agentapprove 0.1.10 → 0.1.12

package/dist/cli.js

@@ -2327,12 +2327,185 @@ var source_default = chalk;
 
 // src/cli.ts
 var import_qrcode_terminal = __toESM(require_main(), 1);
-import { existsSync, readFileSync, writeFileSync, mkdirSync, copyFileSync, renameSync, readdirSync, statSync } from "fs";
+import { existsSync as existsSync2, readFileSync, writeFileSync, mkdirSync, copyFileSync, renameSync, readdirSync as readdirSync2, statSync, lstatSync, realpathSync as realpathSync2, rmSync as rmSync2 } from "fs";
 import { homedir, hostname, platform } from "os";
-import { join, dirname, basename } from "path";
+import { join, dirname as dirname2 } from "path";
 import { execSync, spawnSync } from "child_process";
 import { randomBytes, createHash } from "crypto";
-var VERSION = "0.1.10";
+
+// src/uninstall-utils.ts
+import { existsSync, readdirSync, realpathSync, rmSync } from "fs";
+import { basename, dirname, sep } from "path";
+var INSTALLER_COMMAND_DESCRIPTIONS = {
+  uninstall: "Remove hooks/plugins from agent configs and keep local Agent Approve state",
+  purge: "Remove hooks/plugins and delete local Agent Approve state"
+};
+function isPathWithinBase(baseDir, candidatePath) {
+  const safeBase = sanitizeAbsolutePath(baseDir);
+  const safeCandidate = sanitizeAbsolutePath(candidatePath);
+  if (!safeBase || !safeCandidate) {
+    return false;
+  }
+  return safeCandidate === safeBase || safeCandidate.startsWith(`${safeBase}${sep}`);
+}
+function safeJoinWithinBase(baseDir, ...parts) {
+  const safeBase = sanitizeAbsolutePath(baseDir);
+  if (!safeBase || parts.some((part) => !isSafeChildPathPart(part))) {
+    return null;
+  }
+  const childSegments = parts.flatMap(splitPathSegments);
+  const candidatePath = appendPathSegments(safeBase, childSegments);
+  if (!isPathWithinBase(safeBase, candidatePath)) {
+    return null;
+  }
+  return candidatePath;
+}
+function sanitizeAbsolutePath(path) {
+  if (!path || path.includes("\x00")) {
+    return null;
+  }
+  const root = getPathRoot(path);
+  if (!root) {
+    return null;
+  }
+  const segments = splitPathSegments(path);
+  if (segments.includes("..")) {
+    return null;
+  }
+  if (root === sep) {
+    return segments.length > 0 ? `${sep}${segments.join(sep)}` : sep;
+  }
+  const [, ...rest] = segments;
+  return rest.length > 0 ? `${root}${rest.join(sep)}` : root;
+}
+function isSafeChildPathPart(part) {
+  if (!part || part.includes("\x00") || getPathRoot(part)) {
+    return false;
+  }
+  const segments = splitPathSegments(part);
+  if (segments.some((segment) => segment === "..")) {
+    return false;
+  }
+  return true;
+}
+function getPathRoot(path) {
+  if (path.startsWith("/") || path.startsWith("\\")) {
+    return sep;
+  }
+  const windowsDrive = path.match(/^[A-Za-z]:[\\/]/);
+  if (windowsDrive) {
+    return `${windowsDrive[0][0]}:${sep}`;
+  }
+  return null;
+}
+function splitPathSegments(path) {
+  return path.split(/[\\/]+/).filter(Boolean).filter((segment) => segment !== ".");
+}
+function appendPathSegments(basePath, childSegments) {
+  if (childSegments.length === 0) {
+    return basePath;
+  }
+  return basePath.endsWith(sep) ? `${basePath}${childSegments.join(sep)}` : `${basePath}${sep}${childSegments.join(sep)}`;
+}
+function createRemovalTarget(path, kind, recursive = false) {
+  if (!existsSync(path)) {
+    return null;
+  }
+  let actualPath = path;
+  let displayPath = path;
+  try {
+    actualPath = realpathSync(path);
+    if (actualPath !== path) {
+      displayPath = `${path} -> ${actualPath}`;
+    }
+  } catch {}
+  return { path, actualPath, displayPath, kind, recursive };
+}
+function removeRemovalTarget(target) {
+  if (!existsSync(target.path) && !existsSync(target.actualPath)) {
+    return false;
+  }
+  try {
+    rmSync(target.actualPath, { recursive: target.recursive, force: true });
+    if (target.path !== target.actualPath) {
+      rmSync(target.path, { recursive: false, force: true });
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function getOpenClawPluginTargets(openclawConfigPath) {
+  const configDir = dirname(openclawConfigPath);
+  const openclawPath = safeJoinWithinBase(configDir, "extensions", "openclaw");
+  const legacyPath = safeJoinWithinBase(configDir, "extensions", "agentapprove");
+  return [
+    openclawPath ? createRemovalTarget(openclawPath, "plugin_artifact", true) : null,
+    legacyPath ? createRemovalTarget(legacyPath, "plugin_artifact", true) : null
+  ].filter((target) => target !== null);
+}
+function getOpenCodePluginTargets(opencodeConfigDir) {
+  const pluginPath = safeJoinWithinBase(opencodeConfigDir, "node_modules", "@agentapprove", "opencode");
+  return [
+    pluginPath ? createRemovalTarget(pluginPath, "plugin_artifact", true) : null
+  ].filter((target) => target !== null);
+}
+function collectBackupTargets(configPaths) {
+  const targets = [];
+  for (const configPath of configPaths) {
+    const configDir = dirname(configPath);
+    if (!existsSync(configDir)) {
+      continue;
+    }
+    const configBase = basename(configPath);
+    for (const entry of readdirSync(configDir)) {
+      if (!entry.startsWith(`${configBase}.backup.`)) {
+        continue;
+      }
+      const backupPath = safeJoinWithinBase(configDir, entry);
+      const target = backupPath ? createRemovalTarget(backupPath, "backup") : null;
+      if (target) {
+        targets.push(target);
+      }
+    }
+  }
+  return targets;
+}
+function getManagedStateTargets(agentApproveDir) {
+  const reversible = [
+    safeJoinWithinBase(agentApproveDir, "env"),
+    safeJoinWithinBase(agentApproveDir, "env.disabled"),
+    safeJoinWithinBase(agentApproveDir, "hook-debug.log"),
+    safeJoinWithinBase(agentApproveDir, "hooks"),
+    safeJoinWithinBase(agentApproveDir, "install.sh"),
+    safeJoinWithinBase(agentApproveDir, "copilot-cli-hooks.json")
+  ].map((path) => path ? createRemovalTarget(path, "local_state", path.endsWith(`${sep}hooks`)) : null).filter((target) => target !== null);
+  const crypto = [
+    safeJoinWithinBase(agentApproveDir, "e2e-key"),
+    safeJoinWithinBase(agentApproveDir, "e2e-root-key"),
+    safeJoinWithinBase(agentApproveDir, "e2e-server-key"),
+    safeJoinWithinBase(agentApproveDir, "e2e-rotation.json")
+  ].map((path) => path ? createRemovalTarget(path, "crypto_material") : null).filter((target) => target !== null);
+  if (existsSync(agentApproveDir)) {
+    for (const entry of readdirSync(agentApproveDir)) {
+      if (!/^e2e-key\.[^.]+\.bak$/.test(entry)) {
+        continue;
+      }
+      const cryptoPath = safeJoinWithinBase(agentApproveDir, entry);
+      const target = cryptoPath ? createRemovalTarget(cryptoPath, "crypto_material") : null;
+      if (target) {
+        crypto.push(target);
+      }
+    }
+  }
+  return { reversible, crypto };
+}
+function shouldDeleteCryptoMaterial(purgeConfirmed, firstKeyConfirmation, secondKeyConfirmation) {
+  return purgeConfirmed && firstKeyConfirmation && secondKeyConfirmation;
+}
+
+// src/cli.ts
+var VERSION = "0.1.12";
 function getApiUrl() {
   return process.env.AGENTAPPROVE_API || "https://api.agentapprove.com";
 }
@@ -2352,7 +2525,7 @@ function hasFlag2(flag) {
 }
 function updateEnvValue(key, value) {
   const envPath = join(getAgentApproveDir(), "env");
-  if (!existsSync(envPath))
+  if (!existsSync2(envPath))
     return;
   let content = readFileSync(envPath, "utf-8");
   const pattern = new RegExp(`^${key}=.*$`, "m");
@@ -2380,8 +2553,8 @@ function getCommand() {
   }
   return filtered[0] || "install";
 }
-var OPENCODE_PLUGIN_VERSION = "0.1.6";
-var OPENCLAW_PLUGIN_VERSION = "0.2.5";
+var OPENCODE_PLUGIN_VERSION = "0.1.8";
+var OPENCLAW_PLUGIN_VERSION = "0.2.7";
 var OPENCLAW_PLUGIN_SPEC = `@agentapprove/openclaw@${OPENCLAW_PLUGIN_VERSION}`;
 var AGENTS = {
   "claude-code": {
@@ -2494,6 +2667,53 @@ var AGENTS = {
     ]
   }
 };
+var SHARED_HOOK_FILES = ["common.sh"];
+var STATUS_FIELD_LABELS = {
+  AGENTAPPROVE_API: "API URL",
+  AGENTAPPROVE_TOKEN: "Token",
+  AGENTAPPROVE_PRIVACY: "Privacy",
+  AGENTAPPROVE_RETENTION_DAYS: "Retention",
+  AGENTAPPROVE_CONFIG_SET_AT: "Configured at",
+  AGENTAPPROVE_DEBUG_LOG: "Debug logging",
+  AGENTAPPROVE_E2E_MODE: "Security mode",
+  AGENTAPPROVE_E2E_ENABLED: "E2E encryption",
+  AGENTAPPROVE_FAIL_BEHAVIOR: "If unreachable"
+};
+var HOOK_STATUS_LABELS = {
+  PreToolUse: "Tool approval",
+  PostToolUse: "Tool completed",
+  PostToolUseFailure: "Tool failed",
+  PermissionRequest: "Permission request",
+  UserPromptSubmit: "Prompt submitted",
+  SessionStart: "Session start",
+  SessionEnd: "Session end",
+  Stop: "Stop",
+  sessionStart: "Session start",
+  sessionEnd: "Session end",
+  beforeShellExecution: "Shell approval",
+  beforeMCPExecution: "MCP approval",
+  preToolUse: "Tool approval",
+  afterShellExecution: "Shell completed",
+  afterMCPExecution: "MCP completed",
+  postToolUse: "Tool completed",
+  beforeSubmitPrompt: "Prompt submitted",
+  subagentStart: "Subagent start",
+  subagentStop: "Subagent stop",
+  preCompact: "Pre-compact",
+  afterAgentThought: "Agent thinking",
+  afterAgentResponse: "Agent response",
+  BeforeTool: "Tool approval",
+  AfterTool: "Tool completed",
+  BeforeAgent: "Prompt submitted",
+  AfterAgent: "Stop",
+  BeforeModel: "Model request",
+  AfterModel: "Model response",
+  Notification: "Notification",
+  userPromptSubmitted: "Prompt submitted",
+  errorOccurred: "Error",
+  SubagentStart: "Subagent start",
+  SubagentStop: "Subagent stop"
+};
 function findGitBash() {
   if (!isWindows())
     return null;
@@ -2505,7 +2725,7 @@ function findGitBash() {
     join(process.env.ProgramW6432 || "", "Git", "bin", "bash.exe")
   ].filter(Boolean);
   for (const candidate of candidates) {
-    if (existsSync(candidate)) {
+    if (existsSync2(candidate)) {
       return candidate;
     }
   }
@@ -2513,7 +2733,7 @@ function findGitBash() {
     const result = execSync("where bash", { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] });
     const firstLine = result.trim().split(`
 `)[0];
-    if (firstLine && existsSync(firstLine)) {
+    if (firstLine && existsSync2(firstLine)) {
       return firstLine;
     }
   } catch {}
@@ -2550,7 +2770,7 @@ function getVSCodeSettingsPaths() {
   return paths;
 }
 function findInstalledVSCodeVariants() {
-  return getVSCodeSettingsPaths().filter(({ path }) => existsSync(dirname(path)));
+  return getVSCodeSettingsPaths().filter(({ path }) => existsSync2(dirname2(path)));
 }
 function stripJsonComments(content) {
   let result = "";
@@ -2599,7 +2819,7 @@ function stripJsonComments(content) {
   return result;
 }
 function readJsoncConfig(configPath) {
-  if (!existsSync(configPath))
+  if (!existsSync2(configPath))
     return {};
   try {
     const content = readFileSync(configPath, "utf-8");
@@ -2640,7 +2860,7 @@ function removeFromVSCodeHookLocations() {
   const hookLocation = "~/.agentapprove/hooks";
   const modified = [];
   for (const { path: settingsPath, variant } of getVSCodeSettingsPaths()) {
-    if (!existsSync(settingsPath))
+    if (!existsSync2(settingsPath))
       continue;
     try {
       const config = readJsoncConfig(settingsPath);
@@ -2667,36 +2887,238 @@ function detectInstalledAgents() {
         installed.push(id);
       }
     } else if (id === "copilot-cli") {
-      if (existsSync(join(homedir(), ".copilot"))) {
+      if (existsSync2(join(homedir(), ".copilot"))) {
         installed.push(id);
       }
     } else if (id === "openclaw") {
-      if (existsSync(join(homedir(), ".openclaw"))) {
+      if (existsSync2(join(homedir(), ".openclaw"))) {
         installed.push(id);
       }
     } else if (id === "codex") {
-      if (existsSync(join(homedir(), ".codex"))) {
+      if (existsSync2(join(homedir(), ".codex"))) {
         installed.push(id);
       }
     } else if (id === "opencode") {
-      if (existsSync(getOpenCodeConfigDir())) {
+      if (existsSync2(getOpenCodeConfigDir())) {
         installed.push(id);
       }
     } else {
-      const configDir = dirname(agent.configPath);
-      if (existsSync(configDir)) {
+      const configDir = dirname2(agent.configPath);
+      if (existsSync2(configDir)) {
         installed.push(id);
       }
     }
   }
   return installed;
 }
+function getDownloadableHookFilesForAgent(agentId) {
+  const agent = AGENTS[agentId];
+  if (!agent)
+    return [];
+  return agent.hooks.filter((hook) => !hook.isPlugin).map((hook) => hook.file);
+}
+function buildHookDownloadPlan(agentIds) {
+  const files = new Set;
+  const perAgent = [];
+  for (const agentId of agentIds) {
+    const agent = AGENTS[agentId];
+    if (!agent)
+      continue;
+    const agentFiles = [...new Set(getDownloadableHookFilesForAgent(agentId))];
+    if (agentFiles.length === 0) {
+      continue;
+    }
+    perAgent.push({
+      agentId,
+      agentName: agent.name,
+      count: agentFiles.length
+    });
+    for (const file of agentFiles) {
+      files.add(file);
+    }
+  }
+  const sharedCount = perAgent.length > 0 ? SHARED_HOOK_FILES.length : 0;
+  if (sharedCount > 0) {
+    for (const file of SHARED_HOOK_FILES) {
+      files.add(file);
+    }
+  }
+  return {
+    files: [...files],
+    perAgent,
+    sharedCount
+  };
+}
+function formatHookDownloadSummary(plan) {
+  const parts = plan.perAgent.map((entry) => `${entry.agentName}: ${entry.count}`);
+  if (plan.sharedCount > 0) {
+    parts.push(`shared: ${plan.sharedCount}`);
+  }
+  return parts.join(", ");
+}
+function parseEnvAssignment(line) {
+  if (!line.includes("=")) {
+    return null;
+  }
+  const [key, ...valueParts] = line.split("=");
+  return {
+    key: key.trim(),
+    value: valueParts.join("=").trim()
+  };
+}
+function formatStatusValue(key, value) {
+  switch (key) {
+    case "AGENTAPPROVE_TOKEN":
+      return value.slice(0, 15) + "...";
+    case "AGENTAPPROVE_RETENTION_DAYS":
+      return `${value} days`;
+    case "AGENTAPPROVE_CONFIG_SET_AT": {
+      const timestamp = Number.parseInt(value, 10);
+      if (Number.isFinite(timestamp)) {
+        return new Date(timestamp * 1000).toLocaleString();
+      }
+      return value;
+    }
+    case "AGENTAPPROVE_DEBUG_LOG":
+    case "AGENTAPPROVE_E2E_ENABLED":
+      return value === "true" ? "Enabled" : "Disabled";
+    case "AGENTAPPROVE_E2E_MODE":
+      return value.charAt(0).toUpperCase() + value.slice(1);
+    case "AGENTAPPROVE_FAIL_BEHAVIOR":
+    case "AGENTAPPROVE_PRIVACY":
+      return value.charAt(0).toUpperCase() + value.slice(1);
+    default:
+      return value;
+  }
+}
+function formatHookStatusLabel(name) {
+  const explicitLabel = HOOK_STATUS_LABELS[name];
+  if (explicitLabel) {
+    return explicitLabel;
+  }
+  return name.replace(/\*/g, "events").replace(/([a-z])([A-Z])/g, "$1 $2").replace(/[-_]/g, " ").replace(/\s+/g, " ").trim().replace(/^./, (letter) => letter.toUpperCase());
+}
 function getAgentApproveDir() {
   return join(homedir(), ".agentapprove");
 }
+function uniqueRemovalTargets(targets) {
+  const seen = new Set;
+  const unique = [];
+  for (const target of targets) {
+    const key = `${target.kind}:${target.actualPath}`;
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    unique.push(target);
+  }
+  return unique;
+}
+function buildUninstallPlan() {
+  const configuredAgents = detectInstalledAgents();
+  const pluginArtifactTargets = uniqueRemovalTargets([
+    ...getOpenClawPluginTargets(AGENTS.openclaw.configPath),
+    ...getOpenCodePluginTargets(getOpenCodeConfigDir())
+  ]);
+  return {
+    configuredAgents,
+    pluginArtifactTargets,
+    backupTargets: uniqueRemovalTargets(collectBackupTargets(Object.values(AGENTS).map((agent) => agent.configPath))),
+    managedState: getManagedStateTargets(getAgentApproveDir())
+  };
+}
+function hasUninstallWork(mode, plan) {
+  if (plan.configuredAgents.length > 0 || plan.pluginArtifactTargets.length > 0) {
+    return true;
+  }
+  if (mode === "purge") {
+    return plan.backupTargets.length > 0 || plan.managedState.reversible.length > 0 || plan.managedState.crypto.length > 0;
+  }
+  return false;
+}
+function printRemovalTargets(title, targets) {
+  if (targets.length === 0) {
+    return;
+  }
+  console.log(source_default.dim(`    ${title}`));
+  for (const target of targets) {
+    console.log(source_default.dim(`      - ${target.displayPath}`));
+  }
+}
+async function confirmUninstallPlan(mode, plan) {
+  console.log();
+  console.log(source_default.cyan(`  ${mode === "purge" ? "Purge" : "Uninstall"} plan`));
+  if (plan.configuredAgents.length > 0) {
+    console.log(source_default.dim(`    Agent configs: ${plan.configuredAgents.join(", ")}`));
+  }
+  printRemovalTargets("Plugin files to remove:", plan.pluginArtifactTargets);
+  if (mode === "purge") {
+    printRemovalTargets("Local Agent Approve files to remove:", plan.managedState.reversible);
+    printRemovalTargets("Backups to remove:", plan.backupTargets);
+    printRemovalTargets("Irreversible E2E material to remove:", plan.managedState.crypto);
+  } else {
+    console.log(source_default.dim("    Local Agent Approve state kept:"));
+    console.log(source_default.dim("      - ~/.agentapprove/env and env.disabled"));
+    console.log(source_default.dim("      - ~/.agentapprove/hooks, install.sh, and hook-debug.log"));
+    console.log(source_default.dim("      - E2E keys and rotation metadata"));
+    console.log(source_default.dim("      - OS credential-store token and config backups"));
+  }
+  console.log();
+  const proceed = await ce({
+    message: mode === "purge" ? "Proceed with purge? This removes agent hooks/plugins and local Agent Approve state." : "Proceed with uninstall? This removes agent hooks/plugins but keeps local Agent Approve state."
+  });
+  if (lD(proceed) || !proceed) {
+    ge("Cancelled.");
+    return false;
+  }
+  if (mode === "purge" && plan.managedState.crypto.length > 0) {
+    const firstKeyConfirm = await ce({
+      message: "Delete E2E keys and rotation metadata? You may lose access to encrypted local history on this machine."
+    });
+    if (lD(firstKeyConfirm) || !firstKeyConfirm) {
+      v2.warn("Purge cancelled. Run `npx agentapprove uninstall` if you want to keep local keys and config.");
+      return false;
+    }
+    const secondKeyConfirm = await ce({
+      message: "Final confirmation: permanently delete the E2E keys and rotation metadata?"
+    });
+    if (lD(secondKeyConfirm) || !shouldDeleteCryptoMaterial(true, firstKeyConfirm === true, secondKeyConfirm === true)) {
+      v2.warn("Purge cancelled. Run `npx agentapprove uninstall` if you want to keep local keys and config.");
+      return false;
+    }
+  }
+  return true;
+}
+function pruneEmptyDir(path) {
+  if (!existsSync2(path)) {
+    return;
+  }
+  try {
+    if (readdirSync2(path).length === 0) {
+      rmSync2(path, { recursive: false, force: true });
+    }
+  } catch {}
+}
+function finalizeAgentApproveDirPurge(agentApproveDir) {
+  if (!existsSync2(agentApproveDir)) {
+    return;
+  }
+  try {
+    const stat = lstatSync(agentApproveDir);
+    if (stat.isSymbolicLink()) {
+      const actualDir = realpathSync2(agentApproveDir);
+      if (existsSync2(actualDir) && readdirSync2(actualDir).length === 0) {
+        rmSync2(actualDir, { recursive: false, force: true });
+      }
+      rmSync2(agentApproveDir, { recursive: false, force: true });
+      return;
+    }
+  } catch {}
+  pruneEmptyDir(agentApproveDir);
+}
 function readExistingConfig() {
   const envPath = join(getAgentApproveDir(), "env");
-  if (!existsSync(envPath)) {
+  if (!existsSync2(envPath)) {
     return null;
   }
   try {
@@ -2704,10 +3126,12 @@ function readExistingConfig() {
     const config = {};
     for (const line of content.split(`
 `)) {
-      if (line.startsWith("#") || !line.includes("="))
+      if (line.startsWith("#"))
+        continue;
+      const assignment = parseEnvAssignment(line);
+      if (!assignment)
         continue;
-      const [key, ...valueParts] = line.split("=");
-      const value = valueParts.join("=").trim();
+      const { key, value } = assignment;
       switch (key.trim()) {
         case "AGENTAPPROVE_API":
           config.apiUrl = value;
@@ -2727,6 +3151,9 @@ function readExistingConfig() {
         case "AGENTAPPROVE_E2E_MODE":
           config.e2eMode = value;
           break;
+        case "AGENTAPPROVE_E2E_ENABLED":
+          config.e2eEnabled = value === "true";
+          break;
         case "AGENTAPPROVE_FAIL_BEHAVIOR":
           config.failBehavior = value;
           break;
@@ -2739,11 +3166,11 @@ function readExistingConfig() {
 }
 function discoverE2EKeys() {
   const dir = getAgentApproveDir();
-  if (!existsSync(dir))
+  if (!existsSync2(dir))
     return [];
   const keys = [];
   const currentPath = join(dir, "e2e-key");
-  if (existsSync(currentPath)) {
+  if (existsSync2(currentPath)) {
     try {
       const hex = readFileSync(currentPath, "utf-8").trim();
       if (hex.length === 64) {
@@ -2753,7 +3180,7 @@ function discoverE2EKeys() {
     } catch {}
   }
   try {
-    const files = readdirSync(dir).filter((f2) => f2.startsWith("e2e-key.") && f2.endsWith(".bak"));
+    const files = readdirSync2(dir).filter((f2) => f2.startsWith("e2e-key.") && f2.endsWith(".bak"));
     for (const file of files) {
       const fullPath = join(dir, file);
       try {
@@ -2769,7 +3196,7 @@ function discoverE2EKeys() {
 }
 function readRotationConfig() {
   const configPath = join(getAgentApproveDir(), "e2e-rotation.json");
-  if (!existsSync(configPath))
+  if (!existsSync2(configPath))
     return null;
   try {
     return JSON.parse(readFileSync(configPath, "utf-8"));
@@ -2783,11 +3210,11 @@ function writeRotationConfig(config) {
 }
 function ensureAgentApproveDir() {
   const dir = getAgentApproveDir();
-  if (!existsSync(dir)) {
+  if (!existsSync2(dir)) {
     mkdirSync(dir, { recursive: true, mode: 448 });
   }
   const hooksDir = join(dir, "hooks");
-  if (!existsSync(hooksDir)) {
+  if (!existsSync2(hooksDir)) {
     mkdirSync(hooksDir, { recursive: true, mode: 448 });
   }
 }
@@ -2796,14 +3223,14 @@ function migrateE2ERootKey() {
   const keyPath = join(dir, "e2e-key");
   const rootKeyPath = join(dir, "e2e-root-key");
   const rotationPath = join(dir, "e2e-rotation.json");
-  if (!existsSync(keyPath) || existsSync(rootKeyPath))
+  if (!existsSync2(keyPath) || existsSync2(rootKeyPath))
     return;
   try {
     const keyHex = readFileSync(keyPath, "utf-8").trim();
     if (keyHex.length !== 64)
       return;
     writeFileSync(rootKeyPath, keyHex, { mode: 384 });
-    if (!existsSync(rotationPath)) {
+    if (!existsSync2(rotationPath)) {
       const keyId = createHash("sha256").update(Buffer.from(keyHex, "hex")).digest("hex").slice(0, 8);
       writeRotationConfig({
         rootKeyId: keyId,
@@ -2815,7 +3242,7 @@ function migrateE2ERootKey() {
   } catch {}
 }
 function backupConfig(configPath) {
-  if (!existsSync(configPath)) {
+  if (!existsSync2(configPath)) {
     return null;
   }
   const timestamp = new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19);
@@ -2824,7 +3251,7 @@ function backupConfig(configPath) {
   return backupPath;
 }
 function readJsonConfig(configPath) {
-  if (!existsSync(configPath)) {
+  if (!existsSync2(configPath)) {
     return {};
   }
   try {
@@ -2835,21 +3262,21 @@ function readJsonConfig(configPath) {
   }
 }
 function writeJsonConfig(configPath, config) {
-  const dir = dirname(configPath);
-  if (!existsSync(dir)) {
+  const dir = dirname2(configPath);
+  if (!existsSync2(dir)) {
     mkdirSync(dir, { recursive: true, mode: 448 });
   }
   writeFileSync(configPath, JSON.stringify(config, null, 2) + `
 `);
 }
 function ensureCodexFeatureFlag(configPath = join(homedir(), ".codex", "config.toml")) {
-  const dir = dirname(configPath);
-  if (!existsSync(dir)) {
+  const dir = dirname2(configPath);
+  if (!existsSync2(dir)) {
     mkdirSync(dir, { recursive: true, mode: 448 });
   }
   const sectionHeader = "[features]";
   const desiredLine = "codex_hooks = true";
-  if (!existsSync(configPath)) {
+  if (!existsSync2(configPath)) {
     writeFileSync(configPath, `${sectionHeader}
 ${desiredLine}
 `, { mode: 384 });
@@ -2909,7 +3336,7 @@ ${desiredLine}
   return { updated: true, backupPath };
 }
 function disableCodexFeatureFlag(configPath = join(homedir(), ".codex", "config.toml")) {
-  if (!existsSync(configPath)) {
+  if (!existsSync2(configPath)) {
     return { updated: false, backupPath: null };
   }
   const original = readFileSync(configPath, "utf-8");
@@ -3197,7 +3624,7 @@ async function installHooksForAgent(agentId, hooksDir, mode = "approval") {
     }
     hooks.internal.enabled = true;
     writeJsonConfig(agent.configPath, config);
-    installedHooks.push("openclaw");
+    installedHooks.push(installResult.label);
     return { success: true, backupPath, hooks: installedHooks };
   }
   if (agentId === "opencode") {
@@ -3212,13 +3639,13 @@ async function installHooksForAgent(agentId, hooksDir, mode = "approval") {
     const opencodePkgPath = join(getOpenCodeConfigDir(), "package.json");
     try {
       let pkgJson = {};
-      if (existsSync(opencodePkgPath)) {
+      if (existsSync2(opencodePkgPath)) {
         pkgJson = JSON.parse(readFileSync(opencodePkgPath, "utf-8"));
       }
       if (!pkgJson.dependencies) {
         pkgJson.dependencies = {};
       }
-      pkgJson.dependencies["@agentapprove/opencode"] = "latest";
+      pkgJson.dependencies["@agentapprove/opencode"] = OPENCODE_PLUGIN_VERSION;
       writeFileSync(opencodePkgPath, JSON.stringify(pkgJson, null, 2) + `
 `);
     } catch (err) {
@@ -3226,7 +3653,7 @@ async function installHooksForAgent(agentId, hooksDir, mode = "approval") {
         console.warn(`Warning: Could not update package.json: ${err.message}`);
       }
     }
-    installedHooks.push("agentapprove");
+    installedHooks.push("Agent Approve plugin");
     return { success: true, backupPath, hooks: installedHooks };
   }
   const hooksToInstall = mode === "observe" ? agent.hooks.filter((h2) => !h2.isApprovalHook) : agent.hooks;
@@ -3653,64 +4080,10 @@ codex_hooks = true`;
   }
   return "";
 }
-var HOOK_FILES = [
-  "common.sh",
-  "claude-pre-tool.sh",
-  "claude-post-tool.sh",
-  "claude-post-tool-failure.sh",
-  "claude-notification.sh",
-  "claude-user-prompt.sh",
-  "claude-prompt.sh",
-  "claude-session-start.sh",
-  "claude-session-end.sh",
-  "claude-stop.sh",
-  "notify-hook.sh",
-  "completion-hook.sh",
-  "cursor-session-start.sh",
-  "cursor-session-end.sh",
-  "cursor-approval.sh",
-  "cursor-mcp-approval.sh",
-  "cursor-pre-tool.sh",
-  "cursor-shell-complete.sh",
-  "cursor-mcp-complete.sh",
-  "cursor-post-tool.sh",
-  "cursor-start.sh",
-  "cursor-subagent-start.sh",
-  "cursor-subagent-stop.sh",
-  "cursor-precompact.sh",
-  "cursor-stop.sh",
-  "cursor-thought.sh",
-  "cursor-response.sh",
-  "gemini-before-tool.sh",
-  "gemini-after-tool.sh",
-  "gemini-before-agent.sh",
-  "gemini-after-agent.sh",
-  "gemini-before-model.sh",
-  "gemini-after-model.sh",
-  "gemini-notification.sh",
-  "gemini-session-start.sh",
-  "gemini-session-end.sh",
-  "gemini-stop.sh",
-  "codex-session-start.sh",
-  "codex-pre-tool.sh",
-  "codex-post-tool.sh",
-  "codex-user-prompt.sh",
-  "codex-stop.sh",
-  "github-session-start.sh",
-  "github-session-end.sh",
-  "github-user-prompt.sh",
-  "github-pre-tool.sh",
-  "github-post-tool.sh",
-  "github-error.sh",
-  "github-stop.sh",
-  "github-subagent-start.sh",
-  "github-subagent-stop.sh",
-  "github-precompact.sh"
-];
-async function copyHookScripts(hooksDir, token) {
+async function copyHookScripts(hooksDir, token, files) {
   let downloaded = 0;
   const failed = [];
-  for (const file of HOOK_FILES) {
+  for (const file of files) {
     try {
       const response = await fetch(`${API_URL}/${API_VERSION}/hooks/${file}?format=raw`, {
         headers: {
@@ -3737,13 +4110,43 @@ async function copyHookScripts(hooksDir, token) {
   }
   return { downloaded, failed };
 }
+function readOpenClawInstalledVersion() {
+  const packagePath = join(homedir(), ".openclaw", "extensions", "openclaw", "package.json");
+  if (!existsSync2(packagePath)) {
+    return null;
+  }
+  try {
+    const pkg = JSON.parse(readFileSync(packagePath, "utf-8"));
+    return typeof pkg.version === "string" ? pkg.version : null;
+  } catch {
+    return null;
+  }
+}
 function installOpenClawPluginViaCli() {
   try {
     execSync(`openclaw plugins install ${OPENCLAW_PLUGIN_SPEC}`, { stdio: "pipe" });
-    return { success: true };
+    const installedVersion = readOpenClawInstalledVersion();
+    if (!installedVersion) {
+      return {
+        success: true,
+        label: "Agent Approve plugin (version not verified)"
+      };
+    }
+    if (installedVersion !== OPENCLAW_PLUGIN_VERSION) {
+      return {
+        success: false,
+        error: `OpenClaw installed ${installedVersion}, expected ${OPENCLAW_PLUGIN_VERSION}. Re-run after updating the published installer package.`,
+        label: "Agent Approve plugin"
+      };
+    }
+    return {
+      success: true,
+      version: installedVersion,
+      label: `Agent Approve plugin v${installedVersion}`
+    };
   } catch (err) {
     const message = err instanceof Error ? err.message : "unknown error";
-    return { success: false, error: message };
+    return { success: false, error: message, label: "Agent Approve plugin" };
   }
 }
 var SYSTEM_DEPS = [
@@ -3968,7 +4371,7 @@ async function installCommand() {
     const tokenPreview = hasExistingToken ? existingConfig.token.slice(0, 15) + "..." : "not set";
     const e2eKeyPath2 = join(getAgentApproveDir(), "e2e-key");
     let e2eLine = "";
-    if (existsSync(e2eKeyPath2)) {
+    if (existsSync2(e2eKeyPath2)) {
       const keyHex = readFileSync(e2eKeyPath2, "utf-8").trim();
       const keyId = createHash("sha256").update(Buffer.from(keyHex, "hex")).digest("hex").slice(0, 8);
       e2eLine = `
@@ -3978,7 +4381,7 @@ E2E Key: ${keyId}`;
 Privacy: ${existingConfig.privacy || "unknown"}${e2eLine}`, "Existing configuration found");
   } else {
     me(`Approve AI agent actions from your iPhone or Apple Watch.
-Installs hooks for Claude Code, Cursor, Gemini CLI, VS Code GitHub Copilot, and GitHub Copilot CLI.`, "About");
+Installs hooks and plugins for OpenClaw, OpenAI Codex, Claude Code, Cursor, Gemini CLI, and more.`, "About");
   }
   const installedAgents = detectInstalledAgents();
   const agentOptions = Object.entries(AGENTS).map(([id, agent]) => ({
@@ -4057,7 +4460,7 @@ Installs hooks for Claude Code, Cursor, Gemini CLI, VS Code GitHub Copilot, and
   }
   connectionOptions.push({ value: "qr", label: "Scan QR code", hint: hasExistingToken ? undefined : "Recommended" });
   const connectionMethod = await le({
-    message: "Connect to iOS app (required for hook download)",
+    message: "Connect to iOS app (required for setup and any hook downloads)",
     options: connectionOptions
   });
   if (lD(connectionMethod)) {
@@ -4072,7 +4475,7 @@ Installs hooks for Claude Code, Cursor, Gemini CLI, VS Code GitHub Copilot, and
   if (connectionMethod === "existing") {
     token = existingConfig.token;
     apiUrl = existingConfig.apiUrl || API_URL;
-    const e2eKeyExists = existsSync(join(getAgentApproveDir(), "e2e-key"));
+    const e2eKeyExists = existsSync2(join(getAgentApproveDir(), "e2e-key"));
     useE2E = e2eKeyExists;
     v2.success("Using existing token");
   } else if (connectionMethod === "qr") {
@@ -4082,7 +4485,7 @@ Installs hooks for Claude Code, Cursor, Gemini CLI, VS Code GitHub Copilot, and
     const existingKeyPath = join(agentApproveDir, "e2e-key");
     let e2eUserKey = null;
     if (useE2E) {
-      if (existsSync(existingKeyPath)) {
+      if (existsSync2(existingKeyPath)) {
         const oldKeyHex = readFileSync(existingKeyPath, "utf-8").trim();
         const oldKeyId = createHash("sha256").update(Buffer.from(oldKeyHex, "hex")).digest("hex").slice(0, 8);
         v2.info(`Existing E2E key found (Key ID: ${oldKeyId})`);
@@ -4150,7 +4553,7 @@ Installs hooks for Claude Code, Cursor, Gemini CLI, VS Code GitHub Copilot, and
       });
       await new Promise((resolve) => setTimeout(resolve, 10));
       me(qrDisplay + `
-Session: ${session.sessionCode}`, "Scan with Agent Approve iOS app");
+Session: ${session.sessionCode}`, "Scan in Agent Approve iOS app (Settings > Scan QR Code)");
       const pairingSpinner = _2();
       pairingSpinner.start("Waiting for iOS app...");
       const result = await waitForPairing(session.sessionCode, (expiresIn) => {
@@ -4220,17 +4623,23 @@ Session: ${session.sessionCode}`, "Scan with Agent Approve iOS app");
     failBehavior,
     configSetAt
   }).catch(() => {});
-  const downloadSpinner = _2();
-  downloadSpinner.start("Downloading hook scripts");
-  const downloadResult = await copyHookScripts(hooksDir, token);
-  if (downloadResult.failed.length > 0) {
-    downloadSpinner.stop(`Downloaded ${downloadResult.downloaded} hooks, ${downloadResult.failed.length} failed`);
-    v2.warn(`Failed to download: ${downloadResult.failed.join(", ")}`);
+  const hookDownloadPlan = buildHookDownloadPlan(selectedAgents);
+  if (hookDownloadPlan.files.length > 0) {
+    const downloadSpinner = _2();
+    downloadSpinner.start("Downloading hook scripts");
+    const downloadResult = await copyHookScripts(hooksDir, token, hookDownloadPlan.files);
+    const summary = formatHookDownloadSummary(hookDownloadPlan);
+    if (downloadResult.failed.length > 0) {
+      downloadSpinner.stop(`Downloaded ${downloadResult.downloaded} of ${hookDownloadPlan.files.length} hook files (${summary})`);
+      v2.warn(`Failed to download: ${downloadResult.failed.join(", ")}`);
+    } else {
+      downloadSpinner.stop(`Hook scripts downloaded (${downloadResult.downloaded} files: ${summary})`);
+    }
   } else {
-    downloadSpinner.stop(`Hook scripts downloaded (${downloadResult.downloaded} files)`);
+    v2.success("No hook scripts needed for the selected agents");
   }
   const e2eKeyPath = join(homedir(), ".agentapprove", "e2e-key");
-  const hasE2EKey = existsSync(e2eKeyPath);
+  const hasE2EKey = existsSync2(e2eKeyPath);
   let installMode = "approval";
   if (hasE2EKey) {
     const modeChoice = await le({
@@ -4259,7 +4668,7 @@ Session: ${session.sessionCode}`, "Scan with Agent Approve iOS app");
       v2.info("Approval mode: Commands are sent via encrypted channel for policy evaluation.");
     }
     const envPath = join(getAgentApproveDir(), "env");
-    if (existsSync(envPath)) {
+    if (existsSync2(envPath)) {
       let envContent = readFileSync(envPath, "utf-8");
       if (envContent.includes("AGENTAPPROVE_E2E_MODE=")) {
         envContent = envContent.replace(/AGENTAPPROVE_E2E_MODE=\w+/, `AGENTAPPROVE_E2E_MODE=${installMode}`);
@@ -4360,7 +4769,8 @@ Backups will be created with timestamp`, "Files to be modified");
 npx agentapprove pair       Link a new iOS device
 npx agentapprove status     Show current configuration
 npx agentapprove disable    Temporarily disable hooks
-npx agentapprove uninstall  Remove all hooks and config
+npx agentapprove uninstall  Remove hooks/plugins and keep local state
+npx agentapprove purge      Remove hooks/plugins and delete local state
 npx agentapprove restore    Restore original configs`, "Useful commands");
   ge(`${source_default.green("Agent Approve is ready!")} ${source_default.dim("Learn more at")} ${source_default.cyan("agentapprove.com")}`);
 }
@@ -4369,7 +4779,7 @@ async function statusCommand() {
   Agent Approve Status
 `));
   const envPath = join(getAgentApproveDir(), "env");
-  if (!existsSync(envPath)) {
+  if (!existsSync2(envPath)) {
     console.log(source_default.yellow("  Not configured. Run `npx agentapprove` to set up.\n"));
     return;
   }
@@ -4378,38 +4788,42 @@ async function statusCommand() {
 `);
   for (const line of lines) {
     if (line.startsWith("AGENTAPPROVE_")) {
-      const [key, value] = line.split("=");
-      const displayKey = key.replace("AGENTAPPROVE_", "").toLowerCase();
-      const displayValue = key.includes("TOKEN") ? value.slice(0, 15) + "..." : value;
+      const assignment = parseEnvAssignment(line);
+      if (!assignment) {
+        continue;
+      }
+      const { key, value } = assignment;
+      const displayKey = STATUS_FIELD_LABELS[key] || key.replace("AGENTAPPROVE_", "");
+      const displayValue = formatStatusValue(key, value);
       console.log(`  ${source_default.dim(displayKey + ":")} ${displayValue}`);
     }
   }
   const e2eKeyFile = join(getAgentApproveDir(), "e2e-key");
   const e2eServerKeyFile = join(getAgentApproveDir(), "e2e-server-key");
-  if (existsSync(e2eKeyFile)) {
+  if (existsSync2(e2eKeyFile)) {
     console.log(`  ${source_default.green("✓")} E2E user key: installed`);
   }
-  if (existsSync(e2eServerKeyFile)) {
+  if (existsSync2(e2eServerKeyFile)) {
     console.log(`  ${source_default.green("✓")} E2E server key: installed`);
   }
-  if (!existsSync(e2eKeyFile) && !existsSync(e2eServerKeyFile)) {
+  if (!existsSync2(e2eKeyFile) && !existsSync2(e2eServerKeyFile)) {
     console.log(`  ${source_default.dim("  E2E encryption: not configured")}`);
   }
   console.log();
   for (const [agentId, agent] of Object.entries(AGENTS)) {
-    if (existsSync(agent.configPath)) {
+    if (existsSync2(agent.configPath)) {
       const config = readJsonConfig(agent.configPath);
       if (agentId === "opencode") {
         const pluginConfig = config.plugin;
         if (Array.isArray(pluginConfig) && pluginConfig.some((entry) => typeof entry === "string" && entry.includes("@agentapprove/opencode"))) {
-          console.log(`  ${source_default.green("✓")} ${agent.name}: agentapprove plugin`);
+          console.log(`  ${source_default.green("✓")} ${agent.name}: Agent Approve plugin`);
         }
         continue;
       }
       if (agentId === "openclaw") {
         const entries = config.plugins?.entries;
         if (entries?.openclaw) {
-          console.log(`  ${source_default.green("✓")} ${agent.name}: openclaw plugin`);
+          console.log(`  ${source_default.green("✓")} ${agent.name}: Agent Approve plugin`);
         }
         continue;
       }
@@ -4423,7 +4837,7 @@ async function statusCommand() {
           return str.includes("agentapprove");
         });
         if (installedHooks.length > 0) {
-          console.log(`  ${source_default.green("✓")} ${agent.name}: ${installedHooks.map((h2) => h2.name).join(", ")}`);
+          console.log(`  ${source_default.green("✓")} ${agent.name}: ${installedHooks.map((h2) => formatHookStatusLabel(h2.name)).join(", ")}`);
         }
       }
     }
@@ -4433,8 +4847,8 @@ async function statusCommand() {
 async function disableCommand() {
   const envPath = join(getAgentApproveDir(), "env");
   const disabledPath = join(getAgentApproveDir(), "env.disabled");
-  if (!existsSync(envPath)) {
-    if (existsSync(disabledPath)) {
+  if (!existsSync2(envPath)) {
+    if (existsSync2(disabledPath)) {
       console.log(source_default.yellow(`
   Already disabled.
 `));
@@ -4453,13 +4867,13 @@ async function disableCommand() {
 async function enableCommand() {
   const envPath = join(getAgentApproveDir(), "env");
   const disabledPath = join(getAgentApproveDir(), "env.disabled");
-  if (existsSync(envPath)) {
+  if (existsSync2(envPath)) {
     console.log(source_default.yellow(`
   Already enabled.
 `));
     return;
   }
-  if (!existsSync(disabledPath)) {
+  if (!existsSync2(disabledPath)) {
     console.log(source_default.yellow("\n  Not configured. Run `npx agentapprove` to set up.\n"));
     return;
   }
@@ -4469,12 +4883,22 @@ async function enableCommand() {
   ✓ Agent Approve enabled.
 `));
 }
-async function uninstallCommand() {
+async function performUninstall(mode) {
+  const plan = buildUninstallPlan();
+  if (!hasUninstallWork(mode, plan)) {
+    console.log(source_default.yellow(`
+  Nothing to ${mode}. Run \`npx agentapprove install\` to set up Agent Approve.
+`));
+    return;
+  }
+  if (!await confirmUninstallPlan(mode, plan)) {
+    return;
+  }
   console.log(source_default.cyan(`
-  Uninstalling Agent Approve hooks...
+  ${mode === "purge" ? "Purging" : "Uninstalling"} Agent Approve...
 `));
   for (const [agentId, agent] of Object.entries(AGENTS)) {
-    if (!existsSync(agent.configPath))
+    if (!existsSync2(agent.configPath))
       continue;
     const config = readJsonConfig(agent.configPath);
     const hooksConfig = config[agent.hooksKey] ?? {};
@@ -4494,7 +4918,7 @@ async function uninstallCommand() {
       }
       const opencodePkgPath = join(getOpenCodeConfigDir(), "package.json");
       try {
-        if (existsSync(opencodePkgPath)) {
+        if (existsSync2(opencodePkgPath)) {
           const pkgJson = JSON.parse(readFileSync(opencodePkgPath, "utf-8"));
           const deps = pkgJson.dependencies;
           if (deps && deps["@agentapprove/opencode"]) {
@@ -4508,13 +4932,15 @@ async function uninstallCommand() {
       const pluginsConfig = hooksConfig;
       const entries = pluginsConfig.entries;
       const installs = pluginsConfig.installs;
-      if (entries && entries.openclaw) {
-        delete entries.openclaw;
-        modified = true;
-      }
-      if (installs && installs.openclaw) {
-        delete installs.openclaw;
-        modified = true;
+      for (const key of ["openclaw", "agentapprove"]) {
+        if (entries && entries[key]) {
+          delete entries[key];
+          modified = true;
+        }
+        if (installs && installs[key]) {
+          delete installs[key];
+          modified = true;
+        }
       }
     } else {
       for (const hook of agent.hooks) {
@@ -4539,8 +4965,8 @@ async function uninstallCommand() {
           modified = true;
         }
       }
-      if (hooksConfig["Prompt"]) {
-        delete hooksConfig["Prompt"];
+      if (hooksConfig.Prompt) {
+        delete hooksConfig.Prompt;
         modified = true;
       }
     }
@@ -4555,50 +4981,72 @@ async function uninstallCommand() {
       }
     }
   }
-  const envPath = join(getAgentApproveDir(), "env");
-  if (existsSync(envPath)) {
-    const { unlinkSync } = await import("fs");
-    unlinkSync(envPath);
-    console.log(`  ${source_default.green("✓")} Removed configuration`);
-  }
-  if (deleteTokenFromKeychain()) {
-    console.log(`  ${source_default.green("✓")} Removed token from credential store`);
-  }
   const removedVSCode = removeFromVSCodeHookLocations();
   if (removedVSCode.length > 0) {
     for (const path of removedVSCode) {
       console.log(`  ${source_default.green("✓")} Removed hook path from ${path}`);
     }
   }
-  const hooksDir = join(getAgentApproveDir(), "hooks");
-  const agentApproveDir = getAgentApproveDir();
-  for (const configPath of [
-    join(hooksDir, "vscode-hooks.json"),
-    join(agentApproveDir, "copilot-cli-hooks.json"),
-    join(hooksDir, "copilot-cli-hooks.json")
-  ]) {
-    if (existsSync(configPath)) {
-      const { unlinkSync } = await import("fs");
-      unlinkSync(configPath);
-      console.log(`  ${source_default.green("✓")} Removed ${basename(configPath)}`);
+  for (const target of plan.pluginArtifactTargets) {
+    if (!removeRemovalTarget(target)) {
+      continue;
+    }
+    console.log(`  ${source_default.green("✓")} Removed plugin files at ${target.displayPath}`);
+    if (target.actualPath.endsWith("/node_modules/@agentapprove/opencode")) {
+      pruneEmptyDir(dirname2(target.actualPath));
+      pruneEmptyDir(dirname2(dirname2(target.actualPath)));
+    }
+    if (target.actualPath.includes("/extensions/")) {
+      pruneEmptyDir(dirname2(target.actualPath));
     }
   }
+  if (mode === "purge") {
+    for (const target of plan.backupTargets) {
+      if (removeRemovalTarget(target)) {
+        console.log(`  ${source_default.green("✓")} Removed backup ${target.displayPath}`);
+      }
+    }
+    for (const target of plan.managedState.reversible) {
+      if (removeRemovalTarget(target)) {
+        console.log(`  ${source_default.green("✓")} Removed local file ${target.displayPath}`);
+      }
+    }
+    for (const target of plan.managedState.crypto) {
+      if (removeRemovalTarget(target)) {
+        console.log(`  ${source_default.green("✓")} Removed E2E material ${target.displayPath}`);
+      }
+    }
+    if (deleteTokenFromKeychain()) {
+      console.log(`  ${source_default.green("✓")} Removed token from credential store`);
+    }
+    finalizeAgentApproveDirPurge(getAgentApproveDir());
+  }
   console.log(source_default.green(`
-  Agent Approve uninstalled.`));
-  console.log(source_default.dim("    Hook scripts remain in ~/.agentapprove/hooks"));
-  console.log(source_default.dim(`    Backups remain as .backup files
+  Agent Approve ${mode === "purge" ? "purged" : "uninstalled"}.`));
+  if (mode === "purge") {
+    console.log(source_default.dim(`    Local Agent Approve state and backups were removed.
 `));
+    return;
+  }
+  console.log(source_default.dim("    Local Agent Approve config, logs, hooks, backups, and E2E keys were kept."));
+  console.log(source_default.dim("    Run `npx agentapprove purge` if you want to remove all local Agent Approve traces.\n"));
+}
+async function uninstallCommand() {
+  await performUninstall("uninstall");
+}
+async function purgeCommand() {
+  await performUninstall("purge");
 }
 async function restoreCommand() {
   console.log(source_default.cyan(`
   Restoring original configurations...
 `));
-  const { readdirSync: readdirSync2, copyFileSync: copyFileSync2 } = await import("fs");
+  const { readdirSync: readdirSync3, copyFileSync: copyFileSync2 } = await import("fs");
   for (const [agentId, agent] of Object.entries(AGENTS)) {
-    const configDir = dirname(agent.configPath);
-    if (!existsSync(configDir))
+    const configDir = dirname2(agent.configPath);
+    if (!existsSync2(configDir))
       continue;
-    const files = readdirSync2(configDir);
+    const files = readdirSync3(configDir);
     const backups = files.filter((f2) => f2.startsWith(agent.configPath.split("/").pop()) && f2.includes(".backup.")).sort().reverse();
     if (backups.length > 0) {
       const latestBackup = join(configDir, backups[0]);
@@ -4610,7 +5058,7 @@ async function restoreCommand() {
 }
 async function initRepoCommand() {
   const cliHooksPath = join(getAgentApproveDir(), "copilot-cli-hooks.json");
-  if (!existsSync(cliHooksPath)) {
+  if (!existsSync2(cliHooksPath)) {
     console.log(source_default.yellow(`
   GitHub Copilot CLI hooks not found. Run the installer first with GitHub Copilot CLI selected.`));
     console.log(source_default.dim(`    npx agentapprove install
@@ -4619,12 +5067,12 @@ async function initRepoCommand() {
   }
   let repoRoot = process.cwd();
   let found = false;
-  while (repoRoot !== dirname(repoRoot)) {
-    if (existsSync(join(repoRoot, ".git"))) {
+  while (repoRoot !== dirname2(repoRoot)) {
+    if (existsSync2(join(repoRoot, ".git"))) {
       found = true;
       break;
     }
-    repoRoot = dirname(repoRoot);
+    repoRoot = dirname2(repoRoot);
   }
   if (!found) {
     console.log(source_default.yellow(`
@@ -4637,7 +5085,7 @@ async function initRepoCommand() {
   console.log(source_default.cyan(`
   Installing GitHub Copilot CLI hooks to ${targetFile}
 `));
-  if (existsSync(targetFile)) {
+  if (existsSync2(targetFile)) {
     console.log(source_default.yellow("  agentapprove.json already exists in .github/hooks/"));
     const overwrite = await ce({
       message: "Overwrite existing file?"
@@ -4648,7 +5096,7 @@ async function initRepoCommand() {
       process.exit(0);
     }
   }
-  if (!existsSync(targetDir)) {
+  if (!existsSync2(targetDir)) {
     mkdirSync(targetDir, { recursive: true });
   }
   copyFileSync(cliHooksPath, targetFile);
@@ -4666,13 +5114,14 @@ ${source_default.yellow("Usage:")}
 
 ${source_default.yellow("Commands:")}
   ${source_default.green("install")}     Run the installation wizard (default)
-  ${source_default.green("pair")}        Link a new iOS device with existing E2E keys
-  ${source_default.green("refresh")}     Generate a new token (when expired)
+  ${source_default.green("pair")}        Link a new iOS device or repair E2E pairing
+  ${source_default.green("refresh")}     Generate a new token and reuse current pairing context
   ${source_default.green("init-repo")}   Add GitHub Copilot CLI hooks to current repo (.github/hooks/)
   ${source_default.green("status")}      Show current configuration and installed hooks
   ${source_default.green("disable")}     Temporarily disable hooks
   ${source_default.green("enable")}      Re-enable hooks after disabling
-  ${source_default.green("uninstall")}   Remove all hooks from agent configs
+  ${source_default.green("uninstall")}   ${INSTALLER_COMMAND_DESCRIPTIONS.uninstall}
+  ${source_default.green("purge")}       ${INSTALLER_COMMAND_DESCRIPTIONS.purge}
   ${source_default.green("restore")}     Restore original configs from backups
   ${source_default.green("help")}        Show this help message
 
@@ -4700,18 +5149,39 @@ async function refreshCommand() {
 but if unused for 30 days they expire. Get a new one below.`, "Token Expired");
   let token = null;
   let apiUrl = API_URL;
-  const session = await createPairingSession();
+  const installedAgents = detectInstalledAgents();
+  const e2eEnabled = existingConfig.e2eEnabled !== false;
+  const e2eKeyPath = join(getAgentApproveDir(), "e2e-key");
+  let e2eUserKey = null;
+  let e2eKeyId;
+  if (e2eEnabled && existsSync2(e2eKeyPath)) {
+    const existingKey = readFileSync(e2eKeyPath, "utf-8").trim();
+    if (existingKey.length === 64) {
+      e2eUserKey = existingKey;
+      e2eKeyId = createHash("sha256").update(Buffer.from(existingKey, "hex")).digest("hex").slice(0, 8);
+      v2.info(`Refresh will reuse E2E key ${e2eKeyId}. Use "npx agentapprove pair" if you need to choose a different key or repair pairing on another device.`);
+    }
+  } else {
+    v2.info('Refresh updates the token only. Use "npx agentapprove pair" if you need to repair or change E2E pairing.');
+  }
+  const session = await createPairingSession(installedAgents.length > 0 ? installedAgents : undefined, e2eKeyId);
   if (!session || session.error) {
     v2.error(`Failed to create pairing session: ${session?.error || "Unknown error"}`);
     process.exit(1);
   }
+  const machineHost = hostname();
+  let qrUrl = `${session.qrUrl}&host=${encodeURIComponent(machineHost)}`;
+  if (e2eUserKey) {
+    const e2eKeyBase64url = Buffer.from(e2eUserKey, "hex").toString("base64url");
+    qrUrl += `&e2eKey=${e2eKeyBase64url}`;
+  }
   let qrDisplay = "";
-  import_qrcode_terminal.default.generate(session.qrUrl, { small: true }, (qr) => {
+  import_qrcode_terminal.default.generate(qrUrl, { small: true }, (qr) => {
     qrDisplay = qr;
   });
   await new Promise((resolve) => setTimeout(resolve, 10));
   me(qrDisplay + `
-Session: ${session.sessionCode}`, "Scan with Agent Approve iOS app");
+Session: ${session.sessionCode}`, "Scan in Agent Approve iOS app (Settings > Scan QR Code)");
   const pairingSpinner = _2();
   pairingSpinner.start("Waiting for iOS app...");
   const result = await waitForPairing(session.sessionCode, (expiresIn) => {
@@ -4741,10 +5211,16 @@ Session: ${session.sessionCode}`, "Scan with Agent Approve iOS app");
     privacy,
     retentionDays,
     debugLog: existingConfig.debugLog,
+    e2eMode: existingConfig.e2eMode,
+    e2eEnabled,
     failBehavior,
     configSetAt
   });
   await storeTokenInKeychain(token);
+  if (e2eEnabled && result.e2eServerKey) {
+    const serverKeyPath = join(getAgentApproveDir(), "e2e-server-key");
+    writeFileSync(serverKeyPath, result.e2eServerKey, { mode: 384 });
+  }
   pushConfigToCloud({
     apiUrl,
     token,
@@ -4869,7 +5345,7 @@ async function pairCommand() {
   const noteLabel = e2eKeyId ? `Session: ${session.sessionCode}
 Key ID: ${e2eKeyId}` : `Session: ${session.sessionCode}`;
   me(qrDisplay + `
-${noteLabel}`, "Scan with Agent Approve iOS app");
+${noteLabel}`, "Scan in Agent Approve iOS app (Settings > Scan QR Code)");
   const pairingSpinner = _2();
   pairingSpinner.start("Waiting for iOS app...");
   const result = await waitForPairing(session.sessionCode, (expiresIn) => {
@@ -4890,7 +5366,7 @@ ${noteLabel}`, "Scan with Agent Approve iOS app");
   pairingSpinner.stop(`Paired! ${result.email ? `Account: ${result.email}` : ""}`);
   if (e2eUserKey && e2eKeyId) {
     const rootKeyPath = join(getAgentApproveDir(), "e2e-root-key");
-    if (!existsSync(rootKeyPath) || readFileSync(rootKeyPath, "utf-8").trim() !== e2eUserKey) {
+    if (!existsSync2(rootKeyPath) || readFileSync(rootKeyPath, "utf-8").trim() !== e2eUserKey) {
       writeFileSync(rootKeyPath, e2eUserKey, { mode: 384 });
     }
     if (!readRotationConfig()) {
@@ -4914,12 +5390,14 @@ ${noteLabel}`, "Scan with Agent Approve iOS app");
     privacy: existingConfig?.privacy || result.privacy || "full",
     retentionDays: existingConfig?.retentionDays ?? 30,
     debugLog: existingConfig?.debugLog,
+    e2eMode: existingConfig?.e2eMode,
+    e2eEnabled: !!e2eUserKey,
     failBehavior: existingConfig?.failBehavior || "ask",
     configSetAt
   });
   await storeTokenInKeychain(result.token);
   const hooksDir = join(getAgentApproveDir(), "hooks");
-  if (existsSync(hooksDir)) {
+  if (existsSync2(hooksDir)) {
     const updateSpinner = _2();
     updateSpinner.start("Updating hook scripts with new token");
     try {
@@ -4941,7 +5419,7 @@ ${noteLabel}`, "Scan with Agent Approve iOS app");
 }
 async function updateHookScriptsWithToken(token, apiUrl) {
   const hooksDir = join(getAgentApproveDir(), "hooks");
-  if (!existsSync(hooksDir)) {
+  if (!existsSync2(hooksDir)) {
     throw new Error("Hooks directory not found");
   }
   const hookFiles = [
@@ -4964,7 +5442,7 @@ async function updateHookScriptsWithToken(token, apiUrl) {
   ];
   for (const file of hookFiles) {
     const filePath = join(hooksDir, file);
-    if (existsSync(filePath)) {
+    if (existsSync2(filePath)) {
       let content = readFileSync(filePath, "utf-8");
       content = content.replace(/export AGENTAPPROVE_TOKEN=".*"/, `export AGENTAPPROVE_TOKEN="${token}"`);
       content = content.replace(/export AGENTAPPROVE_API=".*"/, `export AGENTAPPROVE_API="${apiUrl}"`);
@@ -4996,6 +5474,9 @@ async function main() {
     case "uninstall":
       await uninstallCommand();
       break;
+    case "purge":
+      await purgeCommand();
+      break;
     case "restore":
       await restoreCommand();
       break;