
630
  // bin/pushary-clean.ts
579
631
  exitOnHelpFlag("clean");
580
632
  var paint = ansiPainter(() => useColor());
@@ -793,6 +845,27 @@ var restoreTakeoverReceipts = () => {
793
845
  }
794
846
  }
795
847
  };
848
+ var KEY_REVOCATION_ICONS = {
849
+ done: check,
850
+ skipped: skip,
851
+ warning: yellow("!")
852
+ };
853
+ var printKeyRevocation = (report) => {
854
+ console.log(` ${KEY_REVOCATION_ICONS[report.tone]} ${report.line}`);
855
+ if (report.next) console.log(` ${dim(report.next)}`);
856
+ };
857
+ var revokeKeysThisCliHolds = async () => {
858
+ const baseUrl = getBaseUrl();
859
+ const revocations = planCliKeyRevocations({
860
+ configKey: readConfigFileKey(),
861
+ profileKeys: findExportedKeyLines().map((line) => line.key),
862
+ envKey: process.env.PUSHARY_API_KEY?.trim() || null,
863
+ macAppKey: readMacAppAgentKey(),
864
+ macAppKeyPrefix: readMacAppKeyPrefix()
865
+ });
866
+ const outcomes = await revokeCliKeys(revocations, { dryRun, baseUrl });
867
+ for (const outcome of outcomes) printKeyRevocation(describeCliKeyRevocation(outcome, baseUrl));
868
+ };
796
869
  var main = async () => {
797
870
  console.log();
798
871
  console.log(` ${bold("Pushary Clean")}`);
@@ -871,6 +944,7 @@ var main = async () => {
871
944
  process.exit(EXIT.FAILED);
872
945
  }
873
946
  console.log(` ${check} Background service ${dim(did("uninstalled"))}`);
947
+ if (everything) await revokeKeysThisCliHolds();
874
948
  const claudeJson2 = readJson(CLAUDE_JSON);
875
949
  const keepClaudeMcp = macAppKeeps("claude_code", mcpServerBearer(claudeJson2?.mcpServers));
876
950
  const claudeHasPusharyEntry = () => Boolean(claudeJson2?.mcpServers?.pushary);
@@ -5,10 +5,10 @@ import {
5
5
  postLiveSession,
6
6
  postLiveSessionUntilAccepted,
7
7
  startLiveSessionHeartbeat
8
- } from "../chunk-RQ32ADJP.js";
8
+ } from "../chunk-5WAYSUWV.js";
9
9
  import {
10
10
  resolveProviderBinary
11
- } from "../chunk-F7R3SZ4Q.js";
11
+ } from "../chunk-N6GEI3PK.js";
12
12
  import "../chunk-RIVNNBEK.js";
13
13
  import {
14
14
  SESSION_IDLE_TIMEOUT_MS,
@@ -16,52 +16,50 @@ import {
16
16
  idleDeadlinePassed,
17
17
  startProcessOwnership,
18
18
  withSpawnProcessOwnership
19
- } from "../chunk-NUVGDBZC.js";
20
- import "../chunk-APP43AW7.js";
21
- import "../chunk-462EQA6K.js";
19
+ } from "../chunk-MITMDERZ.js";
20
+ import "../chunk-2GG77ADC.js";
21
+ import "../chunk-N7HXP4PZ.js";
22
22
  import {
23
23
  transcriptsEnabled
24
- } from "../chunk-VIIHC42X.js";
24
+ } from "../chunk-BZI7EBTB.js";
25
25
  import {
26
26
  spawnClaude
27
27
  } from "../chunk-XHKBHWLX.js";
28
28
  import "../chunk-6ICPEJY5.js";
29
- import "../chunk-REU2VQPH.js";
29
+ import "../chunk-Z4AOR6RZ.js";
30
30
  import {
31
31
  isAskUserResponse,
32
32
  isDecisionStopped,
33
33
  isWaitForAnswerResponse,
34
- withdrawQuestion
35
- } from "../chunk-WRPYCIV2.js";
36
- import {
37
- callMcpTool
38
- } from "../chunk-6AYSKVLL.js";
39
- import "../chunk-QRXPWW3M.js";
40
- import {
34
+ withdrawQuestion,
41
35
  writeDegraded
42
- } from "../chunk-UPIZSCYD.js";
36
+ } from "../chunk-GUNZHSTL.js";
43
37
  import "../chunk-POFBE6ZY.js";
44
- import "../chunk-5N5L6DNN.js";
38
+ import {
39
+ callMcpTool
40
+ } from "../chunk-KBN3UP2R.js";
41
+ import "../chunk-I4I4UH62.js";
42
+ import "../chunk-EJVYEOKC.js";
45
43
  import {
46
44
  getMachineId
47
- } from "../chunk-KOWFRUIT.js";
45
+ } from "../chunk-2NAQRPZQ.js";
48
46
  import "../chunk-7QLSKOSU.js";
49
47
  import "../chunk-KZERVKTD.js";
50
- import "../chunk-BNSKVIAW.js";
51
- import "../chunk-Z23ZBYDW.js";
48
+ import "../chunk-CBDJ2X5P.js";
49
+ import "../chunk-4FWWHCYM.js";
52
50
  import "../chunk-T7E75EKA.js";
53
51
  import {
54
52
  getApiKey,
55
53
  getBaseUrl
56
- } from "../chunk-IRHABAQT.js";
57
- import "../chunk-5DCDQ5VW.js";
54
+ } from "../chunk-FJCOOFT7.js";
55
+ import "../chunk-M54ATCOZ.js";
58
56
  import {
59
57
  elicitationContent,
60
58
  parseAgentQuestion,
61
59
  parseAgentQuestionAnswers,
62
60
  planElicitationAsk,
63
61
  readElicitationFields
64
- } from "../chunk-5RGA636G.js";
62
+ } from "../chunk-VOP5U2VX.js";
65
63
 
66
64
  // bin/pushary-codex-bridge.ts
67
65
  import { existsSync } from "fs";