agentapprove 0.1.12 → 0.1.15

package/dist/cli.js

@@ -1821,20 +1821,6 @@ function ye() {
   const s = ["[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)", "(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]))"].join("|");
   return new RegExp(s, "g");
 }
-var ve = async (s, n) => {
-  const t = {}, i = Object.keys(s);
-  for (const r2 of i) {
-    const o = s[r2], c = await o({ results: t })?.catch((l2) => {
-      throw l2;
-    });
-    if (typeof n?.onCancel == "function" && lD(c)) {
-      t[r2] = "canceled", n.onCancel({ results: t });
-      continue;
-    }
-    t[r2] = c;
-  }
-  return t;
-};
 
 // ../../node_modules/.bun/chalk@5.6.2/node_modules/chalk/source/vendor/ansi-styles/index.js
 var ANSI_BACKGROUND_OFFSET = 10;
@@ -2444,10 +2430,28 @@ function getOpenClawPluginTargets(openclawConfigPath) {
     legacyPath ? createRemovalTarget(legacyPath, "plugin_artifact", true) : null
   ].filter((target) => target !== null);
 }
-function getOpenCodePluginTargets(opencodeConfigDir) {
+function getOpenCodePluginTargets(opencodeConfigDir, opencodeCacheDir) {
   const pluginPath = safeJoinWithinBase(opencodeConfigDir, "node_modules", "@agentapprove", "opencode");
+  const cacheNodeModulesPath = opencodeCacheDir ? safeJoinWithinBase(opencodeCacheDir, "node_modules", "@agentapprove", "opencode") : null;
+  const packageCacheTargets = [];
+  if (opencodeCacheDir) {
+    const scopedPackageCacheDir = safeJoinWithinBase(opencodeCacheDir, "packages", "@agentapprove");
+    if (scopedPackageCacheDir && existsSync(scopedPackageCacheDir)) {
+      for (const entry of readdirSync(scopedPackageCacheDir)) {
+        if (!entry.startsWith("opencode@")) {
+          continue;
+        }
+        const packageCachePath = safeJoinWithinBase(scopedPackageCacheDir, entry);
+        if (packageCachePath) {
+          packageCacheTargets.push(createRemovalTarget(packageCachePath, "plugin_artifact", true));
+        }
+      }
+    }
+  }
   return [
-    pluginPath ? createRemovalTarget(pluginPath, "plugin_artifact", true) : null
+    pluginPath ? createRemovalTarget(pluginPath, "plugin_artifact", true) : null,
+    cacheNodeModulesPath ? createRemovalTarget(cacheNodeModulesPath, "plugin_artifact", true) : null,
+    ...packageCacheTargets
   ].filter((target) => target !== null);
 }
 function collectBackupTargets(configPaths) {
@@ -2504,8 +2508,130 @@ function shouldDeleteCryptoMaterial(purgeConfirmed, firstKeyConfirmation, second
   return purgeConfirmed && firstKeyConfirmation && secondKeyConfirmation;
 }
 
+// src/pairing-artifact.ts
+var PAIRING_ARTIFACT_PREFIX = "AAP1.";
+function encodePairingArtifact(artifact) {
+  const payload = {
+    s: artifact.sessionCode,
+    p: artifact.config.privacyTier,
+    r: artifact.config.retentionDays,
+    f: artifact.config.failBehavior,
+    c: artifact.config.configSetAt,
+    e: artifact.config.e2eEnabled ? 1 : 0
+  };
+  if (artifact.hostname) {
+    payload.h = artifact.hostname;
+  }
+  if (artifact.e2eUserKey) {
+    payload.k = Buffer.from(artifact.e2eUserKey, "hex").toString("base64url");
+  }
+  return `${PAIRING_ARTIFACT_PREFIX}${Buffer.from(JSON.stringify(payload)).toString("base64url")}`;
+}
+function buildPairingUrl(pairingArtifact) {
+  return `agentapprove://pair?code=${encodeURIComponent(pairingArtifact)}`;
+}
+
+// src/install-flow.ts
+var VALID_RETENTION_DAYS = [1, 7, 30, 90, 365];
+function normalizePrivacy(value) {
+  if (value === "minimal" || value === "summary" || value === "full") {
+    return value;
+  }
+  return "full";
+}
+function normalizeRetentionDays(value) {
+  if (value && VALID_RETENTION_DAYS.includes(value)) {
+    return value;
+  }
+  return 30;
+}
+function normalizeFailBehavior(value) {
+  if (value === "allow" || value === "deny" || value === "ask") {
+    return value;
+  }
+  return "ask";
+}
+function normalizeInstallMode(value) {
+  if (value === "observe" || value === "approval") {
+    return value;
+  }
+  return "approval";
+}
+function getSetupProfileOptions(hasExistingConfig) {
+  if (hasExistingConfig) {
+    return [
+      {
+        value: "existing-config",
+        label: "Existing config",
+        hint: "Reuse the current local settings already saved on this computer."
+      },
+      {
+        value: "customize",
+        label: "Customize options",
+        hint: "Choose your own mode, fallback behavior, privacy, E2E, retention, and debug logging before pairing."
+      }
+    ];
+  }
+  return [
+    {
+      value: "recommended",
+      label: "Recommended setup",
+      hint: "Use Approval mode, E2E on, fallback Ask, Full privacy, 30-day retention, and debug logging off."
+    },
+    {
+      value: "customize",
+      label: "Customize options",
+      hint: "Choose your own mode, fallback behavior, privacy, E2E, retention, and debug logging before pairing."
+    }
+  ];
+}
+function getRecommendedInstallConfig() {
+  return {
+    privacy: "full",
+    retentionDays: 30,
+    failBehavior: "ask",
+    debugLog: false,
+    installMode: "approval",
+    e2eEnabled: true
+  };
+}
+function getExistingInstallConfig(existingConfig) {
+  return {
+    privacy: normalizePrivacy(existingConfig?.privacy),
+    retentionDays: normalizeRetentionDays(existingConfig?.retentionDays),
+    failBehavior: normalizeFailBehavior(existingConfig?.failBehavior),
+    debugLog: existingConfig?.debugLog ?? false,
+    installMode: normalizeInstallMode(existingConfig?.e2eMode),
+    e2eEnabled: existingConfig?.e2eEnabled !== false
+  };
+}
+function getInitialInstallConfig(choice, existingConfig) {
+  if (choice === "recommended") {
+    return getRecommendedInstallConfig();
+  }
+  return getExistingInstallConfig(existingConfig);
+}
+function getExistingKeyActionOptions(e2eRequired) {
+  const options = [
+    { value: "reuse", label: "Reuse existing key", hint: "recommended - keeps old events decryptable" },
+    { value: "backup", label: "Back up old key, then generate new" },
+    { value: "discard", label: "Discard old key and generate new" }
+  ];
+  if (!e2eRequired) {
+    options.push({
+      value: "disable",
+      label: "Disable E2E encryption",
+      hint: "events visible on web dashboard"
+    });
+  }
+  return options;
+}
+function shouldCreateFreshPairing(connectionMethod) {
+  return connectionMethod === "qr" || connectionMethod === "copy";
+}
+
 // src/cli.ts
-var VERSION = "0.1.12";
+var VERSION = "0.1.15";
 function getApiUrl() {
   return process.env.AGENTAPPROVE_API || "https://api.agentapprove.com";
 }
@@ -2518,6 +2644,12 @@ function getOpenCodeConfigDir() {
 function getOpenCodeConfigPath() {
   return join(getOpenCodeConfigDir(), "opencode.json");
 }
+function getXdgCacheHome() {
+  return process.env.XDG_CACHE_HOME || join(homedir(), ".cache");
+}
+function getOpenCodeCacheDir() {
+  return join(getXdgCacheHome(), "opencode");
+}
 var API_URL = getApiUrl();
 var API_VERSION = process.env.AGENTAPPROVE_API_VERSION || "v001";
 function hasFlag2(flag) {
@@ -2525,18 +2657,36 @@ function hasFlag2(flag) {
 }
 function updateEnvValue(key, value) {
   const envPath = join(getAgentApproveDir(), "env");
-  if (!existsSync2(envPath))
-    return;
-  let content = readFileSync(envPath, "utf-8");
-  const pattern = new RegExp(`^${key}=.*$`, "m");
-  if (pattern.test(content)) {
-    content = content.replace(pattern, `${key}=${value}`);
-  } else {
-    content = content.trimEnd() + `
-${key}=${value}
-`;
+  let content;
+  try {
+    content = readFileSync(envPath, "utf-8");
+  } catch (err) {
+    if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
+      return;
+    }
+    throw err;
   }
-  writeFileSync(envPath, content, { mode: 384 });
+  const lines = content.endsWith(`
+`) ? content.slice(0, -1).split(`
+`) : content.split(`
+`);
+  let seenKey = false;
+  const updatedLines = lines.flatMap((line) => {
+    const trimmed = line.replace(/^export\s+/, "").trim();
+    const eqIdx = trimmed.indexOf("=");
+    if (eqIdx <= 0 || trimmed.slice(0, eqIdx) !== key)
+      return [line];
+    if (seenKey)
+      return [];
+    seenKey = true;
+    return [`${key}=${value}`];
+  });
+  if (!seenKey) {
+    updatedLines.push(`${key}=${value}`);
+  }
+  writeFileSync(envPath, `${updatedLines.join(`
+`)}
+`, { mode: 384 });
 }
 function getCommand() {
   const args = process.argv.slice(2);
@@ -2553,9 +2703,13 @@ function getCommand() {
   }
   return filtered[0] || "install";
 }
-var OPENCODE_PLUGIN_VERSION = "0.1.8";
-var OPENCLAW_PLUGIN_VERSION = "0.2.7";
+var OPENCODE_PLUGIN_VERSION = "0.1.12";
+var OPENCODE_PLUGIN_SPEC = `@agentapprove/opencode@${OPENCODE_PLUGIN_VERSION}`;
+var OPENCLAW_PLUGIN_VERSION = "0.2.10";
 var OPENCLAW_PLUGIN_SPEC = `@agentapprove/openclaw@${OPENCLAW_PLUGIN_VERSION}`;
+var PI_PLUGIN_VERSION = "0.1.2";
+var PI_PLUGIN_SPEC = `npm:@agentapprove/pi@${PI_PLUGIN_VERSION}`;
+var PI_STATUS_TIMEOUT_MS = 5000;
 var AGENTS = {
   "claude-code": {
     name: "Claude Code",
@@ -2665,6 +2819,14 @@ var AGENTS = {
     hooks: [
       { name: "agentapprove", file: "@agentapprove/opencode", description: "Tool approval + event monitoring", isApprovalHook: true, isPlugin: true }
     ]
+  },
+  pi: {
+    name: "Pi",
+    configPath: join(homedir(), ".pi", "agent", "settings.json"),
+    hooksKey: "packages",
+    hooks: [
+      { name: "agentapprove", file: "@agentapprove/pi", description: "Tool approval + event monitoring", isApprovalHook: true, isPlugin: true }
+    ]
   }
 };
 var SHARED_HOOK_FILES = ["common.sh"];
@@ -2902,6 +3064,15 @@ function detectInstalledAgents() {
       if (existsSync2(getOpenCodeConfigDir())) {
         installed.push(id);
       }
+    } else if (id === "pi") {
+      if (existsSync2(join(homedir(), ".pi", "agent"))) {
+        installed.push(id);
+      } else {
+        try {
+          execSync("pi --version", { stdio: "ignore" });
+          installed.push(id);
+        } catch {}
+      }
     } else {
       const configDir = dirname2(agent.configPath);
       if (existsSync2(configDir)) {
@@ -2991,6 +3162,68 @@ function formatStatusValue(key, value) {
       return value;
   }
 }
+function formatSetupValue(value) {
+  return value.charAt(0).toUpperCase() + value.slice(1);
+}
+function describePrivacy(value) {
+  switch (value) {
+    case "minimal":
+      return "Tool name only is stored in event history.";
+    case "summary":
+      return "Command details are truncated to 50 characters in event history.";
+    case "full":
+    default:
+      return "Complete command details are stored in event history.";
+  }
+}
+function describeRetentionDays(days) {
+  return `Delete events older than ${days} ${days === 1 ? "day" : "days"}.`;
+}
+function describeFailBehavior(value) {
+  switch (value) {
+    case "allow":
+      return "Allow commands to proceed without approval.";
+    case "deny":
+      return "Block all commands until the service is restored.";
+    case "ask":
+    default:
+      return "Fall back to the agent's built-in approval dialog.";
+  }
+}
+function describeInstallMode(value) {
+  switch (value) {
+    case "observe":
+      return "Agent runs freely and all events are end-to-end encrypted.";
+    case "approval":
+    default:
+      return "Commands are sent via an encrypted channel for policy evaluation.";
+  }
+}
+function describeE2EEnabled(enabled) {
+  if (enabled) {
+    return "Event content is encrypted between this computer and your devices.";
+  }
+  return "Event content can be viewed on the web dashboard.";
+}
+function describeDebugLogging(enabled) {
+  if (enabled) {
+    return "Write hook logs to ~/.agentapprove/hook-debug.log.";
+  }
+  return "Do not write hook debug logs unless you turn them on later.";
+}
+function formatSetupProfileBlock(title, config, extraLines = []) {
+  return [
+    title,
+    ...extraLines.map((line) => `  ${line}`),
+    `  Security mode: ${formatSetupValue(config.installMode)} - ${describeInstallMode(config.installMode)}`,
+    `  If Agent Approve is unreachable: ${formatSetupValue(config.failBehavior)} - ${describeFailBehavior(config.failBehavior)}`,
+    `  Privacy tier: ${formatSetupValue(config.privacy)} - ${describePrivacy(config.privacy)}`,
+    `  End-to-end encryption: ${config.e2eEnabled ? "Enabled" : "Disabled"} - ${describeE2EEnabled(config.e2eEnabled)}`,
+    `  Data retention: ${config.retentionDays} days - ${describeRetentionDays(config.retentionDays)}`,
+    `  Debug logging: ${config.debugLog ? "Enabled" : "Disabled"} - ${describeDebugLogging(config.debugLog)}`
+  ].join(`
+`);
+}
 function formatHookStatusLabel(name) {
   const explicitLabel = HOOK_STATUS_LABELS[name];
   if (explicitLabel) {
@@ -3018,7 +3251,7 @@ function buildUninstallPlan() {
   const configuredAgents = detectInstalledAgents();
   const pluginArtifactTargets = uniqueRemovalTargets([
     ...getOpenClawPluginTargets(AGENTS.openclaw.configPath),
-    ...getOpenCodePluginTargets(getOpenCodeConfigDir())
+    ...getOpenCodePluginTargets(getOpenCodeConfigDir(), getOpenCodeCacheDir())
   ]);
   return {
     configuredAgents,
@@ -3145,6 +3378,13 @@ function readExistingConfig() {
         case "AGENTAPPROVE_RETENTION_DAYS":
           config.retentionDays = value === "forever" ? 365 : parseInt(value, 10);
           break;
+        case "AGENTAPPROVE_CONFIG_SET_AT": {
+          const parsed = parseInt(value, 10);
+          if (Number.isFinite(parsed) && parsed > 0) {
+            config.configSetAt = parsed;
+          }
+          break;
+        }
         case "AGENTAPPROVE_DEBUG_LOG":
           config.debugLog = value === "true";
           break;
@@ -3433,6 +3673,101 @@ async function waitForPairing(sessionCode, onProgress, onCancel) {
   cleanup();
   return null;
 }
+function buildPairingPresentation(params) {
+  const pairingArtifact = encodePairingArtifact({
+    sessionCode: params.sessionCode,
+    hostname: params.hostname,
+    config: params.config,
+    e2eUserKey: params.e2eUserKey ?? undefined
+  });
+  return {
+    pairingArtifact,
+    pairingUrl: buildPairingUrl(pairingArtifact),
+    manualCode: pairingArtifact
+  };
+}
+function copyToClipboard(text) {
+  let cmd;
+  let args = [];
+  switch (process.platform) {
+    case "darwin":
+      cmd = "pbcopy";
+      break;
+    case "win32":
+      cmd = "clip";
+      break;
+    default:
+      for (const candidate of [
+        { cmd: "wl-copy", args: [] },
+        { cmd: "xclip", args: ["-selection", "clipboard"] },
+        { cmd: "xsel", args: ["--clipboard", "--input"] }
+      ]) {
+        const result2 = spawnSync(candidate.cmd, candidate.args, {
+          input: text,
+          stdio: ["pipe", "ignore", "ignore"]
+        });
+        if (result2.status === 0 && !result2.error)
+          return true;
+      }
+      return false;
+  }
+  const result = spawnSync(cmd, args, {
+    input: text,
+    stdio: ["pipe", "ignore", "ignore"]
+  });
+  return result.status === 0 && !result.error;
+}
+async function promptPairingMethod() {
+  const choice = await le({
+    message: "How will you connect to the iOS app?",
+    options: [
+      { value: "qr", label: "Scan QR code", hint: "Recommended" },
+      { value: "copy", label: "Copy and paste code", hint: "No camera" }
+    ],
+    initialValue: "qr"
+  });
+  if (lD(choice)) {
+    he("Cancelled");
+    process.exit(0);
+  }
+  return choice;
+}
+async function showPairingPresentation(params) {
+  const detailLines = [`Session: ${params.sessionCode}`];
+  if (params.keyId) {
+    detailLines.push(`Key ID:  ${params.keyId}`);
+  }
+  if (params.method === "qr") {
+    let qrDisplay = "";
+    import_qrcode_terminal.default.generate(params.pairingUrl, { small: true }, (qr) => {
+      qrDisplay = qr;
+    });
+    await new Promise((resolve) => setTimeout(resolve, 10));
+    process.stdout.write(`
+`);
+    process.stdout.write(`  Scan with the Agent Approve iOS app:
+
+`);
+    process.stdout.write(qrDisplay);
+    process.stdout.write(`
+`);
+    me(detailLines.join(`
+`), "Pairing details");
+    return;
+  }
+  me(detailLines.join(`
+`), "Pairing details");
+  const copied = copyToClipboard(params.manualCode);
+  if (copied) {
+    v2.success("Paste code copied to clipboard. In the iOS app, choose the option to enter a code manually and paste.");
+  } else {
+    v2.warn("Could not access the system clipboard. Copy the code below manually instead.");
+  }
+  process.stdout.write(`
+` + params.manualCode + `
+
+`);
+}
 function saveEnvConfig(config) {
   const envPath = join(getAgentApproveDir(), "env");
   const configSetAt = config.configSetAt || Math.floor(Date.now() / 1000);
@@ -3489,7 +3824,7 @@ function isCredentialManagerAvailable() {
     return false;
   }
 }
-async function storeTokenInKeychain(token) {
+async function storeTokenInKeychain(token, options) {
   if (isKeychainAvailable()) {
     try {
       spawnSync("security", [
@@ -3512,7 +3847,9 @@ async function storeTokenInKeychain(token) {
       if (addResult.status !== 0 || addResult.error) {
         throw addResult.error || new Error("security add-generic-password failed");
       }
-      v2.success("Token stored in macOS Keychain");
+      if (!options?.quiet) {
+        v2.success("Token stored in macOS Keychain");
+      }
       return true;
     } catch (err) {
       v2.warn("Could not store token in Keychain (file fallback will be used)");
@@ -3530,7 +3867,9 @@ async function storeTokenInKeychain(token) {
       if (addResult.status !== 0 || addResult.error) {
         throw addResult.error || new Error("cmdkey add credential failed");
       }
-      v2.success("Token stored in Windows Credential Manager");
+      if (!options?.quiet) {
+        v2.success("Token stored in Windows Credential Manager");
+      }
       return true;
     } catch (err) {
       v2.warn("Could not store token in Credential Manager (file fallback will be used)");
@@ -3560,31 +3899,18 @@ function deleteTokenFromKeychain() {
   }
   return false;
 }
-async function pushConfigToCloud(config) {
-  try {
-    const response = await fetch(`${config.apiUrl}/${API_VERSION}/config`, {
-      method: "PUT",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${config.token}`
-      },
-      body: JSON.stringify({
-        privacyTier: config.privacy,
-        retentionDays: config.retentionDays,
-        failBehavior: config.failBehavior,
-        configSetAt: config.configSetAt
-      })
-    });
-    return response.ok;
-  } catch (error) {
-    return false;
-  }
-}
 async function installHooksForAgent(agentId, hooksDir, mode = "approval") {
   const agent = AGENTS[agentId];
   if (!agent) {
     return { success: false, backupPath: null, hooks: [] };
   }
+  if (agentId === "pi") {
+    const installResult = installPiPluginViaCli();
+    if (!installResult.success) {
+      return { success: false, backupPath: null, hooks: [], error: installResult.error };
+    }
+    return { success: true, backupPath: null, hooks: [installResult.label] };
+  }
   const backupPath = backupConfig(agent.configPath);
   const config = readJsonConfig(agent.configPath);
   if (!config[agent.hooksKey]) {
@@ -3628,32 +3954,41 @@ async function installHooksForAgent(agentId, hooksDir, mode = "approval") {
     return { success: true, backupPath, hooks: installedHooks };
   }
   if (agentId === "opencode") {
-    if (!Array.isArray(config.plugin)) {
-      config.plugin = [];
+    const installResult = installOpenCodePluginViaCli();
+    if (!installResult.success) {
+      return { success: false, backupPath, hooks: [], error: installResult.error };
     }
-    const pluginArray = config.plugin;
-    if (!pluginArray.includes("@agentapprove/opencode")) {
-      pluginArray.push("@agentapprove/opencode");
+    const opencodeConfig = readJsonConfig(agent.configPath);
+    if (!Array.isArray(opencodeConfig.plugin)) {
+      opencodeConfig.plugin = [];
     }
-    writeJsonConfig(agent.configPath, config);
+    const pluginArray = opencodeConfig.plugin.filter((entry) => typeof entry === "string").filter((entry) => entry !== "@agentapprove/opencode" && !entry.startsWith("@agentapprove/opencode@"));
+    if (!pluginArray.includes(OPENCODE_PLUGIN_SPEC)) {
+      pluginArray.push(OPENCODE_PLUGIN_SPEC);
+    }
+    opencodeConfig.plugin = pluginArray;
+    writeJsonConfig(agent.configPath, opencodeConfig);
     const opencodePkgPath = join(getOpenCodeConfigDir(), "package.json");
     try {
-      let pkgJson = {};
-      if (existsSync2(opencodePkgPath)) {
-        pkgJson = JSON.parse(readFileSync(opencodePkgPath, "utf-8"));
-      }
-      if (!pkgJson.dependencies) {
-        pkgJson.dependencies = {};
-      }
-      pkgJson.dependencies["@agentapprove/opencode"] = OPENCODE_PLUGIN_VERSION;
-      writeFileSync(opencodePkgPath, JSON.stringify(pkgJson, null, 2) + `
+      const pkgJson = JSON.parse(readFileSync(opencodePkgPath, "utf-8"));
+      const deps = pkgJson.dependencies;
+      if (deps?.["@agentapprove/opencode"]) {
+        delete deps["@agentapprove/opencode"];
+        if (Object.keys(deps).length === 0) {
+          delete pkgJson.dependencies;
+        }
+        writeFileSync(opencodePkgPath, JSON.stringify(pkgJson, null, 2) + `
 `);
+      }
     } catch (err) {
+      if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
+        return { success: true, backupPath, hooks: [...installedHooks, installResult.label] };
+      }
       if (err instanceof Error) {
         console.warn(`Warning: Could not update package.json: ${err.message}`);
       }
     }
-    installedHooks.push("Agent Approve plugin");
+    installedHooks.push(installResult.label);
     return { success: true, backupPath, hooks: installedHooks };
   }
   const hooksToInstall = mode === "observe" ? agent.hooks.filter((h2) => !h2.isApprovalHook) : agent.hooks;
@@ -4062,19 +4397,32 @@ codex_hooks = true`;
 `);
   } else if (agentId === "opencode") {
     const configJson = JSON.stringify({
-      plugin: ["@agentapprove/opencode"]
+      plugin: [OPENCODE_PLUGIN_SPEC]
     }, null, 2);
     const opencodeConfigPath = process.env.XDG_CONFIG_HOME ? `${process.env.XDG_CONFIG_HOME}/opencode/opencode.json` : "~/.config/opencode/opencode.json";
     return [
-      `Add the Agent Approve plugin to your OpenCode config (${opencodeConfigPath}):`,
+      "Install the Agent Approve plugin for OpenCode:",
+      "",
+      `  opencode plugin ${OPENCODE_PLUGIN_SPEC} --global --force`,
+      "",
+      `This command installs the npm plugin and updates your global OpenCode config (${opencodeConfigPath}).`,
+      "",
+      "If you need to edit the config manually, ensure it contains:",
       "",
       configJson,
       "",
-      "Then add the dependency to your OpenCode package.json (same directory):",
+      "Restart OpenCode to activate the plugin."
+    ].join(`
+`);
+  } else if (agentId === "pi") {
+    return [
+      "Install the Agent Approve extension for Pi:",
+      "",
+      `  pi install ${PI_PLUGIN_SPEC}`,
       "",
-      `  { "dependencies": { "@agentapprove/opencode": "${OPENCODE_PLUGIN_VERSION}" } }`,
+      "The extension reads your existing Agent Approve config from ~/.agentapprove/env.",
       "",
-      "OpenCode will auto-install the plugin on next start."
+      "Restart Pi to activate the extension."
     ].join(`
 `);
   }
@@ -4149,6 +4497,112 @@ function installOpenClawPluginViaCli() {
     return { success: false, error: message, label: "Agent Approve plugin" };
   }
 }
+function readJsonPackageVersion(packagePath) {
+  if (!existsSync2(packagePath)) {
+    return null;
+  }
+  try {
+    const pkg = JSON.parse(readFileSync(packagePath, "utf-8"));
+    return typeof pkg.version === "string" ? pkg.version : null;
+  } catch {
+    return null;
+  }
+}
+function readOpenCodeInstalledVersion() {
+  const cacheDir = getOpenCodeCacheDir();
+  const candidates = [
+    join(cacheDir, "packages", "@agentapprove", `opencode@${OPENCODE_PLUGIN_VERSION}`, "node_modules", "@agentapprove", "opencode", "package.json"),
+    join(cacheDir, "packages", "@agentapprove", "opencode@latest", "node_modules", "@agentapprove", "opencode", "package.json"),
+    join(cacheDir, "node_modules", "@agentapprove", "opencode", "package.json"),
+    join(getOpenCodeConfigDir(), "node_modules", "@agentapprove", "opencode", "package.json")
+  ];
+  for (const candidate of candidates) {
+    const version = readJsonPackageVersion(candidate);
+    if (version === OPENCODE_PLUGIN_VERSION) {
+      return version;
+    }
+  }
+  for (const candidate of candidates) {
+    const version = readJsonPackageVersion(candidate);
+    if (version) {
+      return version;
+    }
+  }
+  return null;
+}
+function installOpenCodePluginViaCli() {
+  try {
+    const result = spawnSync("opencode", ["plugin", OPENCODE_PLUGIN_SPEC, "--global", "--force"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    if (result.error) {
+      return {
+        success: false,
+        label: "Agent Approve plugin",
+        error: `Could not run opencode plugin installer: ${result.error.message}`
+      };
+    }
+    if (result.status !== 0) {
+      const detail = [result.stdout, result.stderr].filter(Boolean).join(`
+`).trim();
+      return {
+        success: false,
+        label: "Agent Approve plugin",
+        error: detail || `opencode plugin installer exited with code ${result.status}`
+      };
+    }
+    const installedVersion = readOpenCodeInstalledVersion();
+    if (!installedVersion) {
+      return {
+        success: false,
+        label: "Agent Approve plugin",
+        error: `OpenCode installed ${OPENCODE_PLUGIN_SPEC}, but the installer could not verify the package version. Re-run manually with: opencode plugin ${OPENCODE_PLUGIN_SPEC} --global --force`
+      };
+    }
+    if (installedVersion !== OPENCODE_PLUGIN_VERSION) {
+      return {
+        success: false,
+        label: "Agent Approve plugin",
+        error: `OpenCode installed ${installedVersion}, expected ${OPENCODE_PLUGIN_VERSION}. Re-run after the npm registry exposes the latest package.`
+      };
+    }
+    return {
+      success: true,
+      version: installedVersion,
+      label: `Agent Approve plugin v${installedVersion}`
+    };
+  } catch (err) {
+    return {
+      success: false,
+      label: "Agent Approve plugin",
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function installPiPluginViaCli() {
+  try {
+    execSync(`pi install ${PI_PLUGIN_SPEC}`, { stdio: "pipe" });
+    return { success: true, label: `Agent Approve extension ${PI_PLUGIN_VERSION}` };
+  } catch (err) {
+    return {
+      success: false,
+      label: "Agent Approve extension",
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function removePiPluginViaCli() {
+  try {
+    execSync("pi remove npm:@agentapprove/pi", { stdio: "pipe" });
+    return { success: true };
+  } catch (err) {
+    return {
+      success: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
 var SYSTEM_DEPS = [
   {
     name: "curl",
@@ -4367,136 +4821,148 @@ async function installCommand() {
   await checkSystemDependencies();
   const existingConfig = readExistingConfig();
   const hasExistingToken = !!(existingConfig?.token && existingConfig.token.length > 10);
+  let existingTokenPreview = "Not set";
+  let existingKeyId = null;
   if (existingConfig) {
-    const tokenPreview = hasExistingToken ? existingConfig.token.slice(0, 15) + "..." : "not set";
+    existingTokenPreview = hasExistingToken ? existingConfig.token.slice(0, 15) + "..." : "Not set";
     const e2eKeyPath2 = join(getAgentApproveDir(), "e2e-key");
-    let e2eLine = "";
     if (existsSync2(e2eKeyPath2)) {
       const keyHex = readFileSync(e2eKeyPath2, "utf-8").trim();
-      const keyId = createHash("sha256").update(Buffer.from(keyHex, "hex")).digest("hex").slice(0, 8);
-      e2eLine = `
-E2E Key: ${keyId}`;
+      existingKeyId = createHash("sha256").update(Buffer.from(keyHex, "hex")).digest("hex").slice(0, 8);
     }
-    me(`Token: ${tokenPreview}
-Privacy: ${existingConfig.privacy || "unknown"}${e2eLine}`, "Existing configuration found");
-  } else {
-    me(`Approve AI agent actions from your iPhone or Apple Watch.
-Installs hooks and plugins for OpenClaw, OpenAI Codex, Claude Code, Cursor, Gemini CLI, and more.`, "About");
   }
+  me(`Approve AI agent actions from your iPhone or Apple Watch.
+Installs hooks and extensions for Cursor, Claude, Gemini, Pi, OpenCode, OpenClaw, and more.`, "About");
   const installedAgents = detectInstalledAgents();
   const agentOptions = Object.entries(AGENTS).map(([id, agent]) => ({
     value: id,
     label: agent.name,
     hint: installedAgents.includes(id) ? "Detected" : "Not found"
   }));
-  const defaultPrivacy = existingConfig?.privacy || "full";
-  const defaultDebugLog = existingConfig?.debugLog ?? false;
-  const defaultFailBehavior = existingConfig?.failBehavior || "ask";
-  const setup = await ve({
-    agents: () => $e({
-      message: "Select agents to configure",
-      options: agentOptions,
-      initialValues: installedAgents,
-      required: true
-    }),
-    privacy: () => le({
-      message: "Privacy tier - controls what data is stored in event logs",
-      initialValue: defaultPrivacy,
-      options: [
-        { value: "full", label: "Full", hint: "Complete command details stored in logs" },
-        { value: "summary", label: "Summary", hint: "Truncated to 50 chars in logs" },
-        { value: "minimal", label: "Minimal", hint: "Tool name only in logs, most private" }
-      ]
-    }),
-    retention: () => le({
-      message: "Data retention - how long to keep event history",
-      initialValue: "30",
+  const selectedAgents = await $e({
+    message: "Select agents to configure",
+    options: agentOptions,
+    initialValues: installedAgents,
+    required: true
+  });
+  if (lD(selectedAgents)) {
+    he("Installation cancelled");
+    process.exit(0);
+  }
+  const setupProfileSummary = existingConfig ? formatSetupProfileBlock("Existing config", getInitialInstallConfig("existing-config", existingConfig), [
+    `Connection token: ${existingTokenPreview} - already linked to your Agent Approve account.`,
+    ...existingKeyId ? [`Encryption key ID: ${existingKeyId} - already installed for this computer.`] : []
+  ]) : formatSetupProfileBlock("Recommended setup", getInitialInstallConfig("recommended", existingConfig));
+  me(setupProfileSummary, "Setup profiles");
+  const setupProfile = await le({
+    message: "How would you like to set up Agent Approve?",
+    options: getSetupProfileOptions(Boolean(existingConfig))
+  });
+  if (lD(setupProfile)) {
+    he("Installation cancelled");
+    process.exit(0);
+  }
+  ensureAgentApproveDir();
+  const hooksDir = join(getAgentApproveDir(), "hooks");
+  const selectedInstallConfig = getInitialInstallConfig(setupProfile, existingConfig);
+  let token = null;
+  let finalPrivacy = selectedInstallConfig.privacy;
+  let email = "";
+  let apiUrl = API_URL;
+  let debugLog = selectedInstallConfig.debugLog;
+  let retentionDays = selectedInstallConfig.retentionDays;
+  let failBehavior = selectedInstallConfig.failBehavior;
+  let installMode = selectedInstallConfig.installMode;
+  let useE2E = selectedInstallConfig.e2eEnabled;
+  let configSetAt = setupProfile === "existing-config" && existingConfig?.configSetAt ? existingConfig.configSetAt : Math.floor(Date.now() / 1000);
+  if (setupProfile === "customize") {
+    const modeChoice = await le({
+      message: "Choose your security mode:",
+      initialValue: installMode,
       options: [
-        { value: "365", label: "1 Year", hint: "Delete events older than 1 year" },
-        { value: "90", label: "90 Days", hint: "Delete events older than 90 days" },
-        { value: "30", label: "30 Days", hint: "Delete events older than 30 days (recommended)" },
-        { value: "7", label: "1 Week", hint: "Delete events older than 7 days" },
-        { value: "1", label: "1 Day", hint: "Delete events older than 1 day" }
+        {
+          value: "approval",
+          label: "Approval Mode (recommended)",
+          hint: "Agent asks permission before running commands. Server evaluates policies via encrypted channel."
+        },
+        {
+          value: "observe",
+          label: "Observe Mode (full E2E)",
+          hint: "Agent runs freely. All events are end-to-end encrypted. No server policy evaluation."
+        }
       ]
-    }),
-    failBehavior: () => le({
+    });
+    if (lD(modeChoice)) {
+      he("Installation cancelled");
+      process.exit(0);
+    }
+    installMode = modeChoice;
+    const failBehaviorChoice = await le({
       message: "If Agent Approve is unreachable, hooks should:",
-      initialValue: defaultFailBehavior,
+      initialValue: failBehavior,
       options: [
         { value: "ask", label: "Ask", hint: "Fall back to the agent's built-in approval dialog (recommended)" },
         { value: "deny", label: "Deny", hint: "Block all commands until service is restored" },
         { value: "allow", label: "Allow", hint: "Allow all commands to proceed without approval" }
       ]
-    }),
-    debugLog: () => ce({
-      message: "Enable debug logging? (writes to ~/.agentapprove/hook-debug.log)",
-      initialValue: defaultDebugLog
-    }),
-    installMethod: () => le({
-      message: "How would you like to install hooks?",
+    });
+    if (lD(failBehaviorChoice)) {
+      he("Installation cancelled");
+      process.exit(0);
+    }
+    failBehavior = failBehaviorChoice;
+    const privacyChoice = await le({
+      message: "Privacy tier - controls what data is stored in event history",
+      initialValue: finalPrivacy,
       options: [
-        { value: "auto", label: "Automatic", hint: "Back up configs and install hooks for me" },
-        { value: "manual", label: "Manual", hint: "Show me what to add (I'll do it myself)" }
+        { value: "full", label: "Full", hint: "Complete command details stored in event history" },
+        { value: "summary", label: "Summary", hint: "Truncated to 50 chars in event history" },
+        { value: "minimal", label: "Minimal", hint: "Tool name only in event history, most private" }
       ]
-    })
-  }, {
-    onCancel: () => {
+    });
+    if (lD(privacyChoice)) {
       he("Installation cancelled");
       process.exit(0);
     }
-  });
-  const { agents: selectedAgents, privacy, retention, failBehavior, debugLog, installMethod } = setup;
-  const retentionDays = parseInt(retention, 10) || 30;
+    finalPrivacy = privacyChoice;
+  }
+  const skipE2E = hasFlag2("--no-e2e");
+  const e2eRequired = installMode === "observe";
+  if (e2eRequired) {
+    if (skipE2E) {
+      v2.warn("Observe Mode requires E2E encryption; ignoring --no-e2e.");
+    }
+    useE2E = true;
+  } else if (skipE2E) {
+    useE2E = false;
+  }
   ensureAgentApproveDir();
-  const hooksDir = join(getAgentApproveDir(), "hooks");
-  const connectionOptions = [];
-  if (hasExistingToken) {
-    const tokenPreview = existingConfig.token.slice(0, 15) + "...";
-    connectionOptions.push({
-      value: "existing",
-      label: "Use existing token",
-      hint: tokenPreview
+  const agentApproveDir = getAgentApproveDir();
+  const existingKeyPath = join(agentApproveDir, "e2e-key");
+  let e2eUserKey = null;
+  let backupOldKeyTo = null;
+  if (setupProfile === "customize" && !e2eRequired && !skipE2E) {
+    const e2eChoice = await ce({
+      message: "Enable end-to-end encryption?",
+      initialValue: useE2E
     });
+    if (lD(e2eChoice)) {
+      he("Installation cancelled");
+      process.exit(0);
+    }
+    useE2E = e2eChoice;
   }
-  connectionOptions.push({ value: "qr", label: "Scan QR code", hint: hasExistingToken ? undefined : "Recommended" });
-  const connectionMethod = await le({
-    message: "Connect to iOS app (required for setup and any hook downloads)",
-    options: connectionOptions
-  });
-  if (lD(connectionMethod)) {
-    he("Installation cancelled");
-    process.exit(0);
-  }
-  let token = null;
-  let finalPrivacy = privacy;
-  let email = "";
-  let apiUrl = API_URL;
-  let useE2E = true;
-  if (connectionMethod === "existing") {
-    token = existingConfig.token;
-    apiUrl = existingConfig.apiUrl || API_URL;
-    const e2eKeyExists = existsSync2(join(getAgentApproveDir(), "e2e-key"));
-    useE2E = e2eKeyExists;
-    v2.success("Using existing token");
-  } else if (connectionMethod === "qr") {
-    const skipE2E = hasFlag2("--no-e2e");
-    useE2E = !skipE2E;
-    const agentApproveDir = getAgentApproveDir();
-    const existingKeyPath = join(agentApproveDir, "e2e-key");
-    let e2eUserKey = null;
-    if (useE2E) {
-      if (existsSync2(existingKeyPath)) {
-        const oldKeyHex = readFileSync(existingKeyPath, "utf-8").trim();
-        const oldKeyId = createHash("sha256").update(Buffer.from(oldKeyHex, "hex")).digest("hex").slice(0, 8);
+  if (useE2E) {
+    if (existsSync2(existingKeyPath)) {
+      const oldKeyHex = readFileSync(existingKeyPath, "utf-8").trim();
+      const oldKeyId = createHash("sha256").update(Buffer.from(oldKeyHex, "hex")).digest("hex").slice(0, 8);
+      if (setupProfile === "existing-config") {
+        e2eUserKey = oldKeyHex;
+      } else {
         v2.info(`Existing E2E key found (Key ID: ${oldKeyId})`);
         const keyAction = await le({
           message: "Reuse existing encryption key or generate a new one?",
-          options: [
-            { value: "reuse", label: "Reuse existing key", hint: "recommended — keeps old events decryptable" },
-            { value: "backup", label: "Back up old key, then generate new" },
-            { value: "discard", label: "Discard old key and generate new" },
-            { value: "disable", label: "Disable E2E encryption", hint: "events visible on web dashboard" }
-          ]
+          options: getExistingKeyActionOptions(e2eRequired)
         });
         if (lD(keyAction)) {
           he("Installation cancelled");
@@ -4508,33 +4974,99 @@ Installs hooks and plugins for OpenClaw, OpenAI Codex, Claude Code, Cursor, Gemi
           e2eUserKey = oldKeyHex;
         } else {
           if (keyAction === "backup") {
-            const backupPath = join(agentApproveDir, `e2e-key.${oldKeyId}.bak`);
-            renameSync(existingKeyPath, backupPath);
-            v2.success(`Old key backed up to ${backupPath}`);
+            backupOldKeyTo = join(agentApproveDir, `e2e-key.${oldKeyId}.bak`);
           }
           e2eUserKey = randomBytes(32).toString("hex");
         }
-      } else {
-        if (!skipE2E) {
-          const e2eChoice = await ce({
-            message: "Enable end-to-end encryption?",
-            initialValue: true
-          });
-          if (lD(e2eChoice)) {
-            he("Installation cancelled");
-            process.exit(0);
-          }
-          useE2E = e2eChoice;
-        }
-        if (useE2E) {
-          e2eUserKey = randomBytes(32).toString("hex");
-        }
       }
+    } else {
+      e2eUserKey = randomBytes(32).toString("hex");
+    }
+  }
+  if (!useE2E) {
+    v2.info("E2E encryption disabled — event content will be visible on the web dashboard");
+  }
+  const e2eKeyId = e2eUserKey ? createHash("sha256").update(Buffer.from(e2eUserKey, "hex")).digest("hex").slice(0, 8) : undefined;
+  if (setupProfile === "customize") {
+    const retentionChoice = await le({
+      message: "Data retention - how long to keep event history",
+      initialValue: `${retentionDays}`,
+      options: [
+        { value: "365", label: "1 Year", hint: "Delete events older than 1 year" },
+        { value: "90", label: "90 Days", hint: "Delete events older than 90 days" },
+        { value: "30", label: "30 Days", hint: "Delete events older than 30 days (recommended)" },
+        { value: "7", label: "1 Week", hint: "Delete events older than 7 days" },
+        { value: "1", label: "1 Day", hint: "Delete events older than 1 day" }
+      ]
+    });
+    if (lD(retentionChoice)) {
+      he("Installation cancelled");
+      process.exit(0);
+    }
+    retentionDays = parseInt(retentionChoice, 10) || 30;
+    const debugLogChoice = await ce({
+      message: "Enable debug logging? (writes to ~/.agentapprove/hook-debug.log)",
+      initialValue: debugLog
+    });
+    if (lD(debugLogChoice)) {
+      he("Installation cancelled");
+      process.exit(0);
     }
-    if (!useE2E) {
-      v2.info("E2E encryption disabled — event content will be visible on the web dashboard");
+    debugLog = debugLogChoice;
+  }
+  const silentlyReuseExistingToken = setupProfile === "existing-config" && hasExistingToken;
+  const connectionOptions = [];
+  if (hasExistingToken) {
+    const tokenPreview = existingConfig.token.slice(0, 15) + "...";
+    connectionOptions.push({
+      value: "existing",
+      label: "Use existing token",
+      hint: tokenPreview
+    });
+  }
+  connectionOptions.push({ value: "qr", label: "Scan QR code", hint: hasExistingToken ? undefined : "Recommended" }, { value: "copy", label: "Copy and paste code", hint: "No camera" });
+  let connectionMethod;
+  if (silentlyReuseExistingToken) {
+    connectionMethod = "existing";
+  } else {
+    const connectionChoice = await le({
+      message: "Connect to iOS app (required for setup and any hook downloads)",
+      options: connectionOptions
+    });
+    if (lD(connectionChoice)) {
+      he("Installation cancelled");
+      process.exit(0);
     }
-    const e2eKeyId = e2eUserKey ? createHash("sha256").update(Buffer.from(e2eUserKey, "hex")).digest("hex").slice(0, 8) : undefined;
+    connectionMethod = connectionChoice;
+  }
+  if (connectionMethod === "existing") {
+    token = existingConfig.token;
+    apiUrl = existingConfig.apiUrl || API_URL;
+    if (setupProfile === "existing-config" && existingConfig?.configSetAt) {
+      configSetAt = existingConfig.configSetAt;
+    }
+    const e2eKeyExists = existsSync2(existingKeyPath);
+    useE2E = e2eKeyExists;
+    e2eUserKey = null;
+    backupOldKeyTo = null;
+    if (!silentlyReuseExistingToken) {
+      v2.success("Using existing token");
+    }
+  } else if (shouldCreateFreshPairing(connectionMethod)) {
+    const pairingMethod = connectionMethod;
+    if (backupOldKeyTo) {
+      renameSync(existingKeyPath, backupOldKeyTo);
+      v2.success(`Old key backed up to ${backupOldKeyTo}`);
+      backupOldKeyTo = null;
+    }
+    configSetAt = Math.floor(Date.now() / 1000);
+    const pairingConfig = {
+      privacyTier: finalPrivacy,
+      retentionDays,
+      failBehavior,
+      configSetAt,
+      e2eEnabled: useE2E
+    };
     const session = await createPairingSession(selectedAgents, e2eKeyId);
     if (!session || session.error) {
       v2.error(`Failed to create pairing session: ${session?.error || "Unknown error"}`);
@@ -4542,18 +5074,19 @@ Installs hooks and plugins for OpenClaw, OpenAI Codex, Claude Code, Cursor, Gemi
       process.exit(1);
     } else {
       const machineHost = hostname();
-      let qrUrlWithE2e = `${session.qrUrl}&host=${encodeURIComponent(machineHost)}`;
-      if (e2eUserKey) {
-        const e2eKeyBase64url = Buffer.from(e2eUserKey, "hex").toString("base64url");
-        qrUrlWithE2e += `&e2eKey=${e2eKeyBase64url}`;
-      }
-      let qrDisplay = "";
-      import_qrcode_terminal.default.generate(qrUrlWithE2e, { small: true }, (qr) => {
-        qrDisplay = qr;
+      const pairingPresentation = buildPairingPresentation({
+        sessionCode: session.sessionCode,
+        hostname: machineHost,
+        config: pairingConfig,
+        e2eUserKey
+      });
+      await showPairingPresentation({
+        sessionCode: session.sessionCode,
+        pairingUrl: pairingPresentation.pairingUrl,
+        manualCode: pairingPresentation.manualCode,
+        keyId: e2eKeyId,
+        method: pairingMethod
       });
-      await new Promise((resolve) => setTimeout(resolve, 10));
-      me(qrDisplay + `
-Session: ${session.sessionCode}`, "Scan in Agent Approve iOS app (Settings > Scan QR Code)");
       const pairingSpinner = _2();
       pairingSpinner.start("Waiting for iOS app...");
       const result = await waitForPairing(session.sessionCode, (expiresIn) => {
@@ -4570,10 +5103,9 @@ Session: ${session.sessionCode}`, "Scan in Agent Approve iOS app (Settings > Sca
         finalPrivacy = result.privacy;
         email = result.email;
         if (e2eUserKey && e2eKeyId) {
-          const agentApproveDir2 = getAgentApproveDir();
-          const rootKeyPath = join(agentApproveDir2, "e2e-root-key");
+          const rootKeyPath = join(agentApproveDir, "e2e-root-key");
           writeFileSync(rootKeyPath, e2eUserKey, { mode: 384 });
-          const userKeyPath = join(agentApproveDir2, "e2e-key");
+          const userKeyPath = join(agentApproveDir, "e2e-key");
           writeFileSync(userKeyPath, e2eUserKey, { mode: 384 });
           writeRotationConfig({
             rootKeyId: e2eKeyId,
@@ -4582,7 +5114,7 @@ Session: ${session.sessionCode}`, "Scan in Agent Approve iOS app (Settings > Sca
             startedAt: new Date().toISOString()
           });
           if (result.e2eServerKey) {
-            const serverKeyPath = join(agentApproveDir2, "e2e-server-key");
+            const serverKeyPath = join(agentApproveDir, "e2e-server-key");
             writeFileSync(serverKeyPath, result.e2eServerKey, { mode: 384 });
           }
         }
@@ -4602,7 +5134,6 @@ Session: ${session.sessionCode}`, "Scan in Agent Approve iOS app (Settings > Sca
     he("Cannot continue without token");
     process.exit(1);
   }
-  const configSetAt = Math.floor(Date.now() / 1000);
   saveEnvConfig({
     apiUrl,
     token,
@@ -4613,16 +5144,10 @@ Session: ${session.sessionCode}`, "Scan in Agent Approve iOS app (Settings > Sca
     e2eEnabled: useE2E,
     failBehavior
   });
-  v2.success("Configuration saved to ~/.agentapprove/env");
-  await storeTokenInKeychain(token);
-  pushConfigToCloud({
-    apiUrl,
-    token,
-    privacy: finalPrivacy,
-    retentionDays,
-    failBehavior,
-    configSetAt
-  }).catch(() => {});
+  if (!silentlyReuseExistingToken) {
+    v2.success("Configuration saved to ~/.agentapprove/env");
+  }
+  await storeTokenInKeychain(token, { quiet: silentlyReuseExistingToken });
   const hookDownloadPlan = buildHookDownloadPlan(selectedAgents);
   if (hookDownloadPlan.files.length > 0) {
     const downloadSpinner = _2();
@@ -4638,36 +5163,17 @@ Session: ${session.sessionCode}`, "Scan in Agent Approve iOS app (Settings > Sca
   } else {
     v2.success("No hook scripts needed for the selected agents");
   }
-  const e2eKeyPath = join(homedir(), ".agentapprove", "e2e-key");
+  const e2eKeyPath = join(agentApproveDir, "e2e-key");
   const hasE2EKey = existsSync2(e2eKeyPath);
-  let installMode = "approval";
   if (hasE2EKey) {
-    const modeChoice = await le({
-      message: "Choose your security mode:",
-      options: [
-        {
-          value: "approval",
-          label: "Approval Mode (recommended)",
-          hint: "Agent asks permission before running commands. Server evaluates policies via encrypted channel."
-        },
-        {
-          value: "observe",
-          label: "Observe Mode (full E2E)",
-          hint: "Agent runs freely. All events are end-to-end encrypted. No server policy evaluation."
-        }
-      ]
-    });
-    if (lD(modeChoice)) {
-      he("Installation cancelled");
-      process.exit(0);
-    }
-    installMode = modeChoice;
-    if (installMode === "observe") {
-      v2.info("Observe mode: All events are E2E encrypted. No approval hooks will be installed.");
-    } else {
-      v2.info("Approval mode: Commands are sent via encrypted channel for policy evaluation.");
+    if (!silentlyReuseExistingToken) {
+      if (installMode === "observe") {
+        v2.info("Observe mode: All events are E2E encrypted. No approval hooks will be installed.");
+      } else {
+        v2.info("Approval mode: Commands are sent via encrypted channel for policy evaluation.");
+      }
     }
-    const envPath = join(getAgentApproveDir(), "env");
+    const envPath = join(agentApproveDir, "env");
     if (existsSync2(envPath)) {
       let envContent = readFileSync(envPath, "utf-8");
       if (envContent.includes("AGENTAPPROVE_E2E_MODE=")) {
@@ -4681,16 +5187,35 @@ AGENTAPPROVE_E2E_MODE=${installMode}
       writeFileSync(envPath, envContent, { mode: 384 });
     }
   }
+  const installMethod = await le({
+    message: "How would you like to install hooks?",
+    options: [
+      { value: "auto", label: "Automatic", hint: "Back up configs and install hooks for me" },
+      { value: "manual", label: "Manual", hint: "Show me what to add (I'll do it myself)" }
+    ]
+  });
+  if (lD(installMethod)) {
+    he("Installation cancelled");
+    process.exit(0);
+  }
   if (installMethod === "auto") {
     const filesToModify = [];
     for (const agentId of selectedAgents) {
       const agent = AGENTS[agentId];
-      filesToModify.push(agent.configPath);
+      if (agentId !== "pi") {
+        filesToModify.push(agent.configPath);
+      }
       if (agentId === "codex") {
         filesToModify.push(join(homedir(), ".codex", "config.toml"));
       }
       if (agentId === "opencode") {
-        filesToModify.push(join(getOpenCodeConfigDir(), "package.json"));
+        filesToModify.push(`OpenCode plugin cache (via \`opencode plugin ${OPENCODE_PLUGIN_SPEC} --global --force\`)`);
+      }
+      if (agentId === "openclaw") {
+        filesToModify.push(`OpenClaw plugin registry (via \`openclaw plugins install ${OPENCLAW_PLUGIN_SPEC}\`)`);
+      }
+      if (agentId === "pi") {
+        filesToModify.push("Pi package registry (via `pi install`)");
       }
       if (agentId === "vscode-agent") {
         const vsCodeVariants = findInstalledVSCodeVariants();
@@ -4713,14 +5238,14 @@ Backups will be created with timestamp`, "Files to be modified");
     for (const agentId of selectedAgents) {
       const agent = AGENTS[agentId];
       const spinner = _2();
-      const spinnerMsg = agentId === "openclaw" ? `Installing ${agent.name} plugin` : `Configuring ${agent.name}`;
+      const spinnerMsg = agentId === "pi" ? `Installing ${agent.name} extension` : agentId === "openclaw" ? `Installing ${agent.name} plugin` : `Configuring ${agent.name}`;
       spinner.start(spinnerMsg);
       const result = await installHooksForAgent(agentId, hooksDir, installMode);
       if (result.success) {
         const installedHookNames = result.hooks.join(", ");
         const backupMsg = result.backupPath ? source_default.dim(` (backup created)`) : "";
-        const modeLabel = installMode === "observe" ? source_default.cyan(" [observe]") : source_default.green(" [approval]");
-        spinner.stop(`${agent.name}${modeLabel}: ${installedHookNames}${backupMsg}`);
+        const agentName = source_default.cyan(agent.name);
+        spinner.stop(`${agentName}: ${installedHookNames}${backupMsg}`);
         if (agentId === "vscode-agent") {
           const vsCodeSpinner = _2();
           vsCodeSpinner.start("Registering hook path in VS Code settings");
@@ -4749,6 +5274,11 @@ Backups will be created with timestamp`, "Files to be modified");
           v2.warn(`Could not install ${OPENCLAW_PLUGIN_SPEC} via OpenClaw CLI.
 ` + `  Error: ${result.error || "unknown"}
 ` + `  Install manually: openclaw plugins install ${OPENCLAW_PLUGIN_SPEC}
+` + `  Then re-run: npx agentapprove`);
+        } else if (agentId === "pi") {
+          v2.warn(`Could not install ${PI_PLUGIN_SPEC} via Pi.
+` + `  Error: ${result.error || "unknown"}
+` + `  Install manually: pi install ${PI_PLUGIN_SPEC}
 ` + `  Then re-run: npx agentapprove`);
         }
       }
@@ -4811,6 +5341,19 @@ async function statusCommand() {
   }
   console.log();
   for (const [agentId, agent] of Object.entries(AGENTS)) {
+    if (agentId === "pi") {
+      try {
+        const listOutput = execSync("pi list", {
+          encoding: "utf-8",
+          stdio: ["pipe", "pipe", "ignore"],
+          timeout: PI_STATUS_TIMEOUT_MS
+        });
+        if (listOutput.includes("@agentapprove/pi")) {
+          console.log(`  ${source_default.green("✓")} ${agent.name}: Agent Approve extension`);
+        }
+      } catch {}
+      continue;
+    }
     if (existsSync2(agent.configPath)) {
       const config = readJsonConfig(agent.configPath);
       if (agentId === "opencode") {
@@ -4898,6 +5441,15 @@ async function performUninstall(mode) {
   ${mode === "purge" ? "Purging" : "Uninstalling"} Agent Approve...
 `));
   for (const [agentId, agent] of Object.entries(AGENTS)) {
+    if (agentId === "pi") {
+      const result = removePiPluginViaCli();
+      if (result.success) {
+        console.log(`  ${source_default.green("✓")} Pi extension removed`);
+      } else if (existsSync2(agent.configPath)) {
+        console.log(`  ${source_default.yellow("⚠")} Pi extension removal skipped or failed (${result.error || "Pi CLI unavailable"})`);
+      }
+      continue;
+    }
     if (!existsSync2(agent.configPath))
       continue;
     const config = readJsonConfig(agent.configPath);
@@ -5164,24 +5716,37 @@ but if unused for 30 days they expire. Get a new one below.`, "Token Expired");
   } else {
     v2.info('Refresh updates the token only. Use "npx agentapprove pair" if you need to repair or change E2E pairing.');
   }
+  const configSetAt = existingConfig.configSetAt || Math.floor(Date.now() / 1000);
+  const privacy = existingConfig.privacy || "full";
+  const retentionDays = existingConfig.retentionDays ?? 30;
+  const failBehavior = existingConfig.failBehavior || "ask";
+  const pairingConfig = {
+    privacyTier: privacy,
+    retentionDays,
+    failBehavior,
+    configSetAt,
+    e2eEnabled
+  };
   const session = await createPairingSession(installedAgents.length > 0 ? installedAgents : undefined, e2eKeyId);
   if (!session || session.error) {
     v2.error(`Failed to create pairing session: ${session?.error || "Unknown error"}`);
     process.exit(1);
   }
+  const pairingMethod = await promptPairingMethod();
   const machineHost = hostname();
-  let qrUrl = `${session.qrUrl}&host=${encodeURIComponent(machineHost)}`;
-  if (e2eUserKey) {
-    const e2eKeyBase64url = Buffer.from(e2eUserKey, "hex").toString("base64url");
-    qrUrl += `&e2eKey=${e2eKeyBase64url}`;
-  }
-  let qrDisplay = "";
-  import_qrcode_terminal.default.generate(qrUrl, { small: true }, (qr) => {
-    qrDisplay = qr;
+  const pairingPresentation = buildPairingPresentation({
+    sessionCode: session.sessionCode,
+    hostname: machineHost,
+    config: pairingConfig,
+    e2eUserKey
+  });
+  await showPairingPresentation({
+    sessionCode: session.sessionCode,
+    pairingUrl: pairingPresentation.pairingUrl,
+    manualCode: pairingPresentation.manualCode,
+    keyId: e2eKeyId,
+    method: pairingMethod
   });
-  await new Promise((resolve) => setTimeout(resolve, 10));
-  me(qrDisplay + `
-Session: ${session.sessionCode}`, "Scan in Agent Approve iOS app (Settings > Scan QR Code)");
   const pairingSpinner = _2();
   pairingSpinner.start("Waiting for iOS app...");
   const result = await waitForPairing(session.sessionCode, (expiresIn) => {
@@ -5201,10 +5766,6 @@ Session: ${session.sessionCode}`, "Scan in Agent Approve iOS app (Settings > Sca
     v2.error('Session expired. Run "npx agentapprove refresh" to try again.');
     process.exit(1);
   }
-  const configSetAt = Math.floor(Date.now() / 1000);
-  const privacy = existingConfig.privacy || "full";
-  const retentionDays = existingConfig.retentionDays ?? 30;
-  const failBehavior = existingConfig.failBehavior || "ask";
   saveEnvConfig({
     apiUrl,
     token,
@@ -5221,14 +5782,6 @@ Session: ${session.sessionCode}`, "Scan in Agent Approve iOS app (Settings > Sca
     const serverKeyPath = join(getAgentApproveDir(), "e2e-server-key");
     writeFileSync(serverKeyPath, result.e2eServerKey, { mode: 384 });
   }
-  pushConfigToCloud({
-    apiUrl,
-    token,
-    privacy,
-    retentionDays,
-    failBehavior,
-    configSetAt
-  }).catch(() => {});
   const updateSpinner = _2();
   updateSpinner.start("Updating hook scripts with new token");
   try {
@@ -5326,26 +5879,34 @@ async function pairCommand() {
     updateEnvValue("AGENTAPPROVE_E2E_ENABLED", "true");
   }
   const installedAgents = detectInstalledAgents();
+  const pairingConfigSetAt = Math.floor(Date.now() / 1000);
+  const pairingConfig = {
+    privacyTier: existingConfig?.privacy || "full",
+    retentionDays: existingConfig?.retentionDays ?? 30,
+    failBehavior: existingConfig?.failBehavior || "ask",
+    configSetAt: pairingConfigSetAt,
+    e2eEnabled: !!e2eUserKey
+  };
   const session = await createPairingSession(installedAgents.length > 0 ? installedAgents : undefined, e2eKeyId);
   if (!session || session.error) {
     v2.error(`Failed to create pairing session: ${session?.error || "Unknown error"}`);
     process.exit(1);
   }
+  const pairingMethod = await promptPairingMethod();
   const machineHost = hostname();
-  let qrUrlWithE2e = `${session.qrUrl}&host=${encodeURIComponent(machineHost)}`;
-  if (e2eUserKey) {
-    const e2eKeyBase64url = Buffer.from(e2eUserKey, "hex").toString("base64url");
-    qrUrlWithE2e += `&e2eKey=${e2eKeyBase64url}`;
-  }
-  let qrDisplay = "";
-  import_qrcode_terminal.default.generate(qrUrlWithE2e, { small: true }, (qr) => {
-    qrDisplay = qr;
+  const pairingPresentation = buildPairingPresentation({
+    sessionCode: session.sessionCode,
+    hostname: machineHost,
+    config: pairingConfig,
+    e2eUserKey
+  });
+  await showPairingPresentation({
+    sessionCode: session.sessionCode,
+    pairingUrl: pairingPresentation.pairingUrl,
+    manualCode: pairingPresentation.manualCode,
+    keyId: e2eKeyId,
+    method: pairingMethod
   });
-  await new Promise((resolve) => setTimeout(resolve, 10));
-  const noteLabel = e2eKeyId ? `Session: ${session.sessionCode}
-Key ID: ${e2eKeyId}` : `Session: ${session.sessionCode}`;
-  me(qrDisplay + `
-${noteLabel}`, "Scan in Agent Approve iOS app (Settings > Scan QR Code)");
   const pairingSpinner = _2();
   pairingSpinner.start("Waiting for iOS app...");
   const result = await waitForPairing(session.sessionCode, (expiresIn) => {
@@ -5408,13 +5969,6 @@ ${noteLabel}`, "Scan in Agent Approve iOS app (Settings > Scan QR Code)");
       v2.warn('You may need to run "npx agentapprove install" to reconfigure hooks.');
     }
   }
-  pushConfigToCloud({
-    apiUrl,
-    token: result.token,
-    privacy: existingConfig?.privacy || result.privacy || "full",
-    retentionDays: existingConfig?.retentionDays ?? 30,
-    configSetAt
-  }).catch(() => {});
   ge(source_default.green(`Device paired with key ${e2eKeyId}`));
 }
 async function updateHookScriptsWithToken(token, apiUrl) {