@ory/cline 0.10.0 → 0.11.1

package/README.md

@@ -41,13 +41,13 @@ npx -y -p @ory/cline ory-cline status              # confirm what landed
 npx -y -p @ory/cline ory-cline uninstall           # remove only the Ory shims + skills
 ```
 
-Uninstall removes only the scripts the Ory installer wrote (matched by a marker comment) — it never touches a hook script you authored that happens to share an event name.
+Install and uninstall both respect hook scripts you authored. If an event name is already taken by a script the Ory installer didn't write (matched by a marker comment), install leaves it untouched, skips that event, and prints a warning listing the skipped events — move or remove your script and re-run the install if you want Ory to handle them. Existing Ory shims are refreshed in place, and uninstall removes only the scripts the Ory installer wrote.
 
 ## Quickstart (≈ 3 minutes)
 
 From any project where you'd like Ory authentication, inside Cline:
 
-1. **Start a local Ory instance.** Ask Cline *"start the local Ory stack"* or run `/local-up`. A banner prints the seeded test user's email and password — note them.
+1. **Start a local Ory instance.** Ask Cline *"start the local Ory stack"* or invoke the `ory-local-up` skill. A banner prints the seeded test user's email and password — note them.
 2. **Scaffold Ory into your project.** Ask Cline *"add Ory auth to this app"* (the `ory-auth-setup` skill). It installs Ory Elements, wires the SDK, and generates the login / registration / recovery / settings pages, all targeting the local stack.
 3. **Sign in.** Start your app, visit the login page, and sign in with the seeded credentials. You now have a real Ory session backed by a real Ory stack — locally, offline, zero configuration.
 

package/dist/cli/setup.js

@@ -60,44 +60,15 @@ const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const argus_1 = require("@ory/argus");
 const assets_js_1 = require("./assets.js");
-const PACKAGE_NAME = "@ory/cline";
+const shims_js_1 = require("./shims.js");
 const HOOK_BIN = "ory-cline-hook";
-/**
- * Cline hook events we register. Each maps to a script whose filename matches
- * the PascalCase event name in the hooks directory (verified against
- * cline@3.0.29). At runtime, the payload Cline writes to the script's stdin
- * carries the snake_case `hookName` the handler switches on:
- *
- *   TaskStart        → agent_start       (auth gates)
- *   TaskResume       → agent_resume      (trace-only)
- *   TaskCancel       → agent_abort       (trace-only)
- *   TaskComplete     → agent_end         (trace-only)
- *   TaskError        → agent_error       (trace-only)
- *   PreToolUse       → tool_call         (permission gate, blocking)
- *   PostToolUse      → tool_result       (trace-only)
- *   UserPromptSubmit → prompt_submit     (trace-only)
- *   PreCompact       → pre_compact       (trace-only)
- *   SessionShutdown  → session_shutdown  (trace-only)
- */
-const HOOK_EVENTS = [
-    "TaskStart",
-    "TaskResume",
-    "TaskCancel",
-    "TaskComplete",
-    "TaskError",
-    "PreToolUse",
-    "PostToolUse",
-    "UserPromptSubmit",
-    "PreCompact",
-    "SessionShutdown",
-];
 /**
  * The version-pinned npx command that each shim execs. Resolving via npx
  * keeps the binary off the PATH requirement and pins the version the shim was
  * generated with (read from this package's own package.json).
  */
 function hookCommand() {
-    return `npx -y -p ${PACKAGE_NAME}@${readPackageVersion()} ${HOOK_BIN}`;
+    return `npx -y -p ${shims_js_1.PACKAGE_NAME}@${readPackageVersion()} ${HOOK_BIN}`;
 }
 function readPackageVersion() {
     // dist/cli/setup.js -> package root is two levels up.
@@ -117,7 +88,7 @@ function readPackageVersion() {
  */
 function shimBody() {
     return `#!/bin/sh
-# Ory plugin hook shim for Cline. Generated by ${PACKAGE_NAME} — do not edit.
+# Ory plugin hook shim for Cline. Generated by ${shims_js_1.PACKAGE_NAME} — do not edit.
 # Forwards the event payload (stdin JSON) to the Ory hook and returns its
 # JSON decision on stdout.
 exec ${hookCommand()}
@@ -148,19 +119,6 @@ function getRulesRoot(args) {
     }
     return path.join(args.projectDir, ".clinerules");
 }
-/**
- * Marker so uninstall only removes scripts we wrote — never a hook script the
- * user authored that happens to share an event name.
- */
-const ORY_MARKER = `${PACKAGE_NAME}`;
-function isOryShim(file) {
-    try {
-        return fs.readFileSync(file, "utf-8").includes(ORY_MARKER);
-    }
-    catch {
-        return false;
-    }
-}
 function main() {
     if (process.argv.includes("--help") || process.argv.includes("-h")) {
         (0, argus_1.printSetupHelp)("ory-cline-setup", "Cline", {
@@ -172,7 +130,7 @@ function main() {
     const args = (0, argus_1.parseSetupArgs)({ supportsGlobal: true });
     const body = shimBody();
     if (args.print) {
-        for (const event of HOOK_EVENTS) {
+        for (const event of shims_js_1.HOOK_EVENTS) {
             console.log(`# ── ${event} ───────────────────────────────`);
             console.log(body);
         }
@@ -186,9 +144,9 @@ function main() {
         }
         else {
             let removed = 0;
-            for (const event of HOOK_EVENTS) {
+            for (const event of shims_js_1.HOOK_EVENTS) {
                 const file = path.join(hooksDir, event);
-                if (fs.existsSync(file) && isOryShim(file)) {
+                if (fs.existsSync(file) && (0, shims_js_1.isOryShim)(file)) {
                     fs.unlinkSync(file);
                     removed++;
                 }
@@ -199,16 +157,18 @@ function main() {
         console.log(`Removed Ory skills from ${path.join(rulesRoot, "skills")}`);
         return;
     }
-    fs.mkdirSync(hooksDir, { recursive: true });
-    for (const event of HOOK_EVENTS) {
-        const file = path.join(hooksDir, event);
-        fs.writeFileSync(file, body, { mode: 0o755 });
-        // Re-assert the mode in case a pre-existing file ignored the create mode.
-        fs.chmodSync(file, 0o755);
-    }
+    // Write the per-event shims, skipping any event whose script the user
+    // authored (i.e. it exists but is not an Ory shim). Existing Ory shims
+    // are refreshed.
+    const { written, skipped } = (0, shims_js_1.writeHookShims)(hooksDir, body);
     (0, assets_js_1.installClineOryAssets)(rulesRoot);
     console.log(`Ory hook scripts installed to ${hooksDir}`);
-    console.log(`  Scripts: ${HOOK_EVENTS.join(", ")}`);
+    console.log(`  Scripts: ${written.length > 0 ? written.join(", ") : "(none)"}`);
+    if (skipped.length > 0) {
+        console.warn("");
+        console.warn((0, shims_js_1.formatSkippedWarning)(skipped));
+        console.warn("");
+    }
     console.log(`Ory skills installed to ${path.join(rulesRoot, "skills")}`);
     (0, argus_1.printNextSteps)("Cline", "npx ory-cline-setup --uninstall");
 }

package/dist/cli/shims.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Hook-shim writing for the Ory Cline plugin, factored out of the setup
+ * CLI so the skip-vs-overwrite logic is directly testable.
+ *
+ * Cline discovers hooks by filename in the hooks directory, so an install
+ * that blindly writes every event shim would clobber hook scripts the
+ * user authored. Install therefore only writes a shim when the target is
+ * absent or is an Ory-generated shim (detected via a content marker);
+ * user-authored scripts are skipped and reported.
+ */
+export declare const PACKAGE_NAME = "@ory/cline";
+/**
+ * Cline hook events we register. Each maps to a script whose filename matches
+ * the PascalCase event name in the hooks directory (verified against
+ * cline@3.0.29). At runtime, the payload Cline writes to the script's stdin
+ * carries the snake_case `hookName` the handler switches on:
+ *
+ *   TaskStart        → agent_start       (auth gates)
+ *   TaskResume       → agent_resume      (trace-only)
+ *   TaskCancel       → agent_abort       (trace-only)
+ *   TaskComplete     → agent_end         (trace-only)
+ *   TaskError        → agent_error       (trace-only)
+ *   PreToolUse       → tool_call         (permission gate, blocking)
+ *   PostToolUse      → tool_result       (trace-only)
+ *   UserPromptSubmit → prompt_submit     (trace-only)
+ *   PreCompact       → pre_compact       (trace-only)
+ *   SessionShutdown  → session_shutdown  (trace-only)
+ */
+export declare const HOOK_EVENTS: readonly ["TaskStart", "TaskResume", "TaskCancel", "TaskComplete", "TaskError", "PreToolUse", "PostToolUse", "UserPromptSubmit", "PreCompact", "SessionShutdown"];
+export declare function isOryShim(file: string): boolean;
+export interface WriteShimsResult {
+    /** Events whose shim was written (fresh or refreshed Ory shim). */
+    written: string[];
+    /** Events skipped because a non-Ory (user-authored) script exists. */
+    skipped: string[];
+}
+/**
+ * Write the per-event hook shims into `hooksDir`. A target that already
+ * exists and is NOT an Ory shim is left untouched and reported in
+ * `skipped`; existing Ory shims are refreshed in place.
+ */
+export declare function writeHookShims(hooksDir: string, body: string, events?: readonly string[]): WriteShimsResult;
+/**
+ * Human-readable warning for events whose shims were skipped because a
+ * user-authored script already owns the event name.
+ */
+export declare function formatSkippedWarning(skipped: readonly string[]): string;

package/dist/cli/shims.js

@@ -0,0 +1,131 @@
+"use strict";
+/**
+ * Hook-shim writing for the Ory Cline plugin, factored out of the setup
+ * CLI so the skip-vs-overwrite logic is directly testable.
+ *
+ * Cline discovers hooks by filename in the hooks directory, so an install
+ * that blindly writes every event shim would clobber hook scripts the
+ * user authored. Install therefore only writes a shim when the target is
+ * absent or is an Ory-generated shim (detected via a content marker);
+ * user-authored scripts are skipped and reported.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HOOK_EVENTS = exports.PACKAGE_NAME = void 0;
+exports.isOryShim = isOryShim;
+exports.writeHookShims = writeHookShims;
+exports.formatSkippedWarning = formatSkippedWarning;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+exports.PACKAGE_NAME = "@ory/cline";
+/**
+ * Cline hook events we register. Each maps to a script whose filename matches
+ * the PascalCase event name in the hooks directory (verified against
+ * cline@3.0.29). At runtime, the payload Cline writes to the script's stdin
+ * carries the snake_case `hookName` the handler switches on:
+ *
+ *   TaskStart        → agent_start       (auth gates)
+ *   TaskResume       → agent_resume      (trace-only)
+ *   TaskCancel       → agent_abort       (trace-only)
+ *   TaskComplete     → agent_end         (trace-only)
+ *   TaskError        → agent_error       (trace-only)
+ *   PreToolUse       → tool_call         (permission gate, blocking)
+ *   PostToolUse      → tool_result       (trace-only)
+ *   UserPromptSubmit → prompt_submit     (trace-only)
+ *   PreCompact       → pre_compact       (trace-only)
+ *   SessionShutdown  → session_shutdown  (trace-only)
+ */
+exports.HOOK_EVENTS = [
+    "TaskStart",
+    "TaskResume",
+    "TaskCancel",
+    "TaskComplete",
+    "TaskError",
+    "PreToolUse",
+    "PostToolUse",
+    "UserPromptSubmit",
+    "PreCompact",
+    "SessionShutdown",
+];
+/**
+ * Marker so install/uninstall only ever overwrite or remove scripts we
+ * wrote — never a hook script the user authored that happens to share an
+ * event name.
+ */
+const ORY_MARKER = `${exports.PACKAGE_NAME}`;
+function isOryShim(file) {
+    try {
+        return fs.readFileSync(file, "utf-8").includes(ORY_MARKER);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Write the per-event hook shims into `hooksDir`. A target that already
+ * exists and is NOT an Ory shim is left untouched and reported in
+ * `skipped`; existing Ory shims are refreshed in place.
+ */
+function writeHookShims(hooksDir, body, events = exports.HOOK_EVENTS) {
+    fs.mkdirSync(hooksDir, { recursive: true });
+    const written = [];
+    const skipped = [];
+    for (const event of events) {
+        const file = path.join(hooksDir, event);
+        if (fs.existsSync(file) && !isOryShim(file)) {
+            skipped.push(event);
+            continue;
+        }
+        fs.writeFileSync(file, body, { mode: 0o755 });
+        // Re-assert the mode in case a pre-existing file ignored the create mode.
+        fs.chmodSync(file, 0o755);
+        written.push(event);
+    }
+    return { written, skipped };
+}
+/**
+ * Human-readable warning for events whose shims were skipped because a
+ * user-authored script already owns the event name.
+ */
+function formatSkippedWarning(skipped) {
+    return [
+        `Warning: skipped ${skipped.length} event(s) — an existing hook script not`,
+        `written by ${exports.PACKAGE_NAME} already owns each of these names:`,
+        `  ${skipped.join(", ")}`,
+        "Those scripts were left untouched, so Ory will not see those events.",
+        "To let Ory handle an event, move or remove your script from the hooks",
+        "directory (or fold this shim's command into it) and re-run the install.",
+    ].join("\n");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/cline",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "description": "Ory plugin for Cline: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -66,7 +66,7 @@
     "!dist/**/*.tsbuildinfo"
   ],
   "dependencies": {
-    "@ory/argus": "0.10.0"
+    "@ory/argus": "0.11.1"
   },
   "devDependencies": {
     "typescript": "^6.0.2",