@pushary/agent-hooks 0.87.2 → 0.87.4

package/dist/bin/pushary-setup.js

@@ -1,26 +1,25 @@
 #!/usr/bin/env node
 import {
   detectClaudeVersion
-} from "../chunk-HAUTLCMA.js";
+} from "../chunk-ICERLAE2.js";
 import {
   claudeWired,
   codexWired,
   geminiWired
-} from "../chunk-XW5CHAQX.js";
+} from "../chunk-QXZ2CKRK.js";
 import {
   runBrowserLogin
 } from "../chunk-Z3Z4VK5F.js";
 import {
   ensureDaemonRunning
-} from "../chunk-SJVLFIYP.js";
+} from "../chunk-H5PIPIKQ.js";
 import {
   addClaudeMcpServer,
   addPusharyHooks,
-  addPusharyToolPermissions,
-  compareVersion,
-  parseVersion
-} from "../chunk-5646VKR4.js";
+  addPusharyToolPermissions
+} from "../chunk-2JYQAW4B.js";
 import {
+  CURSOR_GATE_EVENTS,
   describeDetection,
   detectAllAgents,
   isDetected,
@@ -31,17 +30,30 @@ import {
   shortenHome,
   vscodeSettingsTargets,
   writeInstructionBlock
-} from "../chunk-LT2VLPUK.js";
+} from "../chunk-KULUNLRO.js";
+import {
+  OPENCODE_HOOK_BINARY,
+  addOpenCodeMcpServer,
+  installOpenCodePlugin,
+  openCodeConfigDir,
+  openCodeConfigFile,
+  openCodePluginDir,
+  openCodePluginFile,
+  openCodeWired
+} from "../chunk-ZGC3W23N.js";
 import {
   GEMINI_HOOK_BINARY,
   addGeminiHooks,
-  addGeminiMcpServer
-} from "../chunk-ZZE6FN7T.js";
+  addGeminiMcpServer,
+  compareVersion,
+  parseVersion
+} from "../chunk-K42RXJPG.js";
 import "../chunk-ATBKJNWS.js";
 import {
   guardBinary,
-  guardNodeScript
-} from "../chunk-M7RYIZX6.js";
+  guardNodeScript,
+  guardedArgv
+} from "../chunk-B7ZBHWOW.js";
 import "../chunk-XHKBHWLX.js";
 import {
   installGlobally,
@@ -61,17 +73,20 @@ import {
   codexHome,
   codexHookPositions,
   codexSkillDir2 as codexSkillDir,
+  codexTrustSchemeAgrees,
   cursorPluginDir,
   cursorUserHooks,
   geminiMd,
   geminiSettings,
   pusharyConfigFile,
   vscodePluginDir
-} from "../chunk-B3V2H6SA.js";
+} from "../chunk-NAPRGHZ3.js";
+import "../chunk-GIRT7677.js";
 import {
   reportEvent
-} from "../chunk-V2XPF77V.js";
+} from "../chunk-VOE4SYPR.js";
 import "../chunk-J3YDT4HM.js";
+import "../chunk-7J67NYK4.js";
 import "../chunk-RN3NOEJF.js";
 import {
   confirmAppConnection,
@@ -81,12 +96,12 @@ import {
   printConnectInstructions,
   setHumanStream,
   verifyRoundTrip
-} from "../chunk-3LKYBFWA.js";
+} from "../chunk-EJL3PJU7.js";
 import "../chunk-3EGEA4KH.js";
 import {
   checkApiKey,
   describeKeyCheck
-} from "../chunk-A4I5JGCW.js";
+} from "../chunk-KFAH6KRE.js";
 import {
   useColor
 } from "../chunk-5RUIFDTP.js";
@@ -97,7 +112,7 @@ import {
   readConfigFileKey,
   readKeySource,
   writeKey
-} from "../chunk-OT4YD54Q.js";
+} from "../chunk-YX6ZKCC5.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
@@ -120,7 +135,7 @@ import {
 } from "../chunk-6MTNS63X.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
-import "../chunk-Y3UTTFTZ.js";
+import "../chunk-KBS53WOE.js";
 import {
   UsageError
 } from "../chunk-7QLSKOSU.js";
@@ -130,11 +145,11 @@ import {
 import "../chunk-2UMNXADU.js";
 import {
   isValidApiKey
-} from "../chunk-7YJS2VTG.js";
+} from "../chunk-DMW54VWK.js";
 
 // bin/pushary-setup.ts
-import { existsSync, readFileSync, writeFileSync, mkdirSync, cpSync, rmSync, renameSync, realpathSync, readdirSync, statSync } from "fs";
-import { join as join2, dirname as dirname2, basename } from "path";
+import { existsSync, readFileSync, writeFileSync, mkdirSync, cpSync, rmSync, renameSync, realpathSync, readdirSync, statSync, openSync, readSync, closeSync } from "fs";
+import { join as join3, dirname as dirname2, basename } from "path";
 import { homedir, tmpdir } from "os";
 import { execSync as execSync2 } from "child_process";
 import { checkbox, input, confirm } from "@inquirer/prompts";
@@ -274,7 +289,12 @@ var readCodexVersion = (probe) => {
     if (fromManifest) return fromManifest;
   }
   const brew = probe.brewVersions();
-  return brew ? parseCodexVersion(brew) : null;
+  if (brew) {
+    const parsed = parseCodexVersion(brew);
+    if (parsed) return parsed;
+  }
+  const bundled = probe.bundledVersion?.();
+  return bundled ? parseCodexVersion(bundled) : null;
 };
 
 // src/setup/codex-install.ts
@@ -317,6 +337,30 @@ var checkCodexInstall = (probe) => {
   return { kind: "binary-missing", vendorDir: vendors[0] };
 };
 
+// src/setup/codex-bundled.ts
+import { join as join2 } from "path";
+var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+var codexCliPathFromConfig = (config) => {
+  const servers = asRecord(config.mcp_servers);
+  if (!servers) return null;
+  for (const server of Object.values(servers)) {
+    const declared = asRecord(asRecord(server)?.env)?.CODEX_CLI_PATH;
+    if (typeof declared === "string" && declared.trim()) return declared.trim();
+  }
+  return null;
+};
+var bundledCodexCandidates = (home, platform) => platform === "darwin" ? [
+  "/Applications/ChatGPT.app/Contents/Resources/codex",
+  join2(home, "Applications", "ChatGPT.app", "Contents", "Resources", "codex")
+] : [];
+var findBundledCodex = (probe) => {
+  const config = probe.config();
+  const declared = config ? codexCliPathFromConfig(config) : null;
+  if (declared && probe.exists(declared)) return declared;
+  return bundledCodexCandidates(probe.home, probe.platform).find(probe.exists) ?? null;
+};
+var parseEmbeddedCodexVersion = (haystack) => haystack.match(/cli_version(\d+\.\d+\.\d+)/)?.[1] ?? null;
+
 // src/skills-cli.ts
 import { execSync } from "child_process";
 var installSkillViaSkillsCli = (agent) => {
@@ -414,7 +458,7 @@ var reportSetupAbortWith = async (deps, reason, exitCode, keyCheck = "unknown")
 var reportSetupAbort = (reason, exitCode, keyCheck) => reportSetupAbortWith(defaultDeps, reason, exitCode, keyCheck);
 
 // src/setup/options.ts
-var AGENT_CHOICES = ["claude_code", "codex", "gemini_cli", "hermes", "cursor", "vscode", "custom"];
+var AGENT_CHOICES = ["claude_code", "codex", "gemini_cli", "hermes", "cursor", "vscode", "opencode", "custom"];
 var CONNECT_MODES = ["app", "browser", "web", "none"];
 var CONNECT_ALIASES = { auto: "app", pwa: "web" };
 var parseConnectMode = (raw) => {
@@ -677,8 +721,8 @@ var fetchSkillContent = async () => {
   if (_cachedSkillContent) return _cachedSkillContent;
   const __dirname = dirname2(fileURLToPath(import.meta.url));
   const candidates = [
-    join2(__dirname, "..", "..", "data", "SKILL.md"),
-    join2(__dirname, "..", "data", "SKILL.md")
+    join3(__dirname, "..", "..", "data", "SKILL.md"),
+    join3(__dirname, "..", "data", "SKILL.md")
   ];
   const source = candidates.find((path) => existsSync(path));
   if (!source) throw new Error("packaged skill not found");
@@ -688,12 +732,12 @@ var fetchSkillContent = async () => {
 var writePackagedSkill = async (dir) => {
   const content = await fetchSkillContent();
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-  writeFileSync(join2(dir, "SKILL.md"), content, "utf-8");
+  writeFileSync(join3(dir, "SKILL.md"), content, "utf-8");
 };
-var skillsCliInUse = () => isInstalled("skills") || existsSync(join2(homedir(), ".agents", "skills"));
+var skillsCliInUse = () => isInstalled("skills") || existsSync(join3(homedir(), ".agents", "skills"));
 var skillInstallEffects = {
   runSkillsCli: installSkillViaSkillsCli,
-  skillModifiedAt: (dir) => statSync(join2(dir, "SKILL.md"), { throwIfNoEntry: false })?.mtimeMs ?? null,
+  skillModifiedAt: (dir) => statSync(join3(dir, "SKILL.md"), { throwIfNoEntry: false })?.mtimeMs ?? null,
   writePackagedSkill,
   now: () => Date.now()
 };
@@ -746,8 +790,8 @@ var resolveHermesPython = () => {
     }
   } catch {
   }
-  const venvRoot = join2(homedir(), ".hermes", "hermes-agent", "venv");
-  const candidates = IS_WINDOWS ? [join2(venvRoot, "Scripts", "python.exe"), join2(venvRoot, "Scripts", "python3.exe")] : [join2(venvRoot, "bin", "python3"), join2(venvRoot, "bin", "python")];
+  const venvRoot = join3(homedir(), ".hermes", "hermes-agent", "venv");
+  const candidates = IS_WINDOWS ? [join3(venvRoot, "Scripts", "python.exe"), join3(venvRoot, "Scripts", "python3.exe")] : [join3(venvRoot, "bin", "python3"), join3(venvRoot, "bin", "python")];
   return candidates.find(existsSync) ?? null;
 };
 var ensurePip = (python) => {
@@ -763,7 +807,7 @@ var ensurePip = (python) => {
 };
 var enablePusharyPlugin = (python) => {
   const snippet = 'from hermes_cli.config import load_config, save_config; c = load_config(); p = c.get("plugins") if isinstance(c.get("plugins"), dict) else {}; e = p.get("enabled") if isinstance(p.get("enabled"), list) else []; p["enabled"] = (e + ["pushary"]) if "pushary" not in e else e; c["plugins"] = p; a = c.get("agent") if isinstance(c.get("agent"), dict) else {}; d = a.get("disabled_toolsets") if isinstance(a.get("disabled_toolsets"), list) else []; a["disabled_toolsets"] = (d + ["clarify"]) if "clarify" not in d else d; c["agent"] = a; save_config(c)';
-  const scriptPath = join2(tmpdir(), `pushary-hermes-${process.pid}.py`);
+  const scriptPath = join3(tmpdir(), `pushary-hermes-${process.pid}.py`);
   try {
     writeFileSync(scriptPath, snippet.split("; ").join("\n"), "utf-8");
     execSync2(`"${python}" "${scriptPath}"`, { stdio: "pipe", timeout: 15e3 });
@@ -812,9 +856,9 @@ var setupHermes = async (_apiKey) => {
   console.log(`  ${dim("\u2022")} Permission gating: set ${bold("PUSHARY_GATE_TOOLS")} to require lock-screen approval for risky tools`);
   console.log(`  ${dim("To re-enable terminal prompts:")} remove ${bold("clarify")} from ${dim("agent.disabled_toolsets")} in ~/.hermes/config.yaml`);
 };
-var CODEX_HOOKS_JSON = join2(CODEX_HOME, "hooks.json");
+var CODEX_HOOKS_JSON = join3(CODEX_HOME, "hooks.json");
 var CODEX_HOOKS_MIN_VERSION = [0, 122, 0];
-var CODEX_TRUST_VERIFIED_MAX = [0, 142, 2];
+var CODEX_TRUST_VERIFIED_MAX = [0, 147, 0];
 var codexOnPath = () => {
   const whichCmd = IS_WINDOWS ? "where" : "which";
   try {
@@ -831,6 +875,49 @@ var codexRealpath = (path) => {
     return null;
   }
 };
+var EMBEDDED_SCAN_CHUNK_BYTES = 4 * 1024 * 1024;
+var EMBEDDED_SCAN_MAX_BYTES = 320 * 1024 * 1024;
+var readEmbeddedCodexVersion = (path) => {
+  let fd;
+  try {
+    fd = openSync(path, "r");
+    const chunk = Buffer.allocUnsafe(EMBEDDED_SCAN_CHUNK_BYTES);
+    let carry = "";
+    let scanned = 0;
+    while (scanned < EMBEDDED_SCAN_MAX_BYTES) {
+      const bytes = readSync(fd, chunk, 0, chunk.length, null);
+      if (bytes <= 0) return null;
+      scanned += bytes;
+      const text = carry + chunk.toString("latin1", 0, bytes);
+      const found = parseEmbeddedCodexVersion(text);
+      if (found) return found;
+      carry = text.slice(-32);
+    }
+    return null;
+  } catch {
+    return null;
+  } finally {
+    if (fd !== void 0) {
+      try {
+        closeSync(fd);
+      } catch {
+        fd = void 0;
+      }
+    }
+  }
+};
+var bundledCodex = () => findBundledCodex({
+  config: () => {
+    try {
+      return parseTOML(readFileSync(codexConfigToml(), "utf-8"));
+    } catch {
+      return null;
+    }
+  },
+  exists: existsSync,
+  home: homedir(),
+  platform: process.platform
+});
 var detectCodexVersion = () => readCodexVersion({
   resolveOnPath: codexOnPath,
   realpath: codexRealpath,
@@ -841,6 +928,10 @@ var detectCodexVersion = () => readCodexVersion({
       return null;
     }
   },
+  bundledVersion: () => {
+    const path = bundledCodex();
+    return path ? readEmbeddedCodexVersion(path) : null;
+  },
   brewVersions: () => {
     try {
       return execSync2("brew list --versions codex", {
@@ -872,7 +963,7 @@ var detectCodexInstall = () => checkCodexInstall({
       return null;
     }
   },
-  join: join2,
+  join: join3,
   dirname: dirname2
 });
 var codexSupportsHooks = (version) => version !== null && compareCodexVersion(version, CODEX_HOOKS_MIN_VERSION) >= 0;
@@ -915,12 +1006,19 @@ var setupCodex = async (apiKey) => {
   console.log(`
   ${bold("Setting up Codex")}
 `);
-  if (!isInstalled("codex")) {
-    console.log(`  ${yellow("!")} Codex CLI not found. Skipping.`);
-    console.log(`  ${dim("Install Codex and re-run setup to configure.")}`);
+  const onPath = isInstalled("codex");
+  const bundled = onPath ? null : bundledCodex();
+  if (!onPath && !bundled) {
+    console.log(`  ${yellow("!")} Codex not found. Skipping.`);
+    console.log(`  ${dim("Install the Codex CLI or the ChatGPT desktop app, then re-run setup.")}`);
     return "skipped";
   }
-  if (detectCodexInstall().kind === "binary-missing") {
+  if (bundled) {
+    console.log(`  ${dim("Using the Codex inside the ChatGPT desktop app.")}`);
+    console.log(`  ${dim(shortenHome(bundled))}`);
+    console.log();
+  }
+  if (onPath && detectCodexInstall().kind === "binary-missing") {
     console.log(`  ${yellow("!")} Your Codex install is missing the binary it runs.`);
     console.log(`  ${dim("A Pushary setup before 0.71.0 asked Codex its version. On macOS that hands")}`);
     console.log(`  ${dim("the binary to XProtect, which quarantines the Codex CLI and moves it to the")}`);
@@ -939,7 +1037,7 @@ var setupCodex = async (apiKey) => {
   });
   const codexVersion = detectCodexVersion();
   const hooksSupported = codexSupportsHooks(codexVersion);
-  const trustAuto = codexTrustAutoSupported(codexVersion);
+  const trustAuto = hooksSupported && (codexTrustSchemeAgrees(readAgentJson(CODEX_HOOKS_JSON), readAgentToml(codexConfig), CODEX_HOOKS_JSON) || codexTrustAutoSupported(codexVersion));
   let trusted = false;
   if (hooksSupported) {
     const hookCommand = guardBinary(resolveGlobalBinary("pushary-codex-hook") ?? "pushary-codex-hook");
@@ -994,20 +1092,25 @@ var setupCodex = async (apiKey) => {
   if (hooksSupported) {
     console.log(`  ${dim("\u2022")} Native hooks: phone approvals, policy enforcement, kill switch, session tracking`);
     if (trusted) {
-      console.log(`  ${dim("\u2022")} Hook pre-trusted: no ${cyan("/hooks")} step, phone approvals work right away`);
+      console.log(`  ${dim("\u2022")} Hook pre-trusted: no ${cyan("/hooks")} step. If approvals never arrive, ${cyan("/hooks")} re-trusts it`);
     } else {
       console.log();
       console.log(`  ${bold("One step left, and it happens inside Codex")}`);
       console.log(`  ${dim("Codex makes you trust any hook before it runs. This is Codex's own")}`);
       console.log(`  ${dim("security check, not a Pushary thing, and you only do it once.")}`);
       console.log();
-      console.log(`  ${cyan("1.")} Open Codex and type ${cyan("/hooks")}`);
-      console.log(`  ${cyan("2.")} You will see the Pushary hook commands. Trust them.`);
+      if (bundled) {
+        console.log(`  ${cyan("1.")} Open ChatGPT, then Settings and ${cyan("Hooks")}`);
+        console.log(`  ${cyan("2.")} You will see the Pushary hook commands. Trust them.`);
+      } else {
+        console.log(`  ${cyan("1.")} Open Codex and type ${cyan("/hooks")}`);
+        console.log(`  ${cyan("2.")} You will see the Pushary hook commands. Trust them.`);
+      }
       console.log();
       console.log(`  ${dim("Until you do, Codex just runs as usual without the phone approvals.")}`);
       console.log(`  ${dim("To confirm:")} run a command that needs approval and watch your phone.`);
       console.log(`  ${dim("Pushary updates keep the same trust, so Codex will not ask again.")}`);
-      noteManual("Open Codex, type /hooks, and trust the Pushary hook. Until then Codex runs without phone approvals.");
+      noteManual(bundled ? "Open ChatGPT, then Settings and Hooks, and trust the Pushary hook. Until then Codex runs without phone approvals." : "Open Codex, type /hooks, and trust the Pushary hook. Until then Codex runs without phone approvals.");
     }
   } else {
     console.log(`  ${dim("\u2022")} Notify handler (deprecated): captures turn completions and approval requests`);
@@ -1016,17 +1119,15 @@ var setupCodex = async (apiKey) => {
 var resolveBundledPlugin = () => {
   const dir = dirname2(fileURLToPath(import.meta.url));
   const candidates = [
-    join2(dir, "..", "..", "data", "cursor-plugin"),
-    join2(dir, "..", "data", "cursor-plugin"),
-    join2(dir, "..", "..", "..", "cursor-plugin"),
-    join2(dir, "..", "..", "cursor-plugin")
+    join3(dir, "..", "..", "data", "cursor-plugin"),
+    join3(dir, "..", "data", "cursor-plugin"),
+    join3(dir, "..", "..", "..", "cursor-plugin"),
+    join3(dir, "..", "..", "cursor-plugin")
   ];
-  return candidates.find((p) => existsSync(join2(p, ".cursor-plugin", "plugin.json"))) ?? null;
+  return candidates.find((p) => existsSync(join3(p, ".cursor-plugin", "plugin.json"))) ?? null;
 };
 var installCursorUserHooks = (gateScript) => {
-  const template = readJson(join2(CURSOR_PLUGIN_DIR, "hooks", "hooks.json")).hooks?.beforeShellExecution?.[0];
-  if (!template) throw new Error("bundled Cursor hooks.json missing a beforeShellExecution entry");
-  const entry = { ...template, command: guardNodeScript(gateScript) };
+  const bundled = readJson(join3(CURSOR_PLUGIN_DIR, "hooks", "hooks.json")).hooks ?? {};
   let userHooks = {};
   if (existsSync(CURSOR_USER_HOOKS)) {
     try {
@@ -1040,19 +1141,24 @@ var installCursorUserHooks = (gateScript) => {
     }
   }
   const hooks = userHooks.hooks ?? {};
-  const existing = Array.isArray(hooks.beforeShellExecution) ? hooks.beforeShellExecution : [];
-  const others = existing.filter((h) => !String(h.command ?? "").includes("pushary-gate"));
-  hooks.beforeShellExecution = [...others, entry];
+  for (const event of CURSOR_GATE_EVENTS) {
+    const template = bundled[event]?.[0];
+    if (!template) throw new Error(`bundled Cursor hooks.json missing a ${event} entry`);
+    const existing = Array.isArray(hooks[event]) ? hooks[event] : [];
+    const others = existing.filter((h) => !String(h.command ?? "").includes("pushary-gate"));
+    hooks[event] = [...others, { ...template, command: guardNodeScript(gateScript) }];
+  }
   writeJson(CURSOR_USER_HOOKS, { ...userHooks, version: userHooks.version ?? 1, hooks });
 };
 var neutralizePluginGate = () => {
-  const path = join2(CURSOR_PLUGIN_DIR, "hooks", "hooks.json");
+  const path = join3(CURSOR_PLUGIN_DIR, "hooks", "hooks.json");
   if (!existsSync(path)) return;
   const data = readJson(path);
-  if (data.hooks && "beforeShellExecution" in data.hooks) {
-    delete data.hooks.beforeShellExecution;
-    writeJson(path, { version: data.version ?? 1, hooks: data.hooks });
-  }
+  if (!data.hooks) return;
+  const stripped = CURSOR_GATE_EVENTS.filter((event) => event in data.hooks);
+  if (stripped.length === 0) return;
+  for (const event of stripped) delete data.hooks[event];
+  writeJson(path, { version: data.version ?? 1, hooks: data.hooks });
 };
 var setupCursor = async (apiKey) => {
   console.log(`
@@ -1061,7 +1167,7 @@ var setupCursor = async (apiKey) => {
   const source = resolveBundledPlugin();
   if (!source) throw new Error("bundled Cursor plugin not found in this package");
   await spinner("Installing Pushary plugin", async () => {
-    const staging = join2(dirname2(CURSOR_PLUGIN_DIR), `.pushary-staging-${process.pid}`);
+    const staging = join3(dirname2(CURSOR_PLUGIN_DIR), `.pushary-staging-${process.pid}`);
     const backup = `${CURSOR_PLUGIN_DIR}.pushary-backup-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
     rmSync(staging, { recursive: true, force: true });
     try {
@@ -1069,7 +1175,7 @@ var setupCursor = async (apiKey) => {
         recursive: true,
         filter: (p) => !["tools", "node_modules", ".git", ".DS_Store"].includes(basename(p))
       });
-      const staged = readJsonSafe(join2(staging, ".cursor-plugin", "plugin.json"));
+      const staged = readJsonSafe(join3(staging, ".cursor-plugin", "plugin.json"));
       if (staged.kind !== "ok") {
         throw new Error("staged Cursor plugin is missing or has an unreadable plugin.json");
       }
@@ -1087,7 +1193,7 @@ var setupCursor = async (apiKey) => {
     }
   });
   await spinner("Linking your API key", async () => {
-    const mcpPath = join2(CURSOR_PLUGIN_DIR, "mcp.json");
+    const mcpPath = join3(CURSOR_PLUGIN_DIR, "mcp.json");
     const mcp = readAgentJson(mcpPath);
     const servers = mcp.mcpServers ?? {};
     if (servers.pushary) {
@@ -1097,7 +1203,7 @@ var setupCursor = async (apiKey) => {
     }
   });
   await spinner("Registering permission gate (~/.cursor/hooks.json)", async () => {
-    installCursorUserHooks(join2(CURSOR_PLUGIN_DIR, "scripts", "pushary-gate.mjs"));
+    installCursorUserHooks(join3(CURSOR_PLUGIN_DIR, "scripts", "pushary-gate.mjs"));
     neutralizePluginGate();
   });
   console.log();
@@ -1111,21 +1217,21 @@ var setupCursor = async (apiKey) => {
 var resolveBundledVsCodePlugin = () => {
   const dir = dirname2(fileURLToPath(import.meta.url));
   const candidates = [
-    join2(dir, "..", "..", "data", "vscode-plugin"),
-    join2(dir, "..", "data", "vscode-plugin"),
-    join2(dir, "..", "..", "..", "vscode-plugin"),
-    join2(dir, "..", "..", "vscode-plugin")
+    join3(dir, "..", "..", "data", "vscode-plugin"),
+    join3(dir, "..", "data", "vscode-plugin"),
+    join3(dir, "..", "..", "..", "vscode-plugin"),
+    join3(dir, "..", "..", "vscode-plugin")
   ];
-  return candidates.find((p) => existsSync(join2(p, ".claude-plugin", "plugin.json"))) ?? null;
+  return candidates.find((p) => existsSync(join3(p, ".claude-plugin", "plugin.json"))) ?? null;
 };
 var pinVsCodeGatePath = (pluginDir) => {
-  const hooksPath = join2(pluginDir, "hooks", "hooks.json");
+  const hooksPath = join3(pluginDir, "hooks", "hooks.json");
   const data = readJson(hooksPath);
   const entries = data.hooks?.PreToolUse;
   if (!Array.isArray(entries) || entries.length === 0) {
     throw new Error("bundled VS Code hooks.json is missing a PreToolUse entry");
   }
-  const gate = join2(pluginDir, "scripts", "pushary-gate.mjs");
+  const gate = join3(pluginDir, "scripts", "pushary-gate.mjs");
   data.hooks.PreToolUse = entries.map((entry) => ({ ...entry, command: `node "${gate}"` }));
   writeJson(hooksPath, data);
 };
@@ -1154,7 +1260,7 @@ var setupVsCode = async (apiKey) => {
   const source = resolveBundledVsCodePlugin();
   if (!source) throw new Error("bundled VS Code plugin not found in this package");
   await spinner("Installing Pushary plugin", async () => {
-    const staging = join2(dirname2(VSCODE_PLUGIN_DIR), `.pushary-staging-vscode-${process.pid}`);
+    const staging = join3(dirname2(VSCODE_PLUGIN_DIR), `.pushary-staging-vscode-${process.pid}`);
     const backup = `${VSCODE_PLUGIN_DIR}.pushary-backup-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
     mkdirSync(dirname2(VSCODE_PLUGIN_DIR), { recursive: true });
     rmSync(staging, { recursive: true, force: true });
@@ -1163,7 +1269,7 @@ var setupVsCode = async (apiKey) => {
         recursive: true,
         filter: (p) => !["tools", "node_modules", ".git", ".DS_Store"].includes(basename(p))
       });
-      const staged = readJsonSafe(join2(staging, ".claude-plugin", "plugin.json"));
+      const staged = readJsonSafe(join3(staging, ".claude-plugin", "plugin.json"));
       if (staged.kind !== "ok") {
         throw new Error("staged VS Code plugin is missing or has an unreadable plugin.json");
       }
@@ -1181,7 +1287,7 @@ var setupVsCode = async (apiKey) => {
     }
   });
   await spinner("Linking your API key", async () => {
-    const mcpPath = join2(VSCODE_PLUGIN_DIR, ".mcp.json");
+    const mcpPath = join3(VSCODE_PLUGIN_DIR, ".mcp.json");
     const mcp = readAgentJson(mcpPath);
     const servers = mcp.mcpServers ?? {};
     if (servers.pushary) {
@@ -1308,6 +1414,43 @@ var setupGemini = async (apiKey) => {
   console.log(`  ${dim("Restart Gemini CLI to load the new config.")}`);
   noteManual("Restart Gemini CLI to load the new config.");
 };
+var OPENCODE_INSTRUCTIONS = () => join3(openCodeConfigDir(), "AGENTS.md");
+var setupOpenCode = async (apiKey) => {
+  console.log(`
+  ${bold("Setting up OpenCode")}
+`);
+  if (!isInstalled("opencode") && !existsSync(openCodeConfigDir())) {
+    console.log(`  ${yellow("!")} OpenCode not found. Skipping.`);
+    console.log(`  ${dim("Install OpenCode and re-run setup to configure.")}`);
+    return "skipped";
+  }
+  await installGlobally2();
+  await spinner(`Writing the Pushary plugin (${openCodePluginFile()})`, async () => {
+    const target = resolveGlobalBinary(OPENCODE_HOOK_BINARY) ?? OPENCODE_HOOK_BINARY;
+    installOpenCodePlugin(
+      guardedArgv({ kind: "binary", path: target, runtime: "node" }, ["--source", "opencode"]),
+      openCodePluginDir()
+    );
+  });
+  await spinner(`Adding MCP server (${openCodeConfigFile()})`, async () => {
+    const config = readAgentJson(openCodeConfigFile());
+    addOpenCodeMcpServer(config, apiKey);
+    writeJsonAtomic(openCodeConfigFile(), config, KEY_FILE_MODE);
+  });
+  await spinner("Teaching OpenCode to ask via push", async () => {
+    writeInstructionBlock(OPENCODE_INSTRUCTIONS(), renderAgentInstructions("OpenCode"));
+  });
+  console.log();
+  console.log(`  ${dim("What this configured:")}`);
+  console.log(`  ${dim("\u2022")} Plugin: ${openCodePluginFile()}`);
+  console.log(`  ${dim("\u2022")} MCP server: OpenCode can send notifications and ask questions`);
+  console.log(`  ${dim("\u2022")} Approvals: a permission OpenCode raises is answered from your phone`);
+  console.log(`  ${dim("\u2022")} Gate covers ${bold("bash")}, ${bold("edit")}, ${bold("write")} and ${bold("webfetch")}`);
+  console.log(`  ${dim("\u2022")} Receipts: tool results, prompts and turn boundaries reach your account`);
+  console.log(`  ${dim("Restart OpenCode to load the plugin.")}`);
+  noteManual("Restart OpenCode to load the plugin.");
+  return "configured";
+};
 var agentIsWired = (agent) => {
   const readJson2 = (path) => {
     try {
@@ -1321,27 +1464,29 @@ var agentIsWired = (agent) => {
       return claudeWired({
         claudeJson: readJson2(CLAUDE_JSON),
         settings: readJson2(CLAUDE_SETTINGS),
-        skillExists: existsSync(join2(CLAUDE_SKILL_DIR, "SKILL.md"))
+        skillExists: existsSync(join3(CLAUDE_SKILL_DIR, "SKILL.md"))
       });
     case "codex": {
       let config = null;
       try {
-        config = parseTOML(readFileSync(join2(CODEX_HOME, "config.toml"), "utf-8"));
+        config = parseTOML(readFileSync(join3(CODEX_HOME, "config.toml"), "utf-8"));
       } catch {
         config = null;
       }
       return codexWired({
         config,
         hooks: readJson2(CODEX_HOOKS_JSON),
-        skillExists: existsSync(join2(CODEX_SKILL_DIR, "SKILL.md"))
+        skillExists: existsSync(join3(CODEX_SKILL_DIR, "SKILL.md"))
       });
     }
     case "gemini_cli":
       return geminiWired({ settings: readJson2(GEMINI_SETTINGS) });
     case "cursor":
-      return existsSync(join2(CURSOR_PLUGIN_DIR, "mcp.json"));
+      return existsSync(join3(CURSOR_PLUGIN_DIR, "mcp.json"));
     case "vscode":
-      return existsSync(join2(VSCODE_PLUGIN_DIR, ".mcp.json"));
+      return existsSync(join3(VSCODE_PLUGIN_DIR, ".mcp.json"));
+    case "opencode":
+      return openCodeWired();
     default:
       return true;
   }
@@ -1353,6 +1498,7 @@ var AGENT_SETUP = {
   hermes: setupHermes,
   cursor: setupCursor,
   vscode: setupVsCode,
+  opencode: setupOpenCode,
   custom: setupCustom
 };
 var PROJECT_INSTRUCTION_TARGETS = {
@@ -1369,8 +1515,8 @@ var offerProjectInstructions = async (agents, options) => {
   });
   if (!wanted) return;
   for (const target of targets) {
-    await spinner(`Writing managed block to ${join2(process.cwd(), target.file)}`, async () => {
-      writeInstructionBlock(join2(process.cwd(), target.file), renderProjectAgentInstructions(target.label));
+    await spinner(`Writing managed block to ${join3(process.cwd(), target.file)}`, async () => {
+      writeInstructionBlock(join3(process.cwd(), target.file), renderProjectAgentInstructions(target.label));
     }, { optional: true });
   }
   console.log(`  ${dim("Commit the file to share it. Teammates without a key fall back to the terminal.")}`);
@@ -1455,6 +1601,7 @@ var AGENT_NAMES = {
   hermes: "Hermes",
   cursor: "Cursor",
   vscode: "VS Code",
+  opencode: "OpenCode",
   custom: "Other"
 };
 var AGENT_CAPABILITIES = {
@@ -1464,6 +1611,7 @@ var AGENT_CAPABILITIES = {
   hermes: "native plugin + auto-error notifications",
   cursor: "plugin + permission gate",
   vscode: "agent plugin + permission gate",
+  opencode: "generated plugin + permission gate",
   custom: "any MCP or HTTP agent (Windsurf, n8n, custom)"
 };
 var NAME_COLUMN = Math.max(...Object.values(AGENT_NAMES).map((name) => name.length)) + 2;
@@ -1522,12 +1670,18 @@ var resolveAgents = async (options) => {
   });
 };
 var AGENT_TARGETS = {
-  claude_code: [CLAUDE_JSON, CLAUDE_SETTINGS, join2(CLAUDE_SKILL_DIR, "SKILL.md")],
-  codex: [join2(CODEX_HOME, "config.toml"), CODEX_HOOKS_JSON, join2(CODEX_SKILL_DIR, "SKILL.md"), CODEX_AGENTS_MD],
+  claude_code: [CLAUDE_JSON, CLAUDE_SETTINGS, join3(CLAUDE_SKILL_DIR, "SKILL.md")],
+  codex: [join3(CODEX_HOME, "config.toml"), CODEX_HOOKS_JSON, join3(CODEX_SKILL_DIR, "SKILL.md"), CODEX_AGENTS_MD],
   gemini_cli: [GEMINI_SETTINGS, GEMINI_MD],
   hermes: ["the Hermes virtualenv (pip install pushary-hermes)"],
-  cursor: [join2(CURSOR_PLUGIN_DIR, "mcp.json"), CURSOR_USER_HOOKS],
-  vscode: [join2(VSCODE_PLUGIN_DIR, ".mcp.json"), ...vscodeSettingsTargets(existsSync)],
+  cursor: [join3(CURSOR_PLUGIN_DIR, "mcp.json"), CURSOR_USER_HOOKS],
+  vscode: [join3(VSCODE_PLUGIN_DIR, ".mcp.json"), ...vscodeSettingsTargets(existsSync)],
+  opencode: [
+    openCodePluginFile(),
+    join3(openCodePluginDir(), "package.json"),
+    openCodeConfigFile(),
+    OPENCODE_INSTRUCTIONS()
+  ],
   custom: ["nothing (prints connection details only)"]
 };
 var reportDryRun = (apiKey, agents, keyCheck) => {