pushary 1.8.0

package/dist/bin/pushary-wait.js

@@ -0,0 +1,122 @@
+#!/usr/bin/env node
+import {
+  describeWaitLadder
+} from "../chunk-CVWG2N3Y.js";
+import {
+  exitOnFailedResponse
+} from "../chunk-EX3GAPA4.js";
+import {
+  createIo
+} from "../chunk-U4TMAANR.js";
+import {
+  exitOnHelpFlag
+} from "../chunk-HZVVNGEW.js";
+import {
+  rejectUnknownFlags
+} from "../chunk-GMXKITVA.js";
+import "../chunk-2ABTSGFT.js";
+import "../chunk-2OY3ZZ5N.js";
+import "../chunk-LXQ5FBBD.js";
+import {
+  UsageError
+} from "../chunk-7QLSKOSU.js";
+import {
+  EXIT
+} from "../chunk-KZERVKTD.js";
+import "../chunk-A2A2YTMG.js";
+import "../chunk-T7E75EKA.js";
+import {
+  getApiKey,
+  getBaseUrl
+} from "../chunk-GPEGOGRJ.js";
+import "../chunk-E4FJTUH4.js";
+import "../chunk-NQTHFF4W.js";
+
+// bin/pushary-wait.ts
+exitOnHelpFlag("wait");
+var { dim, bold, green, cyan, yellow } = createIo();
+var MAX_WINDOW = 300;
+var printLadder = (data) => {
+  console.log();
+  console.log(`  ${bold("Wait ladder")} ${dim("(what happens when you don't answer)")}`);
+  console.log();
+  console.log(`  Default push window: ${cyan(`${data.defaultPushFirstSeconds}s`)} ${dim("(catch-all tools)")}`);
+  if (data.modeOverride) {
+    console.log(`  ${yellow("!")} Active mode override: ${cyan(data.modeOverride)} ${dim("(pushary mode status)")}`);
+  }
+  console.log();
+  const rows = [...data.policies].sort((a, b) => a.tool === "*" ? -1 : b.tool === "*" ? 1 : a.tool.localeCompare(b.tool));
+  const width = Math.max(...rows.map((p) => p.tool.length), 4);
+  for (const p of rows) {
+    const label = p.tool === "*" ? "default (*)" : p.tool;
+    console.log(`  ${label.padEnd(width + 2)} ${dim("\xB7")} ${describeWaitLadder(p)}`);
+  }
+  console.log();
+  console.log(`  ${dim("Set the default window:")} ${cyan("pushary wait <seconds>")}`);
+  console.log(`  ${dim("Reset it:")}              ${cyan("pushary wait clear")}`);
+  console.log(`  ${dim("Per-tool rules live in the dashboard under Agent \u2192 Policies.")}`);
+};
+var fetchPolicy = async (baseUrl, headers) => {
+  const res = await fetch(`${baseUrl}/api/mcp/policy`, { headers });
+  if (!res.ok) await exitOnFailedResponse(res, baseUrl);
+  return res.json();
+};
+var setWindow = async (baseUrl, headers, seconds) => {
+  const res = await fetch(`${baseUrl}/api/mcp/policy`, {
+    method: "PATCH",
+    headers,
+    body: JSON.stringify({ defaultPushFirstSeconds: seconds })
+  });
+  if (!res.ok) await exitOnFailedResponse(res, baseUrl);
+  const data = await res.json();
+  return data.defaultPushFirstSeconds;
+};
+{
+  const raw = process.argv.slice(2);
+  const positional = raw[0] === "wait" ? raw.slice(1) : raw;
+  try {
+    rejectUnknownFlags(positional, []);
+  } catch (err) {
+    process.stderr.write(`  ! ${err instanceof Error ? err.message : String(err)}
+`);
+    process.exit(EXIT.USAGE);
+  }
+}
+var main = async () => {
+  const apiKey = getApiKey();
+  const baseUrl = getBaseUrl();
+  const headers = {
+    "Authorization": `Bearer ${apiKey}`,
+    "Content-Type": "application/json"
+  };
+  const rest = process.argv.slice(2);
+  const args = rest[0] === "wait" ? rest.slice(1) : rest;
+  const arg = args[0];
+  if (!arg || arg === "status") {
+    printLadder(await fetchPolicy(baseUrl, headers));
+    return;
+  }
+  if (arg === "clear" || arg === "reset") {
+    const value2 = await setWindow(baseUrl, headers, 20);
+    console.log(`  ${green("\u2713")} Default push window reset to ${cyan(`${value2}s`)}`);
+    return;
+  }
+  const seconds = Number(arg);
+  if (!Number.isFinite(seconds) || seconds < 0 || seconds > MAX_WINDOW) {
+    console.log(`  ${yellow("!")} Invalid window: ${arg} ${dim(`(use 0-${MAX_WINDOW} seconds, or "status" / "clear")`)}`);
+    console.log(`  ${dim("Usage: pushary wait <seconds> | status | clear")}`);
+    process.exit(EXIT.USAGE);
+  }
+  const value = await setWindow(baseUrl, headers, Math.trunc(seconds));
+  const ladder = describeWaitLadder({ tool: "*", mode: "push_first", pushFirstSeconds: value, timeoutSeconds: 0, timeoutAction: "escalate" });
+  console.log(`  ${green("\u2713")} Default push window set to ${cyan(`${value}s`)} ${dim(`(${ladder})`)}`);
+};
+main().catch((err) => {
+  if (err instanceof UsageError) {
+    process.stderr.write(`  ! ${err.message}
+`);
+    process.exit(EXIT.USAGE);
+  }
+  console.error(`  ${yellow("!")} ${err instanceof Error ? err.message : err}`);
+  process.exit(1);
+});

package/dist/bin/pushary.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/bin/pushary.js

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+import {
+  installNetworkDefaults
+} from "../chunk-2OY3ZZ5N.js";
+import "../chunk-LXQ5FBBD.js";
+import "../chunk-7QLSKOSU.js";
+import {
+  EXIT
+} from "../chunk-KZERVKTD.js";
+import "../chunk-A2A2YTMG.js";
+import "../chunk-T7E75EKA.js";
+import "../chunk-GPEGOGRJ.js";
+import {
+  COMMANDS,
+  isCommandName,
+  renderHelp
+} from "../chunk-E4FJTUH4.js";
+import {
+  getPackageVersion
+} from "../chunk-NQTHFF4W.js";
+
+// src/cli/runtime.ts
+var supportsRuntime = (version) => {
+  const [major, minor] = version.split(".").map(Number);
+  return major >= 24 || major === 23 && minor >= 5 || major === 22 && minor >= 13 || major === 20 && minor >= 17;
+};
+
+// bin/pushary.ts
+var LOADERS = {
+  setup: () => import("./pushary-setup.js"),
+  cowork: () => import("./pushary-cowork.js"),
+  claude: () => import("./pushary-claude.js"),
+  daemon: () => import("./pushary-daemon.js"),
+  status: () => import("./pushary-status.js"),
+  login: () => import("./pushary-login.js"),
+  logout: () => import("./pushary-logout.js"),
+  connect: () => import("./pushary-connect.js"),
+  bell: () => import("./pushary-bell.js"),
+  doctor: () => import("./pushary-doctor.js"),
+  disconnect: () => import("./pushary-disconnect.js"),
+  clean: () => import("./pushary-clean.js"),
+  mode: () => import("./pushary-mode.js"),
+  wait: () => import("./pushary-wait.js"),
+  stats: () => import("./pushary-stats.js"),
+  suggestions: () => import("./pushary-suggestions.js"),
+  upgrade: () => import("./pushary-upgrade.js"),
+  hook: () => import("./pushary-hook.js"),
+  transcripts: () => import("./pushary-transcripts.js")
+};
+if (!supportsRuntime(process.versions.node)) {
+  process.stderr.write("Pushary requires Node 20.17+, 22.13+, or 23.5+. Upgrade to a current Node LTS and retry.\n");
+  process.exit(EXIT.USAGE);
+}
+installNetworkDefaults();
+var argv = process.argv.slice(2);
+var command = argv[0] ?? "";
+var wants = (...names) => argv.some((arg) => names.includes(arg));
+if (!command || wants("--help", "-h") && !isCommandName(command)) {
+  process.stdout.write(renderHelp(getPackageVersion()));
+  process.exit(EXIT.OK);
+}
+if (wants("--version", "-v") && !isCommandName(command)) {
+  process.stdout.write(`${getPackageVersion()}
+`);
+  process.exit(EXIT.OK);
+}
+if (!isCommandName(command)) {
+  process.stderr.write(`Unknown command: ${command}
+`);
+  process.stderr.write(`Run \`pushary --help\`. Available: ${COMMANDS.map((c) => c.name).join(", ")}
+`);
+  process.exit(EXIT.USAGE);
+}
+await LOADERS[command]();

package/dist/chunk-2ABTSGFT.js

@@ -0,0 +1,173 @@
+import {
+  pusharyFetch
+} from "./chunk-2OY3ZZ5N.js";
+import {
+  NetworkError
+} from "./chunk-7QLSKOSU.js";
+import {
+  EXIT
+} from "./chunk-KZERVKTD.js";
+import {
+  getBaseUrl
+} from "./chunk-GPEGOGRJ.js";
+import {
+  isValidApiKey,
+  normalizeKeyScope
+} from "./chunk-NQTHFF4W.js";
+
+// src/session.ts
+var samePusharyAccount = (left, right) => left.kind === "ok" && right.kind === "ok" && left.identity.workspaceId !== "" && left.identity.workspaceId === right.identity.workspaceId && left.identity.siteId === right.identity.siteId;
+var IDENTITY_PATH = "/api/v1/server/identity";
+var DEFAULT_TIMEOUT_MS = 1e4;
+var SUBSCRIPTION_REQUIRED_CODE = "subscription_required";
+var DEFAULT_UPGRADE_PATH = "/dashboard/settings?tab=billing";
+var SUBSCRIPTION_STATUSES = [
+  "active",
+  "past_due",
+  "canceled",
+  "incomplete",
+  "trialing",
+  "expired",
+  "none"
+];
+var asString = (value) => typeof value === "string" && value ? value : null;
+var asStatus = (value) => SUBSCRIPTION_STATUSES.includes(value) ? value : "none";
+var asCount = (value) => typeof value === "number" && Number.isFinite(value) ? Math.max(0, Math.trunc(value)) : 0;
+var absoluteUrl = (baseUrl, pathOrUrl) => {
+  if (/^https?:\/\//i.test(pathOrUrl)) return pathOrUrl;
+  return `${baseUrl.replace(/\/+$/, "")}${pathOrUrl.startsWith("/") ? "" : "/"}${pathOrUrl}`;
+};
+var toIdentity = (body) => {
+  if (typeof body !== "object" || body === null) return null;
+  const raw = body;
+  const keyId = asString(raw.keyId);
+  const siteId = asString(raw.siteId);
+  const keyScope = normalizeKeyScope(raw.keyScope);
+  if (!keyId || !siteId || !keyScope) return null;
+  return {
+    keyId,
+    keyPrefix: asString(raw.keyPrefix) ?? "",
+    keyName: asString(raw.keyName) ?? "",
+    keyScope,
+    siteId,
+    siteSlug: asString(raw.siteSlug) ?? "",
+    siteName: asString(raw.siteName) ?? "",
+    workspaceId: asString(raw.workspaceId) ?? "",
+    plan: asString(raw.plan) ?? "unknown",
+    surfacePlan: asString(raw.surfacePlan) ?? "unknown",
+    subscriptionStatus: asStatus(raw.subscriptionStatus),
+    locked: raw.locked === true,
+    machineId: asString(raw.machineId),
+    authorizedUserId: asString(raw.authorizedUserId),
+    workspaceMembers: asCount(raw.workspaceMembers),
+    createdAt: asString(raw.createdAt),
+    lastUsedAt: asString(raw.lastUsedAt)
+  };
+};
+var readJsonBody = async (response) => {
+  try {
+    return await response.json();
+  } catch {
+    return null;
+  }
+};
+var checkApiKey = async (apiKey, options = {}) => {
+  if (!isValidApiKey(apiKey)) return { kind: "malformed" };
+  const baseUrl = options.baseUrl ?? getBaseUrl();
+  const fetchImpl = options.fetchImpl ?? pusharyFetch;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  let response;
+  try {
+    response = await fetchImpl(`${baseUrl.replace(/\/+$/, "")}${IDENTITY_PATH}`, {
+      headers: { Authorization: `Bearer ${apiKey}`, Accept: "application/json" },
+      timeoutMs
+    });
+  } catch (err) {
+    const detail = err instanceof NetworkError || err instanceof Error ? err.message : String(err);
+    return { kind: "unreachable", detail };
+  }
+  if (response.status === 401) return { kind: "rejected" };
+  if (response.status === 403) {
+    const body = await readJsonBody(response);
+    const raw = typeof body === "object" && body !== null ? body : {};
+    if (raw.code !== SUBSCRIPTION_REQUIRED_CODE) {
+      return { kind: "unreachable", detail: asString(raw.message) ?? `HTTP ${response.status}` };
+    }
+    return {
+      kind: "locked",
+      plan: asString(raw.plan),
+      upgradeUrl: absoluteUrl(baseUrl, asString(raw.upgradeUrl) ?? DEFAULT_UPGRADE_PATH)
+    };
+  }
+  if (!response.ok) {
+    return { kind: "unreachable", detail: `HTTP ${response.status}` };
+  }
+  const identity = toIdentity(await readJsonBody(response));
+  if (!identity) {
+    return { kind: "unreachable", detail: "the server answered with an unexpected body" };
+  }
+  return { kind: "ok", identity };
+};
+var keyCheckFromResponse = async (response, baseUrl = getBaseUrl()) => {
+  if (response.status === 401) return { kind: "rejected" };
+  if (response.status !== 403) return null;
+  const body = await readJsonBody(response.clone());
+  const raw = typeof body === "object" && body !== null ? body : {};
+  if (raw.code !== SUBSCRIPTION_REQUIRED_CODE) return null;
+  return {
+    kind: "locked",
+    plan: asString(raw.plan),
+    upgradeUrl: absoluteUrl(baseUrl, asString(raw.upgradeUrl) ?? DEFAULT_UPGRADE_PATH)
+  };
+};
+var describeKeyCheck = (check, baseUrl = getBaseUrl()) => {
+  const settingsUrl = absoluteUrl(baseUrl, "/dashboard/agent/settings");
+  switch (check.kind) {
+    case "ok":
+      return {
+        message: `Key verified for ${check.identity.siteSlug || check.identity.siteName || "your site"}.`,
+        next: [],
+        exitCode: EXIT.OK,
+        fatal: false
+      };
+    case "malformed":
+      return {
+        message: "That does not look like a Pushary API key.",
+        next: [`Expected the pk_xxx.xxx form. Copy yours from ${settingsUrl}`],
+        exitCode: EXIT.USAGE,
+        fatal: true
+      };
+    case "rejected":
+      return {
+        message: "This key was rejected by pushary.com.",
+        next: [`Get a working key: ${settingsUrl}`, "Then re-run: pushary setup"],
+        exitCode: EXIT.UNAUTHENTICATED,
+        fatal: true
+      };
+    case "locked":
+      return {
+        message: "Your Pushary plan is not active, so approvals will not deliver yet.",
+        next: [
+          "Your key is valid; activating the plan does not require replacing it.",
+          `Activate the plan: ${check.upgradeUrl}`,
+          "Then run: pushary doctor"
+        ],
+        exitCode: EXIT.PROBLEMS_FOUND,
+        fatal: false
+      };
+    case "unreachable":
+      return {
+        message: `Could not reach pushary.com to verify the key (${check.detail}).`,
+        next: ["Account readiness is unverified. Re-run `pushary setup` once you are online."],
+        exitCode: EXIT.UNREACHABLE,
+        fatal: false
+      };
+  }
+};
+
+export {
+  samePusharyAccount,
+  checkApiKey,
+  keyCheckFromResponse,
+  describeKeyCheck
+};

package/dist/chunk-2OY3ZZ5N.js

@@ -0,0 +1,124 @@
+import {
+  readExistingMachineId
+} from "./chunk-LXQ5FBBD.js";
+import {
+  NetworkError
+} from "./chunk-7QLSKOSU.js";
+import {
+  getBaseUrl
+} from "./chunk-GPEGOGRJ.js";
+import {
+  clientContextHeaders,
+  getPackageVersion
+} from "./chunk-NQTHFF4W.js";
+
+// src/cli/net.ts
+import { createRequire } from "module";
+
+// src/cli/client-context.ts
+import { randomUUID } from "crypto";
+var CLI_RUN_ID = randomUUID();
+var cliPlatform = () => `${process.platform}-${process.arch}`;
+var memoizedContext = null;
+var safeMachineId = () => {
+  try {
+    return readExistingMachineId();
+  } catch {
+    return null;
+  }
+};
+var readCliClientContext = () => ({
+  surface: "cli",
+  clientVersion: getPackageVersion(),
+  machineId: safeMachineId(),
+  runId: CLI_RUN_ID,
+  platform: cliPlatform()
+});
+var cliClientContext = () => {
+  if (memoizedContext) return memoizedContext;
+  const context = readCliClientContext();
+  if (context.machineId !== null) memoizedContext = context;
+  return context;
+};
+var originOf = (url) => {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return null;
+  }
+};
+var requestUrlOf = (input) => typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+var isPusharyRequest = (input, baseUrl) => {
+  const target = originOf(requestUrlOf(input));
+  return target !== null && target === originOf(baseUrl);
+};
+var mergeClientContextHeaders = (input, init, context) => {
+  const headers = new Headers(input instanceof Request ? input.headers : void 0);
+  new Headers(init?.headers).forEach((value, name) => headers.set(name, value));
+  for (const [name, value] of Object.entries(clientContextHeaders(context))) {
+    if (!headers.has(name)) headers.set(name, value);
+  }
+  return headers;
+};
+var withClientContext = (fetchImpl, options) => (input, init) => isPusharyRequest(input, options.baseUrl()) ? fetchImpl(input, { ...init, headers: mergeClientContextHeaders(input, init, options.context()) }) : fetchImpl(input, init);
+var installed = false;
+var installClientContextHeaders = () => {
+  if (installed) return;
+  installed = true;
+  globalThis.fetch = withClientContext(globalThis.fetch.bind(globalThis), { baseUrl: getBaseUrl, context: cliClientContext });
+};
+
+// src/cli/net.ts
+var requireCjs = createRequire(import.meta.url);
+var PROXY_VARS = ["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy"];
+var proxyFromEnv = () => {
+  for (const name of PROXY_VARS) {
+    const value = process.env[name]?.trim();
+    if (value) return value;
+  }
+  return void 0;
+};
+var installed2 = false;
+var installNetworkDefaults = () => {
+  if (installed2) return;
+  installed2 = true;
+  installClientContextHeaders();
+  if (!proxyFromEnv()) return;
+  try {
+    const { EnvHttpProxyAgent, setGlobalDispatcher } = requireCjs("undici");
+    setGlobalDispatcher(new EnvHttpProxyAgent());
+  } catch {
+  }
+};
+var isNetworkFailure = (err) => {
+  if (!(err instanceof Error)) return false;
+  const code = err.code;
+  if (code && ["ENOTFOUND", "ECONNREFUSED", "ECONNRESET", "ETIMEDOUT", "EAI_AGAIN", "EPROTO", "CERT_HAS_EXPIRED", "UNABLE_TO_VERIFY_LEAF_SIGNATURE"].includes(code)) {
+    return true;
+  }
+  return err.name === "AbortError" || err.name === "TimeoutError" || /fetch failed/i.test(err.message);
+};
+var DEFAULT_TIMEOUT_MS = 15e3;
+var pusharyFetch = async (url, init = {}) => {
+  installNetworkDefaults();
+  const { timeoutMs = DEFAULT_TIMEOUT_MS, signal, ...rest } = init;
+  try {
+    return await fetch(url, {
+      ...rest,
+      signal: signal ?? AbortSignal.timeout(timeoutMs)
+    });
+  } catch (err) {
+    if (isNetworkFailure(err)) {
+      const proxy = proxyFromEnv();
+      const via = proxy ? ` (via proxy ${proxy})` : "";
+      throw new NetworkError(`Could not reach ${new URL(url).host}${via}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    throw err;
+  }
+};
+
+export {
+  installNetworkDefaults,
+  isNetworkFailure,
+  pusharyFetch
+};

package/dist/chunk-3EGEA4KH.js

@@ -0,0 +1,44 @@
+// src/pairing.ts
+import crypto from "crypto";
+var X25519_SPKI_PREFIX = Buffer.from("302a300506032b656e032100", "hex");
+var HKDF_INFO = Buffer.from("pushary-pair-v1");
+var HEADER_BYTES = 32 + 12 + 16;
+var rawToPublicKey = (raw) => crypto.createPublicKey({
+  key: Buffer.concat([X25519_SPKI_PREFIX, raw]),
+  format: "der",
+  type: "spki"
+});
+var publicKeyToRaw = (key) => key.export({ format: "der", type: "spki" }).subarray(-32);
+var generateKeypair = () => {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync("x25519");
+  const publicKeyRaw = publicKeyToRaw(publicKey);
+  return { publicKeyB64: publicKeyRaw.toString("base64"), publicKeyRaw, privateKey };
+};
+var publicKeyFingerprint = (b64) => {
+  const raw = Buffer.from(b64, "base64");
+  const digest = crypto.createHash("sha256").update(raw).digest("hex");
+  return (digest.slice(0, 8).match(/.{2}/g) ?? []).join(" ").toUpperCase();
+};
+var openSealedKey = (blobB64, keypair) => {
+  const blob = Buffer.from(blobB64, "base64");
+  if (blob.length <= HEADER_BYTES) throw new Error("sealed payload too short");
+  const ephemeralRaw = blob.subarray(0, 32);
+  const nonce = blob.subarray(32, 44);
+  const tag = blob.subarray(44, 60);
+  const ciphertext = blob.subarray(60);
+  const shared = crypto.diffieHellman({
+    privateKey: keypair.privateKey,
+    publicKey: rawToPublicKey(ephemeralRaw)
+  });
+  const salt = Buffer.concat([ephemeralRaw, keypair.publicKeyRaw]);
+  const key = Buffer.from(crypto.hkdfSync("sha256", shared, salt, HKDF_INFO, 32));
+  const decipher = crypto.createDecipheriv("aes-256-gcm", key, nonce);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+};
+
+export {
+  generateKeypair,
+  publicKeyFingerprint,
+  openSealedKey
+};