@pushary/agent-hooks 1.4.0 → 1.4.2

package/dist/bin/pushary-clean.js

@@ -7,14 +7,14 @@ import {
   createGuards,
   resolveHermesPython,
   runHermesPythonScript
-} from "../chunk-NBCTKC4Z.js";
+} from "../chunk-Y3MM6PYN.js";
 import "../chunk-P32LPT2L.js";
 import {
   removeInstructionBlock,
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-O5L2OJBB.js";
+} from "../chunk-MUVTZNJW.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -24,7 +24,7 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-Q4UAMWXK.js";
+} from "../chunk-F4UWL4NY.js";
 import {
   compatibleConfigFile,
   compatibleInstructionsFile,
@@ -32,40 +32,40 @@ import {
   compatiblePermissionRuleFile,
   removeCompatibleHooks,
   removeCompatibleMcpServer
-} from "../chunk-HGN6VZTY.js";
+} from "../chunk-VIOL2DJS.js";
 import {
   isClaudeMcpSnapshot,
   removeClaudeMcpServers,
   removePusharySettings,
   removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-5IBVIMWT.js";
+} from "../chunk-II7PUMPB.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-UTYTPDWN.js";
-import "../chunk-5MSBI6NP.js";
+} from "../chunk-4ZDKSDVW.js";
+import "../chunk-DY4ILT6L.js";
 import {
   liveBridgeProbe,
   resolveBridgeStub
-} from "../chunk-YYRZPEMA.js";
+} from "../chunk-ZVY25BMK.js";
 import {
   pusharyHookExecutable
-} from "../chunk-O6RN46OS.js";
+} from "../chunk-WPVHRUDT.js";
 import {
   disableDaemonService
-} from "../chunk-RGZY77CD.js";
+} from "../chunk-BZ4GDOJX.js";
 import {
   removeGeminiSettings
-} from "../chunk-A7XIL2WD.js";
-import "../chunk-7PQZYCEP.js";
+} from "../chunk-LPYCPFBZ.js";
+import "../chunk-MW6ZPC6R.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-IF46POXX.js";
-import "../chunk-KZIXHLPQ.js";
+import "../chunk-G653QPTR.js";
+import "../chunk-YXP3WPAI.js";
 import "../chunk-LGXUGYUH.js";
-import "../chunk-RQM5SMMR.js";
+import "../chunk-NHTAHAIS.js";
 import {
   bridgeAgentKey,
   claudeJson,
@@ -94,7 +94,7 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-UCGQEAKZ.js";
+} from "../chunk-TRLFZKVG.js";
 import {
   exitOnHelpFlag
 } from "../chunk-TWWLVOPB.js";
@@ -107,14 +107,14 @@ import {
   CANDIDATE_RCS,
   isDisabledExport,
   removeClaudeAlias
-} from "../chunk-NYHNLMQO.js";
+} from "../chunk-FU2DFEAZ.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-P4JVVJ2D.js";
+import "../chunk-UM5J3J4V.js";
 import "../chunk-T7E75EKA.js";
 import "../chunk-2UMNXADU.js";
 import {
@@ -123,18 +123,19 @@ import {
   HOOK_LOCATOR_BINARY,
   SUPPORT_DISCORD,
   SUPPORT_EMAIL,
-  isValidApiKey
-} from "../chunk-7IEB2GV4.js";
+  isValidApiKey,
+  redactSecrets
+} from "../chunk-SOUZBGYJ.js";
 
 // bin/pushary-clean.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync3 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync3 } from "fs";
 import { dirname, join as join5 } from "path";
 import { homedir as homedir5, tmpdir } from "os";
 import { confirm } from "@inquirer/prompts";
 import { parse as parseTOML, stringify as stringifyTOML } from "smol-toml";
 
 // src/cli/mac-leftovers.ts
-import { execSync } from "child_process";
+import { execSync, execFileSync } from "child_process";
 import { existsSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
@@ -186,7 +187,11 @@ var MAC_KEYCHAIN_ACCOUNTS = [
   "pushary.site-api-key",
   "pushary.site-id",
   "clerk.device-token",
-  "clerk.session-id"
+  "clerk.session-id",
+  "clerkDeviceToken",
+  "cachedClient",
+  "cachedClientServerDate",
+  "cachedEnvironment"
 ];
 var MAC_DEFAULTS_DOMAINS = ["com.pushary.app", "pushary-bridge", "pushary.render"];
 var macLibraryState = (home = homedir()) => [
@@ -209,21 +214,16 @@ var pusharyKeychainServices = (dump) => {
   return [...found];
 };
 var storedPusharyKeychainServices = () => {
-  try {
-    const dump = execSync("security dump-keychain", {
-      encoding: "utf-8",
-      timeout: 3e4,
-      maxBuffer: 64 * 1024 * 1024,
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-    const stored = pusharyKeychainServices(dump);
-    return stored.includes(MAC_KEYCHAIN_SERVICE) ? stored : [MAC_KEYCHAIN_SERVICE, ...stored];
-  } catch {
-    return [MAC_KEYCHAIN_SERVICE];
-  }
+  const dump = execFileSync("security", ["dump-keychain"], {
+    encoding: "utf-8",
+    timeout: 3e4,
+    maxBuffer: 64 * 1024 * 1024,
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+  const stored = pusharyKeychainServices(dump);
+  return stored.includes(MAC_KEYCHAIN_SERVICE) ? stored : [MAC_KEYCHAIN_SERVICE, ...stored];
 };
 var MAC_APP_BUNDLE_ID = "com.pushary.app";
-var QUIT_MAC_APP = `osascript -e 'tell application id "${MAC_APP_BUNDLE_ID}" to quit'`;
 var runningMacAppPIDs = () => {
   if (process.platform !== "darwin") return [];
   try {
@@ -245,8 +245,83 @@ var waitForMacAppExit = (attempts = 20, everyMs = 250) => {
   return runningMacAppPIDs().length === 0;
 };
 
+// src/cli/clean-mac.ts
+import { existsSync as existsSync2 } from "fs";
+var removeDeveloperLeftovers = (guards2, domains, bundles) => {
+  let removed = 0;
+  for (const domain of domains) {
+    try {
+      guards2.execFile("defaults", ["delete", domain], { stdio: "ignore", timeout: 1e4 }, `delete preferences ${domain}`);
+      removed++;
+    } catch {
+      continue;
+    }
+  }
+  for (const bundle of bundles) {
+    try {
+      guards2.execFile(LSREGISTER, ["-u", bundle], { stdio: "ignore", timeout: 2e4 }, `unregister ${bundle}`);
+      removed++;
+    } catch {
+      continue;
+    }
+  }
+  return removed;
+};
+var removeMacAppState = (guards2, readServices, home) => {
+  let removed = 0;
+  let failed = 0;
+  let services;
+  try {
+    services = readServices();
+  } catch {
+    return { removed, failed: 1 };
+  }
+  for (const service of services) {
+    for (const account of MAC_KEYCHAIN_ACCOUNTS) {
+      try {
+        guards2.execFile(
+          "security",
+          ["delete-generic-password", "-s", service, "-a", account],
+          { stdio: "ignore" },
+          `remove keychain item ${service} (${account})`
+        );
+        removed++;
+      } catch (error) {
+        if (!(error instanceof Error && "status" in error && error.status === 44)) failed++;
+      }
+    }
+  }
+  for (const domain of MAC_DEFAULTS_DOMAINS) {
+    try {
+      guards2.execFile("defaults", ["delete", domain], { stdio: "ignore", timeout: 1e4 }, `delete preferences ${domain}`);
+      removed++;
+    } catch {
+      continue;
+    }
+  }
+  for (const path of macLibraryState(home)) {
+    if (!existsSync2(path)) continue;
+    guards2.remove(path, { force: true });
+    removed++;
+  }
+  return { removed, failed };
+};
+var quitMacApp = (guards2, state) => {
+  if (state.platform !== "darwin" || state.running().length === 0) return "not-running";
+  try {
+    guards2.execFile(
+      "osascript",
+      ["-e", `tell application id "${MAC_APP_BUNDLE_ID}" to quit`],
+      { stdio: "ignore", timeout: 3e4 },
+      "quit Pushary"
+    );
+  } catch {
+  }
+  return state.dryRun || state.waitForExit() ? "quit" : "running";
+};
+
 // src/cli/editor-extension.ts
-import { existsSync as existsSync2, readFileSync, readdirSync } from "fs";
+import { existsSync as existsSync3, readFileSync, readdirSync } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
 var EDITOR_EXTENSION_ID = "pushary.pushary";
@@ -273,13 +348,13 @@ var recordWithoutUs = (directory) => {
     return void 0;
   }
 };
-var editorExtensionRemovals = (home = homedir2()) => EDITOR_EXTENSION_DIRS.map((relative) => join2(home, relative)).filter(existsSync2).map((directory) => {
+var editorExtensionRemovals = (home = homedir2()) => EDITOR_EXTENSION_DIRS.map((relative) => join2(home, relative)).filter(existsSync3).map((directory) => {
   const folders = readdirSync(directory).filter((name) => name.startsWith(`${EDITOR_EXTENSION_ID}-`)).map((name) => join2(directory, name));
   return { directory, folders, record: recordWithoutUs(directory) };
 }).filter((removal) => removal.folders.length > 0 || removal.record !== void 0);
 
 // src/cli/skills-store.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join3 } from "path";
 var SKILLS_STORE_DIR = ".agents";
@@ -287,9 +362,12 @@ var LOCK_FILE = ".skill-lock.json";
 var lockWithoutUs = (path) => {
   try {
     const lock = JSON.parse(readFileSync2(path, "utf-8"));
-    const entry = lock.skills?.[PUSHARY_SKILL_NAME];
-    if (entry?.source !== PUSHARY_SKILL_SOURCE) return void 0;
-    const { [PUSHARY_SKILL_NAME]: _ours, ...skills } = lock.skills ?? {};
+    if (!lock || typeof lock !== "object" || Array.isArray(lock) || !("skills" in lock)) return void 0;
+    const entries = lock.skills;
+    if (!entries || typeof entries !== "object" || Array.isArray(entries) || !(PUSHARY_SKILL_NAME in entries)) return void 0;
+    const entry = entries[PUSHARY_SKILL_NAME];
+    if (!entry || typeof entry !== "object" || !("source" in entry) || entry.source !== PUSHARY_SKILL_SOURCE) return void 0;
+    const { [PUSHARY_SKILL_NAME]: _ours, ...skills } = entries;
     return { path, contents: `${JSON.stringify({ ...lock, skills }, null, 2)}
 ` };
   } catch {
@@ -299,22 +377,23 @@ var lockWithoutUs = (path) => {
 var skillsStoreRemoval = (home = homedir3()) => {
   const store = join3(home, SKILLS_STORE_DIR);
   const skillDir = join3(store, "skills", PUSHARY_SKILL_NAME);
+  const lock = lockWithoutUs(join3(store, LOCK_FILE));
   return {
-    skillDir: existsSync3(skillDir) ? skillDir : void 0,
-    lock: lockWithoutUs(join3(store, LOCK_FILE))
+    skillDir: lock && existsSync4(skillDir) ? skillDir : void 0,
+    lock
   };
 };
 
 // src/cli/claude-backups.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
 import { homedir as homedir4 } from "os";
 import { join as join4 } from "path";
 var BACKUP_PREFIX = ".claude.json.backup";
 var claudeJsonBackups = (home = homedir4()) => {
   const rollingDir = join4(home, ".claude", "backups");
   const legacy = join4(home, BACKUP_PREFIX);
-  const rolling = existsSync4(rollingDir) ? readdirSync2(rollingDir).filter((name) => name.startsWith(BACKUP_PREFIX)).sort().map((name) => join4(rollingDir, name)) : [];
-  return existsSync4(legacy) ? [...rolling, legacy] : rolling;
+  const rolling = existsSync5(rollingDir) ? readdirSync2(rollingDir).filter((name) => name.startsWith(BACKUP_PREFIX)).sort().map((name) => join4(rollingDir, name)) : [];
+  return existsSync5(legacy) ? [...rolling, legacy] : rolling;
 };
 var parsed = (path) => {
   try {
@@ -414,69 +493,6 @@ var wouldNote = (action, path) => {
 var guards = createGuards(() => dryRun, wouldNote);
 var guardedWrite = (path, contents) => guards.write(path, contents);
 var guardedRemove = (path, options) => guards.remove(path, options);
-var guardedExec = (command, options, describe) => guards.exec(command, options ?? {}, describe);
-var removeDeveloperLeftovers = () => {
-  if (process.platform !== "darwin") return 0;
-  let removed = 0;
-  for (const domain of leakedTestDefaultsDomains()) {
-    const command = `defaults delete ${JSON.stringify(domain)}`;
-    try {
-      guardedExec(command, { stdio: "ignore", timeout: 1e4 }, command);
-      removed++;
-    } catch {
-      continue;
-    }
-  }
-  for (const bundle of registeredPusharyBundles()) {
-    const command = `${LSREGISTER} -u ${JSON.stringify(bundle)}`;
-    try {
-      guardedExec(command, { stdio: "ignore", timeout: 2e4 }, command);
-      removed++;
-    } catch {
-      continue;
-    }
-  }
-  return removed;
-};
-var removeMacAppState = () => {
-  if (process.platform !== "darwin") return 0;
-  let removed = 0;
-  for (const service of storedPusharyKeychainServices()) {
-    for (const account of MAC_KEYCHAIN_ACCOUNTS) {
-      const command = `security delete-generic-password -s ${JSON.stringify(service)} -a ${account}`;
-      try {
-        guardedExec(command, { stdio: "ignore", timeout: 1e4 }, command);
-        removed++;
-      } catch {
-        continue;
-      }
-    }
-  }
-  for (const domain of MAC_DEFAULTS_DOMAINS) {
-    const command = `defaults delete ${JSON.stringify(domain)}`;
-    try {
-      guardedExec(command, { stdio: "ignore", timeout: 1e4 }, command);
-      removed++;
-    } catch {
-      continue;
-    }
-  }
-  for (const path of macLibraryState(homedir5())) {
-    if (!existsSync5(path)) continue;
-    guardedRemove(path, { force: true });
-    removed++;
-  }
-  return removed;
-};
-var quitMacApp = () => {
-  if (process.platform !== "darwin") return "not-running";
-  if (runningMacAppPIDs().length === 0) return "not-running";
-  try {
-    guardedExec(QUIT_MAC_APP, { stdio: "ignore", timeout: 3e4 }, QUIT_MAC_APP);
-  } catch {
-  }
-  return dryRun || waitForMacAppExit() ? "quit" : "running";
-};
 var CURSOR_PLUGIN_STAGING = ".pushary-staging-";
 var cursorPluginLeftovers = () => {
   const parent = dirname(CURSOR_PLUGIN_DIR);
@@ -496,14 +512,14 @@ var guardedDaemonRemoval = async () => {
 };
 var guardedInstructionBlockRemoval = (path) => {
   if (!dryRun) return removeInstructionBlock(path);
-  if (!existsSync5(path)) return false;
+  if (!existsSync6(path)) return false;
   const hasBlock = readFileSync4(path, "utf-8").includes("pushary");
   if (hasBlock) wouldNote("rewrite", path);
   return hasBlock;
 };
 var guardedAliasRemoval = () => {
   if (!dryRun) return removeClaudeAlias();
-  const shells = CANDIDATE_RCS.map((name) => join5(homedir5(), name)).filter((path) => existsSync5(path) && readFileSync4(path, "utf-8").includes("pushary claude"));
+  const shells = CANDIDATE_RCS.map((name) => join5(homedir5(), name)).filter((path) => existsSync6(path) && readFileSync4(path, "utf-8").includes("pushary claude"));
   for (const path of shells) wouldNote("rewrite", path);
   return shells;
 };
@@ -511,7 +527,7 @@ var writeJson = (path, data) => {
   guardedWrite(path, JSON.stringify(data, null, 2) + "\n");
 };
 var removeCursorUserHook = (scope) => {
-  if (!existsSync5(CURSOR_USER_HOOKS)) return "absent";
+  if (!existsSync6(CURSOR_USER_HOOKS)) return "absent";
   let parsed2;
   try {
     parsed2 = JSON.parse(readFileSync4(CURSOR_USER_HOOKS, "utf-8"));
@@ -585,11 +601,11 @@ var restoreTakeoverReceipts = () => {
   ];
   for (const [agent, hookFile, mcpFile, mcpKey, mcpFormat] of targets) {
     const receiptPath = hookTakeoverReceipt(agent);
-    if (!existsSync5(receiptPath)) continue;
+    if (!existsSync6(receiptPath)) continue;
     try {
       const receipt = readJson(receiptPath);
       if (!isHookTakeoverReceipt(receipt) || receipt.agent !== agent) throw new Error("invalid receipt");
-      const document = existsSync5(hookFile) ? JSON.parse(readFileSync4(hookFile, "utf-8")) : {};
+      const document = existsSync6(hookFile) ? JSON.parse(readFileSync4(hookFile, "utf-8")) : {};
       if (!document || typeof document !== "object" || Array.isArray(document)) throw new Error("invalid hooks file");
       const appAlreadyOwns = hookOwnerOf(document) === "app";
       const cliPositions = agent === "codex" ? codexHookPositions(document) : {};
@@ -600,7 +616,7 @@ var restoreTakeoverReceipts = () => {
         if (mcpFile === hookFile) {
           mcpDocument = document;
         } else {
-          const raw = existsSync5(mcpFile) ? readFileSync4(mcpFile, "utf-8") : "";
+          const raw = existsSync6(mcpFile) ? readFileSync4(mcpFile, "utf-8") : "";
           mcpDocument = raw.trim() ? mcpFormat === "toml" ? parseTOML(raw) : JSON.parse(raw) : {};
         }
         mcpChanged = restoreMcpServer(mcpDocument, mcpKey, receipt.mcpServer);
@@ -610,7 +626,7 @@ var restoreTakeoverReceipts = () => {
       if (!appAlreadyOwns && agent === "codex") {
         if (!mcpDocument) {
           const configPath = codexConfigToml();
-          const raw = existsSync5(configPath) ? readFileSync4(configPath, "utf-8") : "";
+          const raw = existsSync6(configPath) ? readFileSync4(configPath, "utf-8") : "";
           mcpDocument = raw.trim() ? parseTOML(raw) : {};
         }
         codexConfig = mcpDocument;
@@ -679,18 +695,19 @@ var main = async () => {
     console.log(`  ${dim("Removing the Mac app's wiring and state as well.")}`);
   }
   if (everything) {
-    const quit = quitMacApp();
+    const quit = quitMacApp(guards, { platform: process.platform, dryRun, running: runningMacAppPIDs, waitForExit: waitForMacAppExit });
     if (quit === "quit") {
       console.log(`  ${check} Pushary ${dim(did("quit"))} ${dim("(running, and its watcher puts back what this removes)")}`);
     } else if (quit === "running") {
       incompleteClean = true;
       console.log(`  ${cross} Pushary ${dim("would not quit, and it puts back what this removes")}`);
       console.log(`    ${dim("Quit it from the notch menu, then re-run.")}`);
+      process.exit(EXIT.FAILED);
     }
   }
   if (presence !== "absent") console.log();
   const restoredByTakeover = new Set(
-    ["claude_code", "codex", "gemini_cli"].filter((agent) => existsSync5(hookTakeoverReceipt(agent)))
+    ["claude_code", "codex", "gemini_cli"].filter((agent) => existsSync6(hookTakeoverReceipt(agent)))
   );
   if (keepShared) restoreTakeoverReceipts();
   const sharedMcpKeys = {
@@ -718,7 +735,7 @@ var main = async () => {
   const claudeHadPusharyEntry = claudeHasPusharyEntry();
   const rawReceipt = readJson(CLAUDE_MCP_RECEIPT);
   const receipt = isClaudeMcpSnapshot(rawReceipt) ? rawReceipt : null;
-  const receiptUnreadable = existsSync5(CLAUDE_MCP_RECEIPT) && !receipt;
+  const receiptUnreadable = existsSync6(CLAUDE_MCP_RECEIPT) && !receipt;
   if (keepClaudeMcp) {
     console.log(`  ${skip} Claude Code MCP servers ${dim("(kept: the Mac app uses it)")}`);
   } else if (claudeJson2) {
@@ -733,7 +750,7 @@ var main = async () => {
       if (receipt && !keepShared) incompleteClean = true;
       console.log(`  ${skip} Claude Code MCP servers ${dim(receipt ? "(changed after setup; left unchanged)" : "(no pushary entries)")}`);
     }
-  } else if (existsSync5(CLAUDE_MCP_RECEIPT)) {
+  } else if (existsSync6(CLAUDE_MCP_RECEIPT)) {
     incompleteClean = true;
     console.log(`  ${skip} Claude Code MCP servers ${dim("(config missing; setup receipt kept for retry)")}`);
   } else {
@@ -777,7 +794,7 @@ var main = async () => {
   }
   if (cursorGate === "failed") {
     console.log(`  ${skip} Cursor plugin ${dim("(kept: removing it now would block matched commands)")}`);
-  } else if (existsSync5(CURSOR_PLUGIN_DIR)) {
+  } else if (existsSync6(CURSOR_PLUGIN_DIR)) {
     guardedRemove(CURSOR_PLUGIN_DIR);
     console.log(`  ${check} Cursor plugin ${dim("(removed from ~/.cursor/plugins/local)")}`);
   } else {
@@ -793,9 +810,9 @@ var main = async () => {
   if (keepShared) {
     console.log(`  ${skip} VS Code plugin ${dim("(kept: the Mac app writes the same plugin directory)")}`);
   }
-  for (const settingsPath of keepShared ? [] : vscodeSettingsTargets(existsSync5)) {
+  for (const settingsPath of keepShared ? [] : vscodeSettingsTargets(existsSync6)) {
     const label = `VS Code plugin ${dim(`(${shortenHome(settingsPath)})`)}`;
-    if (!existsSync5(settingsPath)) {
+    if (!existsSync6(settingsPath)) {
       console.log(`  ${skip} ${label} ${dim("(no settings.json)")}`);
       continue;
     }
@@ -809,7 +826,7 @@ var main = async () => {
       console.log(`  ${skip} ${label} ${dim("(no pushary entry)")}`);
     }
   }
-  if (!keepShared && existsSync5(VSCODE_PLUGIN_DIR)) {
+  if (!keepShared && existsSync6(VSCODE_PLUGIN_DIR)) {
     guardedRemove(VSCODE_PLUGIN_DIR);
     console.log(`  ${check} VS Code plugin files ${dim(did("removed"))}`);
   }
@@ -828,7 +845,7 @@ var main = async () => {
   }
   if (keepShared) {
     console.log(`  ${skip} Skill directory ${dim("(kept: the Mac app uses it)")}`);
-  } else if (existsSync5(SKILL_DIR)) {
+  } else if (existsSync6(SKILL_DIR)) {
     guardedRemove(SKILL_DIR);
     console.log(`  ${check} Skill directory ${dim(did("removed"))}`);
   } else {
@@ -888,7 +905,7 @@ var main = async () => {
   const codexSkillDir2 = codexSkillDir();
   if (keepShared) {
     console.log(`  ${skip} Codex skill directory ${dim("(kept: the Mac app uses it)")}`);
-  } else if (existsSync5(codexSkillDir2)) {
+  } else if (existsSync6(codexSkillDir2)) {
     guardedRemove(codexSkillDir2);
     console.log(`  ${check} Codex skill directory ${dim(did("removed"))}`);
   } else {
@@ -944,7 +961,7 @@ var main = async () => {
     console.log(`  ${skip} Gemini GEMINI.md ${dim("(no pushary block)")}`);
   }
   const openCodePlugin = openCodePluginFile();
-  const openCodePluginContents = existsSync5(openCodePlugin) ? readFileSync4(openCodePlugin, "utf-8") : null;
+  const openCodePluginContents = existsSync6(openCodePlugin) ? readFileSync4(openCodePlugin, "utf-8") : null;
   if (openCodePluginContents === null) {
     console.log(`  ${skip} OpenCode plugin ${dim("(not installed)")}`);
   } else if (!isOpenCodePluginOurs(openCodePluginContents)) {
@@ -962,7 +979,7 @@ var main = async () => {
         return [];
       }
     })();
-    const siblingIsOurs = existsSync5(sibling) && readFileSync4(sibling, "utf-8") === OPENCODE_PLUGIN_SIBLING_CONTENTS;
+    const siblingIsOurs = existsSync6(sibling) && readFileSync4(sibling, "utf-8") === OPENCODE_PLUGIN_SIBLING_CONTENTS;
     if (siblingIsOurs && !hasForeignPlugins(remaining)) {
       guardedRemove(sibling, { force: true });
       console.log(`  ${check} OpenCode plugin sibling ${dim(did("removed"))}`);
@@ -990,14 +1007,14 @@ var main = async () => {
     } else {
       console.log(`  ${check} Hermes config ${dim("(setup-owned changes restored)")}`);
       try {
-        guardedExec(`"${hermesPython}" -m pip uninstall -y ${HERMES_PIP_PACKAGE}`, { stdio: "pipe", timeout: 6e4 }, `pip uninstall ${HERMES_PIP_PACKAGE}`);
+        guards.execFile(hermesPython, ["-m", "pip", "uninstall", "-y", HERMES_PIP_PACKAGE], { stdio: "pipe", timeout: 6e4 }, `pip uninstall ${HERMES_PIP_PACKAGE}`);
         console.log(`  ${check} Hermes plugin ${dim("(pip uninstalled)")}`);
       } catch {
         incompleteClean = true;
         console.log(`  ${skip} Hermes plugin ${dim("(could not uninstall; setup receipt kept for retry)")}`);
       }
     }
-  } else if (existsSync5(HERMES_CONFIG_RECEIPT)) {
+  } else if (existsSync6(HERMES_CONFIG_RECEIPT)) {
     incompleteClean = true;
     console.log(`  ${skip} Hermes ${dim("(runtime not found; setup receipt kept for retry)")}`);
   } else {
@@ -1025,10 +1042,10 @@ var main = async () => {
           if ((line.match(/pk_[A-Za-z0-9_]+\.[A-Za-z0-9_]+/g) ?? []).some(isValidApiKey)) {
             incompleteClean = true;
             console.log(`  ${cross} ${name} ${dim("still sets PUSHARY_API_KEY, in a form this command will not rewrite:")}`);
-            console.log(`    ${dim(line.trim())}`);
+            console.log(`    ${dim(redactSecrets(line.trim()))}`);
             console.log(`    ${dim("Remove it yourself. A setup run would sign this machine in as that account.")}`);
           } else {
-            console.log(`  ${skip} ${name} ${dim(`left a line referencing PUSHARY_API_KEY: ${line.trim()}`)}`);
+            console.log(`  ${skip} ${name} ${dim(`left a line referencing PUSHARY_API_KEY: ${redactSecrets(line.trim())}`)}`);
           }
         }
       }
@@ -1041,7 +1058,7 @@ var main = async () => {
   } else {
     console.log(`  ${skip} claude alias ${dim("(not set)")}`);
   }
-  if (existsSync5(PUSHARY_DIR)) {
+  if (existsSync6(PUSHARY_DIR)) {
     let removed = 0;
     const kept = [];
     for (const entry of readdirSync3(PUSHARY_DIR)) {
@@ -1084,14 +1101,18 @@ var main = async () => {
     if (store.skillDir || store.lock) {
       console.log(`  ${check} skills.sh registration ${dim(did("removed"))} ${dim("(~/.agents)")}`);
     }
-    const leftovers = removeDeveloperLeftovers();
+    const leftovers = process.platform === "darwin" ? removeDeveloperLeftovers(guards, leakedTestDefaultsDomains(), registeredPusharyBundles()) : 0;
     if (leftovers > 0) {
       console.log(`  ${check} Developer leftovers ${dim(did("removed"))} ${dim(`(${leftovers} leaked test preferences and stale app registrations)`)}`);
     }
-    const removed = removeMacAppState();
+    const { removed, failed } = process.platform === "darwin" ? removeMacAppState(guards, storedPusharyKeychainServices, homedir5()) : { removed: 0, failed: 0 };
+    if (failed > 0) {
+      incompleteClean = true;
+      console.log(`  ${cross} Mac keychain ${dim(`(${failed} operations failed; unlock your keychain and re-run)`)}`);
+    }
     if (removed > 0) {
       console.log(`  ${check} Mac app state ${dim(did("removed"))} ${dim(`(${removed} keychain items, preferences and caches)`)}`);
-    } else {
+    } else if (failed === 0) {
       console.log(`  ${skip} Mac app state ${dim("(nothing of ours in the keychain, preferences or caches)")}`);
     }
   }
@@ -1112,7 +1133,7 @@ var main = async () => {
     console.log(`  ${dim("Still stuck? Send this output to")} ${SUPPORT_EMAIL} ${dim("or")} ${SUPPORT_DISCORD}`);
   } else if (everything) {
     console.log(`  ${green(bold("Clean complete. Nothing of ours is left in any agent config."))}`);
-    const bundle = installedPusharyBundles().find(existsSync5);
+    const bundle = installedPusharyBundles().find(existsSync6);
     if (bundle) {
       console.log(`  ${dim("The app itself is still installed. Drag")} ${bundle} ${dim("to the Trash to finish.")}`);
     }

package/dist/bin/pushary-codex-bridge.js

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
-import "../chunk-GLPWCQ6V.js";
+import "../chunk-TYEO6T5J.js";
 import {
   LiveTranscriptRelay,
   liveSessionSleep,
   postLiveSession,
   postLiveSessionUntilAccepted,
   startLiveSessionHeartbeat
-} from "../chunk-H25UB3CG.js";
+} from "../chunk-2V2IKOGJ.js";
 import {
   SESSION_IDLE_TIMEOUT_MS,
   describeIdleWindow,
   idleDeadlinePassed,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-GIXLZFEY.js";
-import "../chunk-S3EUZZJB.js";
+} from "../chunk-VOMOZ4D5.js";
+import "../chunk-GZ7E6VOB.js";
 import "../chunk-EQRS3SGM.js";
 import {
   transcriptsEnabled
-} from "../chunk-BYAXXBNO.js";
+} from "../chunk-4BROEAKH.js";
 import {
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
@@ -28,18 +28,18 @@ import {
 } from "../chunk-LGXUGYUH.js";
 import {
   getMachineId
-} from "../chunk-RQM5SMMR.js";
+} from "../chunk-NHTAHAIS.js";
 import {
   resolveBinary
-} from "../chunk-UCGQEAKZ.js";
-import "../chunk-NYHNLMQO.js";
+} from "../chunk-TRLFZKVG.js";
+import "../chunk-FU2DFEAZ.js";
 import {
   callMcpTool
 } from "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-P4JVVJ2D.js";
+import "../chunk-UM5J3J4V.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
@@ -48,7 +48,7 @@ import {
 import {
   parseAgentQuestion,
   parseAgentQuestionAnswers
-} from "../chunk-7IEB2GV4.js";
+} from "../chunk-SOUZBGYJ.js";
 
 // bin/pushary-codex-bridge.ts
 import { existsSync } from "fs";