@pushary/agent-hooks 1.9.59 → 1.9.61

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 1.9.61
+
+- Pushary for Mac can connect Codex through its own helper, so Codex follows the account signed in to the app instead of a copied key that sign-out revokes. Setup, upgrade and doctor now recognize that entry. When setup or upgrade handles Codex's hooks itself, with `--take-over-hooks` or because the app is gone, it moves Codex's MCP to this CLI's account too, instead of leaving Codex on the Mac's account or on a helper that cannot start.
+- That move also replaces a Codex configuration an older CLI could leave behind, where the Pushary entry held both the Mac helper's `command` and a `url`. Codex refuses to load any configuration with that mix, so Codex would not start at all. Any other Pushary entry with a `command`, including the helper with `args`, `env` or extra settings, is now left unchanged instead of getting a `url` beside it. An upgrade that has a key to write then leaves Codex's hooks unchanged too.
+- When setup or a manual `pushary upgrade` moves an enabled Codex entry off the Mac helper, it asks you to fully quit and reopen Codex, because a running Codex keeps the connection it started with.
+
+## 1.9.60
+
+- Ships the CLI audit fixes merged after 1.9.59. `pushary mode terminal_only --for=30m` now expires after 30 minutes, just like `--for 30m`, instead of making the mode permanent.
+- Setup, repair and disconnect respect the active Claude configuration directory. Hook commands safely quote paths containing apostrophes, dollar signs or shell substitutions.
+- Commands reject unsupported preview flags and conflicting or surplus arguments before changing configuration. Transcript recovery works through both command entrypoints, and settings requests have a 15-second deadline with validated responses.
+- JSON failures carry the same exit code as the process. Unexpected hook failures report a stable error code while preserving native fallback, and transient error reports get one bounded retry. Network errors and support bundles redact proxy credentials.
+
 ## 1.9.59
 
 - Codex app cards now also carry three questions from Codex's browser: access to a site, a download and an upload. They used to show only in Codex, because the browser raises them itself and no hook sees them. With the switch on, each reaches Pushary as a yes or no question that names the site, and the first answer wins. A download or upload question carries the address up to the end of its path. Nothing after a `?` or `#` is in that question, and the address ends in … when something was left out; the path itself is sent.

package/README.md

@@ -345,3 +345,9 @@ Run `pushary cowork` (or `npx pushary@latest cowork`) for connector setup. `push
 Use `pushary cowork --instructions` for standing instructions or `pushary cowork --skill > SKILL.md` to export the bundled skill for upload. `--json` reports `manual_setup_required`; printing a link does not prove a connection. Ask a test question in Claude, answer it in Pushary, and verify Claude receives it.
 
 This connector is cooperative. Cowork supports plugin hooks on supported versions, but this setup does not install or verify native permission hooks. Use the normal setup command for Claude Code CLI hooks.
+
+### OpenCode versions
+
+The generated plugin supports OpenCode V2 and V1 from 1.18.29. Run setup again after updating Pushary to replace the plugin. V2 still reads the earlier MCP configuration format.
+
+In V2, Pushary answers native permission requests for shell commands in the active directory, single-file reads/writes/edits, and web fetches. Outside-directory access, another shell working directory, multi-file edits, renames with two paths, custom permissions and native questions stay in OpenCode. An approval applies once to the matching request.

package/data/cursor-plugin/.cursor-plugin/plugin.json

@@ -2,7 +2,11 @@
   "name": "pushary",
   "displayName": "Pushary — Control Panel for AI Agents",
   "description": "Push notifications, human-in-the-loop questions, and permission gating for your AI coding agent. Get a push when a task finishes, answer the agent from your phone, and approve risky commands before they run.",
-  "version": "0.2.7",
+  "version": "0.2.8",
+  "minClientVersions": {
+    "grokbot": "never",
+    "sand": "never"
+  },
   "author": { "name": "Pushary", "email": "business@pushary.com" },
   "homepage": "https://pushary.com",
   "repository": "https://github.com/Pushary/cursor-plugin",

package/data/cursor-plugin/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.2.8
+
+- Hidden from Grok Bot. This plugin needs an API key and command hooks on your own computer, which a Bot's cloud computer does not have. Grok Bot users install [Pushary for Grok Bot](https://github.com/Pushary/grok-bot-plugin) instead.
+
 ## 0.2.6
 
 - Under When I'm out, a file change nobody answers is refused, even when your rule approves on timeout. Cursor's file hooks have no prompt of their own, so the change used to run once the wait ended. Under Every time a rule that approves on timeout still runs the change, as before.

package/dist/{api-UVJGNZIF.js → api-LW3PJQYY.js}

@@ -15,24 +15,25 @@ import {
   waitForQuestion,
   waitsForThePhone,
   withdrawQuestion
-} from "./chunk-WW24SG27.js";
-import "./chunk-5EFNBL6V.js";
+} from "./chunk-RJHX66EY.js";
+import "./chunk-XAO6EYGM.js";
 import "./chunk-POFBE6ZY.js";
-import "./chunk-MA37WNVS.js";
-import "./chunk-JAKBCKEB.js";
-import "./chunk-M46WDK64.js";
-import "./chunk-7QLSKOSU.js";
+import "./chunk-YDR4BQ7R.js";
+import "./chunk-7BAO42UV.js";
+import "./chunk-SFAP4AJY.js";
+import "./chunk-PPY5N2E6.js";
 import "./chunk-KZERVKTD.js";
-import "./chunk-KZCYHWDF.js";
-import "./chunk-US3IT6ZC.js";
+import "./chunk-MWLTTLPK.js";
+import "./chunk-CJ5TCFD4.js";
 import "./chunk-QENTGE75.js";
-import "./chunk-4XXZUFWN.js";
-import "./chunk-BMPZ5HVJ.js";
+import "./chunk-BG4Y64FW.js";
+import "./chunk-ERK24P76.js";
 import "./chunk-QTOLNRET.js";
 import {
   DECISION_STOP_REASON,
   UNVERIFIABLE_APPROVAL_REASON
-} from "./chunk-762CDAJJ.js";
+} from "./chunk-AXJLJJ3M.js";
+import "./chunk-MLKGABMK.js";
 export {
   DECISION_STOP_REASON,
   UNVERIFIABLE_APPROVAL_REASON,

package/dist/bin/pushary-bell-hook.js

@@ -1,44 +1,45 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-MMLIQDTG.js";
+} from "../chunk-ATKN4BJT.js";
 import {
   readHookInput
-} from "../chunk-KQHY6L3X.js";
-import "../chunk-2WMZDKPM.js";
+} from "../chunk-6FJ6CK32.js";
+import "../chunk-EUIPTDLX.js";
 import "../chunk-QW3FRUFB.js";
-import "../chunk-KQWN7C5C.js";
-import "../chunk-4QF2YLYK.js";
-import "../chunk-X4ES7QBT.js";
-import "../chunk-TDOKDCFH.js";
-import "../chunk-75UYYIFJ.js";
-import "../chunk-AS4Z6KS4.js";
-import "../chunk-GMXKITVA.js";
-import "../chunk-PVANKDWM.js";
-import "../chunk-3N2ZTHZZ.js";
-import "../chunk-D6CXQIXO.js";
+import "../chunk-GKFO5JLN.js";
+import "../chunk-LBHJJEKT.js";
+import "../chunk-BJTSKOH3.js";
+import "../chunk-RGSW36XH.js";
+import "../chunk-XV6S5PWW.js";
+import "../chunk-IFPOHFDJ.js";
+import "../chunk-NMUI3ZWG.js";
+import "../chunk-2AELPDMT.js";
+import "../chunk-GAMVAORR.js";
+import "../chunk-7JXJJNQ5.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-KAJDKYUM.js";
-import "../chunk-5JWCWALO.js";
-import "../chunk-W47WL6JY.js";
-import "../chunk-XGP5VSQG.js";
-import "../chunk-WW24SG27.js";
-import "../chunk-5EFNBL6V.js";
+import "../chunk-WN3RACVD.js";
+import "../chunk-DQLCFGHK.js";
+import "../chunk-33OOEVPG.js";
+import "../chunk-YPD3MTFU.js";
+import "../chunk-RJHX66EY.js";
+import "../chunk-XAO6EYGM.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-MA37WNVS.js";
-import "../chunk-JAKBCKEB.js";
-import "../chunk-M46WDK64.js";
-import "../chunk-7QLSKOSU.js";
+import "../chunk-YDR4BQ7R.js";
+import "../chunk-7BAO42UV.js";
+import "../chunk-SFAP4AJY.js";
+import "../chunk-PPY5N2E6.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-3RKIJM26.js";
-import "../chunk-KZCYHWDF.js";
-import "../chunk-US3IT6ZC.js";
+import "../chunk-Y5VKZNFN.js";
+import "../chunk-MWLTTLPK.js";
+import "../chunk-CJ5TCFD4.js";
 import "../chunk-QENTGE75.js";
-import "../chunk-4XXZUFWN.js";
-import "../chunk-BMPZ5HVJ.js";
+import "../chunk-BG4Y64FW.js";
+import "../chunk-ERK24P76.js";
 import "../chunk-QTOLNRET.js";
-import "../chunk-762CDAJJ.js";
+import "../chunk-AXJLJJ3M.js";
+import "../chunk-MLKGABMK.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,41 +5,42 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-MMLIQDTG.js";
+} from "../chunk-ATKN4BJT.js";
 import {
   createIo
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-UVZK5LIK.js";
+} from "../chunk-K4MBKXAE.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-AS4Z6KS4.js";
+} from "../chunk-IFPOHFDJ.js";
 import {
   parseFlags
-} from "../chunk-GMXKITVA.js";
-import "../chunk-KAJDKYUM.js";
-import "../chunk-7QLSKOSU.js";
+} from "../chunk-NMUI3ZWG.js";
+import "../chunk-WN3RACVD.js";
+import "../chunk-PPY5N2E6.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-3RKIJM26.js";
+import "../chunk-Y5VKZNFN.js";
 import {
   claudeSettings
-} from "../chunk-KZCYHWDF.js";
-import "../chunk-US3IT6ZC.js";
+} from "../chunk-MWLTTLPK.js";
+import "../chunk-CJ5TCFD4.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-QENTGE75.js";
-import "../chunk-4XXZUFWN.js";
-import "../chunk-BMPZ5HVJ.js";
+import "../chunk-BG4Y64FW.js";
+import "../chunk-ERK24P76.js";
 import "../chunk-QTOLNRET.js";
 import {
   isRecord
-} from "../chunk-762CDAJJ.js";
+} from "../chunk-AXJLJJ3M.js";
+import "../chunk-MLKGABMK.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,40 +8,40 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-MSU3VKGJ.js";
+} from "../chunk-SHJVFW22.js";
 import "../chunk-VUFHYMSP.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-LAEW5QQD.js";
+} from "../chunk-ZEWIMY63.js";
 import {
   claudeTranscriptPath,
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-2WMZDKPM.js";
+} from "../chunk-EUIPTDLX.js";
 import "../chunk-QW3FRUFB.js";
 import {
   ensureDaemonRunning
-} from "../chunk-4QF2YLYK.js";
-import "../chunk-X4ES7QBT.js";
-import "../chunk-TDOKDCFH.js";
-import "../chunk-75UYYIFJ.js";
-import "../chunk-AS4Z6KS4.js";
-import "../chunk-GMXKITVA.js";
+} from "../chunk-LBHJJEKT.js";
+import "../chunk-BJTSKOH3.js";
+import "../chunk-RGSW36XH.js";
+import "../chunk-XV6S5PWW.js";
+import "../chunk-IFPOHFDJ.js";
+import "../chunk-NMUI3ZWG.js";
 import {
   encryptRecord
-} from "../chunk-PVANKDWM.js";
-import "../chunk-3N2ZTHZZ.js";
+} from "../chunk-2AELPDMT.js";
+import "../chunk-GAMVAORR.js";
 import {
   transcriptsEnabled
-} from "../chunk-D6CXQIXO.js";
+} from "../chunk-7JXJJNQ5.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-KAJDKYUM.js";
+import "../chunk-WN3RACVD.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -58,11 +58,11 @@ import {
   reportEvent,
   savePendingCommand,
   scopePathFor
-} from "../chunk-5JWCWALO.js";
-import "../chunk-W47WL6JY.js";
+} from "../chunk-DQLCFGHK.js";
+import "../chunk-33OOEVPG.js";
 import {
   repoKeyFor
-} from "../chunk-XGP5VSQG.js";
+} from "../chunk-YPD3MTFU.js";
 import {
   askUser,
   cancelQuestion,
@@ -73,29 +73,31 @@ import {
   waitForAnswer,
   waitsForThePhone,
   withdrawQuestion
-} from "../chunk-WW24SG27.js";
+} from "../chunk-RJHX66EY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-5EFNBL6V.js";
+} from "../chunk-XAO6EYGM.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-MA37WNVS.js";
-import "../chunk-JAKBCKEB.js";
+import "../chunk-YDR4BQ7R.js";
+import "../chunk-7BAO42UV.js";
 import {
   getMachineId
-} from "../chunk-M46WDK64.js";
-import "../chunk-7QLSKOSU.js";
+} from "../chunk-SFAP4AJY.js";
+import "../chunk-PPY5N2E6.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-3RKIJM26.js";
-import "../chunk-KZCYHWDF.js";
-import "../chunk-US3IT6ZC.js";
+import "../chunk-Y5VKZNFN.js";
+import {
+  claudeConfigDir
+} from "../chunk-MWLTTLPK.js";
+import "../chunk-CJ5TCFD4.js";
 import "../chunk-QENTGE75.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-4XXZUFWN.js";
+} from "../chunk-BG4Y64FW.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-BMPZ5HVJ.js";
+} from "../chunk-ERK24P76.js";
 import "../chunk-QTOLNRET.js";
 import {
   DECISION_STOP_REASON,
@@ -106,7 +108,8 @@ import {
   redactSecretsFromContent,
   resolveGate,
   timeoutActionWithoutLocalPrompt
-} from "../chunk-762CDAJJ.js";
+} from "../chunk-AXJLJJ3M.js";
+import "../chunk-MLKGABMK.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {
@@ -1228,7 +1231,6 @@ var remoteCompatibilityIssue = (args2) => {
 
 // src/wrapper/localLeg.ts
 import { readFileSync } from "fs";
-import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
 var SIGNAL_EXIT_BASE = 128;
 var SIGNAL_NUMBERS2 = { SIGHUP: 1, SIGINT: 2, SIGTERM: 15 };
@@ -1299,7 +1301,7 @@ var runLocalLeg = (session, deps = {}) => {
     const readIdentity = () => {
       if (!child.pid) return;
       try {
-        const root = process.env.CLAUDE_CONFIG_DIR || join2(homedir2(), ".claude");
+        const root = claudeConfigDir();
         const record = JSON.parse(readFileSync(join2(root, "sessions", `${child.pid}.json`), "utf8"));
         if (record.pid !== child.pid || record.cwd !== process.cwd() || record.startedAt < spawnedAt - 5e3 || typeof record.startedAt !== "number" || !/^[a-f0-9-]{36}$/i.test(record.sessionId)) return;
         if (record.sessionId !== session.getSessionId()) session.setSessionId(record.sessionId);

package/dist/bin/pushary-clean.js

@@ -15,26 +15,26 @@ import {
   storedMacAppState,
   storedPusharyKeychainServices,
   waitForMacAppExit
-} from "../chunk-TCH5UCPR.js";
+} from "../chunk-BQ2VV7LY.js";
 import {
   PUSHARY_SKILL_NAME,
   PUSHARY_SKILL_SOURCE,
   createGuards
 } from "../chunk-EUW7JL2K.js";
-import "../chunk-CPRA7IEK.js";
+import "../chunk-PITQ5ZIQ.js";
 import "../chunk-XCEN33UP.js";
 import {
   describeCliKeyRevocation,
   planCliKeyRevocations,
   readCliHeldKeys,
   revokeCliKeys
-} from "../chunk-DK35M4TH.js";
-import "../chunk-DS7X36Z3.js";
+} from "../chunk-Y6Z7DA5Y.js";
+import "../chunk-64S5PQBQ.js";
 import {
   isCursorPluginLeftover,
   releaseSoleGate,
   withoutPusharyCursorHooks
-} from "../chunk-MYU5D5VH.js";
+} from "../chunk-GZCSWDAS.js";
 import {
   HERMES_PIP_PACKAGE,
   readHermesStatus,
@@ -43,21 +43,21 @@ import {
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-YQVKG5MC.js";
+} from "../chunk-GDKQUB52.js";
 import {
   macAppKeepsMcpEntry,
   mcpServerBearer,
   pusharyKey,
   readMacAppAgentKey,
   setupReceiptKey
-} from "../chunk-EHCIQA5D.js";
+} from "../chunk-KPNZ7JUL.js";
 import "../chunk-QCGNGEGE.js";
-import "../chunk-AY32RSUC.js";
+import "../chunk-ADR3KHOC.js";
 import {
   planFxRemoval,
   removeInstructionBlock
-} from "../chunk-6ONSTCDJ.js";
-import "../chunk-3NROUNIS.js";
+} from "../chunk-4VRTSDGP.js";
+import "../chunk-UADSXJZ4.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -69,14 +69,14 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-JBCMXSBO.js";
+} from "../chunk-ZGU3NXL2.js";
 import {
   ansiPainter,
   useColor
 } from "../chunk-FO3MDD26.js";
 import {
   exitOnHelpFlag
-} from "../chunk-UVZK5LIK.js";
+} from "../chunk-K4MBKXAE.js";
 import "../chunk-VUFHYMSP.js";
 import {
   compatibleConfigFile,
@@ -94,10 +94,10 @@ import {
   removePusharyToolPermissions,
   restoreClaudeMcpServer,
   serializeConfigDocument
-} from "../chunk-KQWN7C5C.js";
+} from "../chunk-GKFO5JLN.js";
 import {
   disableDaemonService
-} from "../chunk-4QF2YLYK.js";
+} from "../chunk-LBHJJEKT.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
@@ -105,15 +105,15 @@ import {
   resolveBridgeStub,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-X4ES7QBT.js";
+} from "../chunk-BJTSKOH3.js";
 import {
   removeGeminiSettings
-} from "../chunk-TDOKDCFH.js";
-import "../chunk-75UYYIFJ.js";
-import "../chunk-AS4Z6KS4.js";
+} from "../chunk-RGSW36XH.js";
+import "../chunk-XV6S5PWW.js";
+import "../chunk-IFPOHFDJ.js";
 import {
-  rejectUnknownFlags
-} from "../chunk-GMXKITVA.js";
+  parseFlags
+} from "../chunk-NMUI3ZWG.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
 import {
@@ -121,32 +121,35 @@ import {
   isDisabledExport,
   removeClaudeAlias,
   shellProfileCandidates
-} from "../chunk-KAJDKYUM.js";
+} from "../chunk-WN3RACVD.js";
 import "../chunk-E46NE7FB.js";
-import "../chunk-5JWCWALO.js";
-import "../chunk-W47WL6JY.js";
-import "../chunk-XGP5VSQG.js";
-import "../chunk-WW24SG27.js";
-import "../chunk-5EFNBL6V.js";
+import "../chunk-DQLCFGHK.js";
+import "../chunk-33OOEVPG.js";
+import "../chunk-YPD3MTFU.js";
+import "../chunk-RJHX66EY.js";
+import "../chunk-XAO6EYGM.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-MA37WNVS.js";
-import "../chunk-JAKBCKEB.js";
-import "../chunk-M46WDK64.js";
-import "../chunk-7QLSKOSU.js";
+import "../chunk-YDR4BQ7R.js";
+import "../chunk-7BAO42UV.js";
+import "../chunk-SFAP4AJY.js";
+import "../chunk-PPY5N2E6.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-3RKIJM26.js";
+import "../chunk-Y5VKZNFN.js";
 import {
+  claudeConfigDir,
   claudeJson,
   claudeMcpReceipt,
   claudeSettings,
   claudeSettingsLocal,
   claudeSkillDir,
+  claudeUserConfigFile,
   codexAgentsMd,
   codexConfigToml,
   codexHookPositions,
   codexHooksJson,
+  codexMcpMixesCommandWithHttp,
   codexSkillDir,
   cursorPluginDir,
   cursorUserHooks,
@@ -168,21 +171,21 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-KZCYHWDF.js";
+} from "../chunk-MWLTTLPK.js";
 import {
   cleanNpmEnv,
   globalPackageState,
   npmIsOnPath,
   readGlobalFolder,
   readGlobalPrefix
-} from "../chunk-US3IT6ZC.js";
+} from "../chunk-CJ5TCFD4.js";
 import "../chunk-QENTGE75.js";
 import {
   getBaseUrl
-} from "../chunk-4XXZUFWN.js";
+} from "../chunk-BG4Y64FW.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-BMPZ5HVJ.js";
+} from "../chunk-ERK24P76.js";
 import {
   CLI_PACKAGE_NAMES,
   globalPackageFolder,
@@ -196,11 +199,12 @@ import {
   SUPPORT_EMAIL,
   isValidApiKey,
   redactSecrets
-} from "../chunk-762CDAJJ.js";
+} from "../chunk-AXJLJJ3M.js";
+import "../chunk-MLKGABMK.js";
 
 // bin/pushary-clean.ts
 import { existsSync as existsSync5, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync4 } from "fs";
-import { dirname, join as join5 } from "path";
+import { dirname as dirname2, join as join5 } from "path";
 import { homedir as homedir4, tmpdir } from "os";
 import { confirm } from "@inquirer/prompts";
 import { parse as parseTOML, stringify as stringifyTOML } from "smol-toml";
@@ -357,11 +361,11 @@ var skillsStoreRemoval = (home = homedir2()) => {
 // src/cli/claude-backups.ts
 import { existsSync as existsSync4, readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
+import { dirname, join as join3 } from "path";
 var BACKUP_PREFIX = ".claude.json.backup";
 var claudeJsonBackups = (home = homedir3()) => {
-  const rollingDir = join3(home, ".claude", "backups");
-  const legacy = join3(home, BACKUP_PREFIX);
+  const rollingDir = join3(claudeConfigDir(home), "backups");
+  const legacy = join3(dirname(claudeUserConfigFile(home)), BACKUP_PREFIX);
   const rolling = existsSync4(rollingDir) ? readdirSync2(rollingDir).filter((name) => name.startsWith(BACKUP_PREFIX)).sort().map((name) => join3(rollingDir, name)) : [];
   return existsSync4(legacy) ? [...rolling, legacy] : rolling;
 };
@@ -572,7 +576,7 @@ var guards = createGuards(() => dryRun, wouldNote);
 var guardedWrite = (path, contents) => guards.write(path, contents);
 var guardedRemove = (path, options) => guards.remove(path, options);
 var cursorPluginLeftovers = () => {
-  const parent = dirname(CURSOR_PLUGIN_DIR);
+  const parent = dirname2(CURSOR_PLUGIN_DIR);
   try {
     return readdirSync4(parent).filter(isCursorPluginLeftover).map((name) => join5(parent, name));
   } catch {
@@ -666,13 +670,13 @@ var cleanSettingsFile = (path, label, scope) => {
 };
 var agentConfigDirectories = () => [
   homedir4(),
-  dirname(CLAUDE_SETTINGS),
-  dirname(codexConfigToml()),
-  dirname(geminiSettings()),
-  dirname(CURSOR_USER_HOOKS),
+  dirname2(CLAUDE_SETTINGS),
+  dirname2(codexConfigToml()),
+  dirname2(geminiSettings()),
+  dirname2(CURSOR_USER_HOOKS),
   openCodeConfigDir(),
   fxConfigDir(),
-  ...vscodeSettingsTargets(existsSync5).map((settings) => dirname(settings))
+  ...vscodeSettingsTargets(existsSync5).map((settings) => dirname2(settings))
 ];
 var restoreTakeoverReceipts = () => {
   const targets = [
@@ -754,23 +758,26 @@ var main = async () => {
   console.log(`  ${bold("Pushary Clean")}`);
   console.log(`  ${dim("Removes all Pushary configuration")}`);
   console.log();
+  let flags;
   try {
-    rejectUnknownFlags(
-      process.argv.slice(2).filter((a) => a !== "clean"),
-      ["--dry-run", "--everything", "--yes", "-y", "--help", "-h"]
+    const args = process.argv.slice(2);
+    flags = parseFlags(
+      args[0] === "clean" ? args.slice(1) : args,
+      { bools: ["dry-run", "everything", "yes", "y"], values: [] }
     );
+    if (flags.command !== void 0 || flags.rest.length > 0) throw new Error("clean takes no positional arguments");
   } catch (err) {
     process.stderr.write(`  ! ${err instanceof Error ? err.message : String(err)}
 `);
     process.exit(EXIT.USAGE);
   }
-  dryRun = process.argv.includes("--dry-run");
-  const everything = process.argv.includes("--everything");
+  dryRun = flags.bools.has("dry-run");
+  const everything = flags.bools.has("everything");
   if (dryRun) {
     console.log(`  ${bold("Dry run")} ${dim("- nothing will be changed")}`);
     console.log();
   }
-  const assumeYes = dryRun || process.argv.includes("--yes") || process.argv.includes("-y");
+  const assumeYes = dryRun || flags.bools.has("yes") || flags.bools.has("y");
   if (!assumeYes && !process.stdin.isTTY) {
     console.log(`  ${yellow("!")} Non-interactive shell. Re-run with --yes to confirm removal.`);
     process.exit(1);
@@ -858,7 +865,7 @@ var main = async () => {
       console.log(`  ${skip} Claude Code MCP servers ${dim("(setup receipt is unreadable; left unchanged)")}`);
     } else if (receipt && restoreClaudeMcpServer(claudeJson2, receipt) || !receipt && removeClaudeMcpServers(claudeJson2)) {
       writeJson(CLAUDE_JSON, claudeJson2);
-      console.log(`  ${check} Claude Code MCP servers ${dim(receipt ? "(previous entry restored)" : "(removed from ~/.claude.json)")}`);
+      console.log(`  ${check} Claude Code MCP servers ${dim(receipt ? "(previous entry restored)" : `(removed from ${shortenHome(CLAUDE_JSON)})`)}`);
       if (keepShared && receipt) guardedRemove(CLAUDE_MCP_RECEIPT, { force: true });
     } else {
       if (receipt && !keepShared) incompleteClean = true;
@@ -975,7 +982,7 @@ var main = async () => {
     const trustRemoved = hookOwnerOf(codexHooksData) === "app" && keepShared ? false : removeCodexHookTrust(parsed2, codexHooksJson2, codexPositions);
     const hadPushary = config.includes("pushary");
     if (hadPushary || trustRemoved) {
-      const macAppKeepsCodexMcp = macAppKeeps("codex", codexMcpKey(parsed2));
+      const macAppKeepsCodexMcp = !codexMcpMixesCommandWithHttp(parsed2.mcp_servers?.pushary) && macAppKeeps("codex", codexMcpKey(parsed2));
       if (!macAppKeepsCodexMcp) {
         const mcpServers = parsed2.mcp_servers ?? {};
         delete mcpServers.pushary;