@pushary/agent-hooks 1.7.1 → 1.7.2

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 1.7.2
+
+- **Approval text shows the whole command again.** A credential name that closes a quoted string, as in `grep -rl "password=" . | xargs rm -f`, made 1.7.1 redact everything after it, so the approval read `grep -rl "password="[redacted]"` and hid the `rm`. The value after a credential name is still redacted, and the rest of the command is shown.
+- **Hermes works again after an uninstall.** When setup found Pushary's own Hermes settings already in `~/.hermes/config.yaml`, left by an earlier install, its record of your config included them, and `pushary clean` put them back: approvals stayed pointed at the plugin clean had just uninstalled, and Hermes' `clarify` tool stayed off, so Hermes could not ask you anything in the terminal. Clean now recognises Pushary's own values in that record, including records older versions wrote, and removes `transport: pushary`, the `pushary` plugin entry, and the `clarify` entry that came with Pushary's transport, while restoring everything else you set. Running clean again, or after the Mac app has disconnected Hermes, no longer fails once Hermes' defaults fill the removed settings back in.
+- `pushary clean` says what it did to Hermes: "Pushary settings removed" only when it changed `config.yaml`, "no Pushary settings" when there was nothing of ours, and it skips the plugin uninstall when the plugin is not installed. `--dry-run` previews the exact change without saving it.
+- `pushary doctor` checks Hermes when Pushary set it up: that the plugin is installed in Hermes' Python and enabled, and whether approvals and questions go through Pushary. A plugin the Mac app left installed but disabled is not reported as a failure.
+- Setup on a machine without npm now says so and asks you to install Node.js, instead of printing `/bin/sh: npm: command not found` and suggesting an `npx` retry that needs npm too. Pushary still needs npm; bun, pnpm and yarn installs are not supported yet.
+- `pushary clean` tells an npm it cannot find, a package that is not installed and a failed uninstall apart, instead of calling each of them "not installed". A failed uninstall no longer ends in "Clean complete".
+- `pushary clean --dry-run` lists only the Mac keychain items and preference domains that exist, and the fx setup record only when there is one. It used to list every candidate it would try. A keychain that cannot be read, for example while locked, still counts as possibly holding Pushary's items, so clean tries them and reports a failure instead of calling the keychain clean.
+- `pushary clean` honours `NO_COLOR`.
+- Setup's agent picker shows only the names you picked once you confirm, instead of repeating every agent's description, and the transcript notice is indented like the lines around it.
+- A message you send from your phone or the Mac notch while Claude Code is running a subagent now waits for Claude Code itself. It used to be handed to the subagent's next tool call, where the main conversation never saw it.
+- When your Pushary workspace has no active subscription, Pushary now steps aside and your agent's own approval prompt decides, as it does when Pushary is not installed. Claude Code, Codex, Gemini CLI and OpenCode used to refuse gated tool calls instead, telling you to retry or that the approval was cancelled, and Claude Code questions, plan approvals and MCP forms stopped the same way. A kill switch and your deny rules still apply.
+- Your agent's terminal says once per session why Pushary stepped aside, with the link to subscribe.
+- A Claude Code or Gemini CLI session started from your phone has no prompt on your machine, so it still refuses the call, now saying the workspace has no active subscription instead of asking you to retry.
+- Pairing your phone during setup now says when your workspace has no active subscription, and to subscribe in the Pushary app or at pushary.com before running setup again. It used to say only that pairing failed.
+
 ## 1.7.1
 
 - **fx asks through Pushary.** Setup now adds `"ask_user_question": "deny"` as the last rule in `~/.fx/settings.json`, which removes fx's own terminal question tool from what its agent can call, so every question goes through `mcp_pushary_ask_user`: to the Mac notch at the Mac, to the phone away from it. fx cannot forward its own prompt, so a question asked there used to wait unseen once you walked away. A rule you already set for `ask_user_question` is kept, and setup names it. The instructions in `~/.fx/AGENTS.md` now tell fx's agent to load `mcp_pushary_ask_user` with `mcp_select_tool` by exact name and to ask there even while you are at the terminal, and to ask in its reply only when Pushary hands the question back or cannot be reached.

package/dist/bin/pushary-bell-hook.js

@@ -1,38 +1,38 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-55RO62FV.js";
+} from "../chunk-ZUKZJQGR.js";
 import {
   readHookInput
-} from "../chunk-7GI6QC3M.js";
-import "../chunk-7GYGVQBU.js";
+} from "../chunk-3RO2UWJQ.js";
+import "../chunk-ZMWX5SDA.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-SVEMF2VO.js";
-import "../chunk-XMN37YJH.js";
-import "../chunk-MWVCDP64.js";
-import "../chunk-XDASEYRS.js";
-import "../chunk-AAGLDXH4.js";
-import "../chunk-WZWXBTRF.js";
-import "../chunk-XPMOCJHN.js";
-import "../chunk-O5JD7UI5.js";
-import "../chunk-OTZHT34O.js";
-import "../chunk-XPTCPU6V.js";
+import "../chunk-E3PLF7YB.js";
+import "../chunk-I7B2DNVU.js";
+import "../chunk-JMSB6CJT.js";
+import "../chunk-L6IF4JOF.js";
+import "../chunk-4S7CCOXB.js";
+import "../chunk-A6WQF7FQ.js";
+import "../chunk-KLXYMPTM.js";
+import "../chunk-R7ZETVNR.js";
+import "../chunk-QSZ37ROP.js";
+import "../chunk-Q7CDBJXU.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-4C4NRDIC.js";
-import "../chunk-KSNAAMU5.js";
+import "../chunk-RLRDPZG4.js";
+import "../chunk-6QZK4O36.js";
 import "../chunk-POFBE6ZY.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-YZKS3ME3.js";
-import "../chunk-JTQDP4ZL.js";
-import "../chunk-P5CBNSYL.js";
+import "../chunk-VSGKQ3HI.js";
+import "../chunk-UFNBKYWT.js";
+import "../chunk-HOIGXMI7.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-UPKP67TA.js";
-import "../chunk-454KMJHF.js";
+import "../chunk-LI3C2IQY.js";
+import "../chunk-NYBZJ44G.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-OAL44FM2.js";
-import "../chunk-EIZW73P5.js";
-import "../chunk-XFNVG3OV.js";
+import "../chunk-SJN64NJX.js";
+import "../chunk-65RN6ZCO.js";
+import "../chunk-WWTLAZQA.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,37 +5,37 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-55RO62FV.js";
+} from "../chunk-ZUKZJQGR.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-XPMOCJHN.js";
+} from "../chunk-KLXYMPTM.js";
 import {
   createIo
-} from "../chunk-O5PRIYFZ.js";
+} from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-6PV2JQ64.js";
+} from "../chunk-6NHXKTQU.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-YZKS3ME3.js";
+import "../chunk-VSGKQ3HI.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-UPKP67TA.js";
+import "../chunk-LI3C2IQY.js";
 import {
   claudeSettings
-} from "../chunk-454KMJHF.js";
+} from "../chunk-NYBZJ44G.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-T7E75EKA.js";
-import "../chunk-OAL44FM2.js";
-import "../chunk-EIZW73P5.js";
-import "../chunk-XFNVG3OV.js";
+import "../chunk-SJN64NJX.js";
+import "../chunk-65RN6ZCO.js";
+import "../chunk-WWTLAZQA.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,58 +8,62 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-SNWNA3MQ.js";
+} from "../chunk-PWNQGITG.js";
 import {
+  announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-YHG74UFF.js";
+} from "../chunk-5OP5MQI7.js";
 import {
   claudeTranscriptPath,
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-7GYGVQBU.js";
+} from "../chunk-ZMWX5SDA.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-SVEMF2VO.js";
-import "../chunk-XMN37YJH.js";
-import "../chunk-MWVCDP64.js";
-import "../chunk-XDASEYRS.js";
+import "../chunk-E3PLF7YB.js";
+import "../chunk-I7B2DNVU.js";
+import "../chunk-JMSB6CJT.js";
+import "../chunk-L6IF4JOF.js";
 import {
   ensureDaemonRunning
-} from "../chunk-AAGLDXH4.js";
-import "../chunk-WZWXBTRF.js";
-import "../chunk-XPMOCJHN.js";
+} from "../chunk-4S7CCOXB.js";
+import "../chunk-A6WQF7FQ.js";
+import "../chunk-KLXYMPTM.js";
 import {
   encryptRecord
-} from "../chunk-O5JD7UI5.js";
-import "../chunk-OTZHT34O.js";
+} from "../chunk-R7ZETVNR.js";
+import "../chunk-QSZ37ROP.js";
 import {
   transcriptsEnabled
-} from "../chunk-XPTCPU6V.js";
+} from "../chunk-Q7CDBJXU.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import {
-  DEFAULT_SESSION,
   UNNAMED_ACTION,
   deriveToolTarget,
   describeToolCall,
   fetchModeState,
   getPolicy,
+  phoneDrivenEnv,
+  repoKeyFor,
+  reportEvent,
+  scopePathFor
+} from "../chunk-2B4XCMH6.js";
+import {
+  DEFAULT_SESSION,
   markPendingCommandDelivered,
   markPendingCommandFailed,
-  phoneDrivenEnv,
   readPendingCommand,
   readPendingCommandById,
   removePendingCommand,
-  repoKeyFor,
-  reportEvent,
-  savePendingCommand,
-  scopePathFor
-} from "../chunk-WM3U2RUK.js";
-import "../chunk-4C4NRDIC.js";
+  savePendingCommand
+} from "../chunk-N6IOSZOE.js";
+import "../chunk-RLRDPZG4.js";
 import {
   DECISION_STOP_REASON,
+  UNVERIFIABLE_APPROVAL_REASON,
   askUser,
   cancelQuestion,
   isDecisionStopped,
@@ -67,33 +71,36 @@ import {
   nextLongPollMs,
   waitForAnswer,
   withdrawQuestion
-} from "../chunk-ZIIYTQHC.js";
-import "../chunk-KSNAAMU5.js";
+} from "../chunk-2XOHXZRC.js";
+import "../chunk-6QZK4O36.js";
 import "../chunk-POFBE6ZY.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-YZKS3ME3.js";
-import "../chunk-NQFGVAT6.js";
-import "../chunk-JTQDP4ZL.js";
+import "../chunk-VSGKQ3HI.js";
+import {
+  SubscriptionRequiredError
+} from "../chunk-D4OGEWLH.js";
+import "../chunk-VQDJ6KB3.js";
+import "../chunk-UFNBKYWT.js";
 import {
   getMachineId
-} from "../chunk-P5CBNSYL.js";
+} from "../chunk-HOIGXMI7.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-UPKP67TA.js";
-import "../chunk-454KMJHF.js";
+import "../chunk-LI3C2IQY.js";
+import "../chunk-NYBZJ44G.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-OAL44FM2.js";
+} from "../chunk-SJN64NJX.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-EIZW73P5.js";
+} from "../chunk-65RN6ZCO.js";
 import {
   KILL_REASON,
   redactSecrets,
   resolveGate
-} from "../chunk-XFNVG3OV.js";
+} from "../chunk-WWTLAZQA.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {
@@ -425,6 +432,8 @@ var BoundedInputQueue = class {
 
 // src/wrapper/approver.ts
 var DEFAULT_MAX_CONCURRENT = 16;
+var NO_LOCAL_APPROVAL_UI = "This remote session has no local approval UI. Continue in an interactive session or choose a mode that permits remote approval.";
+var SUBSCRIPTION_REQUIRED_NO_LOCAL_APPROVAL_UI = "Your Pushary workspace has no active subscription, so approvals cannot reach your phone, and this remote session has no local approval UI. Continue in an interactive session.";
 var DEFAULT_APPROVAL_WINDOW_MS = 5 * 6e4;
 var MAX_APPROVAL_WINDOW_MS = 30 * 6e4;
 var allow = (input) => ({
@@ -528,8 +537,10 @@ var createRemoteApprover = (deps) => {
           toolTarget,
           repoKey: repoKeyFor(deps.cwd)
         });
-      } catch {
-        return deny("Pushary could not create a verifiable approval. Retry the action.");
+      } catch (error) {
+        if (!(error instanceof SubscriptionRequiredError)) return deny(UNVERIFIABLE_APPROVAL_REASON);
+        announceSubscriptionRequired(error.upgradeUrl, sessionId);
+        return deny(SUBSCRIPTION_REQUIRED_NO_LOCAL_APPROVAL_UI);
       }
       if (isDecisionStopped(question)) return deny(DECISION_STOP_REASON);
       entry.correlationId = question.correlationId;
@@ -546,7 +557,7 @@ var createRemoteApprover = (deps) => {
         if (isDeferAnswer(answer.value)) return deny("Deferred \u2014 handle it on the machine");
         return answer.value === "yes" ? allow(input) : deny("Denied from your phone");
       }
-      if (localHandoff) return deny("This remote session has no local approval UI. Continue in an interactive session or choose a mode that permits remote approval.");
+      if (localHandoff) return deny(NO_LOCAL_APPROVAL_UI);
       return applyTimeout(policy, input);
     } catch {
       return deny("Approval unavailable; denied by default");

package/dist/bin/pushary-clean.js

@@ -1,33 +1,33 @@
 #!/usr/bin/env node
 import {
-  HERMES_CONFIG_SCRIPT,
-  HERMES_PIP_PACKAGE,
   PUSHARY_SKILL_NAME,
   PUSHARY_SKILL_SOURCE,
   createGuards,
-  resolveHermesPython,
-  runHermesPythonScript,
   withoutPusharyCursorHooks
-} from "../chunk-JMBG47WV.js";
+} from "../chunk-MY3UZO5U.js";
 import {
   FX_PROFILE_REFUSALS,
   FX_QUESTION_TOOL,
   FX_SETTINGS_REFUSALS,
+  HERMES_PIP_PACKAGE,
   fxProfileText,
   fxSettingsText,
   isFxQuestionRuleReceipt,
   readFxFile,
   readFxProfile,
   readFxSettings,
+  readHermesStatus,
   removeInstructionBlock,
+  resolveHermesPython,
+  runHermesConfigScript,
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets,
   withoutFxPusharyServer,
   withoutPusharyToolsAllowed,
   withoutQuestionsRoutedToPushary
-} from "../chunk-NAAZCNKI.js";
-import "../chunk-2FU43B5Q.js";
+} from "../chunk-SKMWPXGV.js";
+import "../chunk-TVJYGZXB.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -39,7 +39,7 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-NID4UZDN.js";
+} from "../chunk-SKEW3TQX.js";
 import {
   compatibleConfigFile,
   compatibleInstructionsFile,
@@ -47,42 +47,47 @@ import {
   compatiblePermissionRuleFile,
   removeCompatibleHooks,
   removeCompatibleMcpServer
-} from "../chunk-KBLIVEFJ.js";
+} from "../chunk-T3PRPFDY.js";
 import {
   isClaudeMcpSnapshot,
   removeClaudeMcpServers,
   removePusharySettings,
   removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-WSC53O7I.js";
+} from "../chunk-KAJT6HPI.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-SVEMF2VO.js";
-import "../chunk-XMN37YJH.js";
+} from "../chunk-E3PLF7YB.js";
+import "../chunk-I7B2DNVU.js";
 import {
   liveBridgeProbe,
   resolveBridgeStub
-} from "../chunk-MWVCDP64.js";
-import "../chunk-XDASEYRS.js";
+} from "../chunk-JMSB6CJT.js";
+import "../chunk-L6IF4JOF.js";
 import {
   disableDaemonService
-} from "../chunk-AAGLDXH4.js";
+} from "../chunk-4S7CCOXB.js";
 import {
   removeGeminiSettings
-} from "../chunk-WZWXBTRF.js";
-import "../chunk-XPMOCJHN.js";
+} from "../chunk-A6WQF7FQ.js";
+import "../chunk-KLXYMPTM.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-WM3U2RUK.js";
-import "../chunk-4C4NRDIC.js";
-import "../chunk-ZIIYTQHC.js";
-import "../chunk-KSNAAMU5.js";
+import "../chunk-2B4XCMH6.js";
+import "../chunk-N6IOSZOE.js";
+import "../chunk-RLRDPZG4.js";
+import "../chunk-2XOHXZRC.js";
+import "../chunk-6QZK4O36.js";
 import "../chunk-POFBE6ZY.js";
+import {
+  ansiPainter,
+  useColor
+} from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-6PV2JQ64.js";
+} from "../chunk-6NHXKTQU.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
@@ -90,16 +95,18 @@ import {
   CANDIDATE_RCS,
   isDisabledExport,
   removeClaudeAlias
-} from "../chunk-YZKS3ME3.js";
-import "../chunk-NQFGVAT6.js";
-import "../chunk-JTQDP4ZL.js";
-import "../chunk-P5CBNSYL.js";
+} from "../chunk-VSGKQ3HI.js";
+import "../chunk-D4OGEWLH.js";
+import "../chunk-VQDJ6KB3.js";
+import "../chunk-UFNBKYWT.js";
+import "../chunk-HOIGXMI7.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-UPKP67TA.js";
+import "../chunk-LI3C2IQY.js";
 import {
+  AGENT_HOOKS_PACKAGE,
   bridgeAgentKey,
   claudeJson,
   claudeMcpReceipt,
@@ -122,8 +129,11 @@ import {
   fxSettings,
   geminiMd,
   geminiSettings,
+  globalPackageState,
+  hermesConfig,
   hermesConfigReceipt,
   hookTakeoverReceipt,
+  npmIsOnPath,
   pusharyDir,
   readCodexMcpAuth,
   removeCodexHookTrust,
@@ -131,10 +141,10 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-454KMJHF.js";
+} from "../chunk-NYBZJ44G.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-OAL44FM2.js";
-import "../chunk-EIZW73P5.js";
+import "../chunk-SJN64NJX.js";
+import "../chunk-65RN6ZCO.js";
 import {
   HOOK_COMPATIBLE_PROFILES,
   HOOK_LOCATOR_BINARY,
@@ -142,7 +152,7 @@ import {
   SUPPORT_EMAIL,
   isValidApiKey,
   redactSecrets
-} from "../chunk-XFNVG3OV.js";
+} from "../chunk-WWTLAZQA.js";
 
 // bin/pushary-clean.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync4 } from "fs";
@@ -169,7 +179,7 @@ var TEST_DEFAULTS_PREFIXES = [
 var isTestDefaultsDomain = (domain) => TEST_DEFAULTS_PREFIXES.some((prefix) => domain.startsWith(prefix));
 var leakedTestDefaultsDomains = () => {
   try {
-    return execSync("defaults domains", { encoding: "utf-8", timeout: 2e4 }).split(",").map((entry) => entry.trim()).filter(isTestDefaultsDomain);
+    return execSync("defaults domains", { encoding: "utf-8", timeout: 2e4 }).split(",").map((entry) => entry.trim()).filter(isTestDefaultsDomain).filter(liveMacStatePresence.defaultsDomain);
   } catch {
     return [];
   }
@@ -211,6 +221,28 @@ var MAC_KEYCHAIN_ACCOUNTS = [
   "cachedEnvironment"
 ];
 var MAC_DEFAULTS_DOMAINS = ["com.pushary.app", "pushary-bridge", "pushary.render"];
+var PRESENCE_PROBE_TIMEOUT_MS = 1e4;
+var commandSucceeds = (file, args) => {
+  try {
+    execFileSync(file, args, { stdio: "ignore", timeout: PRESENCE_PROBE_TIMEOUT_MS });
+    return true;
+  } catch {
+    return false;
+  }
+};
+var KEYCHAIN_ITEM_NOT_FOUND = 44;
+var keychainItemMayExist = (service, account) => {
+  try {
+    execFileSync("security", ["find-generic-password", "-s", service, "-a", account], { stdio: "ignore" });
+    return true;
+  } catch (error) {
+    return !(error instanceof Error && "status" in error && error.status === KEYCHAIN_ITEM_NOT_FOUND);
+  }
+};
+var liveMacStatePresence = {
+  keychainItem: keychainItemMayExist,
+  defaultsDomain: (domain) => commandSucceeds("defaults", ["read", domain])
+};
 var macLibraryState = (home = homedir()) => [
   join(home, "Library", "Application Support", "Pushary"),
   join(home, "Library", "Caches", "com.pushary.app"),
@@ -284,7 +316,7 @@ var removeDeveloperLeftovers = (guards2, domains, bundles) => {
   }
   return removed;
 };
-var removeMacAppState = (guards2, readServices, home) => {
+var removeMacAppState = (guards2, readServices, home, present) => {
   let removed = 0;
   let failed = 0;
   let services;
@@ -294,7 +326,7 @@ var removeMacAppState = (guards2, readServices, home) => {
     return { removed, failed: 1 };
   }
   for (const service of services) {
-    for (const account of MAC_KEYCHAIN_ACCOUNTS) {
+    for (const account of MAC_KEYCHAIN_ACCOUNTS.filter((account2) => present.keychainItem(service, account2))) {
       try {
         guards2.execFile(
           "security",
@@ -308,7 +340,7 @@ var removeMacAppState = (guards2, readServices, home) => {
       }
     }
   }
-  for (const domain of MAC_DEFAULTS_DOMAINS) {
+  for (const domain of MAC_DEFAULTS_DOMAINS.filter(present.defaultsDomain)) {
     try {
       guards2.execFile("defaults", ["delete", domain], { stdio: "ignore", timeout: 1e4 }, `delete preferences ${domain}`);
       removed++;
@@ -479,11 +511,12 @@ var macAppKeepsMcpEntry = (entryKey, keys) => {
 
 // bin/pushary-clean.ts
 exitOnHelpFlag("clean");
-var dim = (s) => `\x1B[2m${s}\x1B[0m`;
-var bold = (s) => `\x1B[1m${s}\x1B[0m`;
-var green = (s) => `\x1B[32m${s}\x1B[0m`;
-var yellow = (s) => `\x1B[33m${s}\x1B[0m`;
-var red = (s) => `\x1B[31m${s}\x1B[0m`;
+var paint = ansiPainter(() => useColor());
+var dim = paint("\x1B[2m");
+var bold = paint("\x1B[1m");
+var green = paint("\x1B[32m");
+var yellow = paint("\x1B[33m");
+var red = paint("\x1B[31m");
 var check = green("\u2713");
 var skip = yellow("\u2013");
 var cross = red("\u2717");
@@ -494,6 +527,7 @@ var CLAUDE_SETTINGS_LOCAL = claudeSettingsLocal();
 var CLAUDE_JSON = claudeJson();
 var CLAUDE_MCP_RECEIPT = claudeMcpReceipt();
 var HERMES_CONFIG_RECEIPT = hermesConfigReceipt();
+var HERMES_CONFIG_FILE = hermesConfig();
 var SKILL_DIR = claudeSkillDir();
 var CURSOR_MCP = cursorUserMcp();
 var CURSOR_PLUGIN_DIR = cursorPluginDir();
@@ -617,7 +651,7 @@ var removeFxQuestionRule = () => {
     if (outcome === "removed") writeFxText(path, fxSettingsText(settings), "fx question rule");
     else if (outcome !== "absent") console.log(`  ${skip} fx question rule ${dim(`(${FX_QUESTION_TOOL} in ${path}: ${FX_QUESTION_RULE_KEPT[outcome]})`)}`);
   }
-  guardedRemove(fxQuestionRuleReceipt(), { force: true });
+  if (existsSync6(fxQuestionRuleReceipt())) guardedRemove(fxQuestionRuleReceipt(), { force: true });
 };
 var removeFxInstructions = () => {
   if (guardedInstructionBlockRemoval(fxAgentsMd())) {
@@ -1099,18 +1133,27 @@ var main = async () => {
   removeFxInstructions();
   const hermesPython = resolveHermesPython();
   if (hermesPython) {
-    const configUpdated = dryRun ? (wouldNote("run    ", "hermes plugin config restore"), true) : runHermesPythonScript(hermesPython, HERMES_CONFIG_SCRIPT, "clean", HERMES_CONFIG_RECEIPT);
-    if (!configUpdated) {
+    const configRun = runHermesConfigScript(hermesPython, dryRun ? "clean-preview" : "clean", HERMES_CONFIG_RECEIPT);
+    if (configRun === "failed") {
       incompleteClean = true;
       console.log(`  ${skip} Hermes config ${dim("(could not update config.yaml)")}`);
     } else {
-      console.log(`  ${check} Hermes config ${dim("(setup-owned changes restored)")}`);
-      try {
-        guards.execFile(hermesPython, ["-m", "pip", "uninstall", "-y", HERMES_PIP_PACKAGE], { stdio: "pipe", timeout: 6e4 }, `pip uninstall ${HERMES_PIP_PACKAGE}`);
-        console.log(`  ${check} Hermes plugin ${dim("(pip uninstalled)")}`);
-      } catch {
-        incompleteClean = true;
-        console.log(`  ${skip} Hermes plugin ${dim("(could not uninstall; setup receipt kept for retry)")}`);
+      if (configRun === "changed") {
+        if (dryRun) wouldNote("rewrite", HERMES_CONFIG_FILE);
+        console.log(`  ${check} Hermes config ${dim(did("removed"))} ${dim("(Pushary settings)")}`);
+      } else {
+        console.log(`  ${skip} Hermes config ${dim("(no Pushary settings)")}`);
+      }
+      if (readHermesStatus(hermesPython)?.pluginInstalled === false) {
+        console.log(`  ${skip} Hermes plugin ${dim("(not installed)")}`);
+      } else {
+        try {
+          guards.execFile(hermesPython, ["-m", "pip", "uninstall", "-y", HERMES_PIP_PACKAGE], { stdio: "pipe", timeout: 6e4 }, `pip uninstall ${HERMES_PIP_PACKAGE}`);
+          console.log(`  ${check} Hermes plugin ${dim(did("uninstalled"))}`);
+        } catch {
+          incompleteClean = true;
+          console.log(`  ${skip} Hermes plugin ${dim("(could not uninstall; setup receipt kept for retry)")}`);
+        }
       }
     }
   } else if (existsSync6(HERMES_CONFIG_RECEIPT)) {
@@ -1209,26 +1252,30 @@ var main = async () => {
     if (leftovers > 0) {
       console.log(`  ${check} Developer leftovers ${dim(did("removed"))} ${dim(`(${leftovers} leaked test preferences and stale app registrations)`)}`);
     }
-    const { removed, failed } = process.platform === "darwin" ? removeMacAppState(guards, storedPusharyKeychainServices, homedir5()) : { removed: 0, failed: 0 };
+    const { removed, failed } = process.platform === "darwin" ? removeMacAppState(guards, storedPusharyKeychainServices, homedir5(), liveMacStatePresence) : { removed: 0, failed: 0 };
     if (failed > 0) {
       incompleteClean = true;
       console.log(`  ${cross} Mac keychain ${dim(`(${failed} operations failed; unlock your keychain and re-run)`)}`);
     }
     if (removed > 0) {
-      console.log(`  ${check} Mac app state ${dim(did("removed"))} ${dim(`(${removed} keychain items, preferences and caches)`)}`);
+      console.log(`  ${check} Mac app state ${dim(did("removed"))} ${dim(`(${removed} across the keychain, preferences and caches)`)}`);
     } else if (failed === 0) {
       console.log(`  ${skip} Mac app state ${dim("(nothing of ours in the keychain, preferences or caches)")}`);
     }
   }
-  try {
-    if (dryRun) {
-      wouldNote("run    ", "npm uninstall -g @pushary/agent-hooks");
-    } else {
-      execNpm("uninstall -g --no-workspaces @pushary/agent-hooks", { stdio: "ignore", timeout: 3e4 });
-    }
-    console.log(`  ${check} Global package ${dim(did("uninstalled"))}`);
-  } catch {
+  if (!npmIsOnPath()) {
+    console.log(`  ${skip} Global package ${dim(`(npm not found; remove ${AGENT_HOOKS_PACKAGE} with the tool that installed it)`)}`);
+  } else if (globalPackageState(AGENT_HOOKS_PACKAGE) === "absent") {
     console.log(`  ${skip} Global package ${dim("(not installed)")}`);
+  } else {
+    try {
+      if (dryRun) wouldNote("run    ", `npm uninstall -g ${AGENT_HOOKS_PACKAGE}`);
+      else execNpm(`uninstall -g --no-workspaces ${AGENT_HOOKS_PACKAGE}`, { stdio: "ignore", timeout: 3e4 });
+      console.log(`  ${check} Global package ${dim(did("uninstalled"))}`);
+    } catch {
+      incompleteClean = true;
+      console.log(`  ${cross} Global package ${dim(`(npm uninstall failed; run npm uninstall -g ${AGENT_HOOKS_PACKAGE})`)}`);
+    }
   }
   console.log();
   if (incompleteClean) {