pushary 1.9.63 → 1.9.65

package/dist/{chunk-LTT54NOU.js → chunk-P5HZEGT7.js}

@@ -1,18 +1,15 @@
 import {
   compatibleConfigFile
-} from "./chunk-3QLFB2EY.js";
+} from "./chunk-WY6YAMZW.js";
 import {
   hookOwnerOf,
   hookOwnerOfCommands,
   liveBridgeProbe,
   resolveBridgeStub
-} from "./chunk-SKUSGWFK.js";
+} from "./chunk-GTBWWCCM.js";
 import {
   AGENT_CHOICES
-} from "./chunk-XE5N352V.js";
-import {
-  readJsonSafe
-} from "./chunk-QENTGE75.js";
+} from "./chunk-SROWUG5W.js";
 import {
   claudeSettings,
   codexHooksJson,
@@ -21,7 +18,10 @@ import {
   guardedArgv,
   pusharyDir,
   vscodePluginDir
-} from "./chunk-MK4USZYQ.js";
+} from "./chunk-ATPJGHUP.js";
+import {
+  readJsonSafe
+} from "./chunk-SCMEVDAR.js";
 import {
   HOOK_BUDGETS,
   HOOK_COMPATIBLE_PROFILES,
@@ -29,7 +29,7 @@ import {
   OPENCODE_APPROVAL_EVENT,
   hookCompatibleProfile,
   isRecord
-} from "./chunk-7NCLUA65.js";
+} from "./chunk-MNKIR2ZB.js";
 
 // src/opencode-plugin.ts
 var OPENCODE_PLUGIN_MARKER = "pushary-opencode-plugin w1";
@@ -456,6 +456,59 @@ var addOpenCodeMcpServer = (config, apiKey) => {
   };
   config.mcp = servers;
 };
+var OPENCODE_ASKED_PERMISSIONS = ["bash", "edit", "webfetch"];
+var PERMISSION_KEY = "permission";
+var TOOLS_KEY = "tools";
+var ASK_ACTION = "ask";
+var ALLOW_ACTION = "allow";
+var DENY_ACTION = "deny";
+var ALL_PATTERNS = "*";
+var OPENCODE_ACTION_NAMES = {
+  bash: ["bash", "shell"],
+  edit: ["edit", "write", "patch"],
+  webfetch: ["webfetch"]
+};
+var escapedForPattern = (text) => text.replace(/[.+^${}()|[\]\\]/g, "\\$&").replaceAll("?", ".");
+var keyMatches = (key, name) => new RegExp(`^${key.split(ALL_PATTERNS).map(escapedForPattern).join(".*")}$`).test(name);
+var ruleNamesPermission = (permission) => ([key]) => OPENCODE_ACTION_NAMES[permission].some((name) => keyMatches(key, name));
+var toolRules = (config) => Object.entries(asRecord(config[TOOLS_KEY]) ?? {}).filter(([, enabled]) => typeof enabled === "boolean").map(([key, enabled]) => [key, enabled ? ALLOW_ACTION : DENY_ACTION]);
+var permissionRules = (config) => {
+  const permission = config[PERMISSION_KEY];
+  if (permission === void 0) return [];
+  const rules = asRecord(permission);
+  return rules ? Object.entries(rules) : [[ALL_PATTERNS, permission]];
+};
+var rulesInOrder = (config) => [...toolRules(config), ...permissionRules(config)];
+var actionOfRule = (value) => {
+  const patterns = asRecord(value);
+  return patterns ? patterns[ALL_PATTERNS] : value;
+};
+var holdsTheCall = (action) => action === ASK_ACTION || action === DENY_ACTION;
+var withOpenCodeAskRules = (config) => {
+  const permission = config[PERMISSION_KEY];
+  const rules = asRecord(permission);
+  if (permission !== void 0 && !rules) return { config, change: { kind: "person-setting-kept" } };
+  const personRules = rulesInOrder(config);
+  const added = OPENCODE_ASKED_PERMISSIONS.filter((name) => !personRules.some(ruleNamesPermission(name)));
+  if (added.length === 0) return { config, change: { kind: "present" } };
+  const asks = Object.fromEntries(added.map((name) => [name, ASK_ACTION]));
+  return { config: { ...config, [PERMISSION_KEY]: { ...asks, ...rules } }, change: { kind: "added", added } };
+};
+var openCodePermissionsLeftOpen = (config) => {
+  const rules = rulesInOrder(asRecord(config) ?? {});
+  return OPENCODE_ASKED_PERMISSIONS.filter((name) => !holdsTheCall(
+    rules.filter(ruleNamesPermission(name)).map(([, value]) => actionOfRule(value)).filter((action) => action !== void 0).at(-1)
+  ));
+};
+var openCodeAskCheck = (config) => {
+  if (config.kind === "unreadable" || config.kind === "unparseable") return { kind: "unreadable" };
+  const value = config.kind === "ok" ? asRecord(config.value) ?? {} : {};
+  const open = openCodePermissionsLeftOpen(value);
+  if (open.length === 0) return { kind: "asks" };
+  const personRules = rulesInOrder(value);
+  const namedByPerson = (name) => personRules.some(ruleNamesPermission(name));
+  return { kind: "open", unset: open.filter((name) => !namedByPerson(name)), allowedByPerson: open.filter(namedByPerson) };
+};
 var removeOpenCodeMcpServer = (config) => {
   const servers = asRecord(config.mcp);
   if (!servers || !("pushary" in servers)) return false;
@@ -518,6 +571,10 @@ export {
   openCodeConfigFile,
   openCodeInstructionsFile,
   addOpenCodeMcpServer,
+  OPENCODE_ASKED_PERMISSIONS,
+  withOpenCodeAskRules,
+  openCodePermissionsLeftOpen,
+  openCodeAskCheck,
   removeOpenCodeMcpServer,
   agentHookFile,
   agentHooksKeyPath,

package/dist/{chunk-YMZOM6BD.js → chunk-PP7FC3Y7.js}

@@ -1,25 +1,25 @@
 import {
   registerTranscript
-} from "./chunk-T6XQNOZV.js";
+} from "./chunk-Q2BD4IBX.js";
 import {
   namedEvent
-} from "./chunk-3QLFB2EY.js";
+} from "./chunk-WY6YAMZW.js";
 import {
   isBridgeLocator,
   liveBridgeProbe,
   pusharyHookExecutable,
   resolveBridgeStub
-} from "./chunk-SKUSGWFK.js";
-import {
-  atLeast,
-  parseVersion
-} from "./chunk-6ICPEJY5.js";
+} from "./chunk-GTBWWCCM.js";
 import {
   writeDegraded
-} from "./chunk-TBKHQWIH.js";
+} from "./chunk-DTVHZDYM.js";
 import {
   cursorUserHooks
-} from "./chunk-MK4USZYQ.js";
+} from "./chunk-ATPJGHUP.js";
+import {
+  atLeast,
+  parseVersion
+} from "./chunk-SCMEVDAR.js";
 import {
   CURSOR_GATE_COVERAGE,
   CURSOR_GATE_SCRIPT,
@@ -33,7 +33,7 @@ import {
   isGrokSessionEndStop,
   isRecord,
   toolsCoveredByGateEntry
-} from "./chunk-7NCLUA65.js";
+} from "./chunk-MNKIR2ZB.js";
 
 // src/tool-hook-input.ts
 var OPTIONAL_TEXT_FIELDS = ["hook_event_name", "session_id", "cwd", "transcript_path", "tool_use_id", "permission_mode", "cursor_version"];

package/dist/{chunk-T6XQNOZV.js → chunk-Q2BD4IBX.js}

@@ -3,43 +3,43 @@ import {
   loadPin,
   savePin,
   verifyRecipients
-} from "./chunk-QW3FRUFB.js";
+} from "./chunk-SZBMTOUZ.js";
 import {
   ensureDaemonRunning
-} from "./chunk-4WFAP6QN.js";
+} from "./chunk-ADXHPGBZ.js";
 import {
   hookOwnerOf
-} from "./chunk-SKUSGWFK.js";
+} from "./chunk-GTBWWCCM.js";
 import {
   buildTranscriptRecords,
   decodePublicKey,
   generateSessionKey,
   recordSealerFor,
   wrapSessionKey
-} from "./chunk-BCVCUDFI.js";
+} from "./chunk-QSW3HAKI.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-V7N5NOZV.js";
+} from "./chunk-TJUJAK5L.js";
 import {
   transcriptEnvironmentPreference,
   transcriptsEnabled
-} from "./chunk-OJEIS5L2.js";
+} from "./chunk-TK4JU2F7.js";
 import {
   readTranscriptPreference
-} from "./chunk-IOH2T3CB.js";
-import {
-  writeJsonAtomic
-} from "./chunk-QENTGE75.js";
+} from "./chunk-ED2SWTPC.js";
 import {
   claudeConfigDir,
   codexHome,
   pusharyDir
-} from "./chunk-MK4USZYQ.js";
+} from "./chunk-ATPJGHUP.js";
+import {
+  writeJsonAtomic
+} from "./chunk-SCMEVDAR.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-BUQU3OPX.js";
+} from "./chunk-Y64JGYTB.js";
 
 // src/transcript-registration.ts
 import { createHash } from "crypto";

package/dist/{chunk-DMNLFWGY.js → chunk-QNZ6G3LY.js}

@@ -1,148 +1,41 @@
 import {
   AgentConfigError,
+  AgentConfigWriteError,
   configFailureKind,
-  retryAgentCommand
-} from "./chunk-S2Z6VWHH.js";
+  retryAgentCommand,
+  writeSetupConfigFile
+} from "./chunk-W5L2ZLHE.js";
 import {
   MCP_BRIDGE_BINARY
-} from "./chunk-WUOOZE5S.js";
+} from "./chunk-BEQ3MEE3.js";
 import {
   KEY_FILE_MODE
-} from "./chunk-IOH2T3CB.js";
+} from "./chunk-ED2SWTPC.js";
+import {
+  CLINE_SERVER_NAME_TAKEN,
+  CLINE_SETTINGS_REFUSALS,
+  clineEntryAuthorization,
+  clineEntryHoldsLiteralKey,
+  clineEntryRunsCommand,
+  clineEntrySignedIn,
+  clineEntrySwitchedOff,
+  clineEntryUsesKey,
+  clinePusharyEntryOf,
+  clineServerNameTakenElsewhere,
+  clineSettingsText,
+  isClinePusharyEntry,
+  otherPusharyServerNames,
+  readClineSettings,
+  renderAgentInstructions,
+  withClinePusharyServer,
+  withRefreshedClineKey,
+  withoutClinePusharyServer
+} from "./chunk-ATPJGHUP.js";
 import {
   readJsonSafe,
   writeFileAtomic,
   writeJsonAtomic
-} from "./chunk-QENTGE75.js";
-
-// src/instruction-file.ts
-import { accessSync, constants, existsSync, readFileSync, statSync, writeFileSync, mkdirSync, rmSync } from "fs";
-import { dirname } from "path";
-var PUSHARY_BEGIN = "<!-- BEGIN PUSHARY (managed by @pushary/agent-hooks; do not edit this block) -->";
-var PUSHARY_END = "<!-- END PUSHARY -->";
-var instructionBody = (label) => `## Pushary notifications and approvals
-
-You have Pushary MCP tools that reach the user on their phone. Use them proactively. Do not wait for the user to ask.
-
-- When you need the user to make a decision or answer a clarifying question, call \`ask_user\` instead of guessing or stalling. Use type "confirm" for yes/no, "select" for a fixed set of options, and "input" for free text. Read \`answered\`, \`status\` and the returned handoff instead of assuming the tool blocked. Silence is not consent; choice/text answers do not authorize a separate action.
-- Ask once, on one channel. If you also have a built-in way to prompt the user, use that or \`ask_user\` for a given question, never both. \`ask_user\` is the one that reaches the user when they are away from this machine, so prefer it. Raising both strands the user in whichever prompt you are not waiting on.
-- Honor authorization already granted in this session. Ask before a risky or irreversible action outside that authorization, or when an enforced host policy requires it. Do not ask again for an already authorized step, and never bypass an enforced gate. When a Pushary hook result says the user approved a specific command after a denial, rerunning that exact command is the approved path and not a bypass of that gate.
-- Call \`propose_scope\` only for an unresolved or requested file boundary. A ratified scope narrows what may proceed; it does not bypass other approval rules. Do not add a plan approval merely because work spans several files, and do not propose a new scope mid-run just to widen it. Let the installed gate request any scope expansion before the edit executes. Only file paths are checked, and only on tool calls that carry one, so put a boundary that is not a path (recipients, channels, spend, systems you will not open) in \`promises\` and never in \`allowedPaths\`. Read the \`enforces\` field that comes back: an empty array means nothing in that contract is checked automatically, and you must say so rather than report that a scope is in force. \`hookSeen: false\` means no hook has reported that sessionId, so the gate will never find the contract: fix the session id rather than proceeding as if a scope were in force.
-- Before a task of more than two steps, break it into steps and find the forks. Settle by yourself every fork that a file, a command or a tool call can answer, then ask the rest as one numbered round with your recommended answer against each. A question in the terminal is free; a push is not. When the user is at the terminal, ask the whole round there. When the user is away, send only the fork that stops the run, and decide the rest on your recommendation.
-- When you are blocked, stuck, or hit an error you cannot resolve on your own, call \`send_notification\` so the user knows, and call \`ask_user\` if you need a decision to continue.
-- When meaningful work finishes while the user is away, or they requested an alert, call \`send_notification\` so the user knows it is done. Skip trivial completions and duplicate reports to someone already reading. Always pass \`context\` with a \`type\` of "task_complete", "error" or "info": it is what tells Pushary this is a task update, so the user's own setting for where updates land can route it.
-- Confirm notifications can offer lock-screen actions; arbitrary choices and text open the app. The Mac notch handles personal account questions, not Partner customer enrollment.
-- Use \`cancel_question\` to retract a pending question once it is no longer needed.
-- When the user asks to be reminded later, call \`schedule_reminder\` with \`body\` and either \`inMinutes\` or \`at\` with an explicit UTC offset. Confirm the returned time, never guess their timezone, and do not use \`ask_user\` as a reminder. Pushary saves it and delivers after this agent exits. Call with no arguments to list pending reminders or \`cancelReminderId\` to cancel one before dispatch starts.
-- Respect the user's Pushary delivery mode: it decides where an approval is surfaced (phone, terminal, or awareness only), not whether it is required. In Terminal mode do not expect a phone answer; the approval waits in the terminal. If the Pushary hook already gated an action, a single approval is enough, do not ask again.
-
-Pass \`agentName\` as "${label} - <project folder name>" so the user knows which session is asking. If a question times out, follow \`handoffAction\` when present, otherwise \`nextAction\`: keep waiting with the same correlationId while pending. A poll ending is not question expiry. Cancel only for an explicit handoff or when the answer is no longer needed. If cancellation returns \`handoffAction: "stop"\`, stop. Otherwise, if cancellation returns false, poll once for 1 second and honor the answer that won the race.`;
-var SHARED_AGENTS_MD_LABEL = "<your agent's name, such as Codex or Hermes>";
-var CODEX_INSTRUCTIONS_LABEL = "Codex";
-var GEMINI_INSTRUCTIONS_LABEL = "Gemini";
-var OPENCODE_INSTRUCTIONS_LABEL = "OpenCode";
-var renderAgentInstructions = (label) => instructionBody(label);
-var KEYLESS_FALLBACK_LINE = "This repo uses Pushary phone approvals. Your teammates get agent questions on their lock screens; you do not have a key yet, so questions will fall back to the terminal. Get your own key (3-day trial): https://pushary.com/sign-up?utm_source=agents-md&utm_medium=teammate";
-var renderProjectAgentInstructions = (label) => `${instructionBody(label)}
-
-If this environment has no Pushary API key (no PUSHARY_API_KEY and no key in ~/.pushary/config.json), the tools above are unavailable in this session. In that case, treat the following as a statement of fact about this session and continue in the terminal: ${KEYLESS_FALLBACK_LINE}`;
-var wrap = (body) => `${PUSHARY_BEGIN}
-${body}
-${PUSHARY_END}`;
-var withInstructionBlockAppended = (existing, body) => {
-  const prefix = existing.trim() ? existing.replace(/\s*$/, "") + "\n\n" : "";
-  return prefix + wrap(body) + "\n";
-};
-var managedBlockRange = (text) => {
-  const start = text.indexOf(PUSHARY_BEGIN);
-  const end = text.indexOf(PUSHARY_END);
-  return start !== -1 && end > start ? { start, end: end + PUSHARY_END.length } : null;
-};
-var withInstructionBlockReplaced = (existing, body) => {
-  const range = managedBlockRange(existing);
-  return range ? existing.slice(0, range.start) + wrap(body) + existing.slice(range.end) : null;
-};
-var writeInstructionBlock = (filePath, body) => {
-  const dir = dirname(filePath);
-  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-  let existing = "";
-  try {
-    existing = readFileSync(filePath, "utf-8");
-  } catch {
-  }
-  writeFileSync(filePath, withInstructionBlockReplaced(existing, body) ?? withInstructionBlockAppended(existing, body), "utf-8");
-};
-var occurrencesOf = (marker, text) => text.split(marker).length - 1;
-var soleManagedBlock = (text) => {
-  const begins = occurrencesOf(PUSHARY_BEGIN, text);
-  const ends = occurrencesOf(PUSHARY_END, text);
-  if (begins === 0 && ends === 0) return { kind: "none" };
-  const range = managedBlockRange(text);
-  return begins === 1 && ends === 1 && range ? { kind: "one", range } : { kind: "ambiguous" };
-};
-var CRLF = "\r\n";
-var withLineEndingsOf = (sample, block) => sample.includes(CRLF) ? block.replaceAll("\n", CRLF) : block;
-var readUtf8 = (filePath) => {
-  try {
-    const bytes = readFileSync(filePath);
-    const text = bytes.toString("utf-8");
-    return Buffer.from(text, "utf-8").equals(bytes) ? { kind: "text", text } : { kind: "not_utf8" };
-  } catch {
-    return { kind: "unreadable" };
-  }
-};
-var isWritable = (filePath) => {
-  try {
-    accessSync(filePath, constants.W_OK);
-    return true;
-  } catch {
-    return false;
-  }
-};
-var refreshInstructionBlock = (filePath, body) => {
-  if (!existsSync(filePath)) return "absent";
-  const read = readUtf8(filePath);
-  if (read.kind !== "text") return read.kind;
-  const block = soleManagedBlock(read.text);
-  if (block.kind === "none") return "absent";
-  if (block.kind === "ambiguous") return "ambiguous_markers";
-  const existing = read.text.slice(block.range.start, block.range.end);
-  const fresh = withLineEndingsOf(existing, wrap(body));
-  if (existing === fresh) return "current";
-  if (!isWritable(filePath)) return "read_only";
-  try {
-    const refreshed = read.text.slice(0, block.range.start) + fresh + read.text.slice(block.range.end);
-    writeFileAtomic(filePath, refreshed, statSync(filePath).mode & 511);
-    return "refreshed";
-  } catch {
-    return "write_failed";
-  }
-};
-var removeInstructionBlock = (filePath) => {
-  let existing = "";
-  try {
-    existing = readFileSync(filePath, "utf-8");
-  } catch {
-    return false;
-  }
-  const start = existing.indexOf(PUSHARY_BEGIN);
-  const end = existing.indexOf(PUSHARY_END);
-  if (start === -1 || end === -1 || end < start) return false;
-  const remaining = (existing.slice(0, start) + existing.slice(end + PUSHARY_END.length)).trim();
-  if (remaining === "") {
-    rmSync(filePath, { force: true });
-  } else {
-    writeFileSync(filePath, remaining + "\n", "utf-8");
-  }
-  return true;
-};
-var hasInstructionBlock = (filePath) => {
-  try {
-    return readFileSync(filePath, "utf-8").includes(PUSHARY_BEGIN);
-  } catch {
-    return false;
-  }
-};
+} from "./chunk-SCMEVDAR.js";
 
 // src/fx-config.ts
 var FX_SERVER_NAME = "pushary";
@@ -485,13 +378,13 @@ var workspaceShowsQuestionTool = (workspace) => {
 var workspacesShowingQuestionTool = (settings) => Object.entries(asRecord(settings[WORKSPACES_KEY]) ?? {}).filter(([, workspace]) => workspaceShowsQuestionTool(workspace)).map(([path]) => path);
 
 // src/fx-files.ts
-import { existsSync as existsSync2, lstatSync, readFileSync as readFileSync2, realpathSync } from "fs";
+import { existsSync, lstatSync, readFileSync, realpathSync } from "fs";
 import { relative, isAbsolute } from "path";
 var readFxFile = (path, read) => {
-  if (!existsSync2(path)) return { kind: "missing" };
+  if (!existsSync(path)) return { kind: "missing" };
   let text;
   try {
-    text = readFileSync2(path, "utf-8");
+    text = readFileSync(path, "utf-8");
   } catch {
     return { kind: "unreadable" };
   }
@@ -512,7 +405,7 @@ var fxIgnoresInstructionsFile = (path, fxDir) => {
 };
 
 // src/fx-lifecycle.ts
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync2 } from "fs";
 import { join } from "path";
 var fxRetryHint = () => `Fix it, then run ${retryAgentCommand("fx")}.`;
 var readFxProfileForSetup = (filePath) => {
@@ -549,7 +442,7 @@ var fxSettingsReadRefusal = (filePath, read) => {
 };
 var recordFxQuestionRule = (receiptPath) => {
   try {
-    if (!existsSync3(receiptPath)) writeJsonAtomic(receiptPath, FX_QUESTION_RULE_RECEIPT, 384);
+    if (!existsSync2(receiptPath)) writeJsonAtomic(receiptPath, FX_QUESTION_RULE_RECEIPT, 384);
     return true;
   } catch {
     return false;
@@ -630,21 +523,182 @@ var planFxRemoval = (profilePath, settingsPath, receiptPath) => {
       actions.push({ kind: "kept", label: "fx question rule", detail: FX_QUESTION_RULE_KEPT[question.outcome] });
     }
   }
-  if (existsSync3(receiptPath)) actions.push({ kind: "remove-receipt", path: receiptPath });
+  if (existsSync2(receiptPath)) actions.push({ kind: "remove-receipt", path: receiptPath });
   return actions;
 };
 
+// src/cline-lifecycle.ts
+import { randomUUID } from "crypto";
+import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync2, renameSync, rmdirSync, rmSync, statSync, writeFileSync } from "fs";
+import { dirname, join as join2 } from "path";
+var CLINE_SETTINGS_LOCK_STALE_MS = 1e4;
+var CLINE_SETTINGS_LOCK_WAIT_MS = 1e4;
+var CLINE_SETTINGS_LOCK_POLL_MS = 25;
+var CLINE_SETTINGS_BUSY = "stayed locked by Cline";
+var ClineSettingsBusyError = class extends AgentConfigWriteError {
+  constructor(settingsPath) {
+    super(`${settingsPath} ${CLINE_SETTINGS_BUSY}, so it was left untouched. Close Cline, then run ${retryAgentCommand("cline")}.`);
+    this.name = "ClineSettingsBusyError";
+  }
+};
+var readClineSettingsFile = (settingsPath) => {
+  if (!existsSync3(settingsPath)) return { kind: "missing" };
+  try {
+    return readClineSettings(readFileSync2(settingsPath, "utf-8"));
+  } catch {
+    return { kind: "unreadable" };
+  }
+};
+var pause = (milliseconds) => {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds);
+};
+var lockDirectoryOf = (settingsPath) => `${settingsPath}.lock`;
+var ownerFileOf = (directory, token) => join2(directory, `owner.${token}`);
+var tryTakeLock = (lockDirectory, token) => {
+  const staging = `${lockDirectory}.tmp.${token}`;
+  mkdirSync(staging, { recursive: true });
+  writeFileSync(ownerFileOf(staging, token), token, { encoding: "utf-8", flag: "wx" });
+  try {
+    renameSync(staging, lockDirectory);
+    return true;
+  } catch (error) {
+    rmSync(staging, { recursive: true, force: true });
+    if (existsSync3(lockDirectory)) return false;
+    throw error;
+  }
+};
+var lockIsStale = (lockDirectory, now) => {
+  try {
+    return now - statSync(lockDirectory).mtimeMs > CLINE_SETTINGS_LOCK_STALE_MS;
+  } catch {
+    return false;
+  }
+};
+var reclaimStaleLock = (lockDirectory, token) => {
+  const setAside = `${lockDirectory}.stale.${token}`;
+  try {
+    renameSync(lockDirectory, setAside);
+  } catch {
+    return false;
+  }
+  rmSync(setAside, { recursive: true, force: true });
+  return true;
+};
+var releaseLock = (lockDirectory, token) => {
+  try {
+    rmSync(ownerFileOf(lockDirectory, token), { force: true });
+    rmdirSync(lockDirectory);
+  } catch {
+    return;
+  }
+};
+var withClineSettingsLock = (settingsPath, run) => {
+  const lockDirectory = lockDirectoryOf(settingsPath);
+  const token = `${process.pid}.${Date.now()}.${randomUUID()}`;
+  mkdirSync(dirname(lockDirectory), { recursive: true });
+  const deadline = Date.now() + CLINE_SETTINGS_LOCK_WAIT_MS;
+  while (!tryTakeLock(lockDirectory, token)) {
+    if (lockIsStale(lockDirectory, Date.now()) && reclaimStaleLock(lockDirectory, token)) continue;
+    if (Date.now() >= deadline) throw new ClineSettingsBusyError(settingsPath);
+    pause(CLINE_SETTINGS_LOCK_POLL_MS);
+  }
+  try {
+    return run();
+  } finally {
+    releaseLock(lockDirectory, token);
+  }
+};
+var writeClineSettingsText = (settingsPath, text) => {
+  writeSetupConfigFile(settingsPath, text, KEY_FILE_MODE);
+};
+var writeClineSettings = (settingsPath, settings) => {
+  writeClineSettingsText(settingsPath, clineSettingsText(settings));
+};
+var retryHint = () => `Fix it, then run ${retryAgentCommand("cline")}.`;
+var settingsForSetup = (settingsPath, read) => {
+  if (read.kind === "settings") return read.settings;
+  if (read.kind === "missing") return {};
+  if (read.kind === "unreadable") {
+    throw new AgentConfigError(configFailureKind("unreadable"), settingsPath, `${settingsPath} could not be read, so it was left untouched. ${retryHint()}`);
+  }
+  throw new AgentConfigError(
+    configFailureKind("unparseable"),
+    settingsPath,
+    `${settingsPath} ${CLINE_SETTINGS_REFUSALS[read.reason]}, so it was left untouched. ${retryHint()}`
+  );
+};
+var ClineServerNameTakenError = class extends AgentConfigError {
+  constructor(settingsPath) {
+    super(
+      "config-conflict",
+      settingsPath,
+      `${settingsPath} ${CLINE_SERVER_NAME_TAKEN}, so it was left untouched. Rename that server in Cline, then run ${retryAgentCommand("cline")}.`
+    );
+    this.name = "ClineServerNameTakenError";
+  }
+};
+var unclaimedSettings = (settingsPath, settings) => {
+  if (clineServerNameTakenElsewhere(settings)) throw new ClineServerNameTakenError(settingsPath);
+  return settings;
+};
+var configureClineServer = (settingsPath, apiKey) => withClineSettingsLock(settingsPath, () => {
+  const current = unclaimedSettings(settingsPath, settingsForSetup(settingsPath, readClineSettingsFile(settingsPath)));
+  const settings = withClinePusharyServer(current, apiKey);
+  writeClineSettings(settingsPath, settings);
+  return { otherServers: otherPusharyServerNames(settings) };
+});
+var carriesPusharyKey = (entry) => clineEntryAuthorization(entry) !== void 0;
+var refreshClineKey = (settingsPath, apiKey) => !existsSync3(settingsPath) ? "not-configured" : withClineSettingsLock(settingsPath, () => {
+  const read = readClineSettingsFile(settingsPath);
+  if (read.kind !== "settings") return "not-configured";
+  const entry = clinePusharyEntryOf(read.settings);
+  if (!isClinePusharyEntry(entry)) return "not-configured";
+  if (!apiKey || clineEntryRunsCommand(entry) || !clineEntryHoldsLiteralKey(entry) || clineEntryUsesKey(entry, apiKey)) return "unchanged";
+  writeClineSettings(settingsPath, withRefreshedClineKey(read.settings, apiKey));
+  return "refreshed";
+});
+var inspectClineInstallation = (settingsPath, apiKey) => {
+  const read = readClineSettingsFile(settingsPath);
+  const settings = read.kind === "settings" ? read.settings : {};
+  const entry = clinePusharyEntryOf(settings);
+  return {
+    read,
+    configured: isClinePusharyEntry(entry),
+    hasKey: carriesPusharyKey(entry),
+    holdsPusharyKey: clineEntryHoldsLiteralKey(entry),
+    runsCommand: clineEntryRunsCommand(entry),
+    signedIn: clineEntrySignedIn(entry),
+    switchedOff: clineEntrySwitchedOff(entry),
+    usesCurrentKey: apiKey !== void 0 && clineEntryUsesKey(entry, apiKey),
+    nameTakenElsewhere: clineServerNameTakenElsewhere(settings),
+    otherServers: otherPusharyServerNames(settings)
+  };
+};
+var planClineRemoval = (settingsPath) => {
+  const read = readClineSettingsFile(settingsPath);
+  if (read.kind === "missing") return { kind: "absent" };
+  if (read.kind === "unreadable") return { kind: "kept", detail: `${settingsPath} could not be read; left untouched` };
+  if (read.kind === "refused" && !read.mentionsPushary) return { kind: "absent" };
+  if (read.kind === "refused") return { kind: "kept", detail: `${settingsPath} ${CLINE_SETTINGS_REFUSALS[read.reason]}; left untouched` };
+  const result = withoutClinePusharyServer(read.settings);
+  return result.removed ? { kind: "write", path: settingsPath, text: clineSettingsText(result.settings) } : { kind: "absent" };
+};
+var failedRemovalDetail = (settingsPath, error) => error instanceof ClineSettingsBusyError ? `${settingsPath} ${CLINE_SETTINGS_BUSY}; close Cline and try again` : `${settingsPath} could not be updated: ${error instanceof Error ? error.message : String(error)}`;
+var removeFromLockedSettings = (settingsPath) => withClineSettingsLock(settingsPath, () => {
+  const plan = planClineRemoval(settingsPath);
+  if (plan.kind === "write") writeClineSettingsText(plan.path, plan.text);
+  return plan;
+});
+var removeClineServer = (settingsPath) => {
+  if (!existsSync3(settingsPath)) return { kind: "absent" };
+  try {
+    return removeFromLockedSettings(settingsPath);
+  } catch (error) {
+    return { kind: "failed", detail: failedRemovalDetail(settingsPath, error) };
+  }
+};
+
 export {
-  SHARED_AGENTS_MD_LABEL,
-  CODEX_INSTRUCTIONS_LABEL,
-  GEMINI_INSTRUCTIONS_LABEL,
-  OPENCODE_INSTRUCTIONS_LABEL,
-  renderAgentInstructions,
-  renderProjectAgentInstructions,
-  writeInstructionBlock,
-  refreshInstructionBlock,
-  removeInstructionBlock,
-  hasInstructionBlock,
   FX_PUSHARY_TOOLS_RULE,
   fxInstructionsBody,
   FX_PROFILE_REFUSALS,
@@ -658,5 +712,10 @@ export {
   fxServerHolder,
   configureFxSettings,
   inspectFxInstallation,
-  planFxRemoval
+  planFxRemoval,
+  configureClineServer,
+  refreshClineKey,
+  inspectClineInstallation,
+  planClineRemoval,
+  removeClineServer
 };

package/dist/{chunk-BCVCUDFI.js → chunk-QSW3HAKI.js}

@@ -1,7 +1,7 @@
 import {
   compressTranscriptRecord,
   redactSecretsFromContent
-} from "./chunk-7NCLUA65.js";
+} from "./chunk-MNKIR2ZB.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";

package/dist/{chunk-HOIO66DU.js → chunk-R4FL5JHK.js}

@@ -1,9 +1,9 @@
 import {
   realpath
-} from "./chunk-OY6Z4IKB.js";
+} from "./chunk-HIYLAC3C.js";
 import {
   findNativeClaudeInstall
-} from "./chunk-VUFHYMSP.js";
+} from "./chunk-RABLE5R6.js";
 import {
   readGlobalPrefixAsync,
   resolveGlobalBinary,
@@ -13,10 +13,10 @@ import {
   resolvePackageVersionFromBinary,
   resolvePathBinary,
   resolvePathBinaryAsync
-} from "./chunk-5LOP4AVD.js";
+} from "./chunk-SCMEVDAR.js";
 import {
   MANAGED_PROVIDERS
-} from "./chunk-7NCLUA65.js";
+} from "./chunk-MNKIR2ZB.js";
 
 // src/live-capabilities.ts
 import { homedir } from "os";

package/dist/{chunk-VUFHYMSP.js → chunk-RABLE5R6.js}

@@ -1,6 +1,6 @@
 import {
   isFile
-} from "./chunk-QENTGE75.js";
+} from "./chunk-SCMEVDAR.js";
 
 // src/claude-native-install.ts
 import { accessSync, constants } from "fs";