@pushary/agent-hooks 1.9.50 → 1.9.52

package/dist/{chunk-DH4BWFU7.js → chunk-MTKV4RUQ.js}

@@ -1,14 +1,14 @@
 import {
   MCP_BRIDGE_BINARY
-} from "./chunk-GDDXGBTM.js";
+} from "./chunk-46TC24ET.js";
 import {
   KEY_FILE_MODE
-} from "./chunk-XH3F66VD.js";
+} from "./chunk-VYBH6D4X.js";
 import {
   NpmInstallError,
   NpmMissingError,
   NpmPermissionError
-} from "./chunk-ZYYQJSIO.js";
+} from "./chunk-XUW2DRAQ.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -16,13 +16,13 @@ import {
 } from "./chunk-AQFEP65J.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-ZOKMGBPR.js";
+} from "./chunk-MC4VY5LK.js";
 import {
   readSetupAgentFailures
-} from "./chunk-OR5F63C2.js";
+} from "./chunk-LF3TLC7B.js";
 
 // src/instruction-file.ts
-import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from "fs";
+import { accessSync, constants, existsSync, readFileSync, statSync, writeFileSync, mkdirSync, rmSync } from "fs";
 import { dirname } from "path";
 var PUSHARY_BEGIN = "<!-- BEGIN PUSHARY (managed by @pushary/agent-hooks; do not edit this block) -->";
 var PUSHARY_END = "<!-- END PUSHARY -->";
@@ -44,6 +44,9 @@ You have Pushary MCP tools that reach the user on their phone. Use them proactiv
 
 Pass \`agentName\` as "${label} - <project folder name>" so the user knows which session is asking. If a question times out, follow \`handoffAction\` when present, otherwise \`nextAction\`: keep waiting with the same correlationId while pending. A poll ending is not question expiry. Cancel only for an explicit handoff or when the answer is no longer needed. If cancellation returns \`handoffAction: "stop"\`, stop. Otherwise, if cancellation returns false, poll once for 1 second and honor the answer that won the race.`;
 var SHARED_AGENTS_MD_LABEL = "<your agent's name, such as Codex or Hermes>";
+var CODEX_INSTRUCTIONS_LABEL = "Codex";
+var GEMINI_INSTRUCTIONS_LABEL = "Gemini";
+var OPENCODE_INSTRUCTIONS_LABEL = "OpenCode";
 var renderAgentInstructions = (label) => instructionBody(label);
 var KEYLESS_FALLBACK_LINE = "This repo uses Pushary phone approvals. Your teammates get agent questions on their lock screens; you do not have a key yet, so questions will fall back to the terminal. Get your own key (3-day trial): https://pushary.com/sign-up?utm_source=agents-md&utm_medium=teammate";
 var renderProjectAgentInstructions = (label) => `${instructionBody(label)}
@@ -52,6 +55,19 @@ If this environment has no Pushary API key (no PUSHARY_API_KEY and no key in ~/.
 var wrap = (body) => `${PUSHARY_BEGIN}
 ${body}
 ${PUSHARY_END}`;
+var withInstructionBlockAppended = (existing, body) => {
+  const prefix = existing.trim() ? existing.replace(/\s*$/, "") + "\n\n" : "";
+  return prefix + wrap(body) + "\n";
+};
+var managedBlockRange = (text) => {
+  const start = text.indexOf(PUSHARY_BEGIN);
+  const end = text.indexOf(PUSHARY_END);
+  return start !== -1 && end > start ? { start, end: end + PUSHARY_END.length } : null;
+};
+var withInstructionBlockReplaced = (existing, body) => {
+  const range = managedBlockRange(existing);
+  return range ? existing.slice(0, range.start) + wrap(body) + existing.slice(range.end) : null;
+};
 var writeInstructionBlock = (filePath, body) => {
   const dir = dirname(filePath);
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
@@ -60,17 +76,53 @@ var writeInstructionBlock = (filePath, body) => {
     existing = readFileSync(filePath, "utf-8");
   } catch {
   }
-  const block = wrap(body);
-  const start = existing.indexOf(PUSHARY_BEGIN);
-  const end = existing.indexOf(PUSHARY_END);
-  let next;
-  if (start !== -1 && end !== -1 && end > start) {
-    next = existing.slice(0, start) + block + existing.slice(end + PUSHARY_END.length);
-  } else {
-    const prefix = existing.trim() ? existing.replace(/\s*$/, "") + "\n\n" : "";
-    next = prefix + block + "\n";
+  writeFileSync(filePath, withInstructionBlockReplaced(existing, body) ?? withInstructionBlockAppended(existing, body), "utf-8");
+};
+var occurrencesOf = (marker, text) => text.split(marker).length - 1;
+var soleManagedBlock = (text) => {
+  const begins = occurrencesOf(PUSHARY_BEGIN, text);
+  const ends = occurrencesOf(PUSHARY_END, text);
+  if (begins === 0 && ends === 0) return { kind: "none" };
+  const range = managedBlockRange(text);
+  return begins === 1 && ends === 1 && range ? { kind: "one", range } : { kind: "ambiguous" };
+};
+var CRLF = "\r\n";
+var withLineEndingsOf = (sample, block) => sample.includes(CRLF) ? block.replaceAll("\n", CRLF) : block;
+var readUtf8 = (filePath) => {
+  try {
+    const bytes = readFileSync(filePath);
+    const text = bytes.toString("utf-8");
+    return Buffer.from(text, "utf-8").equals(bytes) ? { kind: "text", text } : { kind: "not_utf8" };
+  } catch {
+    return { kind: "unreadable" };
+  }
+};
+var isWritable = (filePath) => {
+  try {
+    accessSync(filePath, constants.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var refreshInstructionBlock = (filePath, body) => {
+  if (!existsSync(filePath)) return "absent";
+  const read = readUtf8(filePath);
+  if (read.kind !== "text") return read.kind;
+  const block = soleManagedBlock(read.text);
+  if (block.kind === "none") return "absent";
+  if (block.kind === "ambiguous") return "ambiguous_markers";
+  const existing = read.text.slice(block.range.start, block.range.end);
+  const fresh = withLineEndingsOf(existing, wrap(body));
+  if (existing === fresh) return "current";
+  if (!isWritable(filePath)) return "read_only";
+  try {
+    const refreshed = read.text.slice(0, block.range.start) + fresh + read.text.slice(block.range.end);
+    writeFileAtomic(filePath, refreshed, statSync(filePath).mode & 511);
+    return "refreshed";
+  } catch {
+    return "write_failed";
   }
-  writeFileSync(filePath, next, "utf-8");
 };
 var removeInstructionBlock = (filePath) => {
   let existing = "";
@@ -550,6 +602,7 @@ var agentFailureWire = (failures) => readSetupAgentFailures(failures);
 
 // src/fx-lifecycle.ts
 import { existsSync as existsSync3 } from "fs";
+import { join } from "path";
 var fxRetryHint = () => `Fix it, then run ${retryAgentCommand("fx")}.`;
 var readFxProfileForSetup = (filePath) => {
   const read = readFxFile(filePath, readFxProfile);
@@ -571,6 +624,13 @@ var writeFxProfile = (filePath, profile) => {
   }
   writeFileAtomic(filePath, rendered.text, KEY_FILE_MODE);
 };
+var macAppFxBridge = (pusharyDir) => join(pusharyDir, "bin", MCP_BRIDGE_BINARY);
+var fxServerHolder = (profilePath, appBridge) => {
+  const read = readFxFile(profilePath, readFxProfile);
+  const entry = read.kind === "profile" ? fxPusharyEntryOf(read.profile) : void 0;
+  if (!isFxPusharyEntry(entry)) return "none";
+  return fxBridgeTargetOf(entry) === appBridge ? "app" : "cli";
+};
 var fxSettingsReadRefusal = (filePath, read) => {
   if (read.kind === "unreadable") return `${filePath} could not be read`;
   if (read.kind === "refused") return `${filePath} ${FX_SETTINGS_REFUSALS[read.reason]}`;
@@ -665,9 +725,13 @@ var planFxRemoval = (profilePath, settingsPath, receiptPath) => {
 
 export {
   SHARED_AGENTS_MD_LABEL,
+  CODEX_INSTRUCTIONS_LABEL,
+  GEMINI_INSTRUCTIONS_LABEL,
+  OPENCODE_INSTRUCTIONS_LABEL,
   renderAgentInstructions,
   renderProjectAgentInstructions,
   writeInstructionBlock,
+  refreshInstructionBlock,
   removeInstructionBlock,
   hasInstructionBlock,
   FX_PUSHARY_TOOLS_RULE,
@@ -691,6 +755,8 @@ export {
   agentFailureWire,
   readFxProfileForSetup,
   writeFxProfile,
+  macAppFxBridge,
+  fxServerHolder,
   configureFxSettings,
   inspectFxInstallation,
   planFxRemoval

package/dist/{chunk-Y74IJ2IO.js → chunk-N77BH7H2.js}

@@ -3,19 +3,20 @@ import {
   addGeminiMcpServer,
   removeGeminiMcpServer,
   supportedClaudeEvents
-} from "./chunk-25SYEAW4.js";
+} from "./chunk-6C4S3QYD.js";
 import {
   CLAUDE_CODE_AGENT,
   compatibleToolLookup
-} from "./chunk-YVO4HIHX.js";
+} from "./chunk-U2L42GVI.js";
 import {
   guardBinary,
   guardBinaryRefusing,
   holdBudgetOf,
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-ZYYQJSIO.js";
+} from "./chunk-OML4YFBN.js";
 import {
+  HOOK_COMPATIBLE_PROFILES,
   HOOK_LOCATOR_BINARY,
   PHONE_ANSWERED_TOOLS,
   compatibleTargetFiles,
@@ -25,7 +26,7 @@ import {
   pusharyMissingReason,
   refusalOutput,
   withHookHoldBudget
-} from "./chunk-OR5F63C2.js";
+} from "./chunk-LF3TLC7B.js";
 
 // src/claude-config.ts
 import { join } from "path";
@@ -280,6 +281,10 @@ var compatibleDocuments = (profile, home) => {
   }
   return documents;
 };
+var compatibleRecord = (of) => HOOK_COMPATIBLE_PROFILES.reduce(
+  (record, profile) => ({ ...record, [profile.agentType]: of(profile) }),
+  {}
+);
 var compatibleTargetPaths = (profile, home) => compatibleTargetFiles(profile).map((file) => compatibleFilePath(file, home));
 var compatibleConfigFile = (profile, home) => compatibleFilePath(profile.configFile, home);
 var compatibleMcpFile = (profile, home) => profile.mcp ? compatibleFilePath(profile.mcp.file, home) : null;
@@ -489,6 +494,7 @@ export {
   grokHome,
   compatibleFilePath,
   compatibleDocuments,
+  compatibleRecord,
   compatibleTargetPaths,
   compatibleConfigFile,
   compatibleMcpFile,

package/dist/{chunk-ZTTCYHOM.js → chunk-NECZKPJN.js}

@@ -4,7 +4,7 @@ import {
   forkFinishWithUpgradeLock,
   installWithUpgradeLock,
   releaseAutoUpdateLock
-} from "./chunk-KBGKWB5T.js";
+} from "./chunk-H57DXSHR.js";
 import {
   describeAutoUpdateCheck,
   globalInstallLocation,
@@ -14,23 +14,25 @@ import {
   readAutoUpdateState,
   updateAutoUpdateState,
   upgradeEntryFor
-} from "./chunk-APASKZ2I.js";
+} from "./chunk-QKU46TK5.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
 import {
   autoUpdateLock,
   autoUpdateLog,
-  autoUpdateState,
+  autoUpdateState
+} from "./chunk-OML4YFBN.js";
+import {
   execNpm,
   fetchLatestPublishedVersion,
   npmErrorMessage,
   readGlobalCliInstallAt,
   readGlobalPrefix
-} from "./chunk-ZYYQJSIO.js";
+} from "./chunk-XUW2DRAQ.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-ZOKMGBPR.js";
+} from "./chunk-MC4VY5LK.js";
 import {
   commandsPackage,
   globalUpgradeEntry,
@@ -39,7 +41,7 @@ import {
   isSameMajorVersion,
   ownPackageRoot,
   packageVersionAt
-} from "./chunk-OR5F63C2.js";
+} from "./chunk-QTOLNRET.js";
 
 // src/global-upgrade.ts
 import { existsSync } from "fs";
@@ -50,6 +52,26 @@ import { dirname } from "path";
 
 // src/upgrade-finish.ts
 var FINISHED_UPGRADE = { kind: "finished" };
+var refreshedPartsOf = (agent) => [
+  ...agent.result.hooks ? ["hooks"] : [],
+  ...agent.result.mcp ? ["MCP key"] : [],
+  ...agent.instructions?.outcome === "refreshed" ? ["instructions"] : []
+];
+var wasRefreshed = (agent) => refreshedPartsOf(agent).length > 0;
+var INSTRUCTIONS_LEFT_BECAUSE = {
+  refreshed: null,
+  current: null,
+  absent: null,
+  read_only: "the file is read-only",
+  ambiguous_markers: "its Pushary markers do not form exactly one block",
+  not_utf8: "the file is not UTF-8 text",
+  unreadable: "the file could not be read",
+  write_failed: "the file could not be written"
+};
+var instructionsLeftNoteOf = (agent) => {
+  const reason = agent.instructions ? INSTRUCTIONS_LEFT_BECAUSE[agent.instructions.outcome] : null;
+  return agent.instructions && reason ? `${agent.instructions.file}: ${reason}` : null;
+};
 var RETRYABLE_UPGRADE_FINISH = { kind: "retryable" };
 var SETTLED_UPGRADE_FINISH = { kind: "settled" };
 var controlWaitsOnThePerson = (readings) => readings.controlPolicy === "legacy" || readings.controlMode === "on" && readings.controlPolicy === "unsupported";
@@ -273,6 +295,9 @@ var upgradeInstalledPackage = async (subject, effects) => {
 };
 
 export {
+  refreshedPartsOf,
+  wasRefreshed,
+  instructionsLeftNoteOf,
   upgradeFinishOutcome,
   upgradeFinishExitCode,
   FINISH_UPGRADE_FLAG,

package/dist/{chunk-TGCIFEDE.js → chunk-NELH25J7.js}

@@ -4,19 +4,19 @@ import {
   outcomeOfFailedAsk,
   reportMachineDenial,
   storedWaitDeadline
-} from "./chunk-EP6S6VY3.js";
+} from "./chunk-JPABKXK6.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-Y7WD72J7.js";
+} from "./chunk-7CLLWDCP.js";
 import {
   isDeferAnswer,
   oncePerSession
-} from "./chunk-IF2UPWD2.js";
+} from "./chunk-DHJSBK63.js";
 import {
   activeHookSource,
   activeIdentity
-} from "./chunk-Y74IJ2IO.js";
+} from "./chunk-N77BH7H2.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -40,7 +40,10 @@ import {
   reportEvent,
   scopePathFor,
   settleQuestionsForToolUse
-} from "./chunk-YVO4HIHX.js";
+} from "./chunk-U2L42GVI.js";
+import {
+  repoKeyFor
+} from "./chunk-JBT3ZSJS.js";
 import {
   askUser,
   cancelQuestion,
@@ -49,22 +52,21 @@ import {
   isDecisionStopped,
   isLocalQuestionHandoff,
   pollForAnswer,
-  repoKeyFor,
   requestGate,
   sendNotification,
   waitForQuestion,
   waitsForThePhone
-} from "./chunk-AWMMABVB.js";
+} from "./chunk-ZMPR436Z.js";
 import {
   getMachineId
-} from "./chunk-LY3OJFBW.js";
+} from "./chunk-T6RIKJUO.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-VUS6QGND.js";
+} from "./chunk-CQ5JGRML.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-ZOKMGBPR.js";
+} from "./chunk-MC4VY5LK.js";
 import {
   AGENT_QUESTION_STRATEGY,
   AGENT_QUESTION_TOOL,
@@ -109,7 +111,7 @@ import {
   resolveGate,
   timeoutActionWithoutLocalPrompt,
   unansweredRefusalReason
-} from "./chunk-OR5F63C2.js";
+} from "./chunk-LF3TLC7B.js";
 
 // src/claude-permission-rules.ts
 import { readFileSync, statSync } from "fs";

package/dist/{chunk-HXRH7ZCK.js → chunk-NHVEQLQC.js}

@@ -1,9 +1,9 @@
 import {
   CODEX_HOOK_STATUS
-} from "./chunk-KIO2MZQC.js";
+} from "./chunk-FCMWUYIE.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-ZOKMGBPR.js";
+} from "./chunk-MC4VY5LK.js";
 
 // src/setup/codex-trust.ts
 var CODEX_TRUST_TELEMETRY = {

package/dist/{chunk-OW4DNSQ6.js → chunk-NSY2V7XU.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_HOLD_BUDGET_ENV,
   hookHoldBudgetProof
-} from "./chunk-OR5F63C2.js";
+} from "./chunk-LF3TLC7B.js";
 
 // src/hold-budget.ts
 var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {

package/dist/chunk-OHSHDQZF.js

@@ -0,0 +1,271 @@
+import {
+  codexPassThroughScript,
+  desktopEngine,
+  desktopProxyScript,
+  installedCodexApp,
+  shellQuoted
+} from "./chunk-DMJFW4KL.js";
+import {
+  writeHuman
+} from "./chunk-QCGNGEGE.js";
+import {
+  xml
+} from "./chunk-BL3WAGIK.js";
+import {
+  CODEX_APP_LAUNCH_VARIABLE
+} from "./chunk-36NGFHE4.js";
+import {
+  writeFileAtomic
+} from "./chunk-AQFEP65J.js";
+
+// src/codex-app-cards-switch.ts
+import { execFileSync } from "child_process";
+import { existsSync, mkdirSync, readFileSync, rmSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var CODEX_APP_CARDS_LOGIN_ITEM = "com.pushary.codex-app-cards";
+var CODEX_APP_CARDS_DIRECTORY = "codex-app";
+var LAUNCHCTL = "/bin/launchctl";
+var LAUNCHER_NAME = "codex";
+var RECEIPT_NAME = "turned-on.json";
+var PRIVATE_DIRECTORY_MODE = 448;
+var PRIVATE_PROGRAM_MODE = 448;
+var PRIVATE_FILE_MODE = 384;
+var LOGIN_ITEM_DIRECTORY_MODE = 493;
+var LOGIN_ITEM_MODE = 420;
+var MAC_APP_HELPER = "/Contents/Helpers/pushary-native-transcripts";
+var TEMPORARY_NPX_FOLDER = "/_npx/";
+var codexAppCardsPaths = (homeDir, uid) => {
+  const launcherDirectory = join(homeDir, ".pushary", CODEX_APP_CARDS_DIRECTORY);
+  const loginItemDirectory = join(homeDir, "Library", "LaunchAgents");
+  return {
+    launcherDirectory,
+    launcherPath: join(launcherDirectory, LAUNCHER_NAME),
+    receiptPath: join(launcherDirectory, RECEIPT_NAME),
+    loginItemDirectory,
+    loginItemPath: join(loginItemDirectory, `${CODEX_APP_CARDS_LOGIN_ITEM}.plist`),
+    loginItemTarget: `gui/${uid}/${CODEX_APP_CARDS_LOGIN_ITEM}`
+  };
+};
+var codexAppCardsLoginScript = (launcherPath, engine) => [
+  `if [ -x ${shellQuoted(launcherPath)} ] && [ -x ${shellQuoted(engine)} ]`,
+  `&& [ -z "$(${LAUNCHCTL} getenv ${CODEX_APP_LAUNCH_VARIABLE})" ];`,
+  `then ${LAUNCHCTL} setenv ${CODEX_APP_LAUNCH_VARIABLE} ${shellQuoted(launcherPath)}; fi`
+].join(" ");
+var codexAppCardsLoginItem = (launcherPath, engine) => `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${CODEX_APP_CARDS_LOGIN_ITEM}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/bin/sh</string>
+    <string>-c</string>
+    <string>${xml(codexAppCardsLoginScript(launcherPath, engine))}</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+</dict>
+</plist>
+`;
+var isAString = (value) => typeof value === "string";
+var codexAppCardsReceiptFrom = (contents) => {
+  if (contents === null) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(contents);
+  } catch {
+    return null;
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  const { entry, app, engine } = parsed;
+  return Array.isArray(entry) && entry.length > 0 && entry.every(isAString) && isAString(app) && isAString(engine) ? { entry, app, engine } : null;
+};
+var codexAppCardsInstallation = (input) => {
+  const paths = codexAppCardsPaths(input.homeDir, input.uid);
+  return {
+    paths,
+    launcherScript: desktopProxyScript(input.entry, input.app, input.engine, { turnsItselfOffWithoutTheEngine: true }),
+    loginItem: codexAppCardsLoginItem(paths.launcherPath, input.engine),
+    receipt: { entry: input.entry, app: input.app, engine: input.engine }
+  };
+};
+var isAbsolutePath = (value) => value.startsWith("/");
+var whatTheLauncherCannotRun = (receipt, machine) => {
+  if (receipt === null) return null;
+  if (!machine.exists(receipt.engine)) return { kind: "on_but_the_codex_engine_moved", engine: receipt.engine };
+  const missing = receipt.entry.filter(isAbsolutePath).find((path) => !machine.exists(path));
+  return missing === void 0 ? null : { kind: "on_but_pushary_is_missing", missing };
+};
+var codexAppCardsStatus = (paths, machine) => {
+  const value = machine.launchVariable();
+  if (value.length > 0 && value !== paths.launcherPath) return { kind: "another_program_owns_the_launch", value };
+  const launcherIsThere = machine.exists(paths.launcherPath);
+  const setForThisLogin = value === paths.launcherPath && launcherIsThere;
+  const setAtEveryLogin = launcherIsThere && machine.exists(paths.loginItemPath);
+  if (!setForThisLogin && !setAtEveryLogin) return { kind: "off" };
+  const cannotRun = whatTheLauncherCannotRun(codexAppCardsReceiptFrom(machine.readFile(paths.receiptPath)), machine);
+  if (cannotRun) return cannotRun;
+  if (setForThisLogin && setAtEveryLogin) return { kind: "on" };
+  return setForThisLogin ? { kind: "on_until_logout" } : { kind: "on_after_next_login" };
+};
+var turnCodexAppCardsOn = (installation, machine) => {
+  const { paths } = installation;
+  const value = machine.launchVariable();
+  if (value.length > 0 && value !== paths.launcherPath) return { kind: "another_program_owns_the_launch", value };
+  machine.makeDirectory(paths.launcherDirectory, PRIVATE_DIRECTORY_MODE);
+  machine.writeFile(paths.launcherPath, installation.launcherScript, PRIVATE_PROGRAM_MODE);
+  machine.writeFile(paths.receiptPath, `${JSON.stringify(installation.receipt, null, 2)}
+`, PRIVATE_FILE_MODE);
+  machine.makeDirectory(paths.loginItemDirectory, LOGIN_ITEM_DIRECTORY_MODE);
+  machine.writeFile(paths.loginItemPath, installation.loginItem, LOGIN_ITEM_MODE);
+  machine.setLaunchVariable(paths.launcherPath);
+  return { kind: "on" };
+};
+var leaveOnlyThePathToTheEngine = (paths, machine) => {
+  const receipt = codexAppCardsReceiptFrom(machine.readFile(paths.receiptPath));
+  const launcher = machine.readFile(paths.launcherPath);
+  if (receipt === null || launcher === null) return;
+  const onlyThePathToTheEngine = codexPassThroughScript(receipt.engine);
+  if (launcher !== onlyThePathToTheEngine) machine.writeFile(paths.launcherPath, onlyThePathToTheEngine, PRIVATE_PROGRAM_MODE);
+};
+var turnCodexAppCardsOff = (paths, machine) => {
+  const value = machine.launchVariable();
+  const ours = value === paths.launcherPath;
+  const loginItemIsThere = machine.exists(paths.loginItemPath);
+  leaveOnlyThePathToTheEngine(paths, machine);
+  if (ours) machine.unsetLaunchVariable();
+  if (loginItemIsThere) {
+    machine.unloadLoginItem(paths.loginItemTarget);
+    machine.remove(paths.loginItemPath);
+  }
+  return { wasOn: ours || loginItemIsThere, launchLeftToAnotherProgram: value.length > 0 && !ours ? value : null };
+};
+var turnedOnByTheMacApp = (receipt) => receipt !== null && receipt.entry[0].endsWith(MAC_APP_HELPER);
+var removeCodexAppCards = (request, machine) => {
+  const paths = codexAppCardsPaths(request.homeDir, request.uid);
+  if (!machine.exists(paths.launcherDirectory) && !machine.exists(paths.loginItemPath)) return "absent";
+  const keptOnForTheMacApp = request.keepWhatTheMacAppTurnedOn && turnedOnByTheMacApp(codexAppCardsReceiptFrom(machine.readFile(paths.receiptPath))) && codexAppCardsStatus(paths, machine).kind !== "off";
+  if (keptOnForTheMacApp) return "kept_for_the_mac_app";
+  if (request.dryRun) return "removed";
+  turnCodexAppCardsOff(paths, machine);
+  machine.remove(paths.launcherDirectory);
+  return "removed";
+};
+var launchctl = (args) => execFileSync(LAUNCHCTL, [...args], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+var launchctlIgnoringFailure = (args) => {
+  try {
+    return launchctl(args);
+  } catch {
+    return "";
+  }
+};
+var fileContents = (path) => {
+  try {
+    return readFileSync(path, "utf8");
+  } catch {
+    return null;
+  }
+};
+var thisMacsCodexAppCardsMachine = () => ({
+  launchVariable: () => launchctlIgnoringFailure(["getenv", CODEX_APP_LAUNCH_VARIABLE]).trim(),
+  setLaunchVariable: (value) => {
+    launchctl(["setenv", CODEX_APP_LAUNCH_VARIABLE, value]);
+  },
+  unsetLaunchVariable: () => {
+    launchctl(["unsetenv", CODEX_APP_LAUNCH_VARIABLE]);
+  },
+  unloadLoginItem: (target) => {
+    launchctlIgnoringFailure(["bootout", target]);
+  },
+  exists: existsSync,
+  readFile: fileContents,
+  makeDirectory: (path, mode) => {
+    mkdirSync(path, { recursive: true, mode });
+  },
+  writeFile: (path, contents, mode) => {
+    writeFileAtomic(path, contents, mode);
+  },
+  remove: (path) => {
+    rmSync(path, { recursive: true, force: true });
+  }
+});
+var removeCodexAppCardsFromThisMac = (request) => removeCodexAppCards(request, thisMacsCodexAppCardsMachine());
+var USAGE = "Usage: pushary codex --app-cards on [path/to/Codex.app] | off | status";
+var TAKES_EFFECT_AFTER_REOPENING = "Quit Codex and open it again.";
+var TURN_THEM_ON_AGAIN = "Run the same command with on to repair it.";
+var runsFromATemporaryFolder = (entry) => entry.some((part) => part.includes(TEMPORARY_NPX_FOLDER));
+var ownedByAnotherProgram = (value) => `Another program already starts the Codex app through ${value}. Pushary did not change it.`;
+var codexAppCardsStatusLine = (status) => {
+  switch (status.kind) {
+    case "on":
+      return "Codex app cards are on.";
+    case "off":
+      return "Codex app cards are off.";
+    case "on_until_logout":
+      return "Codex app cards are on until you log out. Turn them on again to keep them on.";
+    case "on_after_next_login":
+      return "Codex app cards start the next time you log in. Turn them on again to start now.";
+    case "on_but_pushary_is_missing":
+      return `Codex app cards are on, but no card can reach Pushary: ${status.missing} is gone. Codex itself works. ${TURN_THEM_ON_AGAIN}`;
+    case "on_but_the_codex_engine_moved":
+      return `Codex app cards are on, but the Codex engine is no longer at ${status.engine}. ${TURN_THEM_ON_AGAIN}`;
+    case "another_program_owns_the_launch":
+      return ownedByAnotherProgram(status.value);
+  }
+};
+var codexAppCardsCommand = async (args, entry, readAccount, machine, say) => {
+  const [action, chosenApp, ...rest] = args;
+  const uid = process.getuid?.();
+  if (uid === void 0) throw new Error("Codex app cards need macOS");
+  const paths = codexAppCardsPaths(homedir(), uid);
+  if (action === "status" && chosenApp === void 0) {
+    say(codexAppCardsStatusLine(codexAppCardsStatus(paths, machine)));
+    return 0;
+  }
+  if (action === "off" && chosenApp === void 0) {
+    const turnedOff = turnCodexAppCardsOff(paths, machine);
+    say(turnedOff.wasOn ? `Codex app cards are off. ${TAKES_EFFECT_AFTER_REOPENING}` : "Codex app cards were already off.");
+    if (turnedOff.launchLeftToAnotherProgram) say(ownedByAnotherProgram(turnedOff.launchLeftToAnotherProgram));
+    return 0;
+  }
+  if (action !== "on" || rest.length > 0) throw new Error(USAGE);
+  if (!await readAccount()) throw new Error("Connect Pushary before turning Codex app cards on");
+  const app = installedCodexApp(chosenApp);
+  const engine = await desktopEngine(app);
+  const turnedOn = turnCodexAppCardsOn(codexAppCardsInstallation({ homeDir: homedir(), uid, entry, app, engine }), machine);
+  if (turnedOn.kind === "another_program_owns_the_launch") {
+    say(ownedByAnotherProgram(turnedOn.value));
+    return 1;
+  }
+  say(`Codex app cards are on. ${TAKES_EFFECT_AFTER_REOPENING}`);
+  say("From then on, when Codex asks to use an app on this Mac, the question also reaches Pushary. Everything else in Codex stays as it is.");
+  say("Turn them off by running the same command with off.");
+  if (runsFromATemporaryFolder(entry)) say("This copy of Pushary runs from a temporary npx folder. If that folder is cleared, the cards stop reaching Pushary and Codex keeps working. Install Pushary with npm install -g pushary and turn them on again to make it last.");
+  return 0;
+};
+var sayToThePerson = (line) => {
+  writeHuman(`${line}
+`);
+};
+var codexAppCardsCommandOnThisMac = (args, entry, readAccount) => codexAppCardsCommand(args, entry, readAccount, thisMacsCodexAppCardsMachine(), sayToThePerson);
+
+export {
+  CODEX_APP_CARDS_LOGIN_ITEM,
+  CODEX_APP_CARDS_DIRECTORY,
+  codexAppCardsPaths,
+  codexAppCardsLoginScript,
+  codexAppCardsLoginItem,
+  codexAppCardsReceiptFrom,
+  codexAppCardsInstallation,
+  codexAppCardsStatus,
+  turnCodexAppCardsOn,
+  turnCodexAppCardsOff,
+  removeCodexAppCards,
+  removeCodexAppCardsFromThisMac,
+  runsFromATemporaryFolder,
+  codexAppCardsStatusLine,
+  codexAppCardsCommand,
+  codexAppCardsCommandOnThisMac
+};