pushary 1.9.66 → 1.9.67

package/dist/{chunk-EJR5JXMV.js → chunk-RQOT6QL3.js}

@@ -242,10 +242,10 @@ var AGENTS = {
     label: "Hermes",
     policyAgent: "hermes",
     enforcement: "enforced",
-    connectVia: "Native Python plugin + approval transport",
+    connectVia: "Native plugin in ~/.hermes/plugins + approval transport",
     setupCommand: PUSHARY_SETUP_COMMAND,
     enforcementDetail: "Hermes dangerous-command approvals when the Pushary transport is selected; optional PUSHARY_GATE_TOOLS gates named tools.",
-    capabilityNote: "Uses the Python plugin, not a macOS bridge HookSource. CLI disconnect and managed-provider controls are not implemented for Hermes."
+    capabilityNote: "Uses the Pushary plugin in ~/.hermes/plugins/pushary, not a macOS bridge HookSource. CLI disconnect and managed-provider controls are not implemented for Hermes."
   },
   cursor: {
     ...defaults,
@@ -2602,6 +2602,16 @@ var shellCommandStringOf = (shell, args) => {
   return operand === void 0 || operand.expands ? UNREADABLE2 : { kind: "readable", script: operand.text };
 };
 
+// ../contracts/src/partner-developer-guide.ts
+var PARTNER_API_KEYS_URL = "https://pushary.com/dashboard/agent/settings";
+var PARTNER_INSTALL_COMMAND = "npm i @pushary/server";
+var PARTNER_DEVELOPER_STEPS = [
+  `Install on our server: ${PARTNER_INSTALL_COMMAND}. Create the client with our Partner API key from ${PARTNER_API_KEYS_URL} and keep the key on the server.`,
+  "For each customer, call pushary.enroll(customerId) and show the universalLink it returns as a button or QR code in our app. They open it in the free Pushary app and allow notifications. Installing the app does not carry the link over, so keep it available until they finish.",
+  "Before a risky action, call pushary.authorize({ externalId: customerId, toolName, question }) and run the action only if approved is true.",
+  "If the answer can come later than the request, create a decision with pushary.decisions.create, save its id, and resume from pushary.decisions.get or the webhook."
+];
+
 // ../contracts/src/degraded.ts
 var DEGRADED_PREFIX = "[degraded]";
 var degradedPayload = (subsystem, report) => ({
@@ -2614,6 +2624,16 @@ var degradedPayload = (subsystem, report) => ({
 });
 var degradedLine = (subsystem, report) => `${DEGRADED_PREFIX} ${JSON.stringify(degradedPayload(subsystem, report))}`;
 
+// ../contracts/src/key-scope.ts
+var KEY_SCOPES = ["full_access", "agent", "connector", "bound"];
+var KEY_SCOPE = {
+  full_access: "full_access",
+  agent: "agent",
+  connector: "connector",
+  bound: "bound"
+};
+var normalizeKeyScope = (value) => typeof value === "string" && KEY_SCOPES.includes(value) ? value : null;
+
 // ../contracts/src/observability.ts
 var CLIENT_CONTEXT_HEADERS = {
   surface: "x-pushary-surface",
@@ -3072,10 +3092,26 @@ var compressTranscriptRecord = (raw, deflateRaw) => {
 };
 
 // ../contracts/src/index.ts
-var KEY_SCOPES = ["full_access", "agent", "connector", "bound"];
-var normalizeKeyScope = (value) => typeof value === "string" && KEY_SCOPES.includes(value) ? value : null;
 var APPROVAL_MODES = ["push_only", "terminal_only", "push_first", "notify_only"];
 var isApprovalMode = (value) => typeof value === "string" && APPROVAL_MODES.includes(value);
+var APPROVAL_MODE_META = {
+  push_first: {
+    label: "When away",
+    description: "Ask in the notch. Alert my phone when I\u2019m away."
+  },
+  push_only: {
+    label: "Always",
+    description: "Ask in the notch and on my phone."
+  },
+  notify_only: {
+    label: "Alert only",
+    description: "Notify my phone. I answer in the agent."
+  },
+  terminal_only: {
+    label: "In agent",
+    description: "I answer in the agent. No approval alerts."
+  }
+};
 var approvalWaitsAtTheAgentsPrompt = (mode) => {
   switch (mode) {
     case "push_first":
@@ -6355,6 +6391,8 @@ export {
   toolsCoveredByGateEntry,
   cursorGateOwnsToolCall,
   degradedLine,
+  KEY_SCOPE,
+  normalizeKeyScope,
   hookWritePath,
   MAX_HOOK_ACTIVATION_EVIDENCE_ROWS,
   isHookActivationReport,
@@ -6389,8 +6427,8 @@ export {
   parseCodexNativeApproval,
   codexNativeApprovalResponse,
   compressTranscriptRecord,
-  normalizeKeyScope,
   isApprovalMode,
+  APPROVAL_MODE_META,
   approvalModeWithoutLocalPrompt,
   timeoutActionWithoutLocalPrompt,
   isTimeoutAction,

package/dist/{chunk-SVKCYUYP.js → chunk-SB6TYV4M.js}

@@ -3,13 +3,13 @@ import {
   loadPin,
   savePin,
   verifyRecipients
-} from "./chunk-DBUHSUL7.js";
+} from "./chunk-Y6ZN454E.js";
 import {
   ensureDaemonRunning
-} from "./chunk-57NTMVMI.js";
+} from "./chunk-LJHDUKBB.js";
 import {
   hookOwnerOf
-} from "./chunk-YQDCTID4.js";
+} from "./chunk-BFF3ABFV.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
@@ -18,26 +18,26 @@ import {
   recordSealerFor,
   uploadTranscriptRecords,
   wrapSessionKey
-} from "./chunk-XEXF2OFZ.js";
+} from "./chunk-NWN6GGJL.js";
 import {
   transcriptEnvironmentPreference,
   transcriptsEnabled
-} from "./chunk-XGFFNERF.js";
+} from "./chunk-YSD4SMHE.js";
 import {
   readTranscriptPreference
-} from "./chunk-CNJ7SI5V.js";
+} from "./chunk-JOBSKQ2Z.js";
 import {
   claudeConfigDir,
   codexHome,
   pusharyDir
-} from "./chunk-GDLT32I4.js";
+} from "./chunk-TI4JYPGQ.js";
 import {
   writeJsonAtomic
-} from "./chunk-KS3O6O7E.js";
+} from "./chunk-WJLHZ6E6.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-A47UKPC7.js";
+} from "./chunk-32OSSYGZ.js";
 
 // src/transcript-registration.ts
 import { createHash } from "crypto";

package/dist/{chunk-GDLT32I4.js → chunk-TI4JYPGQ.js}

@@ -4,7 +4,7 @@ import {
   quoteIfNeeded,
   shellDoubleQuoted,
   writeFileAtomic
-} from "./chunk-KS3O6O7E.js";
+} from "./chunk-WJLHZ6E6.js";
 import {
   CLAUDE_PRETOOLUSE_MATCHER,
   CODEX_QUESTION_TOOLS,
@@ -12,7 +12,7 @@ import {
   HOOK_LOCATOR_BINARY,
   PRETOOLUSE_GATED_TOOLS,
   withHookHoldBudget
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/setup/paths.ts
 import { createHash as createHash2 } from "crypto";
@@ -1049,6 +1049,8 @@ var clientReportClaims = () => join5(pusharyDir(), "client-reports");
 var claudeRegistrationReceipt = () => join5(claudeSetupDir(), "claude-registration.json");
 var hermesConfig = () => join5(homedir3(), ".hermes", "config.yaml");
 var hermesConfigReceipt = () => join5(pusharyDir(), "setup", "hermes-config.json");
+var hermesSetupReceipt = () => join5(pusharyDir(), "setup", "hermes-plugin.json");
+var hermesAppWiringRecord = () => join5(pusharyDir(), "setup", "hermes-wired-by-mac-app");
 var fxQuestionRuleReceipt = () => join5(pusharyDir(), "setup", "fx-question-rule.json");
 var hookTakeoverReceipt = (agent) => join5(agent === "claude_code" ? claudeSetupDir() : join5(pusharyDir(), "setup"), `hook-takeover-${agent}.json`);
 var codexSkillDir2 = () => join5(codexHome(), "skills", "pushary");
@@ -1185,6 +1187,8 @@ export {
   claudeRegistrationReceipt,
   hermesConfig,
   hermesConfigReceipt,
+  hermesSetupReceipt,
+  hermesAppWiringRecord,
   fxQuestionRuleReceipt,
   hookTakeoverReceipt,
   codexSkillDir2,

package/dist/{chunk-B6JC676X.js → chunk-UC2J5RR4.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_HOLD_BUDGET_ENV,
   hookHoldBudgetProof
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/hold-budget.ts
 var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {

package/dist/{chunk-XDDSURY3.js → chunk-UQIPWXBL.js}

@@ -1,10 +1,10 @@
 import {
   pusharyDir
-} from "./chunk-GDLT32I4.js";
+} from "./chunk-TI4JYPGQ.js";
 import {
   readJsonSafe,
   writeFileAtomic
-} from "./chunk-KS3O6O7E.js";
+} from "./chunk-WJLHZ6E6.js";
 import {
   DECLINED_AGENTS_FILE,
   DISCONNECT_AGENT_IDS,
@@ -13,7 +13,7 @@ import {
   serializeDeclinedAgents,
   withDeclinedAgent,
   withoutDeclinedAgent
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/declined-agents-file.ts
 import { join } from "path";

package/dist/{chunk-EU2ZOZC3.js → chunk-UXN73YAE.js}

@@ -1,6 +1,6 @@
 import {
   SETUP_FLAGS
-} from "./chunk-UTAARXYQ.js";
+} from "./chunk-ZK5WYAMI.js";
 import {
   parseFlags
 } from "./chunk-NMUI3ZWG.js";
@@ -9,7 +9,7 @@ import {
 } from "./chunk-PPY5N2E6.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-GO7YKPT3.js";
+} from "./chunk-X2MTVD4W.js";
 import {
   CLAUDE_CONNECTOR_GUIDE,
   CLAUDE_CONNECTOR_STEPS,
@@ -17,7 +17,7 @@ import {
   CLAUDE_CONNECTOR_URL,
   COWORK_CONNECTOR_LIMIT,
   COWORK_STANDING_INSTRUCTIONS
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/cli/cowork.ts
 import { readFileSync } from "fs";

package/dist/{chunk-RSZQEEEW.js → chunk-VEYFXRZ6.js}

@@ -3,10 +3,10 @@ import {
   forkFinishWithUpgradeLock,
   installWithUpgradeLock,
   releaseAutoUpdateLock
-} from "./chunk-V3YBVOTZ.js";
+} from "./chunk-DP6LU6BB.js";
 import {
   phoneStartIsRequired
-} from "./chunk-T6YLXO6N.js";
+} from "./chunk-KE4TSJUD.js";
 import {
   describeAutoUpdateCheck,
   globalInstallLocation,
@@ -18,7 +18,7 @@ import {
   readAutoUpdateState,
   updateAutoUpdateState,
   upgradeEntryFor
-} from "./chunk-VURDLVAQ.js";
+} from "./chunk-IXTVUINH.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
@@ -26,17 +26,17 @@ import {
   autoUpdateLock,
   autoUpdateLog,
   autoUpdateState
-} from "./chunk-GDLT32I4.js";
+} from "./chunk-TI4JYPGQ.js";
 import {
   execNpm,
   fetchLatestPublishedVersion,
   npmErrorMessage,
   readGlobalCliInstallAt,
   readGlobalPrefix
-} from "./chunk-KS3O6O7E.js";
+} from "./chunk-WJLHZ6E6.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-GO7YKPT3.js";
+} from "./chunk-X2MTVD4W.js";
 import {
   commandsPackage,
   globalUpgradeEntry,
@@ -60,6 +60,7 @@ var refreshedPartsOf = (agent) => [
   ...agent.result.hooks ? ["hooks"] : [],
   ...agent.result.mcp ? ["MCP key"] : [],
   ...agent.result.approvalRules ? ["approval rules"] : [],
+  ...agent.result.pluginFiles ? ["plugin"] : [],
   ...agent.instructions?.outcome === "refreshed" ? ["instructions"] : []
 ];
 var wasRefreshed = (agent) => refreshedPartsOf(agent).length > 0;

package/dist/{chunk-XFQAK35L.js → chunk-VHMZPN3N.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   redactSecretsFromContent
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/cli/json.ts
 var writeStdoutFully = (text) => new Promise((resolve, reject) => {

package/dist/{chunk-45KMS76L.js → chunk-VKZ3RJ5U.js}

@@ -2,7 +2,7 @@ import {
   isApprovalMode,
   isRecord,
   isTimeoutAction
-} from "./chunk-EJR5JXMV.js";
+} from "./chunk-RQOT6QL3.js";
 
 // src/cli/settings-response.ts
 var isFiniteNumber = (value) => typeof value === "number" && Number.isFinite(value);