@pushary/agent-hooks 1.3.1 → 1.4.1

package/dist/bin/pushary-clean.js

@@ -2,17 +2,19 @@
 import {
   HERMES_CONFIG_SCRIPT,
   HERMES_PIP_PACKAGE,
+  PUSHARY_SKILL_NAME,
+  PUSHARY_SKILL_SOURCE,
   createGuards,
   resolveHermesPython,
   runHermesPythonScript
-} from "../chunk-AFOTOA24.js";
+} from "../chunk-37VLIYLI.js";
 import "../chunk-P32LPT2L.js";
 import {
   removeInstructionBlock,
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-PEV6ULSM.js";
+} from "../chunk-3UA6FPRC.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -22,7 +24,7 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-XVE52YFZ.js";
+} from "../chunk-VYUDGQM7.js";
 import {
   compatibleConfigFile,
   compatibleInstructionsFile,
@@ -30,37 +32,40 @@ import {
   compatiblePermissionRuleFile,
   removeCompatibleHooks,
   removeCompatibleMcpServer
-} from "../chunk-LWT34GSY.js";
+} from "../chunk-HQLAZWJJ.js";
 import {
   isClaudeMcpSnapshot,
   removeClaudeMcpServers,
   removePusharySettings,
   removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-SGZE2JBF.js";
+} from "../chunk-WIOXWUUH.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-REIZ5GXG.js";
-import "../chunk-FGNABUPN.js";
-import "../chunk-KLZJEMSE.js";
+} from "../chunk-KEMEBTCJ.js";
+import "../chunk-R3AMKNIW.js";
+import {
+  liveBridgeProbe,
+  resolveBridgeStub
+} from "../chunk-LYXX5NSB.js";
 import {
   pusharyHookExecutable
-} from "../chunk-QOCWB4Q6.js";
+} from "../chunk-TF4IOINR.js";
 import {
   disableDaemonService
-} from "../chunk-6HH4IH4K.js";
+} from "../chunk-3BPB2HYZ.js";
 import {
   removeGeminiSettings
-} from "../chunk-KHGIM2BN.js";
-import "../chunk-EAGMQMRM.js";
+} from "../chunk-ED5TA2FJ.js";
+import "../chunk-JOVWYVSR.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-WOBHHXW5.js";
-import "../chunk-XP2KRTZD.js";
+import "../chunk-LNGYW6G4.js";
+import "../chunk-WEO5JCB4.js";
 import "../chunk-LGXUGYUH.js";
-import "../chunk-465UENKO.js";
+import "../chunk-3T52B2OF.js";
 import {
   bridgeAgentKey,
   claudeJson,
@@ -89,41 +94,319 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-34NNTYK6.js";
+} from "../chunk-SAF6NNXY.js";
 import {
   exitOnHelpFlag
-} from "../chunk-GOQHN2UH.js";
-import "../chunk-LZQVAEWP.js";
+} from "../chunk-TWWLVOPB.js";
+import "../chunk-FAH3D74E.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
 import {
+  CANDIDATE_RCS,
+  isDisabledExport,
   removeClaudeAlias
-} from "../chunk-5SALHATY.js";
+} from "../chunk-TI3ZWXZG.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-5WLH2ENB.js";
+import "../chunk-K6I5M2ME.js";
 import "../chunk-T7E75EKA.js";
 import "../chunk-2UMNXADU.js";
 import {
   CURSOR_GATE_EVENTS,
   HOOK_COMPATIBLE_PROFILES,
   HOOK_LOCATOR_BINARY,
-  isValidApiKey
-} from "../chunk-5UWDYOZX.js";
+  SUPPORT_DISCORD,
+  SUPPORT_EMAIL,
+  isValidApiKey,
+  redactSecrets
+} from "../chunk-FVKFDTN6.js";
 
 // bin/pushary-clean.ts
-import { existsSync, readFileSync, copyFileSync, readdirSync } from "fs";
-import { join } from "path";
-import { homedir, tmpdir } from "os";
+import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync3 } from "fs";
+import { dirname, join as join5 } from "path";
+import { homedir as homedir5, tmpdir } from "os";
 import { confirm } from "@inquirer/prompts";
 import { parse as parseTOML, stringify as stringifyTOML } from "smol-toml";
 
+// src/cli/mac-leftovers.ts
+import { execSync, execFileSync } from "child_process";
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var MAC_APP_BUNDLE = "/Applications/Pushary.app";
+var installedPusharyBundles = (home = homedir()) => [MAC_APP_BUNDLE, join(home, "Applications", "Pushary.app")];
+var LSREGISTER = "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";
+var TEST_DEFAULTS_PREFIXES = [
+  "com.pushary.mac.tests.",
+  "com.pushary.tests.",
+  "pushary.tests.",
+  "pushary.quiet-mode-test.",
+  "pushary-optin-"
+];
+var isTestDefaultsDomain = (domain) => TEST_DEFAULTS_PREFIXES.some((prefix) => domain.startsWith(prefix));
+var leakedTestDefaultsDomains = () => {
+  try {
+    return execSync("defaults domains", { encoding: "utf-8", timeout: 2e4 }).split(",").map((entry) => entry.trim()).filter(isTestDefaultsDomain);
+  } catch {
+    return [];
+  }
+};
+var BUNDLE_NAME = "Pushary.app";
+var DUMP_PATH_LINE = /^\s*path:\s+(.+?)(?: \(0x[0-9a-f]+\))?\s*$/;
+var bundlesInLaunchServicesDump = (dump) => {
+  const found = /* @__PURE__ */ new Set();
+  for (const line of dump.split("\n")) {
+    const path = DUMP_PATH_LINE.exec(line)?.[1];
+    const bundle = path?.indexOf(`/${BUNDLE_NAME}`);
+    if (path === void 0 || bundle === void 0 || bundle === -1) continue;
+    found.add(path.slice(0, bundle + BUNDLE_NAME.length + 1));
+  }
+  return [...found];
+};
+var registeredPusharyBundles = (installed = installedPusharyBundles()) => {
+  if (!existsSync(LSREGISTER)) return [];
+  try {
+    const dump = execSync(`${LSREGISTER} -dump`, {
+      encoding: "utf-8",
+      timeout: 6e4,
+      maxBuffer: 256 * 1024 * 1024
+    });
+    return bundlesInLaunchServicesDump(dump).filter((path) => !installed.includes(path));
+  } catch {
+    return [];
+  }
+};
+var MAC_KEYCHAIN_SERVICE = "com.pushary.app.mac";
+var MAC_KEYCHAIN_ACCOUNTS = [
+  "pushary.site-api-key",
+  "pushary.site-id",
+  "clerk.device-token",
+  "clerk.session-id"
+];
+var MAC_DEFAULTS_DOMAINS = ["com.pushary.app", "pushary-bridge", "pushary.render"];
+var macLibraryState = (home = homedir()) => [
+  join(home, "Library", "Application Support", "Pushary"),
+  join(home, "Library", "Caches", "com.pushary.app"),
+  join(home, "Library", "Caches", "com.pushary.app.sparkle"),
+  join(home, "Library", "Saved Application State", "com.pushary.app.savedState"),
+  join(home, "Library", "Caches", "pushary-bridge"),
+  join(home, "Library", "HTTPStorages", "com.pushary.app"),
+  join(home, "Library", "HTTPStorages", "com.pushary.app.binarycookies"),
+  join(home, "Library", "HTTPStorages", "pushary-bridge")
+];
+var DUMP_SERVICE_LINE = /^\s*"svce"<blob>="(.+)"\s*$/;
+var pusharyKeychainServices = (dump) => {
+  const found = /* @__PURE__ */ new Set();
+  for (const line of dump.split("\n")) {
+    const service = DUMP_SERVICE_LINE.exec(line)?.[1];
+    if (service?.startsWith(MAC_KEYCHAIN_SERVICE)) found.add(service);
+  }
+  return [...found];
+};
+var storedPusharyKeychainServices = () => {
+  const dump = execFileSync("security", ["dump-keychain"], {
+    encoding: "utf-8",
+    timeout: 3e4,
+    maxBuffer: 64 * 1024 * 1024,
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+  const stored = pusharyKeychainServices(dump);
+  return stored.includes(MAC_KEYCHAIN_SERVICE) ? stored : [MAC_KEYCHAIN_SERVICE, ...stored];
+};
+var MAC_APP_BUNDLE_ID = "com.pushary.app";
+var runningMacAppPIDs = () => {
+  if (process.platform !== "darwin") return [];
+  try {
+    return execSync('pgrep -f "Pushary.app/Contents/MacOS/Pushary"', {
+      encoding: "utf-8",
+      timeout: 1e4,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).split("\n").map((line) => Number(line.trim())).filter((pid) => Number.isInteger(pid) && pid > 0);
+  } catch {
+    return [];
+  }
+};
+var waitForMacAppExit = (attempts = 20, everyMs = 250) => {
+  const idle = new Int32Array(new SharedArrayBuffer(4));
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    if (runningMacAppPIDs().length === 0) return true;
+    Atomics.wait(idle, 0, 0, everyMs);
+  }
+  return runningMacAppPIDs().length === 0;
+};
+
+// src/cli/clean-mac.ts
+import { existsSync as existsSync2 } from "fs";
+var removeDeveloperLeftovers = (guards2, domains, bundles) => {
+  let removed = 0;
+  for (const domain of domains) {
+    try {
+      guards2.execFile("defaults", ["delete", domain], { stdio: "ignore", timeout: 1e4 }, `delete preferences ${domain}`);
+      removed++;
+    } catch {
+      continue;
+    }
+  }
+  for (const bundle of bundles) {
+    try {
+      guards2.execFile(LSREGISTER, ["-u", bundle], { stdio: "ignore", timeout: 2e4 }, `unregister ${bundle}`);
+      removed++;
+    } catch {
+      continue;
+    }
+  }
+  return removed;
+};
+var removeMacAppState = (guards2, readServices, home) => {
+  let removed = 0;
+  let failed = 0;
+  let services;
+  try {
+    services = readServices();
+  } catch {
+    return { removed, failed: 1 };
+  }
+  for (const service of services) {
+    for (const account of MAC_KEYCHAIN_ACCOUNTS) {
+      try {
+        guards2.execFile(
+          "security",
+          ["delete-generic-password", "-s", service, "-a", account],
+          { stdio: "ignore" },
+          `remove keychain item ${service} (${account})`
+        );
+        removed++;
+      } catch (error) {
+        if (!(error instanceof Error && "status" in error && error.status === 44)) failed++;
+      }
+    }
+  }
+  for (const domain of MAC_DEFAULTS_DOMAINS) {
+    try {
+      guards2.execFile("defaults", ["delete", domain], { stdio: "ignore", timeout: 1e4 }, `delete preferences ${domain}`);
+      removed++;
+    } catch {
+      continue;
+    }
+  }
+  for (const path of macLibraryState(home)) {
+    if (!existsSync2(path)) continue;
+    guards2.remove(path, { force: true });
+    removed++;
+  }
+  return { removed, failed };
+};
+var quitMacApp = (guards2, state) => {
+  if (state.platform !== "darwin" || state.running().length === 0) return "not-running";
+  try {
+    guards2.execFile(
+      "osascript",
+      ["-e", `tell application id "${MAC_APP_BUNDLE_ID}" to quit`],
+      { stdio: "ignore", timeout: 3e4 },
+      "quit Pushary"
+    );
+  } catch {
+  }
+  return state.dryRun || state.waitForExit() ? "quit" : "running";
+};
+
+// src/cli/editor-extension.ts
+import { existsSync as existsSync3, readFileSync, readdirSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+var EDITOR_EXTENSION_ID = "pushary.pushary";
+var EDITOR_EXTENSION_DIRS = [
+  join2(".cursor", "extensions"),
+  join2(".vscode", "extensions")
+];
+var EXTENSIONS_JSON = "extensions.json";
+var isOurEntry = (entry) => {
+  if (typeof entry !== "object" || entry === null) return false;
+  const identifier = entry.identifier;
+  if (typeof identifier !== "object" || identifier === null) return false;
+  const id = identifier.id;
+  return typeof id === "string" && id.toLowerCase() === EDITOR_EXTENSION_ID;
+};
+var recordWithoutUs = (directory) => {
+  const path = join2(directory, EXTENSIONS_JSON);
+  try {
+    const entries = JSON.parse(readFileSync(path, "utf-8"));
+    if (!Array.isArray(entries)) return void 0;
+    const kept = entries.filter((entry) => !isOurEntry(entry));
+    return kept.length === entries.length ? void 0 : { path, contents: JSON.stringify(kept) };
+  } catch {
+    return void 0;
+  }
+};
+var editorExtensionRemovals = (home = homedir2()) => EDITOR_EXTENSION_DIRS.map((relative) => join2(home, relative)).filter(existsSync3).map((directory) => {
+  const folders = readdirSync(directory).filter((name) => name.startsWith(`${EDITOR_EXTENSION_ID}-`)).map((name) => join2(directory, name));
+  return { directory, folders, record: recordWithoutUs(directory) };
+}).filter((removal) => removal.folders.length > 0 || removal.record !== void 0);
+
+// src/cli/skills-store.ts
+import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
+var SKILLS_STORE_DIR = ".agents";
+var LOCK_FILE = ".skill-lock.json";
+var lockWithoutUs = (path) => {
+  try {
+    const lock = JSON.parse(readFileSync2(path, "utf-8"));
+    if (!lock || typeof lock !== "object" || Array.isArray(lock) || !("skills" in lock)) return void 0;
+    const entries = lock.skills;
+    if (!entries || typeof entries !== "object" || Array.isArray(entries) || !(PUSHARY_SKILL_NAME in entries)) return void 0;
+    const entry = entries[PUSHARY_SKILL_NAME];
+    if (!entry || typeof entry !== "object" || !("source" in entry) || entry.source !== PUSHARY_SKILL_SOURCE) return void 0;
+    const { [PUSHARY_SKILL_NAME]: _ours, ...skills } = entries;
+    return { path, contents: `${JSON.stringify({ ...lock, skills }, null, 2)}
+` };
+  } catch {
+    return void 0;
+  }
+};
+var skillsStoreRemoval = (home = homedir3()) => {
+  const store = join3(home, SKILLS_STORE_DIR);
+  const skillDir = join3(store, "skills", PUSHARY_SKILL_NAME);
+  const lock = lockWithoutUs(join3(store, LOCK_FILE));
+  return {
+    skillDir: lock && existsSync4(skillDir) ? skillDir : void 0,
+    lock
+  };
+};
+
+// src/cli/claude-backups.ts
+import { existsSync as existsSync5, readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join4 } from "path";
+var BACKUP_PREFIX = ".claude.json.backup";
+var claudeJsonBackups = (home = homedir4()) => {
+  const rollingDir = join4(home, ".claude", "backups");
+  const legacy = join4(home, BACKUP_PREFIX);
+  const rolling = existsSync5(rollingDir) ? readdirSync2(rollingDir).filter((name) => name.startsWith(BACKUP_PREFIX)).sort().map((name) => join4(rollingDir, name)) : [];
+  return existsSync5(legacy) ? [...rolling, legacy] : rolling;
+};
+var parsed = (path) => {
+  try {
+    const value = JSON.parse(readFileSync3(path, "utf-8"));
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+};
+var claudeBackupRewrites = (receipt, home = homedir4()) => claudeJsonBackups(home).flatMap((path) => {
+  const backup = parsed(path);
+  if (!backup) return [];
+  const changed = receipt ? restoreClaudeMcpServer(backup, receipt) : removeClaudeMcpServers(backup);
+  return changed ? [{ path, contents: `${JSON.stringify(backup, null, 2)}
+` }] : [];
+});
+
 // src/app-owned-paths.ts
 var APP_OWNED_ENTRIES = [
   // PusharyPaths.bin: bridgeStub, bridgeCache
@@ -176,10 +459,15 @@ var CURSOR_PLUGIN_DIR = cursorPluginDir();
 var CURSOR_USER_HOOKS = cursorUserHooks();
 var VSCODE_PLUGIN_DIR = vscodePluginDir();
 var PUSHARY_DIR = pusharyDir();
-var SHELL_FILES = [".zshrc", ".zprofile", ".bashrc", ".bash_profile"].map((f) => join(homedir(), f));
-var macAppInstalled = () => existsSync(join(PUSHARY_DIR, "bin", HOOK_LOCATOR_BINARY));
-var removalScope = (keepMcpServer) => ({
-  keepAppWiring: true,
+var SHELL_FILES = [".zshrc", ".zprofile", ".bashrc", ".bash_profile"].map((f) => join5(homedir5(), f));
+var PRESENCE_BY_RESOLUTION = {
+  bundle: "present",
+  missing: "gone",
+  "no-stub": "absent"
+};
+var macAppPresence = () => PRESENCE_BY_RESOLUTION[resolveBridgeStub(join5(PUSHARY_DIR, "bin", HOOK_LOCATOR_BINARY), liveBridgeProbe()).kind];
+var removalScope = (keepMcpServer, keepAppWiring) => ({
+  keepAppWiring,
   keepMcpServer
 });
 var codexMcpKey = (config) => {
@@ -188,7 +476,7 @@ var codexMcpKey = (config) => {
 };
 var readJson = (path) => {
   try {
-    return JSON.parse(readFileSync(path, "utf-8"));
+    return JSON.parse(readFileSync4(path, "utf-8"));
   } catch {
     return null;
   }
@@ -201,7 +489,16 @@ var wouldNote = (action, path) => {
 var guards = createGuards(() => dryRun, wouldNote);
 var guardedWrite = (path, contents) => guards.write(path, contents);
 var guardedRemove = (path, options) => guards.remove(path, options);
-var guardedExec = (command, options, describe) => guards.exec(command, options ?? {}, describe);
+var CURSOR_PLUGIN_STAGING = ".pushary-staging-";
+var cursorPluginLeftovers = () => {
+  const parent = dirname(CURSOR_PLUGIN_DIR);
+  const backupPrefix = `${CURSOR_PLUGIN_DIR.split("/").pop()}.pushary-backup-`;
+  try {
+    return readdirSync3(parent).filter((name) => name.startsWith(backupPrefix) || name.startsWith(CURSOR_PLUGIN_STAGING)).map((name) => join5(parent, name));
+  } catch {
+    return [];
+  }
+};
 var guardedDaemonRemoval = async () => {
   if (dryRun) {
     wouldNote("stop and uninstall", "Pushary background service");
@@ -211,14 +508,14 @@ var guardedDaemonRemoval = async () => {
 };
 var guardedInstructionBlockRemoval = (path) => {
   if (!dryRun) return removeInstructionBlock(path);
-  if (!existsSync(path)) return false;
-  const hasBlock = readFileSync(path, "utf-8").includes("pushary");
+  if (!existsSync6(path)) return false;
+  const hasBlock = readFileSync4(path, "utf-8").includes("pushary");
   if (hasBlock) wouldNote("rewrite", path);
   return hasBlock;
 };
 var guardedAliasRemoval = () => {
   if (!dryRun) return removeClaudeAlias();
-  const shells = [".zshrc", ".bashrc", ".bash_profile", ".profile"].map((name) => join(homedir(), name)).filter((path) => existsSync(path) && readFileSync(path, "utf-8").includes("pushary claude"));
+  const shells = CANDIDATE_RCS.map((name) => join5(homedir5(), name)).filter((path) => existsSync6(path) && readFileSync4(path, "utf-8").includes("pushary claude"));
   for (const path of shells) wouldNote("rewrite", path);
   return shells;
 };
@@ -226,15 +523,15 @@ var writeJson = (path, data) => {
   guardedWrite(path, JSON.stringify(data, null, 2) + "\n");
 };
 var removeCursorUserHook = (scope) => {
-  if (!existsSync(CURSOR_USER_HOOKS)) return "absent";
-  let parsed;
+  if (!existsSync6(CURSOR_USER_HOOKS)) return "absent";
+  let parsed2;
   try {
-    parsed = JSON.parse(readFileSync(CURSOR_USER_HOOKS, "utf-8"));
+    parsed2 = JSON.parse(readFileSync4(CURSOR_USER_HOOKS, "utf-8"));
   } catch {
     return "failed";
   }
-  if (!parsed || typeof parsed !== "object") return "failed";
-  const hooks = parsed.hooks ?? {};
+  if (!parsed2 || typeof parsed2 !== "object") return "failed";
+  const hooks = parsed2.hooks ?? {};
   let removedAny = false;
   for (const event of CURSOR_GATE_EVENTS) {
     const existing = Array.isArray(hooks[event]) ? hooks[event] : [];
@@ -248,15 +545,15 @@ var removeCursorUserHook = (scope) => {
     else hooks[event] = others;
   }
   if (!removedAny) return "absent";
-  parsed.hooks = hooks;
+  parsed2.hooks = hooks;
   try {
-    writeJson(CURSOR_USER_HOOKS, parsed);
+    writeJson(CURSOR_USER_HOOKS, parsed2);
   } catch {
     return "failed";
   }
   if (dryRun) return "removed";
   try {
-    const after = JSON.parse(readFileSync(CURSOR_USER_HOOKS, "utf-8"));
+    const after = JSON.parse(readFileSync4(CURSOR_USER_HOOKS, "utf-8"));
     const afterHooks = after?.hooks ?? {};
     const stillThere = CURSOR_GATE_EVENTS.some((event) => {
       const entries = afterHooks[event];
@@ -296,15 +593,15 @@ var restoreTakeoverReceipts = () => {
     ["codex", codexHooksJson(), codexConfigToml(), "mcp_servers", "toml"],
     ["gemini_cli", geminiSettings(), geminiSettings(), "mcpServers", "json"],
     ["cursor", CURSOR_USER_HOOKS, null, null, null],
-    ["vscode", join(VSCODE_PLUGIN_DIR, "hooks", "hooks.json"), vscodePluginMcp(), "mcpServers", "json"]
+    ["vscode", join5(VSCODE_PLUGIN_DIR, "hooks", "hooks.json"), vscodePluginMcp(), "mcpServers", "json"]
   ];
   for (const [agent, hookFile, mcpFile, mcpKey, mcpFormat] of targets) {
     const receiptPath = hookTakeoverReceipt(agent);
-    if (!existsSync(receiptPath)) continue;
+    if (!existsSync6(receiptPath)) continue;
     try {
       const receipt = readJson(receiptPath);
       if (!isHookTakeoverReceipt(receipt) || receipt.agent !== agent) throw new Error("invalid receipt");
-      const document = existsSync(hookFile) ? JSON.parse(readFileSync(hookFile, "utf-8")) : {};
+      const document = existsSync6(hookFile) ? JSON.parse(readFileSync4(hookFile, "utf-8")) : {};
       if (!document || typeof document !== "object" || Array.isArray(document)) throw new Error("invalid hooks file");
       const appAlreadyOwns = hookOwnerOf(document) === "app";
       const cliPositions = agent === "codex" ? codexHookPositions(document) : {};
@@ -315,7 +612,7 @@ var restoreTakeoverReceipts = () => {
         if (mcpFile === hookFile) {
           mcpDocument = document;
         } else {
-          const raw = existsSync(mcpFile) ? readFileSync(mcpFile, "utf-8") : "";
+          const raw = existsSync6(mcpFile) ? readFileSync4(mcpFile, "utf-8") : "";
           mcpDocument = raw.trim() ? mcpFormat === "toml" ? parseTOML(raw) : JSON.parse(raw) : {};
         }
         mcpChanged = restoreMcpServer(mcpDocument, mcpKey, receipt.mcpServer);
@@ -325,7 +622,7 @@ var restoreTakeoverReceipts = () => {
       if (!appAlreadyOwns && agent === "codex") {
         if (!mcpDocument) {
           const configPath = codexConfigToml();
-          const raw = existsSync(configPath) ? readFileSync(configPath, "utf-8") : "";
+          const raw = existsSync6(configPath) ? readFileSync4(configPath, "utf-8") : "";
           mcpDocument = raw.trim() ? parseTOML(raw) : {};
         }
         codexConfig = mcpDocument;
@@ -358,7 +655,7 @@ var main = async () => {
   try {
     rejectUnknownFlags(
       process.argv.slice(2).filter((a) => a !== "clean"),
-      ["--dry-run", "--yes", "-y", "--help", "-h"]
+      ["--dry-run", "--everything", "--yes", "-y", "--help", "-h"]
     );
   } catch (err) {
     process.stderr.write(`  ! ${err instanceof Error ? err.message : String(err)}
@@ -366,6 +663,7 @@ var main = async () => {
     process.exit(EXIT.USAGE);
   }
   dryRun = process.argv.includes("--dry-run");
+  const everything = process.argv.includes("--everything");
   if (dryRun) {
     console.log(`  ${bold("Dry run")} ${dim("- nothing will be changed")}`);
     console.log();
@@ -381,14 +679,31 @@ var main = async () => {
     process.exit(0);
   }
   console.log();
-  const keepShared = macAppInstalled();
-  const scope = removalScope(keepShared);
+  const presence = macAppPresence();
+  const keepShared = presence === "present" && !everything;
+  const scope = removalScope(keepShared, keepShared);
   if (keepShared) {
     console.log(`  ${dim("The Mac app is installed, so its wiring and the state it owns are left alone.")}`);
-    console.log();
+    console.log(`  ${dim("To remove that too, re-run with")} --everything`);
+  } else if (presence === "gone") {
+    console.log(`  ${dim("The Mac app is gone, so the wiring it left behind is removed too.")}`);
+  } else if (everything && presence === "present") {
+    console.log(`  ${dim("Removing the Mac app's wiring and state as well.")}`);
   }
+  if (everything) {
+    const quit = quitMacApp(guards, { platform: process.platform, dryRun, running: runningMacAppPIDs, waitForExit: waitForMacAppExit });
+    if (quit === "quit") {
+      console.log(`  ${check} Pushary ${dim(did("quit"))} ${dim("(running, and its watcher puts back what this removes)")}`);
+    } else if (quit === "running") {
+      incompleteClean = true;
+      console.log(`  ${cross} Pushary ${dim("would not quit, and it puts back what this removes")}`);
+      console.log(`    ${dim("Quit it from the notch menu, then re-run.")}`);
+      process.exit(EXIT.FAILED);
+    }
+  }
+  if (presence !== "absent") console.log();
   const restoredByTakeover = new Set(
-    ["claude_code", "codex", "gemini_cli"].filter((agent) => existsSync(hookTakeoverReceipt(agent)))
+    ["claude_code", "codex", "gemini_cli"].filter((agent) => existsSync6(hookTakeoverReceipt(agent)))
   );
   if (keepShared) restoreTakeoverReceipts();
   const sharedMcpKeys = {
@@ -414,12 +729,13 @@ var main = async () => {
   const keepClaudeMcp = macAppKeeps("claude_code", mcpServerBearer(claudeJson2?.mcpServers));
   const claudeHasPusharyEntry = () => Boolean(claudeJson2?.mcpServers?.pushary);
   const claudeHadPusharyEntry = claudeHasPusharyEntry();
+  const rawReceipt = readJson(CLAUDE_MCP_RECEIPT);
+  const receipt = isClaudeMcpSnapshot(rawReceipt) ? rawReceipt : null;
+  const receiptUnreadable = existsSync6(CLAUDE_MCP_RECEIPT) && !receipt;
   if (keepClaudeMcp) {
     console.log(`  ${skip} Claude Code MCP servers ${dim("(kept: the Mac app uses it)")}`);
   } else if (claudeJson2) {
-    const rawReceipt = readJson(CLAUDE_MCP_RECEIPT);
-    const receipt = isClaudeMcpSnapshot(rawReceipt) ? rawReceipt : null;
-    if (existsSync(CLAUDE_MCP_RECEIPT) && !receipt) {
+    if (receiptUnreadable) {
       if (!keepShared) incompleteClean = true;
       console.log(`  ${skip} Claude Code MCP servers ${dim("(setup receipt is unreadable; left unchanged)")}`);
     } else if (receipt && restoreClaudeMcpServer(claudeJson2, receipt) || !receipt && removeClaudeMcpServers(claudeJson2)) {
@@ -430,13 +746,20 @@ var main = async () => {
       if (receipt && !keepShared) incompleteClean = true;
       console.log(`  ${skip} Claude Code MCP servers ${dim(receipt ? "(changed after setup; left unchanged)" : "(no pushary entries)")}`);
     }
-  } else if (existsSync(CLAUDE_MCP_RECEIPT)) {
+  } else if (existsSync6(CLAUDE_MCP_RECEIPT)) {
     incompleteClean = true;
     console.log(`  ${skip} Claude Code MCP servers ${dim("(config missing; setup receipt kept for retry)")}`);
   } else {
     console.log(`  ${skip} Claude Code MCP servers ${dim("(not found)")}`);
   }
-  const claudeScope = removalScope(keepShared && !(claudeHadPusharyEntry && !claudeHasPusharyEntry()));
+  if (!keepClaudeMcp && !receiptUnreadable) {
+    const rewrites = claudeBackupRewrites(receipt);
+    for (const rewrite of rewrites) guardedWrite(rewrite.path, rewrite.contents);
+    if (rewrites.length > 0) {
+      console.log(`  ${check} Claude Code backups ${dim(did("cleaned"))} ${dim(`(the Pushary entry and its key, in ${rewrites.length})`)}`);
+    }
+  }
+  const claudeScope = removalScope(keepShared && !(claudeHadPusharyEntry && !claudeHasPusharyEntry()), keepShared);
   cleanSettingsFile(CLAUDE_SETTINGS, "Claude Code settings", claudeScope);
   cleanSettingsFile(CLAUDE_SETTINGS_LOCAL, "Claude Code settings.local", claudeScope);
   const cursorData = keepShared ? null : readJson(CURSOR_MCP);
@@ -467,22 +790,29 @@ var main = async () => {
   }
   if (cursorGate === "failed") {
     console.log(`  ${skip} Cursor plugin ${dim("(kept: removing it now would block matched commands)")}`);
-  } else if (existsSync(CURSOR_PLUGIN_DIR)) {
+  } else if (existsSync6(CURSOR_PLUGIN_DIR)) {
     guardedRemove(CURSOR_PLUGIN_DIR);
     console.log(`  ${check} Cursor plugin ${dim("(removed from ~/.cursor/plugins/local)")}`);
   } else {
     console.log(`  ${skip} Cursor plugin ${dim("(not installed)")}`);
   }
+  if (cursorGate !== "failed") {
+    const stale = cursorPluginLeftovers();
+    for (const path of stale) guardedRemove(path);
+    if (stale.length > 0) {
+      console.log(`  ${check} Cursor plugin copies ${dim(did("removed"))} ${dim(`(${stale.length}, each holding the key of an earlier install)`)}`);
+    }
+  }
   if (keepShared) {
     console.log(`  ${skip} VS Code plugin ${dim("(kept: the Mac app writes the same plugin directory)")}`);
   }
-  for (const settingsPath of keepShared ? [] : vscodeSettingsTargets(existsSync)) {
+  for (const settingsPath of keepShared ? [] : vscodeSettingsTargets(existsSync6)) {
     const label = `VS Code plugin ${dim(`(${shortenHome(settingsPath)})`)}`;
-    if (!existsSync(settingsPath)) {
+    if (!existsSync6(settingsPath)) {
       console.log(`  ${skip} ${label} ${dim("(no settings.json)")}`);
       continue;
     }
-    const result = unregisterPluginLocation(readFileSync(settingsPath, "utf-8"), VSCODE_PLUGIN_DIR);
+    const result = unregisterPluginLocation(readFileSync4(settingsPath, "utf-8"), VSCODE_PLUGIN_DIR);
     if (result.kind === "removed") {
       guardedWrite(settingsPath, result.content);
       console.log(`  ${check} ${label} ${dim(did("unregistered"))}`);
@@ -492,13 +822,26 @@ var main = async () => {
       console.log(`  ${skip} ${label} ${dim("(no pushary entry)")}`);
     }
   }
-  if (!keepShared && existsSync(VSCODE_PLUGIN_DIR)) {
+  if (!keepShared && existsSync6(VSCODE_PLUGIN_DIR)) {
     guardedRemove(VSCODE_PLUGIN_DIR);
     console.log(`  ${check} VS Code plugin files ${dim(did("removed"))}`);
   }
+  if (keepShared) {
+    console.log(`  ${skip} Editor extension ${dim("(kept: installed and updated by the Mac app)")}`);
+  } else {
+    const removals = editorExtensionRemovals();
+    for (const removal of removals) {
+      if (removal.record) guardedWrite(removal.record.path, removal.record.contents);
+      for (const folder of removal.folders) guardedRemove(folder);
+      console.log(`  ${check} Editor extension ${dim(`(${did("removed")} from ${shortenHome(removal.directory)})`)}`);
+    }
+    if (removals.length === 0) {
+      console.log(`  ${skip} Editor extension ${dim("(not installed in Cursor or VS Code)")}`);
+    }
+  }
   if (keepShared) {
     console.log(`  ${skip} Skill directory ${dim("(kept: the Mac app uses it)")}`);
-  } else if (existsSync(SKILL_DIR)) {
+  } else if (existsSync6(SKILL_DIR)) {
     guardedRemove(SKILL_DIR);
     console.log(`  ${check} Skill directory ${dim(did("removed"))}`);
   } else {
@@ -509,26 +852,26 @@ var main = async () => {
   const codexHooksData = readJson(codexHooksJson2);
   const codexPositions = codexHookPositions(codexHooksData ?? void 0);
   try {
-    const config = readFileSync(codexConfig, "utf-8");
-    const parsed = parseTOML(config);
-    const trustRemoved = hookOwnerOf(codexHooksData) === "app" ? false : removeCodexHookTrust(parsed, codexHooksJson2, codexPositions);
+    const config = readFileSync4(codexConfig, "utf-8");
+    const parsed2 = parseTOML(config);
+    const trustRemoved = hookOwnerOf(codexHooksData) === "app" && keepShared ? false : removeCodexHookTrust(parsed2, codexHooksJson2, codexPositions);
     const hadPushary = config.includes("pushary");
     if (hadPushary || trustRemoved) {
-      const macAppKeepsCodexMcp = macAppKeeps("codex", codexMcpKey(parsed));
+      const macAppKeepsCodexMcp = macAppKeeps("codex", codexMcpKey(parsed2));
       if (!macAppKeepsCodexMcp) {
-        const mcpServers = parsed.mcp_servers ?? {};
+        const mcpServers = parsed2.mcp_servers ?? {};
         delete mcpServers.pushary;
-        if (Object.keys(mcpServers).length === 0) delete parsed.mcp_servers;
-        else parsed.mcp_servers = mcpServers;
+        if (Object.keys(mcpServers).length === 0) delete parsed2.mcp_servers;
+        else parsed2.mcp_servers = mcpServers;
       }
-      if (Array.isArray(parsed.notify)) {
-        parsed.notify = parsed.notify.filter((n) => typeof n !== "string" || !n.includes("pushary-codex"));
-        if (parsed.notify.length === 0) delete parsed.notify;
+      if (Array.isArray(parsed2.notify)) {
+        parsed2.notify = parsed2.notify.filter((n) => typeof n !== "string" || !n.includes("pushary-codex"));
+        if (parsed2.notify.length === 0) delete parsed2.notify;
       }
-      guardedWrite(codexConfig, stringifyTOML(parsed));
+      guardedWrite(codexConfig, stringifyTOML(parsed2));
       const what = trustRemoved ? "cleaned, hook trust removed" : "cleaned";
       console.log(`  ${check} Codex config ${dim(did(what))}`);
-      if (macAppKeepsCodexMcp && parsed.mcp_servers?.pushary) {
+      if (macAppKeepsCodexMcp && parsed2.mcp_servers?.pushary) {
         console.log(`  ${skip} Codex MCP server ${dim("(kept: the Mac app uses it)")}`);
       }
     } else {
@@ -558,7 +901,7 @@ var main = async () => {
   const codexSkillDir2 = codexSkillDir();
   if (keepShared) {
     console.log(`  ${skip} Codex skill directory ${dim("(kept: the Mac app uses it)")}`);
-  } else if (existsSync(codexSkillDir2)) {
+  } else if (existsSync6(codexSkillDir2)) {
     guardedRemove(codexSkillDir2);
     console.log(`  ${check} Codex skill directory ${dim(did("removed"))}`);
   } else {
@@ -596,7 +939,7 @@ var main = async () => {
   const geminiSettingsPath = geminiSettings();
   const geminiSettings2 = readJson(geminiSettingsPath);
   if (geminiSettings2) {
-    if (removeGeminiSettings(geminiSettings2, removalScope(macAppKeeps("gemini_cli", mcpServerBearer(geminiSettings2.mcpServers))))) {
+    if (removeGeminiSettings(geminiSettings2, removalScope(macAppKeeps("gemini_cli", mcpServerBearer(geminiSettings2.mcpServers)), keepShared))) {
       writeJson(geminiSettingsPath, geminiSettings2);
       console.log(`  ${check} Gemini CLI settings ${dim(did("cleaned"))}`);
     } else {
@@ -614,25 +957,25 @@ var main = async () => {
     console.log(`  ${skip} Gemini GEMINI.md ${dim("(no pushary block)")}`);
   }
   const openCodePlugin = openCodePluginFile();
-  const openCodePluginContents = existsSync(openCodePlugin) ? readFileSync(openCodePlugin, "utf-8") : null;
+  const openCodePluginContents = existsSync6(openCodePlugin) ? readFileSync4(openCodePlugin, "utf-8") : null;
   if (openCodePluginContents === null) {
     console.log(`  ${skip} OpenCode plugin ${dim("(not installed)")}`);
   } else if (!isOpenCodePluginOurs(openCodePluginContents)) {
     console.log(`  ${skip} OpenCode plugin ${dim("(a pushary.js we did not write)")}`);
-  } else if (openCodePluginContents.includes(HOOK_LOCATOR_BINARY)) {
+  } else if (openCodePluginContents.includes(HOOK_LOCATOR_BINARY) && keepShared) {
     console.log(`  ${skip} OpenCode plugin ${dim("(kept: written by the Mac app)")}`);
   } else {
     guardedRemove(openCodePlugin, { force: true });
     console.log(`  ${check} OpenCode plugin ${dim(did("removed"))}`);
-    const sibling = join(openCodePluginDir(), OPENCODE_PLUGIN_SIBLING);
+    const sibling = join5(openCodePluginDir(), OPENCODE_PLUGIN_SIBLING);
     const remaining = (() => {
       try {
-        return readdirSync(openCodePluginDir()).filter((name) => name !== OPENCODE_PLUGIN_SIBLING);
+        return readdirSync3(openCodePluginDir()).filter((name) => name !== OPENCODE_PLUGIN_SIBLING);
       } catch {
         return [];
       }
     })();
-    const siblingIsOurs = existsSync(sibling) && readFileSync(sibling, "utf-8") === OPENCODE_PLUGIN_SIBLING_CONTENTS;
+    const siblingIsOurs = existsSync6(sibling) && readFileSync4(sibling, "utf-8") === OPENCODE_PLUGIN_SIBLING_CONTENTS;
     if (siblingIsOurs && !hasForeignPlugins(remaining)) {
       guardedRemove(sibling, { force: true });
       console.log(`  ${check} OpenCode plugin sibling ${dim(did("removed"))}`);
@@ -660,14 +1003,14 @@ var main = async () => {
     } else {
       console.log(`  ${check} Hermes config ${dim("(setup-owned changes restored)")}`);
       try {
-        guardedExec(`"${hermesPython}" -m pip uninstall -y ${HERMES_PIP_PACKAGE}`, { stdio: "pipe", timeout: 6e4 }, `pip uninstall ${HERMES_PIP_PACKAGE}`);
+        guards.execFile(hermesPython, ["-m", "pip", "uninstall", "-y", HERMES_PIP_PACKAGE], { stdio: "pipe", timeout: 6e4 }, `pip uninstall ${HERMES_PIP_PACKAGE}`);
         console.log(`  ${check} Hermes plugin ${dim("(pip uninstalled)")}`);
       } catch {
         incompleteClean = true;
         console.log(`  ${skip} Hermes plugin ${dim("(could not uninstall; setup receipt kept for retry)")}`);
       }
     }
-  } else if (existsSync(HERMES_CONFIG_RECEIPT)) {
+  } else if (existsSync6(HERMES_CONFIG_RECEIPT)) {
     incompleteClean = true;
     console.log(`  ${skip} Hermes ${dim("(runtime not found; setup receipt kept for retry)")}`);
   } else {
@@ -675,20 +1018,31 @@ var main = async () => {
   }
   for (const shellFile of SHELL_FILES) {
     try {
-      const content = readFileSync(shellFile, "utf-8");
+      const content = readFileSync4(shellFile, "utf-8");
       if (content.includes("PUSHARY_API_KEY")) {
-        const isOurExport = (line) => /^\s*export\s+PUSHARY_API_KEY=['"]?pk_[A-Za-z0-9]+\.[A-Za-z0-9]+['"]?\s*$/.test(line);
+        const isOurExport = (line) => /^\s*export\s+PUSHARY_API_KEY=['"]?pk_[A-Za-z0-9]+\.[A-Za-z0-9]+['"]?\s*$/.test(line) || isDisabledExport(line);
         const lines = content.split("\n");
         const declined = lines.filter((l) => l.includes("PUSHARY_API_KEY") && !isOurExport(l));
         const cleaned = lines.filter((l) => !isOurExport(l)).join("\n");
+        const name = shellFile.split("/").pop();
         if (cleaned !== content) {
           const backup = `${shellFile}.pushary-backup-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
           if (!dryRun) copyFileSync(shellFile, backup);
           guardedWrite(shellFile, cleaned);
-          console.log(`  ${check} ${shellFile.split("/").pop()} ${dim(`(removed the export, backup at ${backup})`)}`);
+          const confirmed = !dryRun && readFileSync4(shellFile, "utf-8") === cleaned;
+          if (confirmed) guardedRemove(backup, { force: true });
+          const kept = confirmed ? "" : `, backup at ${backup}`;
+          console.log(`  ${check} ${name} ${dim(`(removed the export${kept})`)}`);
         }
         for (const line of declined) {
-          console.log(`  ${skip} ${shellFile.split("/").pop()} ${dim(`left a line referencing PUSHARY_API_KEY: ${line.trim()}`)}`);
+          if ((line.match(/pk_[A-Za-z0-9_]+\.[A-Za-z0-9_]+/g) ?? []).some(isValidApiKey)) {
+            incompleteClean = true;
+            console.log(`  ${cross} ${name} ${dim("still sets PUSHARY_API_KEY, in a form this command will not rewrite:")}`);
+            console.log(`    ${dim(redactSecrets(line.trim()))}`);
+            console.log(`    ${dim("Remove it yourself. A setup run would sign this machine in as that account.")}`);
+          } else {
+            console.log(`  ${skip} ${name} ${dim(`left a line referencing PUSHARY_API_KEY: ${redactSecrets(line.trim())}`)}`);
+          }
         }
       }
     } catch {
@@ -700,15 +1054,15 @@ var main = async () => {
   } else {
     console.log(`  ${skip} claude alias ${dim("(not set)")}`);
   }
-  if (existsSync(PUSHARY_DIR)) {
+  if (existsSync6(PUSHARY_DIR)) {
     let removed = 0;
     const kept = [];
-    for (const entry of readdirSync(PUSHARY_DIR)) {
+    for (const entry of readdirSync3(PUSHARY_DIR)) {
       if (keepShared && isAppOwned(entry) || entry === "setup" && (keepShared || incompleteClean)) {
         kept.push(entry);
         continue;
       }
-      guardedRemove(join(PUSHARY_DIR, entry), { force: true });
+      guardedRemove(join5(PUSHARY_DIR, entry), { force: true });
       removed++;
     }
     if (removed > 0) {
@@ -725,10 +1079,10 @@ var main = async () => {
   }
   try {
     let swept = 0;
-    for (const f of readdirSync(tmpdir())) {
+    for (const f of readdirSync3(tmpdir())) {
       if (!f.startsWith("pushary-")) continue;
       try {
-        guardedRemove(join(tmpdir(), f), { force: true });
+        guardedRemove(join5(tmpdir(), f), { force: true });
         swept++;
       } catch {
       }
@@ -736,6 +1090,28 @@ var main = async () => {
     if (swept > 0) console.log(`  ${check} Temp state ${dim(`(${swept} pushary entries swept)`)}`);
   } catch {
   }
+  if (everything) {
+    const store = skillsStoreRemoval();
+    if (store.skillDir) guardedRemove(store.skillDir);
+    if (store.lock) guardedWrite(store.lock.path, store.lock.contents);
+    if (store.skillDir || store.lock) {
+      console.log(`  ${check} skills.sh registration ${dim(did("removed"))} ${dim("(~/.agents)")}`);
+    }
+    const leftovers = process.platform === "darwin" ? removeDeveloperLeftovers(guards, leakedTestDefaultsDomains(), registeredPusharyBundles()) : 0;
+    if (leftovers > 0) {
+      console.log(`  ${check} Developer leftovers ${dim(did("removed"))} ${dim(`(${leftovers} leaked test preferences and stale app registrations)`)}`);
+    }
+    const { removed, failed } = process.platform === "darwin" ? removeMacAppState(guards, storedPusharyKeychainServices, homedir5()) : { removed: 0, failed: 0 };
+    if (failed > 0) {
+      incompleteClean = true;
+      console.log(`  ${cross} Mac keychain ${dim(`(${failed} operations failed; unlock your keychain and re-run)`)}`);
+    }
+    if (removed > 0) {
+      console.log(`  ${check} Mac app state ${dim(did("removed"))} ${dim(`(${removed} keychain items, preferences and caches)`)}`);
+    } else if (failed === 0) {
+      console.log(`  ${skip} Mac app state ${dim("(nothing of ours in the keychain, preferences or caches)")}`);
+    }
+  }
   try {
     if (dryRun) {
       wouldNote("run    ", "npm uninstall -g @pushary/agent-hooks");
@@ -750,13 +1126,32 @@ var main = async () => {
   if (incompleteClean) {
     console.log(`  ${yellow(bold("Clean finished with something left behind."))}`);
     console.log(`  ${dim("See the \u2717 above. Fix it, then re-run")} npx @pushary/agent-hooks@latest clean`);
+    console.log(`  ${dim("Still stuck? Send this output to")} ${SUPPORT_EMAIL} ${dim("or")} ${SUPPORT_DISCORD}`);
+  } else if (everything) {
+    console.log(`  ${green(bold("Clean complete. Nothing of ours is left in any agent config."))}`);
+    const bundle = installedPusharyBundles().find(existsSync6);
+    if (bundle) {
+      console.log(`  ${dim("The app itself is still installed. Drag")} ${bundle} ${dim("to the Trash to finish.")}`);
+    }
+    console.log(`  ${dim("Signing in as someone else? Sign out at pushary.com in your browser first.")}`);
+    console.log(`  ${dim("The app and")} pushary login ${dim("both sign in through it, and would pick the old account back up.")}`);
   } else {
     console.log(`  ${green(bold("Clean complete."))}`);
+    if (keepShared) {
+      console.log(`  ${dim("The Mac app's wiring and its stored key are still here. Re-run with")} --everything ${dim("to remove them.")}`);
+    }
   }
   console.log(`  ${dim("Run")} npx @pushary/agent-hooks@latest setup ${dim("to reinstall.")}`);
-  if (aliasRemovedFrom.length > 0) {
+  const exportedKey = process.env.PUSHARY_API_KEY?.trim();
+  if (aliasRemovedFrom.length > 0 || exportedKey) {
     console.log();
-    console.log(`  ${yellow("!")} ${bold("One thing left in your current terminal.")}`);
+    console.log(`  ${yellow("!")} ${bold("In your current terminal")}`);
+  }
+  if (exportedKey) {
+    console.log(`  ${dim("PUSHARY_API_KEY is still exported here. Run")} ${bold("unset PUSHARY_API_KEY")}`);
+    console.log(`  ${dim("(or open a new terminal) before setup, or it signs back in as the old account.")}`);
+  }
+  if (aliasRemovedFrom.length > 0) {
     console.log(`  ${dim("It still has the")} ${bold("claude")} ${dim("alias loaded from before. Run")} ${bold("unalias claude")}`);
     console.log(`  ${dim("(or open a new terminal) so")} ${bold("claude")} ${dim("runs Claude Code again.")}`);
   }