@ishlabs/cli 0.17.6 → 0.18.0

package/dist/commands/mcp.js

@@ -0,0 +1,676 @@
+/**
+ * ish mcp — wire the ish MCP server into local AI clients.
+ *
+ * Three verbs:
+ *   - `ish mcp add`    Wire ish MCP into selected clients (idempotent).
+ *   - `ish mcp list`   Show detected clients + ish-MCP wiring status.
+ *   - `ish mcp remove` Inverse of add — cleanly unwire the ish block.
+ *
+ * Design choices (per plan workstream C):
+ *   - No API call required — all writes are local JSON files. We use
+ *     `runInline` instead of `withClient`.
+ *   - Atomic writes (tmp file + rename), deep-equal idempotence, and
+ *     unrelated keys in the target config are preserved verbatim.
+ *   - Never embed access tokens in the file. The hosted ish MCP server
+ *     handles OAuth on first connect; we only write the URL.
+ *   - No interactive prompts by default (CLI is for autonomous agents).
+ *     `--yes` is required to commit writes under `--json` / non-TTY.
+ *
+ * Per-client config paths + per-client server-block shapes live in
+ * `src/lib/mcp-clients.ts` (MCP_CLIENT_TARGETS).
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { runInline, collectIds, confirmDestructive } from "../lib/command-helpers.js";
+import { output } from "../lib/output.js";
+import { MCP_CLIENT_TARGETS, ISH_MCP_URL, ISH_SERVER_NAME, getClientSpec, allClientKeys, } from "../lib/mcp-clients.js";
+// ---------------------------------------------------------------------------
+// File I/O helpers
+// ---------------------------------------------------------------------------
+/**
+ * Load the target client config as JSON. Returns:
+ *   - undefined when the file doesn't exist (caller treats as empty object).
+ *   - the parsed object on success.
+ *   - throws a usage-shaped error when the file is malformed JSON, so the
+ *     agent doesn't silently overwrite a partially-edited config.
+ */
+function readClientConfig(file) {
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf-8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return undefined;
+        throw err;
+    }
+    // An empty file is treated as `{}` so we never lose unrelated keys we
+    // don't have, and we still write a valid JSON document on write.
+    if (raw.trim().length === 0)
+        return {};
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+            const e = new Error(`Client config at ${file} is not a JSON object; refusing to edit. Inspect by hand and re-run.`);
+            e.name = "ValidationError";
+            throw e;
+        }
+        return parsed;
+    }
+    catch (err) {
+        if (err instanceof Error && err.name === "ValidationError")
+            throw err;
+        const e = new Error(`Client config at ${file} is not valid JSON: ${err instanceof Error ? err.message : String(err)}. Inspect by hand and re-run.`);
+        e.name = "ValidationError";
+        throw e;
+    }
+}
+/**
+ * Atomic write — tmp file in the same directory + rename. Preserves
+ * 2-space indent and a trailing newline. Creates parent dirs as needed
+ * (the per-client config dir might not exist yet for never-launched
+ * clients the user is opting into via `--client <name>`).
+ */
+function writeClientConfig(file, payload) {
+    const dir = path.dirname(file);
+    fs.mkdirSync(dir, { recursive: true });
+    const serialized = JSON.stringify(payload, null, 2) + "\n";
+    const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
+    fs.writeFileSync(tmp, serialized, "utf-8");
+    try {
+        fs.renameSync(tmp, file);
+    }
+    catch (err) {
+        // Best-effort cleanup of the tmp file before re-throwing — leaving
+        // it around would clutter the user's config dir.
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch { /* ignore */ }
+        throw err;
+    }
+}
+// ---------------------------------------------------------------------------
+// Server-block shape helpers
+// ---------------------------------------------------------------------------
+/**
+ * Stable deep-equal for plain JSON values. Sufficient for ish server
+ * blocks (no Dates, no Maps, no Symbols — only the shapes we render).
+ */
+function deepEqual(a, b) {
+    if (a === b)
+        return true;
+    if (typeof a !== typeof b)
+        return false;
+    if (a === null || b === null)
+        return a === b;
+    if (Array.isArray(a)) {
+        if (!Array.isArray(b) || a.length !== b.length)
+            return false;
+        for (let i = 0; i < a.length; i++) {
+            if (!deepEqual(a[i], b[i]))
+                return false;
+        }
+        return true;
+    }
+    if (typeof a === "object" && typeof b === "object") {
+        const ao = a;
+        const bo = b;
+        const aKeys = Object.keys(ao);
+        const bKeys = Object.keys(bo);
+        if (aKeys.length !== bKeys.length)
+            return false;
+        for (const k of aKeys) {
+            if (!Object.prototype.hasOwnProperty.call(bo, k))
+                return false;
+            if (!deepEqual(ao[k], bo[k]))
+                return false;
+        }
+        return true;
+    }
+    return false;
+}
+/**
+ * Read the current ish server block from a client config. Returns undefined
+ * when either the `<serverKey>` object or the ish entry is missing.
+ */
+function readCurrentIshBlock(config, spec) {
+    if (!config)
+        return undefined;
+    const bucket = config[spec.serverKey];
+    if (!bucket || typeof bucket !== "object" || Array.isArray(bucket))
+        return undefined;
+    const entry = bucket[ISH_SERVER_NAME];
+    if (!entry || typeof entry !== "object" || Array.isArray(entry))
+        return undefined;
+    return entry;
+}
+function classifyStatus(config, expected, spec, fileExists) {
+    if (!fileExists)
+        return "no-config-file";
+    const current = readCurrentIshBlock(config, spec);
+    if (!current)
+        return "absent";
+    return deepEqual(current, expected) ? "present-up-to-date" : "present-drifted";
+}
+// ---------------------------------------------------------------------------
+// `list` — read-only status per client
+// ---------------------------------------------------------------------------
+function buildClientStatuses() {
+    return MCP_CLIENT_TARGETS.map((spec) => {
+        const file = spec.configPath();
+        const expected = spec.renderServer(ISH_MCP_URL);
+        let fileExists = false;
+        let config;
+        try {
+            config = readClientConfig(file);
+            fileExists = config !== undefined;
+        }
+        catch {
+            // Malformed JSON shouldn't crash `list`; surface as drifted so the
+            // user notices it and can re-run `mcp add --force` (which would
+            // re-raise the same parse error and stop, so no silent overwrite).
+            return {
+                client: spec.key,
+                display_name: spec.displayName,
+                detected: spec.detect(),
+                unsupported_on_this_os: spec.unsupportedOnThisOs ?? false,
+                config_path: file,
+                status: "present-drifted",
+            };
+        }
+        return {
+            client: spec.key,
+            display_name: spec.displayName,
+            detected: spec.detect(),
+            unsupported_on_this_os: spec.unsupportedOnThisOs ?? false,
+            config_path: file,
+            status: classifyStatus(config, expected, spec, fileExists),
+        };
+    });
+}
+/**
+ * Resolve which clients the user asked to wire.
+ *
+ *   - explicit `--client a,b`  → validate every key, return spec list.
+ *   - `--all`                  → every *detected* spec on this OS.
+ *   - neither                  → every detected spec (default behavior
+ *                                renders the plan with no writes, suggests
+ *                                a re-invocation with --all --yes).
+ *
+ * Validation: unknown client keys throw a usage error so the agent can
+ * self-correct without inspecting prose.
+ */
+function resolveClients(flags) {
+    if (flags.client.length > 0) {
+        if (flags.all) {
+            const err = new Error("Use either --client or --all, not both.");
+            err.name = "ValidationError";
+            throw err;
+        }
+        const seen = new Set();
+        const specs = [];
+        for (const raw of flags.client) {
+            if (seen.has(raw))
+                continue;
+            seen.add(raw);
+            const spec = getClientSpec(raw);
+            if (!spec) {
+                const e = new Error(`Unknown client "${raw}". Valid: ${allClientKeys().join(", ")}.`);
+                e.name = "ValidationError";
+                throw e;
+            }
+            specs.push(spec);
+        }
+        return { specs, explicit: true };
+    }
+    const detected = MCP_CLIENT_TARGETS.filter((s) => s.detect() && !(s.unsupportedOnThisOs ?? false));
+    return { specs: detected, explicit: false };
+}
+/**
+ * Build the per-client write plan. Pure (no I/O beyond file reads) so
+ * `--dry-run` and the real write share the same plan computation.
+ */
+function buildAddPlan(specs, force) {
+    const plan = [];
+    for (const spec of specs) {
+        const file = spec.configPath();
+        const expected = spec.renderServer(ISH_MCP_URL);
+        let config;
+        try {
+            config = readClientConfig(file);
+        }
+        catch (err) {
+            // Malformed JSON: refuse — agent should inspect manually.
+            plan.push({
+                client: spec.key,
+                display_name: spec.displayName,
+                config_path: file,
+                action: "refuse-drift",
+                reason: err instanceof Error ? err.message : String(err),
+                expected,
+            });
+            continue;
+        }
+        const current = readCurrentIshBlock(config, spec);
+        if (!current) {
+            plan.push({
+                client: spec.key,
+                display_name: spec.displayName,
+                config_path: file,
+                action: config === undefined ? "create" : "update",
+                expected,
+            });
+            continue;
+        }
+        if (deepEqual(current, expected)) {
+            plan.push({
+                client: spec.key,
+                display_name: spec.displayName,
+                config_path: file,
+                action: "skip",
+                reason: "ish block already up to date",
+                expected,
+                current,
+            });
+            continue;
+        }
+        if (force) {
+            plan.push({
+                client: spec.key,
+                display_name: spec.displayName,
+                config_path: file,
+                action: "update",
+                expected,
+                current,
+            });
+        }
+        else {
+            plan.push({
+                client: spec.key,
+                display_name: spec.displayName,
+                config_path: file,
+                action: "refuse-drift",
+                reason: "existing ish block differs; pass --force to overwrite",
+                expected,
+                current,
+            });
+        }
+    }
+    return plan;
+}
+/**
+ * Apply the write plan. Returns `{ written, skipped, refused }` counts.
+ * Drift-refusals throw a usage-shaped error so the CLI exits 2.
+ */
+function applyAddPlan(plan) {
+    const refused = plan.filter((p) => p.action === "refuse-drift");
+    if (refused.length > 0) {
+        const lines = refused.map((p) => `  - ${p.client} (${p.config_path}): ${p.reason ?? "drift"}`);
+        const err = new Error(`Refusing to overwrite drifted ish server block in ${refused.length} client${refused.length === 1 ? "" : "s"}:\n` +
+            lines.join("\n") +
+            "\n\nRe-run with --force to overwrite, or remove the existing block by hand.");
+        err.name = "ValidationError";
+        throw err;
+    }
+    const written = [];
+    const skipped = [];
+    for (const entry of plan) {
+        if (entry.action === "skip") {
+            skipped.push(entry);
+            continue;
+        }
+        const spec = getClientSpec(entry.client);
+        if (!spec)
+            continue;
+        const existing = readClientConfig(entry.config_path) ?? {};
+        const next = { ...existing };
+        const bucket = next[spec.serverKey] && typeof next[spec.serverKey] === "object" && !Array.isArray(next[spec.serverKey])
+            ? { ...next[spec.serverKey] }
+            : {};
+        bucket[ISH_SERVER_NAME] = entry.expected ?? spec.renderServer(ISH_MCP_URL);
+        next[spec.serverKey] = bucket;
+        writeClientConfig(entry.config_path, next);
+        written.push(entry);
+    }
+    return { written, skipped };
+}
+// ---------------------------------------------------------------------------
+// `remove` — inverse of add
+// ---------------------------------------------------------------------------
+function buildRemovePlan(specs) {
+    return specs.map((spec) => {
+        const file = spec.configPath();
+        let config;
+        try {
+            config = readClientConfig(file);
+        }
+        catch (err) {
+            return {
+                client: spec.key,
+                display_name: spec.displayName,
+                config_path: file,
+                action: "refuse-drift",
+                reason: err instanceof Error ? err.message : String(err),
+            };
+        }
+        if (config === undefined) {
+            return {
+                client: spec.key,
+                display_name: spec.displayName,
+                config_path: file,
+                action: "remove-noop",
+                reason: "no client config file",
+            };
+        }
+        const current = readCurrentIshBlock(config, spec);
+        if (!current) {
+            return {
+                client: spec.key,
+                display_name: spec.displayName,
+                config_path: file,
+                action: "remove-noop",
+                reason: "no ish block to remove",
+            };
+        }
+        return {
+            client: spec.key,
+            display_name: spec.displayName,
+            config_path: file,
+            action: "remove",
+            current,
+        };
+    });
+}
+function applyRemovePlan(plan) {
+    const refused = plan.filter((p) => p.action === "refuse-drift");
+    if (refused.length > 0) {
+        const lines = refused.map((p) => `  - ${p.client} (${p.config_path}): ${p.reason ?? "drift"}`);
+        const err = new Error(`Cannot read client config for ${refused.length} client${refused.length === 1 ? "" : "s"}:\n` +
+            lines.join("\n"));
+        err.name = "ValidationError";
+        throw err;
+    }
+    const removed = [];
+    const skipped = [];
+    for (const entry of plan) {
+        if (entry.action !== "remove") {
+            skipped.push(entry);
+            continue;
+        }
+        const spec = getClientSpec(entry.client);
+        if (!spec)
+            continue;
+        const existing = readClientConfig(entry.config_path) ?? {};
+        const next = { ...existing };
+        const bucket = next[spec.serverKey];
+        if (bucket && typeof bucket === "object" && !Array.isArray(bucket)) {
+            const cloned = { ...bucket };
+            delete cloned[ISH_SERVER_NAME];
+            if (Object.keys(cloned).length === 0) {
+                // Drop the empty bucket so we don't leave `{ "mcpServers": {} }`
+                // shrapnel behind. Other clients ignore empty buckets, but it's
+                // tidier and matches what a fresh-from-uninstall config looks like.
+                delete next[spec.serverKey];
+            }
+            else {
+                next[spec.serverKey] = cloned;
+            }
+        }
+        writeClientConfig(entry.config_path, next);
+        removed.push(entry);
+    }
+    return { removed, skipped };
+}
+// ---------------------------------------------------------------------------
+// Commander registration
+// ---------------------------------------------------------------------------
+function renderAddHumanOutput(plan, dryRun, explicit, results) {
+    // Progress to stderr (per CLAUDE.md "stdout = data, stderr = progress").
+    const lead = dryRun ? "Planned" : (results ? "Done" : "Planned");
+    process.stderr.write(`${lead}: ${plan.length} client${plan.length === 1 ? "" : "s"} (server URL ${ISH_MCP_URL})\n`);
+    for (const entry of plan) {
+        const verb = entry.action === "create"
+            ? "create"
+            : entry.action === "update"
+                ? "update"
+                : entry.action === "skip"
+                    ? "skip"
+                    : entry.action === "refuse-drift"
+                        ? "drifted"
+                        : entry.action;
+        process.stderr.write(`  ${verb.padEnd(8)} ${entry.client.padEnd(16)} ${entry.config_path}\n`);
+        if (entry.reason) {
+            process.stderr.write(`           ${entry.reason}\n`);
+        }
+    }
+    if (dryRun && !explicit && plan.length > 0) {
+        process.stderr.write(`\nThis was a dry run. To wire every detected client, re-run with:\n  ish mcp add --all --yes\n`);
+    }
+    if (results) {
+        process.stderr.write(`\nWrote ${results.written.length}, skipped ${results.skipped.length} (already up to date).\n`);
+    }
+}
+export function registerMcpCommands(program) {
+    const mcp = program
+        .command("mcp")
+        .description("Wire the ish MCP server into local AI clients (Cursor, VS Code, Claude Code, Claude Desktop, Windsurf)")
+        .addHelpText("after", `
+The hosted ish MCP server lets agents in Cursor, VS Code, Claude Code,
+Claude Desktop, and Windsurf call ish operations (study run, ask
+run, person generate, …) directly. This command writes the per-client
+config block so each client knows where to find the server. OAuth is
+handled by the server itself on first connect — no token is written to
+your client config.
+
+Verbs:
+  ish mcp list     Read-only: detected clients + wiring status
+  ish mcp add      Wire ish MCP into selected clients
+  ish mcp remove   Remove the ish block from selected clients
+
+Run \`ish mcp <verb> --help\` for flags.
+
+Override the server URL via the \`ISH_MCP_URL\` env var (defaults to
+${ISH_MCP_URL}).`);
+    // --- list -----------------------------------------------------------
+    mcp
+        .command("list")
+        .description("Show detected clients and ish MCP wiring status")
+        .addHelpText("after", `
+Inspects every supported client's config file (or its absence) and
+reports one of: present-up-to-date, present-drifted, absent,
+no-config-file. Read-only — never writes.
+
+JSON output is the stable surface for scripts and agents.`)
+        .action(async (_opts, cmd) => {
+        await runInline(cmd, async (globals) => {
+            const statuses = buildClientStatuses();
+            const payload = {
+                server_url: ISH_MCP_URL,
+                clients: statuses,
+            };
+            if (globals.json) {
+                output(payload, true, { preProjected: true });
+                return;
+            }
+            process.stdout.write(`ish MCP server: ${ISH_MCP_URL}\n\n`);
+            const rows = statuses.map((s) => {
+                const detected = s.unsupported_on_this_os
+                    ? "n/a (this OS)"
+                    : (s.detected ? "yes" : "no");
+                return `  ${s.client.padEnd(16)} ${detected.padEnd(13)} ${s.status.padEnd(20)} ${s.config_path}`;
+            });
+            process.stdout.write(`  ${"CLIENT".padEnd(16)} ${"DETECTED".padEnd(13)} ${"STATUS".padEnd(20)} CONFIG PATH\n`);
+            for (const r of rows)
+                process.stdout.write(`${r}\n`);
+        });
+    });
+    // --- add ------------------------------------------------------------
+    mcp
+        .command("add")
+        .description("Wire the ish MCP server into selected client configs")
+        .option("--client <names>", "Comma-separated and/or repeatable: cursor, vscode, claude-code, claude-desktop, windsurf", collectIds, [])
+        .option("--all", "Wire every detected client on this OS")
+        .option("--dry-run", "Print planned mutations as JSON; write nothing")
+        .option("--force", "Overwrite an existing ish server block that has drifted")
+        .option("-y, --yes", "Confirm writes (required when stdout is piped or --json is set)")
+        .addHelpText("after", `
+Examples:
+  $ ish mcp add                                 # dry-run plan + next-step hint
+  $ ish mcp add --all --yes                     # wire every detected client
+  $ ish mcp add --client cursor,vscode --yes    # wire two specific clients
+  $ ish mcp add --client windsurf --dry-run --json  # inspect a planned mutation
+
+Conventions:
+  - Atomic writes (tmp + rename); never partial files.
+  - Idempotent: re-running is a no-op when the ish block is already up to date.
+  - Preserves every unrelated key in the target config file.
+  - Never embeds a token. OAuth happens on first connect to the MCP server.
+
+Override the server URL with the \`ISH_MCP_URL\` env var.`)
+        .action(async (rawOpts, cmd) => {
+        await runInline(cmd, async (globals) => {
+            const flags = {
+                client: Array.isArray(rawOpts.client) ? rawOpts.client : [],
+                all: rawOpts.all === true,
+                dryRun: rawOpts.dryRun === true,
+                force: rawOpts.force === true,
+                yes: rawOpts.yes === true,
+            };
+            const { specs, explicit } = resolveClients(flags);
+            if (specs.length === 0) {
+                const message = explicit
+                    ? "No client specs matched."
+                    : "No supported AI clients detected on this machine. Pass --client <name> to opt into a specific client (cursor, vscode, claude-code, claude-desktop, windsurf).";
+                if (globals.json) {
+                    output({
+                        ok: true,
+                        server_url: ISH_MCP_URL,
+                        dry_run: true,
+                        plan: [],
+                        hint: message,
+                    }, true, { preProjected: true });
+                    return;
+                }
+                process.stderr.write(`${message}\n`);
+                return;
+            }
+            const plan = buildAddPlan(specs, !!flags.force);
+            // Default with no client flags and no --all: behave like --dry-run
+            // and suggest the explicit re-invocation, so a one-word invocation
+            // is safe to run blind.
+            const implicitDryRun = !flags.dryRun && !explicit && !flags.all;
+            const effectiveDryRun = flags.dryRun || implicitDryRun;
+            if (effectiveDryRun) {
+                if (globals.json) {
+                    output({
+                        ok: true,
+                        server_url: ISH_MCP_URL,
+                        dry_run: true,
+                        plan,
+                        hint: implicitDryRun
+                            ? "Re-run with `ish mcp add --all --yes` to commit these writes."
+                            : "Re-run without --dry-run (and with --yes for non-TTY) to commit.",
+                    }, true, { preProjected: true });
+                    return;
+                }
+                renderAddHumanOutput(plan, true, explicit);
+                return;
+            }
+            // Will any actual writes happen? Skip-only plans don't need confirmation.
+            const willWrite = plan.some((p) => p.action === "create" || p.action === "update");
+            if (willWrite) {
+                await confirmDestructive(`About to write the ish MCP server block into ${plan.filter((p) => p.action !== "skip").length} client config file(s). Continue?`, { yes: !!flags.yes, json: globals.json });
+            }
+            const results = applyAddPlan(plan);
+            if (globals.json) {
+                output({
+                    ok: true,
+                    server_url: ISH_MCP_URL,
+                    dry_run: false,
+                    written: results.written,
+                    skipped: results.skipped,
+                }, true, { preProjected: true });
+                return;
+            }
+            renderAddHumanOutput(plan, false, explicit, results);
+        });
+    });
+    // --- remove ---------------------------------------------------------
+    mcp
+        .command("remove")
+        .description("Remove the ish server block from selected client configs")
+        .option("--client <names>", "Comma-separated and/or repeatable: cursor, vscode, claude-code, claude-desktop, windsurf", collectIds, [])
+        .option("--all", "Remove from every detected client on this OS")
+        .option("--dry-run", "Print planned mutations as JSON; write nothing")
+        .option("-y, --yes", "Confirm writes (required when stdout is piped or --json is set)")
+        .addHelpText("after", `
+Examples:
+  $ ish mcp remove --client cursor --yes
+  $ ish mcp remove --all --yes
+  $ ish mcp remove --all --dry-run --json
+
+Idempotent: a client without an ish block is a no-op. Other keys in
+the client config (other MCP servers, unrelated settings) are preserved.`)
+        .action(async (rawOpts, cmd) => {
+        await runInline(cmd, async (globals) => {
+            const flags = {
+                client: Array.isArray(rawOpts.client) ? rawOpts.client : [],
+                all: rawOpts.all === true,
+                dryRun: rawOpts.dryRun === true,
+                yes: rawOpts.yes === true,
+            };
+            const { specs, explicit } = resolveClients(flags);
+            if (specs.length === 0) {
+                const message = explicit
+                    ? "No client specs matched."
+                    : "No supported AI clients detected on this machine. Pass --client <name> to target a specific client.";
+                if (globals.json) {
+                    output({ ok: true, dry_run: true, plan: [], hint: message }, true, { preProjected: true });
+                    return;
+                }
+                process.stderr.write(`${message}\n`);
+                return;
+            }
+            const plan = buildRemovePlan(specs);
+            const implicitDryRun = !flags.dryRun && !explicit && !flags.all;
+            const effectiveDryRun = flags.dryRun || implicitDryRun;
+            if (effectiveDryRun) {
+                if (globals.json) {
+                    output({
+                        ok: true,
+                        dry_run: true,
+                        plan,
+                        hint: implicitDryRun
+                            ? "Re-run with `ish mcp remove --all --yes` to commit these removals."
+                            : "Re-run without --dry-run (and with --yes for non-TTY) to commit.",
+                    }, true, { preProjected: true });
+                    return;
+                }
+                process.stderr.write(`Planned: remove ish block from ${plan.length} client${plan.length === 1 ? "" : "s"}\n`);
+                for (const entry of plan) {
+                    const verb = entry.action === "remove" ? "remove" : entry.action === "remove-noop" ? "skip" : entry.action;
+                    process.stderr.write(`  ${verb.padEnd(8)} ${entry.client.padEnd(16)} ${entry.config_path}\n`);
+                    if (entry.reason)
+                        process.stderr.write(`           ${entry.reason}\n`);
+                }
+                return;
+            }
+            const willWrite = plan.some((p) => p.action === "remove");
+            if (willWrite) {
+                await confirmDestructive(`About to remove the ish MCP server block from ${plan.filter((p) => p.action === "remove").length} client config file(s). Continue?`, { yes: !!flags.yes, json: globals.json });
+            }
+            const results = applyRemovePlan(plan);
+            if (globals.json) {
+                output({
+                    ok: true,
+                    dry_run: false,
+                    removed: results.removed,
+                    skipped: results.skipped,
+                }, true, { preProjected: true });
+                return;
+            }
+            process.stderr.write(`Removed ish block from ${results.removed.length} client${results.removed.length === 1 ? "" : "s"}; ${results.skipped.length} had no block to remove.\n`);
+        });
+    });
+}

package/dist/commands/person.d.ts

@@ -0,0 +1,5 @@
+/**
+ * ish person — Manage people, generation, and source uploads.
+ */
+import type { Command } from "commander";
+export declare function registerPersonCommands(program: Command): void;