agentapprove 0.1.11 → 0.1.13

package/dist/cli.js

@@ -1821,20 +1821,6 @@ function ye() {
   const s = ["[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)", "(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]))"].join("|");
   return new RegExp(s, "g");
 }
-var ve = async (s, n) => {
-  const t = {}, i = Object.keys(s);
-  for (const r2 of i) {
-    const o = s[r2], c = await o({ results: t })?.catch((l2) => {
-      throw l2;
-    });
-    if (typeof n?.onCancel == "function" && lD(c)) {
-      t[r2] = "canceled", n.onCancel({ results: t });
-      continue;
-    }
-    t[r2] = c;
-  }
-  return t;
-};
 
 // ../../node_modules/.bun/chalk@5.6.2/node_modules/chalk/source/vendor/ansi-styles/index.js
 var ANSI_BACKGROUND_OFFSET = 10;
@@ -2504,8 +2490,130 @@ function shouldDeleteCryptoMaterial(purgeConfirmed, firstKeyConfirmation, second
   return purgeConfirmed && firstKeyConfirmation && secondKeyConfirmation;
 }
 
+// src/pairing-artifact.ts
+var PAIRING_ARTIFACT_PREFIX = "AAP1.";
+function encodePairingArtifact(artifact) {
+  const payload = {
+    s: artifact.sessionCode,
+    p: artifact.config.privacyTier,
+    r: artifact.config.retentionDays,
+    f: artifact.config.failBehavior,
+    c: artifact.config.configSetAt,
+    e: artifact.config.e2eEnabled ? 1 : 0
+  };
+  if (artifact.hostname) {
+    payload.h = artifact.hostname;
+  }
+  if (artifact.e2eUserKey) {
+    payload.k = Buffer.from(artifact.e2eUserKey, "hex").toString("base64url");
+  }
+  return `${PAIRING_ARTIFACT_PREFIX}${Buffer.from(JSON.stringify(payload)).toString("base64url")}`;
+}
+function buildPairingUrl(pairingArtifact) {
+  return `agentapprove://pair?code=${encodeURIComponent(pairingArtifact)}`;
+}
+
+// src/install-flow.ts
+var VALID_RETENTION_DAYS = [1, 7, 30, 90, 365];
+function normalizePrivacy(value) {
+  if (value === "minimal" || value === "summary" || value === "full") {
+    return value;
+  }
+  return "full";
+}
+function normalizeRetentionDays(value) {
+  if (value && VALID_RETENTION_DAYS.includes(value)) {
+    return value;
+  }
+  return 30;
+}
+function normalizeFailBehavior(value) {
+  if (value === "allow" || value === "deny" || value === "ask") {
+    return value;
+  }
+  return "ask";
+}
+function normalizeInstallMode(value) {
+  if (value === "observe" || value === "approval") {
+    return value;
+  }
+  return "approval";
+}
+function getSetupProfileOptions(hasExistingConfig) {
+  if (hasExistingConfig) {
+    return [
+      {
+        value: "existing-config",
+        label: "Existing config",
+        hint: "Reuse the current local settings already saved on this computer."
+      },
+      {
+        value: "customize",
+        label: "Customize options",
+        hint: "Choose your own mode, fallback behavior, privacy, E2E, retention, and debug logging before pairing."
+      }
+    ];
+  }
+  return [
+    {
+      value: "recommended",
+      label: "Recommended setup",
+      hint: "Use Approval mode, E2E on, fallback Ask, Full privacy, 30-day retention, and debug logging off."
+    },
+    {
+      value: "customize",
+      label: "Customize options",
+      hint: "Choose your own mode, fallback behavior, privacy, E2E, retention, and debug logging before pairing."
+    }
+  ];
+}
+function getRecommendedInstallConfig() {
+  return {
+    privacy: "full",
+    retentionDays: 30,
+    failBehavior: "ask",
+    debugLog: false,
+    installMode: "approval",
+    e2eEnabled: true
+  };
+}
+function getExistingInstallConfig(existingConfig) {
+  return {
+    privacy: normalizePrivacy(existingConfig?.privacy),
+    retentionDays: normalizeRetentionDays(existingConfig?.retentionDays),
+    failBehavior: normalizeFailBehavior(existingConfig?.failBehavior),
+    debugLog: existingConfig?.debugLog ?? false,
+    installMode: normalizeInstallMode(existingConfig?.e2eMode),
+    e2eEnabled: existingConfig?.e2eEnabled !== false
+  };
+}
+function getInitialInstallConfig(choice, existingConfig) {
+  if (choice === "recommended") {
+    return getRecommendedInstallConfig();
+  }
+  return getExistingInstallConfig(existingConfig);
+}
+function getExistingKeyActionOptions(e2eRequired) {
+  const options = [
+    { value: "reuse", label: "Reuse existing key", hint: "recommended - keeps old events decryptable" },
+    { value: "backup", label: "Back up old key, then generate new" },
+    { value: "discard", label: "Discard old key and generate new" }
+  ];
+  if (!e2eRequired) {
+    options.push({
+      value: "disable",
+      label: "Disable E2E encryption",
+      hint: "events visible on web dashboard"
+    });
+  }
+  return options;
+}
+function shouldCreateFreshPairing(connectionMethod) {
+  return connectionMethod === "qr" || connectionMethod === "copy";
+}
+
 // src/cli.ts
-var VERSION = "0.1.11";
+var VERSION = "0.1.13";
 function getApiUrl() {
   return process.env.AGENTAPPROVE_API || "https://api.agentapprove.com";
 }
@@ -2553,9 +2661,12 @@ function getCommand() {
   }
   return filtered[0] || "install";
 }
-var OPENCODE_PLUGIN_VERSION = "0.1.7";
-var OPENCLAW_PLUGIN_VERSION = "0.2.5";
+var OPENCODE_PLUGIN_VERSION = "0.1.9";
+var OPENCLAW_PLUGIN_VERSION = "0.2.8";
 var OPENCLAW_PLUGIN_SPEC = `@agentapprove/openclaw@${OPENCLAW_PLUGIN_VERSION}`;
+var PI_PLUGIN_VERSION = "0.1.0";
+var PI_PLUGIN_SPEC = `npm:@agentapprove/pi@${PI_PLUGIN_VERSION}`;
+var PI_STATUS_TIMEOUT_MS = 5000;
 var AGENTS = {
   "claude-code": {
     name: "Claude Code",
@@ -2665,8 +2776,63 @@ var AGENTS = {
     hooks: [
       { name: "agentapprove", file: "@agentapprove/opencode", description: "Tool approval + event monitoring", isApprovalHook: true, isPlugin: true }
     ]
+  },
+  pi: {
+    name: "Pi",
+    configPath: join(homedir(), ".pi", "agent", "settings.json"),
+    hooksKey: "packages",
+    hooks: [
+      { name: "agentapprove", file: "@agentapprove/pi", description: "Tool approval + event monitoring", isApprovalHook: true, isPlugin: true }
+    ]
   }
 };
+var SHARED_HOOK_FILES = ["common.sh"];
+var STATUS_FIELD_LABELS = {
+  AGENTAPPROVE_API: "API URL",
+  AGENTAPPROVE_TOKEN: "Token",
+  AGENTAPPROVE_PRIVACY: "Privacy",
+  AGENTAPPROVE_RETENTION_DAYS: "Retention",
+  AGENTAPPROVE_CONFIG_SET_AT: "Configured at",
+  AGENTAPPROVE_DEBUG_LOG: "Debug logging",
+  AGENTAPPROVE_E2E_MODE: "Security mode",
+  AGENTAPPROVE_E2E_ENABLED: "E2E encryption",
+  AGENTAPPROVE_FAIL_BEHAVIOR: "If unreachable"
+};
+var HOOK_STATUS_LABELS = {
+  PreToolUse: "Tool approval",
+  PostToolUse: "Tool completed",
+  PostToolUseFailure: "Tool failed",
+  PermissionRequest: "Permission request",
+  UserPromptSubmit: "Prompt submitted",
+  SessionStart: "Session start",
+  SessionEnd: "Session end",
+  Stop: "Stop",
+  sessionStart: "Session start",
+  sessionEnd: "Session end",
+  beforeShellExecution: "Shell approval",
+  beforeMCPExecution: "MCP approval",
+  preToolUse: "Tool approval",
+  afterShellExecution: "Shell completed",
+  afterMCPExecution: "MCP completed",
+  postToolUse: "Tool completed",
+  beforeSubmitPrompt: "Prompt submitted",
+  subagentStart: "Subagent start",
+  subagentStop: "Subagent stop",
+  preCompact: "Pre-compact",
+  afterAgentThought: "Agent thinking",
+  afterAgentResponse: "Agent response",
+  BeforeTool: "Tool approval",
+  AfterTool: "Tool completed",
+  BeforeAgent: "Prompt submitted",
+  AfterAgent: "Stop",
+  BeforeModel: "Model request",
+  AfterModel: "Model response",
+  Notification: "Notification",
+  userPromptSubmitted: "Prompt submitted",
+  errorOccurred: "Error",
+  SubagentStart: "Subagent start",
+  SubagentStop: "Subagent stop"
+};
 function findGitBash() {
   if (!isWindows())
     return null;
@@ -2855,6 +3021,15 @@ function detectInstalledAgents() {
       if (existsSync2(getOpenCodeConfigDir())) {
         installed.push(id);
       }
+    } else if (id === "pi") {
+      if (existsSync2(join(homedir(), ".pi", "agent"))) {
+        installed.push(id);
+      } else {
+        try {
+          execSync("pi --version", { stdio: "ignore" });
+          installed.push(id);
+        } catch {}
+      }
     } else {
       const configDir = dirname2(agent.configPath);
       if (existsSync2(configDir)) {
@@ -2864,6 +3039,155 @@ function detectInstalledAgents() {
   }
   return installed;
 }
+function getDownloadableHookFilesForAgent(agentId) {
+  const agent = AGENTS[agentId];
+  if (!agent)
+    return [];
+  return agent.hooks.filter((hook) => !hook.isPlugin).map((hook) => hook.file);
+}
+function buildHookDownloadPlan(agentIds) {
+  const files = new Set;
+  const perAgent = [];
+  for (const agentId of agentIds) {
+    const agent = AGENTS[agentId];
+    if (!agent)
+      continue;
+    const agentFiles = [...new Set(getDownloadableHookFilesForAgent(agentId))];
+    if (agentFiles.length === 0) {
+      continue;
+    }
+    perAgent.push({
+      agentId,
+      agentName: agent.name,
+      count: agentFiles.length
+    });
+    for (const file of agentFiles) {
+      files.add(file);
+    }
+  }
+  const sharedCount = perAgent.length > 0 ? SHARED_HOOK_FILES.length : 0;
+  if (sharedCount > 0) {
+    for (const file of SHARED_HOOK_FILES) {
+      files.add(file);
+    }
+  }
+  return {
+    files: [...files],
+    perAgent,
+    sharedCount
+  };
+}
+function formatHookDownloadSummary(plan) {
+  const parts = plan.perAgent.map((entry) => `${entry.agentName}: ${entry.count}`);
+  if (plan.sharedCount > 0) {
+    parts.push(`shared: ${plan.sharedCount}`);
+  }
+  return parts.join(", ");
+}
+function parseEnvAssignment(line) {
+  if (!line.includes("=")) {
+    return null;
+  }
+  const [key, ...valueParts] = line.split("=");
+  return {
+    key: key.trim(),
+    value: valueParts.join("=").trim()
+  };
+}
+function formatStatusValue(key, value) {
+  switch (key) {
+    case "AGENTAPPROVE_TOKEN":
+      return value.slice(0, 15) + "...";
+    case "AGENTAPPROVE_RETENTION_DAYS":
+      return `${value} days`;
+    case "AGENTAPPROVE_CONFIG_SET_AT": {
+      const timestamp = Number.parseInt(value, 10);
+      if (Number.isFinite(timestamp)) {
+        return new Date(timestamp * 1000).toLocaleString();
+      }
+      return value;
+    }
+    case "AGENTAPPROVE_DEBUG_LOG":
+    case "AGENTAPPROVE_E2E_ENABLED":
+      return value === "true" ? "Enabled" : "Disabled";
+    case "AGENTAPPROVE_E2E_MODE":
+      return value.charAt(0).toUpperCase() + value.slice(1);
+    case "AGENTAPPROVE_FAIL_BEHAVIOR":
+    case "AGENTAPPROVE_PRIVACY":
+      return value.charAt(0).toUpperCase() + value.slice(1);
+    default:
+      return value;
+  }
+}
+function formatSetupValue(value) {
+  return value.charAt(0).toUpperCase() + value.slice(1);
+}
+function describePrivacy(value) {
+  switch (value) {
+    case "minimal":
+      return "Tool name only is stored in event history.";
+    case "summary":
+      return "Command details are truncated to 50 characters in event history.";
+    case "full":
+    default:
+      return "Complete command details are stored in event history.";
+  }
+}
+function describeRetentionDays(days) {
+  return `Delete events older than ${days} ${days === 1 ? "day" : "days"}.`;
+}
+function describeFailBehavior(value) {
+  switch (value) {
+    case "allow":
+      return "Allow commands to proceed without approval.";
+    case "deny":
+      return "Block all commands until the service is restored.";
+    case "ask":
+    default:
+      return "Fall back to the agent's built-in approval dialog.";
+  }
+}
+function describeInstallMode(value) {
+  switch (value) {
+    case "observe":
+      return "Agent runs freely and all events are end-to-end encrypted.";
+    case "approval":
+    default:
+      return "Commands are sent via an encrypted channel for policy evaluation.";
+  }
+}
+function describeE2EEnabled(enabled) {
+  if (enabled) {
+    return "Event content is encrypted between this computer and your devices.";
+  }
+  return "Event content can be viewed on the web dashboard.";
+}
+function describeDebugLogging(enabled) {
+  if (enabled) {
+    return "Write hook logs to ~/.agentapprove/hook-debug.log.";
+  }
+  return "Do not write hook debug logs unless you turn them on later.";
+}
+function formatSetupProfileBlock(title, config, extraLines = []) {
+  return [
+    title,
+    ...extraLines.map((line) => `  ${line}`),
+    `  Security mode: ${formatSetupValue(config.installMode)} - ${describeInstallMode(config.installMode)}`,
+    `  If Agent Approve is unreachable: ${formatSetupValue(config.failBehavior)} - ${describeFailBehavior(config.failBehavior)}`,
+    `  Privacy tier: ${formatSetupValue(config.privacy)} - ${describePrivacy(config.privacy)}`,
+    `  End-to-end encryption: ${config.e2eEnabled ? "Enabled" : "Disabled"} - ${describeE2EEnabled(config.e2eEnabled)}`,
+    `  Data retention: ${config.retentionDays} days - ${describeRetentionDays(config.retentionDays)}`,
+    `  Debug logging: ${config.debugLog ? "Enabled" : "Disabled"} - ${describeDebugLogging(config.debugLog)}`
+  ].join(`
+`);
+}
+function formatHookStatusLabel(name) {
+  const explicitLabel = HOOK_STATUS_LABELS[name];
+  if (explicitLabel) {
+    return explicitLabel;
+  }
+  return name.replace(/\*/g, "events").replace(/([a-z])([A-Z])/g, "$1 $2").replace(/[-_]/g, " ").replace(/\s+/g, " ").trim().replace(/^./, (letter) => letter.toUpperCase());
+}
 function getAgentApproveDir() {
   return join(homedir(), ".agentapprove");
 }
@@ -2992,10 +3316,12 @@ function readExistingConfig() {
     const config = {};
     for (const line of content.split(`
 `)) {
-      if (line.startsWith("#") || !line.includes("="))
+      if (line.startsWith("#"))
+        continue;
+      const assignment = parseEnvAssignment(line);
+      if (!assignment)
         continue;
-      const [key, ...valueParts] = line.split("=");
-      const value = valueParts.join("=").trim();
+      const { key, value } = assignment;
       switch (key.trim()) {
         case "AGENTAPPROVE_API":
           config.apiUrl = value;
@@ -3297,6 +3623,101 @@ async function waitForPairing(sessionCode, onProgress, onCancel) {
   cleanup();
   return null;
 }
+function buildPairingPresentation(params) {
+  const pairingArtifact = encodePairingArtifact({
+    sessionCode: params.sessionCode,
+    hostname: params.hostname,
+    config: params.config,
+    e2eUserKey: params.e2eUserKey ?? undefined
+  });
+  return {
+    pairingArtifact,
+    pairingUrl: buildPairingUrl(pairingArtifact),
+    manualCode: pairingArtifact
+  };
+}
+function copyToClipboard(text) {
+  let cmd;
+  let args = [];
+  switch (process.platform) {
+    case "darwin":
+      cmd = "pbcopy";
+      break;
+    case "win32":
+      cmd = "clip";
+      break;
+    default:
+      for (const candidate of [
+        { cmd: "wl-copy", args: [] },
+        { cmd: "xclip", args: ["-selection", "clipboard"] },
+        { cmd: "xsel", args: ["--clipboard", "--input"] }
+      ]) {
+        const result2 = spawnSync(candidate.cmd, candidate.args, {
+          input: text,
+          stdio: ["pipe", "ignore", "ignore"]
+        });
+        if (result2.status === 0 && !result2.error)
+          return true;
+      }
+      return false;
+  }
+  const result = spawnSync(cmd, args, {
+    input: text,
+    stdio: ["pipe", "ignore", "ignore"]
+  });
+  return result.status === 0 && !result.error;
+}
+async function promptPairingMethod() {
+  const choice = await le({
+    message: "How will you connect to the iOS app?",
+    options: [
+      { value: "qr", label: "Scan QR code", hint: "Recommended" },
+      { value: "copy", label: "Copy and paste code", hint: "No camera" }
+    ],
+    initialValue: "qr"
+  });
+  if (lD(choice)) {
+    he("Cancelled");
+    process.exit(0);
+  }
+  return choice;
+}
+async function showPairingPresentation(params) {
+  const detailLines = [`Session: ${params.sessionCode}`];
+  if (params.keyId) {
+    detailLines.push(`Key ID:  ${params.keyId}`);
+  }
+  if (params.method === "qr") {
+    let qrDisplay = "";
+    import_qrcode_terminal.default.generate(params.pairingUrl, { small: true }, (qr) => {
+      qrDisplay = qr;
+    });
+    await new Promise((resolve) => setTimeout(resolve, 10));
+    process.stdout.write(`
+`);
+    process.stdout.write(`  Scan with the Agent Approve iOS app:
+
+`);
+    process.stdout.write(qrDisplay);
+    process.stdout.write(`
+`);
+    me(detailLines.join(`
+`), "Pairing details");
+    return;
+  }
+  me(detailLines.join(`
+`), "Pairing details");
+  const copied = copyToClipboard(params.manualCode);
+  if (copied) {
+    v2.success("Paste code copied to clipboard. In the iOS app, choose the option to enter a code manually and paste.");
+  } else {
+    v2.warn("Could not access the system clipboard. Copy the code below manually instead.");
+  }
+  process.stdout.write(`
+` + params.manualCode + `
+
+`);
+}
 function saveEnvConfig(config) {
   const envPath = join(getAgentApproveDir(), "env");
   const configSetAt = config.configSetAt || Math.floor(Date.now() / 1000);
@@ -3353,7 +3774,7 @@ function isCredentialManagerAvailable() {
     return false;
   }
 }
-async function storeTokenInKeychain(token) {
+async function storeTokenInKeychain(token, options) {
   if (isKeychainAvailable()) {
     try {
       spawnSync("security", [
@@ -3376,7 +3797,9 @@ async function storeTokenInKeychain(token) {
       if (addResult.status !== 0 || addResult.error) {
         throw addResult.error || new Error("security add-generic-password failed");
       }
-      v2.success("Token stored in macOS Keychain");
+      if (!options?.quiet) {
+        v2.success("Token stored in macOS Keychain");
+      }
       return true;
     } catch (err) {
       v2.warn("Could not store token in Keychain (file fallback will be used)");
@@ -3394,7 +3817,9 @@ async function storeTokenInKeychain(token) {
       if (addResult.status !== 0 || addResult.error) {
         throw addResult.error || new Error("cmdkey add credential failed");
       }
-      v2.success("Token stored in Windows Credential Manager");
+      if (!options?.quiet) {
+        v2.success("Token stored in Windows Credential Manager");
+      }
       return true;
     } catch (err) {
       v2.warn("Could not store token in Credential Manager (file fallback will be used)");
@@ -3424,31 +3849,18 @@ function deleteTokenFromKeychain() {
   }
   return false;
 }
-async function pushConfigToCloud(config) {
-  try {
-    const response = await fetch(`${config.apiUrl}/${API_VERSION}/config`, {
-      method: "PUT",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${config.token}`
-      },
-      body: JSON.stringify({
-        privacyTier: config.privacy,
-        retentionDays: config.retentionDays,
-        failBehavior: config.failBehavior,
-        configSetAt: config.configSetAt
-      })
-    });
-    return response.ok;
-  } catch (error) {
-    return false;
-  }
-}
 async function installHooksForAgent(agentId, hooksDir, mode = "approval") {
   const agent = AGENTS[agentId];
   if (!agent) {
     return { success: false, backupPath: null, hooks: [] };
   }
+  if (agentId === "pi") {
+    const installResult = installPiPluginViaCli();
+    if (!installResult.success) {
+      return { success: false, backupPath: null, hooks: [], error: installResult.error };
+    }
+    return { success: true, backupPath: null, hooks: [installResult.label] };
+  }
   const backupPath = backupConfig(agent.configPath);
   const config = readJsonConfig(agent.configPath);
   if (!config[agent.hooksKey]) {
@@ -3488,7 +3900,7 @@ async function installHooksForAgent(agentId, hooksDir, mode = "approval") {
     }
     hooks.internal.enabled = true;
     writeJsonConfig(agent.configPath, config);
-    installedHooks.push("openclaw");
+    installedHooks.push(installResult.label);
     return { success: true, backupPath, hooks: installedHooks };
   }
   if (agentId === "opencode") {
@@ -3517,7 +3929,7 @@ async function installHooksForAgent(agentId, hooksDir, mode = "approval") {
         console.warn(`Warning: Could not update package.json: ${err.message}`);
       }
     }
-    installedHooks.push("agentapprove");
+    installedHooks.push("Agent Approve plugin");
     return { success: true, backupPath, hooks: installedHooks };
   }
   const hooksToInstall = mode === "observe" ? agent.hooks.filter((h2) => !h2.isApprovalHook) : agent.hooks;
@@ -3940,68 +4352,25 @@ codex_hooks = true`;
       "",
       "OpenCode will auto-install the plugin on next start."
     ].join(`
+`);
+  } else if (agentId === "pi") {
+    return [
+      "Install the Agent Approve extension for Pi:",
+      "",
+      `  pi install ${PI_PLUGIN_SPEC}`,
+      "",
+      "The extension reads your existing Agent Approve config from ~/.agentapprove/env.",
+      "",
+      "Restart Pi to activate the extension."
+    ].join(`
 `);
   }
   return "";
 }
-var HOOK_FILES = [
-  "common.sh",
-  "claude-pre-tool.sh",
-  "claude-post-tool.sh",
-  "claude-post-tool-failure.sh",
-  "claude-notification.sh",
-  "claude-user-prompt.sh",
-  "claude-prompt.sh",
-  "claude-session-start.sh",
-  "claude-session-end.sh",
-  "claude-stop.sh",
-  "notify-hook.sh",
-  "completion-hook.sh",
-  "cursor-session-start.sh",
-  "cursor-session-end.sh",
-  "cursor-approval.sh",
-  "cursor-mcp-approval.sh",
-  "cursor-pre-tool.sh",
-  "cursor-shell-complete.sh",
-  "cursor-mcp-complete.sh",
-  "cursor-post-tool.sh",
-  "cursor-start.sh",
-  "cursor-subagent-start.sh",
-  "cursor-subagent-stop.sh",
-  "cursor-precompact.sh",
-  "cursor-stop.sh",
-  "cursor-thought.sh",
-  "cursor-response.sh",
-  "gemini-before-tool.sh",
-  "gemini-after-tool.sh",
-  "gemini-before-agent.sh",
-  "gemini-after-agent.sh",
-  "gemini-before-model.sh",
-  "gemini-after-model.sh",
-  "gemini-notification.sh",
-  "gemini-session-start.sh",
-  "gemini-session-end.sh",
-  "gemini-stop.sh",
-  "codex-session-start.sh",
-  "codex-pre-tool.sh",
-  "codex-post-tool.sh",
-  "codex-user-prompt.sh",
-  "codex-stop.sh",
-  "github-session-start.sh",
-  "github-session-end.sh",
-  "github-user-prompt.sh",
-  "github-pre-tool.sh",
-  "github-post-tool.sh",
-  "github-error.sh",
-  "github-stop.sh",
-  "github-subagent-start.sh",
-  "github-subagent-stop.sh",
-  "github-precompact.sh"
-];
-async function copyHookScripts(hooksDir, token) {
+async function copyHookScripts(hooksDir, token, files) {
   let downloaded = 0;
   const failed = [];
-  for (const file of HOOK_FILES) {
+  for (const file of files) {
     try {
       const response = await fetch(`${API_URL}/${API_VERSION}/hooks/${file}?format=raw`, {
         headers: {
@@ -4028,13 +4397,66 @@ async function copyHookScripts(hooksDir, token) {
   }
   return { downloaded, failed };
 }
+function readOpenClawInstalledVersion() {
+  const packagePath = join(homedir(), ".openclaw", "extensions", "openclaw", "package.json");
+  if (!existsSync2(packagePath)) {
+    return null;
+  }
+  try {
+    const pkg = JSON.parse(readFileSync(packagePath, "utf-8"));
+    return typeof pkg.version === "string" ? pkg.version : null;
+  } catch {
+    return null;
+  }
+}
 function installOpenClawPluginViaCli() {
   try {
     execSync(`openclaw plugins install ${OPENCLAW_PLUGIN_SPEC}`, { stdio: "pipe" });
-    return { success: true };
+    const installedVersion = readOpenClawInstalledVersion();
+    if (!installedVersion) {
+      return {
+        success: true,
+        label: "Agent Approve plugin (version not verified)"
+      };
+    }
+    if (installedVersion !== OPENCLAW_PLUGIN_VERSION) {
+      return {
+        success: false,
+        error: `OpenClaw installed ${installedVersion}, expected ${OPENCLAW_PLUGIN_VERSION}. Re-run after updating the published installer package.`,
+        label: "Agent Approve plugin"
+      };
+    }
+    return {
+      success: true,
+      version: installedVersion,
+      label: `Agent Approve plugin v${installedVersion}`
+    };
   } catch (err) {
     const message = err instanceof Error ? err.message : "unknown error";
-    return { success: false, error: message };
+    return { success: false, error: message, label: "Agent Approve plugin" };
+  }
+}
+function installPiPluginViaCli() {
+  try {
+    execSync(`pi install ${PI_PLUGIN_SPEC}`, { stdio: "pipe" });
+    return { success: true, label: `Agent Approve extension ${PI_PLUGIN_VERSION}` };
+  } catch (err) {
+    return {
+      success: false,
+      label: "Agent Approve extension",
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function removePiPluginViaCli() {
+  try {
+    execSync("pi remove npm:@agentapprove/pi", { stdio: "pipe" });
+    return { success: true };
+  } catch (err) {
+    return {
+      success: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
   }
 }
 var SYSTEM_DEPS = [
@@ -4255,136 +4677,148 @@ async function installCommand() {
   await checkSystemDependencies();
   const existingConfig = readExistingConfig();
   const hasExistingToken = !!(existingConfig?.token && existingConfig.token.length > 10);
+  let existingTokenPreview = "Not set";
+  let existingKeyId = null;
   if (existingConfig) {
-    const tokenPreview = hasExistingToken ? existingConfig.token.slice(0, 15) + "..." : "not set";
+    existingTokenPreview = hasExistingToken ? existingConfig.token.slice(0, 15) + "..." : "Not set";
     const e2eKeyPath2 = join(getAgentApproveDir(), "e2e-key");
-    let e2eLine = "";
     if (existsSync2(e2eKeyPath2)) {
       const keyHex = readFileSync(e2eKeyPath2, "utf-8").trim();
-      const keyId = createHash("sha256").update(Buffer.from(keyHex, "hex")).digest("hex").slice(0, 8);
-      e2eLine = `
-E2E Key: ${keyId}`;
+      existingKeyId = createHash("sha256").update(Buffer.from(keyHex, "hex")).digest("hex").slice(0, 8);
     }
-    me(`Token: ${tokenPreview}
-Privacy: ${existingConfig.privacy || "unknown"}${e2eLine}`, "Existing configuration found");
-  } else {
-    me(`Approve AI agent actions from your iPhone or Apple Watch.
-Installs hooks for Claude Code, Cursor, Gemini CLI, VS Code GitHub Copilot, and GitHub Copilot CLI.`, "About");
   }
+  me(`Approve AI agent actions from your iPhone or Apple Watch.
+Installs hooks and extensions for Cursor, Claude, Gemini, Pi, OpenCode, OpenClaw, and more.`, "About");
   const installedAgents = detectInstalledAgents();
   const agentOptions = Object.entries(AGENTS).map(([id, agent]) => ({
     value: id,
     label: agent.name,
     hint: installedAgents.includes(id) ? "Detected" : "Not found"
   }));
-  const defaultPrivacy = existingConfig?.privacy || "full";
-  const defaultDebugLog = existingConfig?.debugLog ?? false;
-  const defaultFailBehavior = existingConfig?.failBehavior || "ask";
-  const setup = await ve({
-    agents: () => $e({
-      message: "Select agents to configure",
-      options: agentOptions,
-      initialValues: installedAgents,
-      required: true
-    }),
-    privacy: () => le({
-      message: "Privacy tier - controls what data is stored in event logs",
-      initialValue: defaultPrivacy,
-      options: [
-        { value: "full", label: "Full", hint: "Complete command details stored in logs" },
-        { value: "summary", label: "Summary", hint: "Truncated to 50 chars in logs" },
-        { value: "minimal", label: "Minimal", hint: "Tool name only in logs, most private" }
-      ]
-    }),
-    retention: () => le({
-      message: "Data retention - how long to keep event history",
-      initialValue: "30",
+  const selectedAgents = await $e({
+    message: "Select agents to configure",
+    options: agentOptions,
+    initialValues: installedAgents,
+    required: true
+  });
+  if (lD(selectedAgents)) {
+    he("Installation cancelled");
+    process.exit(0);
+  }
+  const setupProfileSummary = existingConfig ? formatSetupProfileBlock("Existing config", getInitialInstallConfig("existing-config", existingConfig), [
+    `Connection token: ${existingTokenPreview} - already linked to your Agent Approve account.`,
+    ...existingKeyId ? [`Encryption key ID: ${existingKeyId} - already installed for this computer.`] : []
+  ]) : formatSetupProfileBlock("Recommended setup", getInitialInstallConfig("recommended", existingConfig));
+  me(setupProfileSummary, "Setup profiles");
+  const setupProfile = await le({
+    message: "How would you like to set up Agent Approve?",
+    options: getSetupProfileOptions(Boolean(existingConfig))
+  });
+  if (lD(setupProfile)) {
+    he("Installation cancelled");
+    process.exit(0);
+  }
+  ensureAgentApproveDir();
+  const hooksDir = join(getAgentApproveDir(), "hooks");
+  const selectedInstallConfig = getInitialInstallConfig(setupProfile, existingConfig);
+  let token = null;
+  let finalPrivacy = selectedInstallConfig.privacy;
+  let email = "";
+  let apiUrl = API_URL;
+  let debugLog = selectedInstallConfig.debugLog;
+  let retentionDays = selectedInstallConfig.retentionDays;
+  let failBehavior = selectedInstallConfig.failBehavior;
+  let installMode = selectedInstallConfig.installMode;
+  let useE2E = selectedInstallConfig.e2eEnabled;
+  let configSetAt = Math.floor(Date.now() / 1000);
+  if (setupProfile === "customize") {
+    const modeChoice = await le({
+      message: "Choose your security mode:",
+      initialValue: installMode,
       options: [
-        { value: "365", label: "1 Year", hint: "Delete events older than 1 year" },
-        { value: "90", label: "90 Days", hint: "Delete events older than 90 days" },
-        { value: "30", label: "30 Days", hint: "Delete events older than 30 days (recommended)" },
-        { value: "7", label: "1 Week", hint: "Delete events older than 7 days" },
-        { value: "1", label: "1 Day", hint: "Delete events older than 1 day" }
+        {
+          value: "approval",
+          label: "Approval Mode (recommended)",
+          hint: "Agent asks permission before running commands. Server evaluates policies via encrypted channel."
+        },
+        {
+          value: "observe",
+          label: "Observe Mode (full E2E)",
+          hint: "Agent runs freely. All events are end-to-end encrypted. No server policy evaluation."
+        }
       ]
-    }),
-    failBehavior: () => le({
+    });
+    if (lD(modeChoice)) {
+      he("Installation cancelled");
+      process.exit(0);
+    }
+    installMode = modeChoice;
+    const failBehaviorChoice = await le({
       message: "If Agent Approve is unreachable, hooks should:",
-      initialValue: defaultFailBehavior,
+      initialValue: failBehavior,
       options: [
         { value: "ask", label: "Ask", hint: "Fall back to the agent's built-in approval dialog (recommended)" },
         { value: "deny", label: "Deny", hint: "Block all commands until service is restored" },
         { value: "allow", label: "Allow", hint: "Allow all commands to proceed without approval" }
       ]
-    }),
-    debugLog: () => ce({
-      message: "Enable debug logging? (writes to ~/.agentapprove/hook-debug.log)",
-      initialValue: defaultDebugLog
-    }),
-    installMethod: () => le({
-      message: "How would you like to install hooks?",
+    });
+    if (lD(failBehaviorChoice)) {
+      he("Installation cancelled");
+      process.exit(0);
+    }
+    failBehavior = failBehaviorChoice;
+    const privacyChoice = await le({
+      message: "Privacy tier - controls what data is stored in event history",
+      initialValue: finalPrivacy,
       options: [
-        { value: "auto", label: "Automatic", hint: "Back up configs and install hooks for me" },
-        { value: "manual", label: "Manual", hint: "Show me what to add (I'll do it myself)" }
+        { value: "full", label: "Full", hint: "Complete command details stored in event history" },
+        { value: "summary", label: "Summary", hint: "Truncated to 50 chars in event history" },
+        { value: "minimal", label: "Minimal", hint: "Tool name only in event history, most private" }
       ]
-    })
-  }, {
-    onCancel: () => {
+    });
+    if (lD(privacyChoice)) {
       he("Installation cancelled");
       process.exit(0);
     }
-  });
-  const { agents: selectedAgents, privacy, retention, failBehavior, debugLog, installMethod } = setup;
-  const retentionDays = parseInt(retention, 10) || 30;
+    finalPrivacy = privacyChoice;
+  }
+  const skipE2E = hasFlag2("--no-e2e");
+  const e2eRequired = installMode === "observe";
+  if (e2eRequired) {
+    if (skipE2E) {
+      v2.warn("Observe Mode requires E2E encryption; ignoring --no-e2e.");
+    }
+    useE2E = true;
+  } else if (skipE2E) {
+    useE2E = false;
+  }
   ensureAgentApproveDir();
-  const hooksDir = join(getAgentApproveDir(), "hooks");
-  const connectionOptions = [];
-  if (hasExistingToken) {
-    const tokenPreview = existingConfig.token.slice(0, 15) + "...";
-    connectionOptions.push({
-      value: "existing",
-      label: "Use existing token",
-      hint: tokenPreview
+  const agentApproveDir = getAgentApproveDir();
+  const existingKeyPath = join(agentApproveDir, "e2e-key");
+  let e2eUserKey = null;
+  let backupOldKeyTo = null;
+  if (setupProfile === "customize" && !e2eRequired && !skipE2E) {
+    const e2eChoice = await ce({
+      message: "Enable end-to-end encryption?",
+      initialValue: useE2E
     });
+    if (lD(e2eChoice)) {
+      he("Installation cancelled");
+      process.exit(0);
+    }
+    useE2E = e2eChoice;
   }
-  connectionOptions.push({ value: "qr", label: "Scan QR code", hint: hasExistingToken ? undefined : "Recommended" });
-  const connectionMethod = await le({
-    message: "Connect to iOS app (required for hook download)",
-    options: connectionOptions
-  });
-  if (lD(connectionMethod)) {
-    he("Installation cancelled");
-    process.exit(0);
-  }
-  let token = null;
-  let finalPrivacy = privacy;
-  let email = "";
-  let apiUrl = API_URL;
-  let useE2E = true;
-  if (connectionMethod === "existing") {
-    token = existingConfig.token;
-    apiUrl = existingConfig.apiUrl || API_URL;
-    const e2eKeyExists = existsSync2(join(getAgentApproveDir(), "e2e-key"));
-    useE2E = e2eKeyExists;
-    v2.success("Using existing token");
-  } else if (connectionMethod === "qr") {
-    const skipE2E = hasFlag2("--no-e2e");
-    useE2E = !skipE2E;
-    const agentApproveDir = getAgentApproveDir();
-    const existingKeyPath = join(agentApproveDir, "e2e-key");
-    let e2eUserKey = null;
-    if (useE2E) {
-      if (existsSync2(existingKeyPath)) {
-        const oldKeyHex = readFileSync(existingKeyPath, "utf-8").trim();
-        const oldKeyId = createHash("sha256").update(Buffer.from(oldKeyHex, "hex")).digest("hex").slice(0, 8);
+  if (useE2E) {
+    if (existsSync2(existingKeyPath)) {
+      const oldKeyHex = readFileSync(existingKeyPath, "utf-8").trim();
+      const oldKeyId = createHash("sha256").update(Buffer.from(oldKeyHex, "hex")).digest("hex").slice(0, 8);
+      if (setupProfile === "existing-config") {
+        e2eUserKey = oldKeyHex;
+      } else {
         v2.info(`Existing E2E key found (Key ID: ${oldKeyId})`);
         const keyAction = await le({
           message: "Reuse existing encryption key or generate a new one?",
-          options: [
-            { value: "reuse", label: "Reuse existing key", hint: "recommended — keeps old events decryptable" },
-            { value: "backup", label: "Back up old key, then generate new" },
-            { value: "discard", label: "Discard old key and generate new" },
-            { value: "disable", label: "Disable E2E encryption", hint: "events visible on web dashboard" }
-          ]
+          options: getExistingKeyActionOptions(e2eRequired)
         });
         if (lD(keyAction)) {
           he("Installation cancelled");
@@ -4396,33 +4830,96 @@ Installs hooks for Claude Code, Cursor, Gemini CLI, VS Code GitHub Copilot, and
           e2eUserKey = oldKeyHex;
         } else {
           if (keyAction === "backup") {
-            const backupPath = join(agentApproveDir, `e2e-key.${oldKeyId}.bak`);
-            renameSync(existingKeyPath, backupPath);
-            v2.success(`Old key backed up to ${backupPath}`);
-          }
-          e2eUserKey = randomBytes(32).toString("hex");
-        }
-      } else {
-        if (!skipE2E) {
-          const e2eChoice = await ce({
-            message: "Enable end-to-end encryption?",
-            initialValue: true
-          });
-          if (lD(e2eChoice)) {
-            he("Installation cancelled");
-            process.exit(0);
+            backupOldKeyTo = join(agentApproveDir, `e2e-key.${oldKeyId}.bak`);
           }
-          useE2E = e2eChoice;
-        }
-        if (useE2E) {
           e2eUserKey = randomBytes(32).toString("hex");
         }
       }
+    } else {
+      e2eUserKey = randomBytes(32).toString("hex");
+    }
+  }
+  if (!useE2E) {
+    v2.info("E2E encryption disabled — event content will be visible on the web dashboard");
+  }
+  const e2eKeyId = e2eUserKey ? createHash("sha256").update(Buffer.from(e2eUserKey, "hex")).digest("hex").slice(0, 8) : undefined;
+  if (setupProfile === "customize") {
+    const retentionChoice = await le({
+      message: "Data retention - how long to keep event history",
+      initialValue: `${retentionDays}`,
+      options: [
+        { value: "365", label: "1 Year", hint: "Delete events older than 1 year" },
+        { value: "90", label: "90 Days", hint: "Delete events older than 90 days" },
+        { value: "30", label: "30 Days", hint: "Delete events older than 30 days (recommended)" },
+        { value: "7", label: "1 Week", hint: "Delete events older than 7 days" },
+        { value: "1", label: "1 Day", hint: "Delete events older than 1 day" }
+      ]
+    });
+    if (lD(retentionChoice)) {
+      he("Installation cancelled");
+      process.exit(0);
+    }
+    retentionDays = parseInt(retentionChoice, 10) || 30;
+    const debugLogChoice = await ce({
+      message: "Enable debug logging? (writes to ~/.agentapprove/hook-debug.log)",
+      initialValue: debugLog
+    });
+    if (lD(debugLogChoice)) {
+      he("Installation cancelled");
+      process.exit(0);
     }
-    if (!useE2E) {
-      v2.info("E2E encryption disabled — event content will be visible on the web dashboard");
+    debugLog = debugLogChoice;
+  }
+  const silentlyReuseExistingToken = setupProfile === "existing-config" && hasExistingToken;
+  const connectionOptions = [];
+  if (hasExistingToken) {
+    const tokenPreview = existingConfig.token.slice(0, 15) + "...";
+    connectionOptions.push({
+      value: "existing",
+      label: "Use existing token",
+      hint: tokenPreview
+    });
+  }
+  connectionOptions.push({ value: "qr", label: "Scan QR code", hint: hasExistingToken ? undefined : "Recommended" }, { value: "copy", label: "Copy and paste code", hint: "No camera" });
+  let connectionMethod;
+  if (silentlyReuseExistingToken) {
+    connectionMethod = "existing";
+  } else {
+    const connectionChoice = await le({
+      message: "Connect to iOS app (required for setup and any hook downloads)",
+      options: connectionOptions
+    });
+    if (lD(connectionChoice)) {
+      he("Installation cancelled");
+      process.exit(0);
     }
-    const e2eKeyId = e2eUserKey ? createHash("sha256").update(Buffer.from(e2eUserKey, "hex")).digest("hex").slice(0, 8) : undefined;
+    connectionMethod = connectionChoice;
+  }
+  if (connectionMethod === "existing") {
+    token = existingConfig.token;
+    apiUrl = existingConfig.apiUrl || API_URL;
+    const e2eKeyExists = existsSync2(existingKeyPath);
+    useE2E = e2eKeyExists;
+    e2eUserKey = null;
+    backupOldKeyTo = null;
+    if (!silentlyReuseExistingToken) {
+      v2.success("Using existing token");
+    }
+  } else if (shouldCreateFreshPairing(connectionMethod)) {
+    const pairingMethod = connectionMethod;
+    if (backupOldKeyTo) {
+      renameSync(existingKeyPath, backupOldKeyTo);
+      v2.success(`Old key backed up to ${backupOldKeyTo}`);
+      backupOldKeyTo = null;
+    }
+    configSetAt = Math.floor(Date.now() / 1000);
+    const pairingConfig = {
+      privacyTier: finalPrivacy,
+      retentionDays,
+      failBehavior,
+      configSetAt,
+      e2eEnabled: useE2E
+    };
     const session = await createPairingSession(selectedAgents, e2eKeyId);
     if (!session || session.error) {
       v2.error(`Failed to create pairing session: ${session?.error || "Unknown error"}`);
@@ -4430,18 +4927,19 @@ Installs hooks for Claude Code, Cursor, Gemini CLI, VS Code GitHub Copilot, and
       process.exit(1);
     } else {
       const machineHost = hostname();
-      let qrUrlWithE2e = `${session.qrUrl}&host=${encodeURIComponent(machineHost)}`;
-      if (e2eUserKey) {
-        const e2eKeyBase64url = Buffer.from(e2eUserKey, "hex").toString("base64url");
-        qrUrlWithE2e += `&e2eKey=${e2eKeyBase64url}`;
-      }
-      let qrDisplay = "";
-      import_qrcode_terminal.default.generate(qrUrlWithE2e, { small: true }, (qr) => {
-        qrDisplay = qr;
+      const pairingPresentation = buildPairingPresentation({
+        sessionCode: session.sessionCode,
+        hostname: machineHost,
+        config: pairingConfig,
+        e2eUserKey
+      });
+      await showPairingPresentation({
+        sessionCode: session.sessionCode,
+        pairingUrl: pairingPresentation.pairingUrl,
+        manualCode: pairingPresentation.manualCode,
+        keyId: e2eKeyId,
+        method: pairingMethod
       });
-      await new Promise((resolve) => setTimeout(resolve, 10));
-      me(qrDisplay + `
-Session: ${session.sessionCode}`, "Scan with Agent Approve iOS app");
       const pairingSpinner = _2();
       pairingSpinner.start("Waiting for iOS app...");
       const result = await waitForPairing(session.sessionCode, (expiresIn) => {
@@ -4458,10 +4956,9 @@ Session: ${session.sessionCode}`, "Scan with Agent Approve iOS app");
         finalPrivacy = result.privacy;
         email = result.email;
         if (e2eUserKey && e2eKeyId) {
-          const agentApproveDir2 = getAgentApproveDir();
-          const rootKeyPath = join(agentApproveDir2, "e2e-root-key");
+          const rootKeyPath = join(agentApproveDir, "e2e-root-key");
           writeFileSync(rootKeyPath, e2eUserKey, { mode: 384 });
-          const userKeyPath = join(agentApproveDir2, "e2e-key");
+          const userKeyPath = join(agentApproveDir, "e2e-key");
           writeFileSync(userKeyPath, e2eUserKey, { mode: 384 });
           writeRotationConfig({
             rootKeyId: e2eKeyId,
@@ -4470,7 +4967,7 @@ Session: ${session.sessionCode}`, "Scan with Agent Approve iOS app");
             startedAt: new Date().toISOString()
           });
           if (result.e2eServerKey) {
-            const serverKeyPath = join(agentApproveDir2, "e2e-server-key");
+            const serverKeyPath = join(agentApproveDir, "e2e-server-key");
             writeFileSync(serverKeyPath, result.e2eServerKey, { mode: 384 });
           }
         }
@@ -4490,7 +4987,6 @@ Session: ${session.sessionCode}`, "Scan with Agent Approve iOS app");
     he("Cannot continue without token");
     process.exit(1);
   }
-  const configSetAt = Math.floor(Date.now() / 1000);
   saveEnvConfig({
     apiUrl,
     token,
@@ -4501,55 +4997,36 @@ Session: ${session.sessionCode}`, "Scan with Agent Approve iOS app");
     e2eEnabled: useE2E,
     failBehavior
   });
-  v2.success("Configuration saved to ~/.agentapprove/env");
-  await storeTokenInKeychain(token);
-  pushConfigToCloud({
-    apiUrl,
-    token,
-    privacy: finalPrivacy,
-    retentionDays,
-    failBehavior,
-    configSetAt
-  }).catch(() => {});
-  const downloadSpinner = _2();
-  downloadSpinner.start("Downloading hook scripts");
-  const downloadResult = await copyHookScripts(hooksDir, token);
-  if (downloadResult.failed.length > 0) {
-    downloadSpinner.stop(`Downloaded ${downloadResult.downloaded} hooks, ${downloadResult.failed.length} failed`);
-    v2.warn(`Failed to download: ${downloadResult.failed.join(", ")}`);
+  if (!silentlyReuseExistingToken) {
+    v2.success("Configuration saved to ~/.agentapprove/env");
+  }
+  await storeTokenInKeychain(token, { quiet: silentlyReuseExistingToken });
+  const hookDownloadPlan = buildHookDownloadPlan(selectedAgents);
+  if (hookDownloadPlan.files.length > 0) {
+    const downloadSpinner = _2();
+    downloadSpinner.start("Downloading hook scripts");
+    const downloadResult = await copyHookScripts(hooksDir, token, hookDownloadPlan.files);
+    const summary = formatHookDownloadSummary(hookDownloadPlan);
+    if (downloadResult.failed.length > 0) {
+      downloadSpinner.stop(`Downloaded ${downloadResult.downloaded} of ${hookDownloadPlan.files.length} hook files (${summary})`);
+      v2.warn(`Failed to download: ${downloadResult.failed.join(", ")}`);
+    } else {
+      downloadSpinner.stop(`Hook scripts downloaded (${downloadResult.downloaded} files: ${summary})`);
+    }
   } else {
-    downloadSpinner.stop(`Hook scripts downloaded (${downloadResult.downloaded} files)`);
+    v2.success("No hook scripts needed for the selected agents");
   }
-  const e2eKeyPath = join(homedir(), ".agentapprove", "e2e-key");
+  const e2eKeyPath = join(agentApproveDir, "e2e-key");
   const hasE2EKey = existsSync2(e2eKeyPath);
-  let installMode = "approval";
   if (hasE2EKey) {
-    const modeChoice = await le({
-      message: "Choose your security mode:",
-      options: [
-        {
-          value: "approval",
-          label: "Approval Mode (recommended)",
-          hint: "Agent asks permission before running commands. Server evaluates policies via encrypted channel."
-        },
-        {
-          value: "observe",
-          label: "Observe Mode (full E2E)",
-          hint: "Agent runs freely. All events are end-to-end encrypted. No server policy evaluation."
-        }
-      ]
-    });
-    if (lD(modeChoice)) {
-      he("Installation cancelled");
-      process.exit(0);
-    }
-    installMode = modeChoice;
-    if (installMode === "observe") {
-      v2.info("Observe mode: All events are E2E encrypted. No approval hooks will be installed.");
-    } else {
-      v2.info("Approval mode: Commands are sent via encrypted channel for policy evaluation.");
+    if (!silentlyReuseExistingToken) {
+      if (installMode === "observe") {
+        v2.info("Observe mode: All events are E2E encrypted. No approval hooks will be installed.");
+      } else {
+        v2.info("Approval mode: Commands are sent via encrypted channel for policy evaluation.");
+      }
     }
-    const envPath = join(getAgentApproveDir(), "env");
+    const envPath = join(agentApproveDir, "env");
     if (existsSync2(envPath)) {
       let envContent = readFileSync(envPath, "utf-8");
       if (envContent.includes("AGENTAPPROVE_E2E_MODE=")) {
@@ -4563,17 +5040,33 @@ AGENTAPPROVE_E2E_MODE=${installMode}
       writeFileSync(envPath, envContent, { mode: 384 });
     }
   }
+  const installMethod = await le({
+    message: "How would you like to install hooks?",
+    options: [
+      { value: "auto", label: "Automatic", hint: "Back up configs and install hooks for me" },
+      { value: "manual", label: "Manual", hint: "Show me what to add (I'll do it myself)" }
+    ]
+  });
+  if (lD(installMethod)) {
+    he("Installation cancelled");
+    process.exit(0);
+  }
   if (installMethod === "auto") {
     const filesToModify = [];
     for (const agentId of selectedAgents) {
       const agent = AGENTS[agentId];
-      filesToModify.push(agent.configPath);
+      if (agentId !== "pi") {
+        filesToModify.push(agent.configPath);
+      }
       if (agentId === "codex") {
         filesToModify.push(join(homedir(), ".codex", "config.toml"));
       }
       if (agentId === "opencode") {
         filesToModify.push(join(getOpenCodeConfigDir(), "package.json"));
       }
+      if (agentId === "pi") {
+        filesToModify.push("Pi package registry (via `pi install`)");
+      }
       if (agentId === "vscode-agent") {
         const vsCodeVariants = findInstalledVSCodeVariants();
         for (const { path: settingsPath, variant } of vsCodeVariants) {
@@ -4595,7 +5088,7 @@ Backups will be created with timestamp`, "Files to be modified");
     for (const agentId of selectedAgents) {
       const agent = AGENTS[agentId];
       const spinner = _2();
-      const spinnerMsg = agentId === "openclaw" ? `Installing ${agent.name} plugin` : `Configuring ${agent.name}`;
+      const spinnerMsg = agentId === "pi" ? `Installing ${agent.name} extension` : agentId === "openclaw" ? `Installing ${agent.name} plugin` : `Configuring ${agent.name}`;
       spinner.start(spinnerMsg);
       const result = await installHooksForAgent(agentId, hooksDir, installMode);
       if (result.success) {
@@ -4631,6 +5124,11 @@ Backups will be created with timestamp`, "Files to be modified");
           v2.warn(`Could not install ${OPENCLAW_PLUGIN_SPEC} via OpenClaw CLI.
 ` + `  Error: ${result.error || "unknown"}
 ` + `  Install manually: openclaw plugins install ${OPENCLAW_PLUGIN_SPEC}
+` + `  Then re-run: npx agentapprove`);
+        } else if (agentId === "pi") {
+          v2.warn(`Could not install ${PI_PLUGIN_SPEC} via Pi.
+` + `  Error: ${result.error || "unknown"}
+` + `  Install manually: pi install ${PI_PLUGIN_SPEC}
 ` + `  Then re-run: npx agentapprove`);
         }
       }
@@ -4670,9 +5168,13 @@ async function statusCommand() {
 `);
   for (const line of lines) {
     if (line.startsWith("AGENTAPPROVE_")) {
-      const [key, value] = line.split("=");
-      const displayKey = key.replace("AGENTAPPROVE_", "").toLowerCase();
-      const displayValue = key.includes("TOKEN") ? value.slice(0, 15) + "..." : value;
+      const assignment = parseEnvAssignment(line);
+      if (!assignment) {
+        continue;
+      }
+      const { key, value } = assignment;
+      const displayKey = STATUS_FIELD_LABELS[key] || key.replace("AGENTAPPROVE_", "");
+      const displayValue = formatStatusValue(key, value);
       console.log(`  ${source_default.dim(displayKey + ":")} ${displayValue}`);
     }
   }
@@ -4689,19 +5191,32 @@ async function statusCommand() {
   }
   console.log();
   for (const [agentId, agent] of Object.entries(AGENTS)) {
+    if (agentId === "pi") {
+      try {
+        const listOutput = execSync("pi list", {
+          encoding: "utf-8",
+          stdio: ["pipe", "pipe", "ignore"],
+          timeout: PI_STATUS_TIMEOUT_MS
+        });
+        if (listOutput.includes("@agentapprove/pi")) {
+          console.log(`  ${source_default.green("✓")} ${agent.name}: Agent Approve extension`);
+        }
+      } catch {}
+      continue;
+    }
     if (existsSync2(agent.configPath)) {
       const config = readJsonConfig(agent.configPath);
       if (agentId === "opencode") {
         const pluginConfig = config.plugin;
         if (Array.isArray(pluginConfig) && pluginConfig.some((entry) => typeof entry === "string" && entry.includes("@agentapprove/opencode"))) {
-          console.log(`  ${source_default.green("✓")} ${agent.name}: agentapprove plugin`);
+          console.log(`  ${source_default.green("✓")} ${agent.name}: Agent Approve plugin`);
         }
         continue;
       }
       if (agentId === "openclaw") {
         const entries = config.plugins?.entries;
         if (entries?.openclaw) {
-          console.log(`  ${source_default.green("✓")} ${agent.name}: openclaw plugin`);
+          console.log(`  ${source_default.green("✓")} ${agent.name}: Agent Approve plugin`);
         }
         continue;
       }
@@ -4715,7 +5230,7 @@ async function statusCommand() {
           return str.includes("agentapprove");
         });
         if (installedHooks.length > 0) {
-          console.log(`  ${source_default.green("✓")} ${agent.name}: ${installedHooks.map((h2) => h2.name).join(", ")}`);
+          console.log(`  ${source_default.green("✓")} ${agent.name}: ${installedHooks.map((h2) => formatHookStatusLabel(h2.name)).join(", ")}`);
         }
       }
     }
@@ -4776,6 +5291,15 @@ async function performUninstall(mode) {
   ${mode === "purge" ? "Purging" : "Uninstalling"} Agent Approve...
 `));
   for (const [agentId, agent] of Object.entries(AGENTS)) {
+    if (agentId === "pi") {
+      const result = removePiPluginViaCli();
+      if (result.success) {
+        console.log(`  ${source_default.green("✓")} Pi extension removed`);
+      } else if (existsSync2(agent.configPath)) {
+        console.log(`  ${source_default.yellow("⚠")} Pi extension removal skipped or failed (${result.error || "Pi CLI unavailable"})`);
+      }
+      continue;
+    }
     if (!existsSync2(agent.configPath))
       continue;
     const config = readJsonConfig(agent.configPath);
@@ -5042,24 +5566,37 @@ but if unused for 30 days they expire. Get a new one below.`, "Token Expired");
   } else {
     v2.info('Refresh updates the token only. Use "npx agentapprove pair" if you need to repair or change E2E pairing.');
   }
+  const configSetAt = Math.floor(Date.now() / 1000);
+  const privacy = existingConfig.privacy || "full";
+  const retentionDays = existingConfig.retentionDays ?? 30;
+  const failBehavior = existingConfig.failBehavior || "ask";
+  const pairingConfig = {
+    privacyTier: privacy,
+    retentionDays,
+    failBehavior,
+    configSetAt,
+    e2eEnabled
+  };
   const session = await createPairingSession(installedAgents.length > 0 ? installedAgents : undefined, e2eKeyId);
   if (!session || session.error) {
     v2.error(`Failed to create pairing session: ${session?.error || "Unknown error"}`);
     process.exit(1);
   }
+  const pairingMethod = await promptPairingMethod();
   const machineHost = hostname();
-  let qrUrl = `${session.qrUrl}&host=${encodeURIComponent(machineHost)}`;
-  if (e2eUserKey) {
-    const e2eKeyBase64url = Buffer.from(e2eUserKey, "hex").toString("base64url");
-    qrUrl += `&e2eKey=${e2eKeyBase64url}`;
-  }
-  let qrDisplay = "";
-  import_qrcode_terminal.default.generate(qrUrl, { small: true }, (qr) => {
-    qrDisplay = qr;
+  const pairingPresentation = buildPairingPresentation({
+    sessionCode: session.sessionCode,
+    hostname: machineHost,
+    config: pairingConfig,
+    e2eUserKey
+  });
+  await showPairingPresentation({
+    sessionCode: session.sessionCode,
+    pairingUrl: pairingPresentation.pairingUrl,
+    manualCode: pairingPresentation.manualCode,
+    keyId: e2eKeyId,
+    method: pairingMethod
   });
-  await new Promise((resolve) => setTimeout(resolve, 10));
-  me(qrDisplay + `
-Session: ${session.sessionCode}`, "Scan with Agent Approve iOS app");
   const pairingSpinner = _2();
   pairingSpinner.start("Waiting for iOS app...");
   const result = await waitForPairing(session.sessionCode, (expiresIn) => {
@@ -5079,10 +5616,6 @@ Session: ${session.sessionCode}`, "Scan with Agent Approve iOS app");
     v2.error('Session expired. Run "npx agentapprove refresh" to try again.');
     process.exit(1);
   }
-  const configSetAt = Math.floor(Date.now() / 1000);
-  const privacy = existingConfig.privacy || "full";
-  const retentionDays = existingConfig.retentionDays ?? 30;
-  const failBehavior = existingConfig.failBehavior || "ask";
   saveEnvConfig({
     apiUrl,
     token,
@@ -5099,14 +5632,6 @@ Session: ${session.sessionCode}`, "Scan with Agent Approve iOS app");
     const serverKeyPath = join(getAgentApproveDir(), "e2e-server-key");
     writeFileSync(serverKeyPath, result.e2eServerKey, { mode: 384 });
   }
-  pushConfigToCloud({
-    apiUrl,
-    token,
-    privacy,
-    retentionDays,
-    failBehavior,
-    configSetAt
-  }).catch(() => {});
   const updateSpinner = _2();
   updateSpinner.start("Updating hook scripts with new token");
   try {
@@ -5204,26 +5729,34 @@ async function pairCommand() {
     updateEnvValue("AGENTAPPROVE_E2E_ENABLED", "true");
   }
   const installedAgents = detectInstalledAgents();
+  const pairingConfigSetAt = Math.floor(Date.now() / 1000);
+  const pairingConfig = {
+    privacyTier: existingConfig?.privacy || "full",
+    retentionDays: existingConfig?.retentionDays ?? 30,
+    failBehavior: existingConfig?.failBehavior || "ask",
+    configSetAt: pairingConfigSetAt,
+    e2eEnabled: !!e2eUserKey
+  };
   const session = await createPairingSession(installedAgents.length > 0 ? installedAgents : undefined, e2eKeyId);
   if (!session || session.error) {
     v2.error(`Failed to create pairing session: ${session?.error || "Unknown error"}`);
     process.exit(1);
   }
+  const pairingMethod = await promptPairingMethod();
   const machineHost = hostname();
-  let qrUrlWithE2e = `${session.qrUrl}&host=${encodeURIComponent(machineHost)}`;
-  if (e2eUserKey) {
-    const e2eKeyBase64url = Buffer.from(e2eUserKey, "hex").toString("base64url");
-    qrUrlWithE2e += `&e2eKey=${e2eKeyBase64url}`;
-  }
-  let qrDisplay = "";
-  import_qrcode_terminal.default.generate(qrUrlWithE2e, { small: true }, (qr) => {
-    qrDisplay = qr;
+  const pairingPresentation = buildPairingPresentation({
+    sessionCode: session.sessionCode,
+    hostname: machineHost,
+    config: pairingConfig,
+    e2eUserKey
+  });
+  await showPairingPresentation({
+    sessionCode: session.sessionCode,
+    pairingUrl: pairingPresentation.pairingUrl,
+    manualCode: pairingPresentation.manualCode,
+    keyId: e2eKeyId,
+    method: pairingMethod
   });
-  await new Promise((resolve) => setTimeout(resolve, 10));
-  const noteLabel = e2eKeyId ? `Session: ${session.sessionCode}
-Key ID: ${e2eKeyId}` : `Session: ${session.sessionCode}`;
-  me(qrDisplay + `
-${noteLabel}`, "Scan with Agent Approve iOS app");
   const pairingSpinner = _2();
   pairingSpinner.start("Waiting for iOS app...");
   const result = await waitForPairing(session.sessionCode, (expiresIn) => {
@@ -5286,13 +5819,6 @@ ${noteLabel}`, "Scan with Agent Approve iOS app");
       v2.warn('You may need to run "npx agentapprove install" to reconfigure hooks.');
     }
   }
-  pushConfigToCloud({
-    apiUrl,
-    token: result.token,
-    privacy: existingConfig?.privacy || result.privacy || "full",
-    retentionDays: existingConfig?.retentionDays ?? 30,
-    configSetAt
-  }).catch(() => {});
   ge(source_default.green(`Device paired with key ${e2eKeyId}`));
 }
 async function updateHookScriptsWithToken(token, apiUrl) {