@pushary/agent-hooks 1.9.6 → 1.9.8

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 1.9.8
+
+- `pushary upgrade` and automatic updates no longer take over agents the Pushary Mac app connected. They used to replace the app's hooks with the CLI's and overwrite its MCP key for Claude Code, Codex, Gemini CLI, VS Code and OpenCode. An agent the app owns is now left exactly as the app wrote it and listed as kept for the Mac app, using the same rule setup uses. Pass `--take-over-hooks` to setup if you want the CLI to own it.
+- `pushary clean` keeps the Mac app's wiring for Qwen Code, CodeBuddy, Qoder, Droid and Devin while the app is installed, as it already did for the other agents. `clean --everything` still removes it.
+- `pushary disconnect cursor` removes the Cursor plugin setup installed in `~/.cursor/plugins/local/pushary`, including the `mcp.json` that held your API key, and setup's leftover copies of it. The plugin is kept, and the output says so, when the gate in `~/.cursor/hooks.json` that points into it could not be removed.
+- `pushary disconnect` removes the Pushary block it wrote to `AGENTS.md` (Codex, OpenCode), `GEMINI.md`, `QWEN.md` and `CODEBUDDY.md`. Only the text between the Pushary markers is removed. Skills are left in place.
+- `pushary disconnect <agent>` is no longer undone by the Mac app. It records the agent in `~/.pushary/declined-agents.json`, and Pushary.app versions that read that file leave the agent off until you connect it again from the app or with `pushary setup`.
+- `pushary mode`, `mode clear`, `wait <seconds>` and `suggestions` no longer say "This key was rejected" when the key is fine. Keys from `pushary login`, phone pairing and the Mac app cannot change approval settings, and these commands now say so, point you to the Pushary app, your phone or the dashboard, and exit with code 2.
+- `pushary sign-out --revoke` revokes those keys too, and then checks with pushary.com and tells you whether the key still works. Before, it could not revoke them and always said the key was still valid. `--json` adds `keyStillValid`.
+- When the Mac app signs out of the key setup borrowed from it, the background service stops once instead of restarting every 10 seconds, and `pushary doctor`, `pushary status` and commands that report a rejected key say the key was signed out on this Mac, tell you to run `pushary login`, and name the shell profile line that still exports the old key. Pushary does not edit that line. A background service with no key at all also stops instead of restarting.
+
+## 1.9.7
+
+- `pushary claude` and the `pushary daemon` commands wait at most 5 seconds for the background service again. Only setup and upgrade allow the 30 seconds a cold Windows start can need, so launching Claude no longer sits silent while the service starts.
+- An automatic update whose configuration refresh fails now retries after 5 minutes, then after an hour, then once a day, instead of every 5 minutes. On a Mac with phone-start on, each retry restarted the background service.
+- A refresh that cannot succeed until you change something (a legacy phone-start service, phone-start turned on without a usable agent, or a config file Pushary cannot rewrite) is no longer retried automatically. `pushary doctor` shows it, and running `pushary upgrade` after the fix finishes it.
+- When a Codex approval hook is turned off in Codex, setup and upgrade tell you to enable it in `/hooks` instead of asking you to trust it. A missing or background (asynchronous) approval hook points you to setup again, as doctor does.
+- Upgrades, including automatic ones, regenerate the OpenCode plugin Pushary installed, so the active directory fix from 1.9.4 reaches existing installs without running setup again. A `pushary.js` you wrote yourself is never touched, and no plugin is added where there was none.
+
 ## 1.9.6
 
 - Read-only shell approval no longer covers commands that make the shell evaluate quoted text again: arithmetic expansion (`$[ ]`), subscripted parameters (`$name[ ]`, including zsh flag prefixes) and `printf -v`. These ran a quoted command substitution in bash or zsh while being approved without asking. They now go to your normal approval.

package/README.md

@@ -210,11 +210,11 @@ claude       Run Claude Code through Pushary, reachable from your phone even whe
 daemon       Keep this machine reachable so your phone can START a new session
 status       One screen: which key is in force, whether the server accepts it, what can receive an approval
 login        Sign in from this terminal, no key to copy (--with-token to pipe one in)
-logout       Remove the key this machine stores, and say what it does not remove
-connect      Connect a phone without re-running setup (--app for the Pushary app)
+sign-out     Sign out: remove the key this machine stores, and say what it does not remove (also: logout)
+pair         Pair a phone without re-running setup (--app for the Pushary app; also: connect)
 bell         Free local bell when an agent finishes or needs you. No account, no key, no network
 doctor       Verify your Pushary installation is working
-disconnect   Turn off one agent (claude|codex|gemini|cursor)
+disconnect   Turn off one agent (claude|codex|gemini|cursor|opencode|qwen|codebuddy|qoder|droid|devin|fx)
 clean        Remove Pushary from this machine (--everything: the Mac app's setup too, --dry-run: preview)
 mode         Choose where approval requests appear
 wait         Show or set the "wait for your phone" ladder (pushary wait 45)

package/data/cursor-plugin/README.md

@@ -26,11 +26,7 @@ There are three things.
 
 You need two things: the plugin, and an API key.
 
-### Option 1: Cursor Marketplace (recommended)
-
-Open the Marketplace panel in Cursor, search for Pushary, and click install. Then set your API key (see below).
-
-### Option 2: CLI
+### Option 1: CLI (recommended)
 
 This also sets up Claude Code, Codex, and Hermes if you use them.
 
@@ -38,7 +34,7 @@ This also sets up Claude Code, Codex, and Hermes if you use them.
 npx pushary@latest setup
 ```
 
-### Option 3: Manual MCP
+### Option 2: Manual MCP
 
 Add this to `.cursor/mcp.json` in your project, or `~/.cursor/mcp.json` for every project:
 
@@ -106,7 +102,7 @@ Then reload Cursor with Developer: Reload Window.
 
 ## Security
 
-This repository has no secrets. Your key is read at runtime from `PUSHARY_API_KEY`. The gate script has no dependencies and only talks to pushary.com. Read `scripts/pushary-gate.mjs` to see exactly what it sends. See `SECURITY.md` for details.
+Your key is read at runtime from `PUSHARY_API_KEY`. The gate script has no dependencies. It sends approval and activity data to pushary.com by default; `PUSHARY_BASE_URL` can change that endpoint. Read `scripts/pushary-gate.mjs` to see exactly what it sends. See `SECURITY.md` for details.
 
 ## License
 

package/data/vscode-plugin/README.md

@@ -121,7 +121,7 @@ echo '{"hook_event_name":"PreToolUse","tool_name":"runTerminalCommand","tool_inp
 
 ## Security
 
-This repository has no secrets. Your key is read at runtime from `PUSHARY_API_KEY`, the plugin `.mcp.json`, or `~/.pushary/config.json`. The gate script has no dependencies and only talks to pushary.com. Command text is redacted for common secret shapes before it is sent. Read `scripts/pushary-gate.mjs` to see exactly what it sends. See `SECURITY.md` for details.
+Your key is read at runtime from `PUSHARY_API_KEY`, the plugin `.mcp.json`, or `~/.pushary/config.json`. The gate script has no dependencies. It sends approval and activity data to pushary.com by default; `PUSHARY_BASE_URL` and `PUSHARY_API_URL` can change its API endpoints. Command text is redacted for common secret shapes before it is sent. Read `scripts/pushary-gate.mjs` to see exactly what it sends. See `SECURITY.md` for details.
 
 ## License
 

package/dist/bin/pushary-bell-hook.js

@@ -1,39 +1,38 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-LBLCFD5K.js";
+} from "../chunk-IHFDPV7C.js";
 import {
   readHookInput
-} from "../chunk-HWQNQVY6.js";
-import "../chunk-VRT3EEZN.js";
+} from "../chunk-WWOHTTVP.js";
+import "../chunk-DPGSLWOS.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-NVGDMTX3.js";
-import "../chunk-SPXBXN23.js";
-import "../chunk-SJN22ADZ.js";
-import "../chunk-D7SOOVHX.js";
-import "../chunk-ZC3TF4LR.js";
-import "../chunk-UKNKYTTY.js";
-import "../chunk-Q23MMVTD.js";
-import "../chunk-5AXCOTIT.js";
-import "../chunk-7JTVYR5B.js";
-import "../chunk-KK54WQ74.js";
+import "../chunk-YIG2R3BJ.js";
+import "../chunk-DL7XWKYV.js";
+import "../chunk-LKLVTG3V.js";
+import "../chunk-2QGYMY7A.js";
+import "../chunk-3I6IVOZV.js";
+import "../chunk-WG3K4TCH.js";
+import "../chunk-ZBK6E2OR.js";
+import "../chunk-CLOSJ4ES.js";
+import "../chunk-M6BZZFVQ.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-DJ4BB264.js";
-import "../chunk-DA4FTGTK.js";
+import "../chunk-CD47ZFFZ.js";
+import "../chunk-DKMD6AWR.js";
 import "../chunk-POFBE6ZY.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-5BHROGRB.js";
-import "../chunk-W4Q7NFXU.js";
-import "../chunk-3BUAEQCY.js";
+import "../chunk-N4QSPI3B.js";
+import "../chunk-TCQ43LSG.js";
+import "../chunk-DUZVXBBU.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-75CA37FZ.js";
-import "../chunk-HJXZJF6O.js";
+import "../chunk-FQ2GORVG.js";
+import "../chunk-ZBHUHJG6.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-2QRE6QH2.js";
-import "../chunk-L6USMDTW.js";
-import "../chunk-Q4E56K4X.js";
+import "../chunk-5QUPKDI5.js";
+import "../chunk-7DVNSQWF.js";
+import "../chunk-I5IJRMNV.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,37 +5,37 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-LBLCFD5K.js";
+} from "../chunk-IHFDPV7C.js";
 import {
   addBellHooks,
   bellInstalled,
   removeBellHooks
-} from "../chunk-Q23MMVTD.js";
+} from "../chunk-WG3K4TCH.js";
 import {
   createIo
 } from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-FBD3QGVJ.js";
+} from "../chunk-CKV3UPMU.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-5BHROGRB.js";
+import "../chunk-N4QSPI3B.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-75CA37FZ.js";
+import "../chunk-FQ2GORVG.js";
 import {
   claudeSettings
-} from "../chunk-HJXZJF6O.js";
+} from "../chunk-ZBHUHJG6.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-T7E75EKA.js";
-import "../chunk-2QRE6QH2.js";
-import "../chunk-L6USMDTW.js";
-import "../chunk-Q4E56K4X.js";
+import "../chunk-5QUPKDI5.js";
+import "../chunk-7DVNSQWF.js";
+import "../chunk-I5IJRMNV.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,7 +8,7 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-RDK7FX5F.js";
+} from "../chunk-KF3UZLYI.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
@@ -18,24 +18,23 @@ import {
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-VRT3EEZN.js";
+} from "../chunk-DPGSLWOS.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-NVGDMTX3.js";
-import "../chunk-SPXBXN23.js";
-import "../chunk-SJN22ADZ.js";
-import "../chunk-D7SOOVHX.js";
+import "../chunk-YIG2R3BJ.js";
+import "../chunk-DL7XWKYV.js";
 import {
   ensureDaemonRunning
-} from "../chunk-ZC3TF4LR.js";
-import "../chunk-UKNKYTTY.js";
-import "../chunk-Q23MMVTD.js";
+} from "../chunk-LKLVTG3V.js";
+import "../chunk-2QGYMY7A.js";
+import "../chunk-3I6IVOZV.js";
+import "../chunk-WG3K4TCH.js";
 import {
   encryptRecord
-} from "../chunk-5AXCOTIT.js";
-import "../chunk-7JTVYR5B.js";
+} from "../chunk-ZBK6E2OR.js";
+import "../chunk-CLOSJ4ES.js";
 import {
   transcriptsEnabled
-} from "../chunk-KK54WQ74.js";
+} from "../chunk-M6BZZFVQ.js";
 import {
   needsShell,
   spawnClaude
@@ -51,7 +50,7 @@ import {
   repoKeyFor,
   reportEvent,
   scopePathFor
-} from "../chunk-CCDVL63C.js";
+} from "../chunk-KRCR2CRQ.js";
 import {
   DEFAULT_SESSION,
   markPendingCommandDelivered,
@@ -61,10 +60,8 @@ import {
   removePendingCommand,
   savePendingCommand
 } from "../chunk-N6IOSZOE.js";
-import "../chunk-DJ4BB264.js";
+import "../chunk-CD47ZFFZ.js";
 import {
-  DECISION_STOP_REASON,
-  UNVERIFIABLE_APPROVAL_REASON,
   askUser,
   cancelQuestion,
   isDecisionStopped,
@@ -72,36 +69,38 @@ import {
   nextLongPollMs,
   waitForAnswer,
   withdrawQuestion
-} from "../chunk-WN6WYUCV.js";
-import "../chunk-DA4FTGTK.js";
+} from "../chunk-2VZAALEJ.js";
+import "../chunk-DKMD6AWR.js";
 import "../chunk-POFBE6ZY.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-5BHROGRB.js";
+import "../chunk-N4QSPI3B.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-ZPW4MJOV.js";
-import "../chunk-4QKM44N6.js";
-import "../chunk-W4Q7NFXU.js";
+} from "../chunk-MKTJEXZ3.js";
+import "../chunk-LWOO567I.js";
+import "../chunk-TCQ43LSG.js";
 import {
   getMachineId
-} from "../chunk-3BUAEQCY.js";
+} from "../chunk-DUZVXBBU.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-75CA37FZ.js";
-import "../chunk-HJXZJF6O.js";
+import "../chunk-FQ2GORVG.js";
+import "../chunk-ZBHUHJG6.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-2QRE6QH2.js";
+} from "../chunk-5QUPKDI5.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-L6USMDTW.js";
+} from "../chunk-7DVNSQWF.js";
 import {
+  DECISION_STOP_REASON,
   KILL_REASON,
+  UNVERIFIABLE_APPROVAL_REASON,
   redactSecretsFromContent,
   resolveGate
-} from "../chunk-Q4E56K4X.js";
+} from "../chunk-I5IJRMNV.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {

package/dist/bin/pushary-clean.js

@@ -1,22 +1,34 @@
 #!/usr/bin/env node
+import {
+  appAgentKey,
+  macAppKeepsMcpEntry,
+  mcpServerBearer,
+  pusharyKey,
+  setupReceiptKey
+} from "../chunk-OP7IHC2I.js";
 import {
   PUSHARY_SKILL_NAME,
   PUSHARY_SKILL_SOURCE,
-  createGuards,
+  createGuards
+} from "../chunk-EUW7JL2K.js";
+import {
+  isCursorPluginLeftover,
   withoutPusharyCursorHooks
-} from "../chunk-6GERGJHF.js";
+} from "../chunk-TCWKTUAE.js";
 import {
   HERMES_PIP_PACKAGE,
-  planFxRemoval,
   readHermesStatus,
-  removeInstructionBlock,
   resolveHermesPython,
   runHermesConfigScript,
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-5PMTC2CB.js";
-import "../chunk-WUKUXICK.js";
+} from "../chunk-KFF7G225.js";
+import {
+  planFxRemoval,
+  removeInstructionBlock
+} from "../chunk-ZN3C6GBG.js";
+import "../chunk-HRULIYDU.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -28,48 +40,45 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-RIC6OOJX.js";
+} from "../chunk-MFF3ONG5.js";
 import {
   compatibleConfigFile,
   compatibleInstructionsFile,
   compatibleMcpFile,
   compatiblePermissionRuleFile,
-  removeCompatibleHooks,
-  removeCompatibleMcpServer
-} from "../chunk-TE5M6GGK.js";
-import {
   isClaudeMcpSnapshot,
   removeClaudeMcpServers,
+  removeCompatibleHooks,
+  removeCompatibleMcpServer,
   removePusharySettings,
   removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-IR5FRUPQ.js";
+} from "../chunk-KHNFLYJO.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-NVGDMTX3.js";
-import "../chunk-SPXBXN23.js";
+} from "../chunk-YIG2R3BJ.js";
+import "../chunk-DL7XWKYV.js";
+import {
+  disableDaemonService
+} from "../chunk-LKLVTG3V.js";
 import {
   liveBridgeProbe,
   resolveBridgeStub
-} from "../chunk-SJN22ADZ.js";
-import "../chunk-D7SOOVHX.js";
-import {
-  disableDaemonService
-} from "../chunk-ZC3TF4LR.js";
+} from "../chunk-2QGYMY7A.js";
 import {
   removeGeminiSettings
-} from "../chunk-UKNKYTTY.js";
-import "../chunk-Q23MMVTD.js";
+} from "../chunk-3I6IVOZV.js";
+import "../chunk-WG3K4TCH.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-CCDVL63C.js";
+import "../chunk-KRCR2CRQ.js";
 import "../chunk-N6IOSZOE.js";
-import "../chunk-DJ4BB264.js";
-import "../chunk-WN6WYUCV.js";
-import "../chunk-DA4FTGTK.js";
+import "../chunk-CD47ZFFZ.js";
+import "../chunk-2VZAALEJ.js";
+import "../chunk-DKMD6AWR.js";
 import "../chunk-POFBE6ZY.js";
 import {
   ansiPainter,
@@ -77,7 +86,7 @@ import {
 } from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-FBD3QGVJ.js";
+} from "../chunk-CKV3UPMU.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
@@ -85,16 +94,16 @@ import {
   CANDIDATE_RCS,
   isDisabledExport,
   removeClaudeAlias
-} from "../chunk-5BHROGRB.js";
-import "../chunk-ZPW4MJOV.js";
-import "../chunk-4QKM44N6.js";
-import "../chunk-W4Q7NFXU.js";
-import "../chunk-3BUAEQCY.js";
+} from "../chunk-N4QSPI3B.js";
+import "../chunk-MKTJEXZ3.js";
+import "../chunk-LWOO567I.js";
+import "../chunk-TCQ43LSG.js";
+import "../chunk-DUZVXBBU.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-75CA37FZ.js";
+import "../chunk-FQ2GORVG.js";
 import {
   bridgeAgentKey,
   claudeJson,
@@ -132,12 +141,12 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-HJXZJF6O.js";
+} from "../chunk-ZBHUHJG6.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-2QRE6QH2.js";
+import "../chunk-5QUPKDI5.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-L6USMDTW.js";
+} from "../chunk-7DVNSQWF.js";
 import {
   CLI_PACKAGE_NAMES,
   HOOK_COMPATIBLE_PROFILES,
@@ -149,7 +158,7 @@ import {
   globalRootFor,
   isValidApiKey,
   redactSecrets
-} from "../chunk-Q4E56K4X.js";
+} from "../chunk-I5IJRMNV.js";
 
 // bin/pushary-clean.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync4 } from "fs";
@@ -526,21 +535,47 @@ var APP_OWNED_ENTRIES = [
   // does the CLI. Not attributable, so it is kept whenever the app is installed
   // rather than removed and left registered against a path that is gone.
   "plugins",
-  "bridge-auth"
+  "bridge-auth",
+  "declined-agents.json"
 ];
 var isAppOwned = (name) => APP_OWNED_ENTRIES.includes(name);
 
-// src/shared-mcp-key.ts
-var asRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-var pusharyKey = (value) => typeof value === "string" && isValidApiKey(value.trim()) ? value.trim() : null;
-var bearerKey = (authorization) => typeof authorization === "string" && authorization.startsWith("Bearer ") ? pusharyKey(authorization.slice("Bearer ".length)) : null;
-var mcpServerBearer = (mcpServers) => bearerKey(asRecord(asRecord(asRecord(mcpServers)?.pushary)?.headers)?.Authorization);
-var appAgentKey = (bridgeAgentKey2) => pusharyKey(asRecord(bridgeAgentKey2)?.key);
-var setupReceiptKey = (claudeMcpReceipt2) => bearerKey(asRecord(asRecord(asRecord(claudeMcpReceipt2)?.installedPushary)?.headers)?.Authorization);
-var macAppKeepsMcpEntry = (entryKey, keys) => {
-  if (!entryKey) return true;
-  if (keys.appKey) return entryKey === keys.appKey;
-  return entryKey !== keys.setupKey;
+// src/compatible-clean.ts
+var keepsMcpServer = (profile, scope, io, home) => {
+  const mcpPath = compatibleMcpFile(profile, home);
+  if (!mcpPath) return false;
+  const mcp = io.readJson(mcpPath);
+  return mcp !== null && scope.keepsMcpEntry(profile.agentType, mcpServerBearer(mcp.mcpServers));
+};
+var removalsByPath = (profile, removalScope2, home) => {
+  const removals = /* @__PURE__ */ new Map();
+  const add = (path, removal) => {
+    if (path) removals.set(path, [...removals.get(path) ?? [], removal]);
+  };
+  add(compatibleConfigFile(profile, home), (config) => removeCompatibleHooks(config, profile, removalScope2));
+  if (removalScope2.keepMcpServer !== true) {
+    add(compatibleMcpFile(profile, home), (config) => removeCompatibleMcpServer(config, profile));
+    add(compatiblePermissionRuleFile(profile, home), removePusharyToolPermissions);
+  }
+  return removals;
+};
+var cleanInstructions = (profile, scope, io, home) => {
+  const path = compatibleInstructionsFile(profile, home);
+  if (!path) return null;
+  if (scope.keepAppWiring) return { path, outcome: "kept_for_app" };
+  return { path, outcome: io.removeInstructionBlock(path) ? "removed" : "absent" };
+};
+var cleanCompatibleAgent = (profile, scope, io, home) => {
+  const mcpKeptForApp = keepsMcpServer(profile, scope, io, home);
+  const removalScope2 = { keepAppWiring: scope.keepAppWiring, keepMcpServer: mcpKeptForApp };
+  const files = [...removalsByPath(profile, removalScope2, home)].map(([path, removals]) => {
+    const config = io.readJson(path);
+    if (!config) return { path, outcome: "not_found" };
+    if (!removals.reduce((changed, remove) => remove(config) || changed, false)) return { path, outcome: "unchanged" };
+    io.writeJson(path, config);
+    return { path, outcome: "cleaned" };
+  });
+  return { profile, files, mcpKeptForApp, instructions: cleanInstructions(profile, scope, io, home) };
 };
 
 // bin/pushary-clean.ts
@@ -598,12 +633,10 @@ var wouldNote = (action, path) => {
 var guards = createGuards(() => dryRun, wouldNote);
 var guardedWrite = (path, contents) => guards.write(path, contents);
 var guardedRemove = (path, options) => guards.remove(path, options);
-var CURSOR_PLUGIN_STAGING = ".pushary-staging-";
 var cursorPluginLeftovers = () => {
   const parent = dirname(CURSOR_PLUGIN_DIR);
-  const backupPrefix = `${CURSOR_PLUGIN_DIR.split("/").pop()}.pushary-backup-`;
   try {
-    return readdirSync4(parent).filter((name) => name.startsWith(backupPrefix) || name.startsWith(CURSOR_PLUGIN_STAGING)).map((name) => join6(parent, name));
+    return readdirSync4(parent).filter(isCursorPluginLeftover).map((name) => join6(parent, name));
   } catch {
     return [];
   }
@@ -1023,34 +1056,23 @@ var main = async () => {
   } else {
     console.log(`  ${skip} Codex skill directory ${dim("(not found)")}`);
   }
+  const compatibleScope = { keepAppWiring: keepShared, keepsMcpEntry: macAppKeeps };
+  const compatibleIo = { readJson, writeJson, removeInstructionBlock: guardedInstructionBlockRemoval };
   for (const profile of HOOK_COMPATIBLE_PROFILES) {
-    const edits = [
-      [compatibleConfigFile(profile), (config) => removeCompatibleHooks(config, profile)],
-      ...compatibleMcpFile(profile) ? [[compatibleMcpFile(profile), (config) => removeCompatibleMcpServer(config, profile)]] : [],
-      ...compatiblePermissionRuleFile(profile) ? [[compatiblePermissionRuleFile(profile), removePusharyToolPermissions]] : []
-    ];
-    const byPath = /* @__PURE__ */ new Map();
-    for (const [path, edit] of edits) byPath.set(path, [...byPath.get(path) ?? [], edit]);
-    for (const [path, removals] of byPath) {
-      const config = readJson(path);
-      if (!config) {
-        console.log(`  ${skip} ${profile.label} ${shortenHome(path)} ${dim("(not found)")}`);
-        continue;
-      }
-      if (removals.reduce((changed, remove) => remove(config) || changed, false)) {
-        writeJson(path, config);
-        console.log(`  ${check} ${profile.label} ${shortenHome(path)} ${dim(did("cleaned"))}`);
-      } else {
-        console.log(`  ${skip} ${profile.label} ${shortenHome(path)} ${dim("(no pushary entries)")}`);
-      }
+    const report = cleanCompatibleAgent(profile, compatibleScope, compatibleIo);
+    for (const file of report.files) {
+      const label2 = `${profile.label} ${shortenHome(file.path)}`;
+      if (file.outcome === "not_found") console.log(`  ${skip} ${label2} ${dim("(not found)")}`);
+      else if (file.outcome === "cleaned") console.log(`  ${check} ${label2} ${dim(did("cleaned"))}`);
+      else console.log(`  ${skip} ${label2} ${dim(keepShared ? "(nothing the CLI wrote)" : "(no pushary entries)")}`);
     }
-    const instructions = compatibleInstructionsFile(profile);
+    if (report.mcpKeptForApp) console.log(`  ${skip} ${profile.label} MCP server ${dim("(kept: the Mac app uses it)")}`);
+    const instructions = report.instructions;
     if (!instructions) continue;
-    if (guardedInstructionBlockRemoval(instructions)) {
-      console.log(`  ${check} ${profile.label} ${shortenHome(instructions)} ${dim("(removed Pushary block)")}`);
-    } else {
-      console.log(`  ${skip} ${profile.label} ${shortenHome(instructions)} ${dim("(no pushary block)")}`);
-    }
+    const label = `${profile.label} ${shortenHome(instructions.path)}`;
+    if (instructions.outcome === "kept_for_app") console.log(`  ${skip} ${label} ${dim("(kept: the Mac app uses it)")}`);
+    else if (instructions.outcome === "removed") console.log(`  ${check} ${label} ${dim("(removed Pushary block)")}`);
+    else console.log(`  ${skip} ${label} ${dim("(no pushary block)")}`);
   }
   const geminiSettingsPath = geminiSettings();
   const geminiSettings2 = readJson(geminiSettingsPath);