arcane-cli 0.20.0 → 0.20.2

package/dist/index.js

@@ -6,7 +6,7 @@ const require = __createRequire(import.meta.url);
 import { Command } from "commander";
 import { createRequire as createRequire2 } from "module";
 import { fileURLToPath } from "url";
-import { dirname as dirname3, join as join12 } from "path";
+import { dirname as dirname4, join as join12 } from "path";
 
 // src/commands/init.ts
 import { select as select2, confirm, input as input2 } from "@inquirer/prompts";
@@ -672,7 +672,7 @@ var WORDMARK = [
 var INDENT = "  ";
 var LOCKUP_WIDTH = INDENT.length + Math.max(...WORDMARK.map((l) => l.length));
 function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 function isAnimatable() {
   return !!process.stdout.isTTY && process.env["TERM"] !== "dumb" && process.env["CI"] !== "true" && process.env["ARCANE_DISABLE_ANIMATION"] !== "true" && (process.stdout.columns ?? 80) >= LOCKUP_WIDTH;
@@ -1795,8 +1795,9 @@ async function runAgentsList(targetDir) {
 }
 
 // src/modules/push-safety.ts
-import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile5, chmod } from "fs/promises";
-import { join as join4 } from "path";
+import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile5, chmod, access as access3, rm as rm2, readdir as readdir3 } from "fs/promises";
+import { constants } from "fs";
+import { join as join4, resolve, dirname, basename } from "path";
 
 // src/modules/git.ts
 import { execFile } from "child_process";
@@ -1893,7 +1894,7 @@ function buildGitEnv() {
 function runGit(cwd, args, options = {}) {
   const commandClass = options.commandClass ?? classifyGitCommand(args);
   const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUTS_MS[commandClass] ?? DEFAULT_TIMEOUTS_MS.write;
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const child = execFile(
       "git",
       args,
@@ -1927,7 +1928,7 @@ function runGit(cwd, args, options = {}) {
           reject(error);
           return;
         }
-        resolve2({ stdout, stderr });
+        resolve3({ stdout, stderr });
       }
     );
     child.stdin?.end();
@@ -2017,24 +2018,38 @@ async function ensureLocalPullRebase(cwd) {
 }
 
 // src/modules/push-safety.ts
-var DISABLED_PUSH_URL = "arcane-push-blocked://this-repository-is-push-blocked";
+var DISABLED_PUSH_URL = "arcane-push-blocked-run-spell-unblock-push://this-repository";
+var NO_PUSH_URL_MARKER = (remote) => `remote.${remote}.arcaneHadNoPushUrl`;
 var ARCANE_HOOKS_DIR = ".arcane/hooks";
 async function readHooksPath(cwd) {
-  let effective;
+  let raw;
   try {
-    const { stdout } = await runGit(cwd, ["config", "--get", "core.hooksPath"]);
-    effective = stdout.trim();
-  } catch {
+    const { stdout } = await runGit(cwd, ["config", "--show-scope", "--get", "core.hooksPath"]);
+    raw = stdout.trim();
+  } catch (error) {
+    if (error.code !== 1) {
+      return { value: "", scope: "unknown", unreadable: true };
+    }
     return void 0;
   }
-  if (effective === "") return void 0;
-  let local = "";
-  try {
-    const { stdout } = await runGit(cwd, ["config", "--local", "--get", "core.hooksPath"]);
-    local = stdout.trim();
-  } catch {
-  }
-  return { value: effective, scope: local === effective && local !== "" ? "local" : "inherited" };
+  if (raw === "") return void 0;
+  const separator = raw.indexOf("	");
+  if (separator === -1) return { value: raw, scope: "unknown" };
+  const scope = raw.slice(0, separator).trim();
+  const value = raw.slice(separator + 1).trim();
+  if (value === "") return void 0;
+  const known = ["local", "worktree", "global", "system", "command"];
+  const matched = known.find((candidate) => candidate === scope);
+  return { value, scope: matched ?? "unknown" };
+}
+function isArcaneHooksPath(root, value) {
+  const windows = process.platform === "win32";
+  const normalize = (p) => {
+    const separated = windows ? p.replace(/\\/g, "/") : p;
+    const absolute = resolve(root, separated).replace(/\\/g, "/").replace(/\/+$/, "");
+    return windows ? absolute.toLowerCase() : absolute;
+  };
+  return normalize(value) === normalize(ARCANE_HOOKS_DIR);
 }
 var HOOK_BODY = `#!/bin/sh
 # Installed by Arcane because this repository's .arcane.json sets
@@ -2054,39 +2069,123 @@ var HOOK_BODY = `#!/bin/sh
 echo "arcane: push blocked (push_policy: blocked). Run 'spell unblock-push' to undo." >&2
 exit 1
 `;
-function hookFilePath(cwd) {
-  return join4(cwd, ARCANE_HOOKS_DIR, "pre-push");
+function describeConfigScope(scope) {
+  switch (scope) {
+    case "local":
+      return "set for this repository";
+    case "worktree":
+      return "set for this worktree";
+    case "global":
+      return "set globally, for your user";
+    case "system":
+      return "set system-wide";
+    case "command":
+      return "set on the command line";
+    default:
+      return "scope unknown";
+  }
+}
+async function repositoryRoot(cwd) {
+  try {
+    const { stdout } = await runGit(cwd, [
+      "rev-parse",
+      "--path-format=absolute",
+      "--git-common-dir"
+    ]);
+    const commonDir = stdout.trim();
+    if (commonDir !== "") {
+      const parent = dirname(commonDir);
+      if (basename(commonDir) === ".git" && parent !== "") return parent;
+    }
+  } catch {
+  }
+  try {
+    const { stdout } = await runGit(cwd, ["rev-parse", "--show-toplevel"]);
+    const top = stdout.trim();
+    if (top !== "") return top;
+  } catch {
+  }
+  return cwd;
+}
+async function hookFilePath(cwd) {
+  return join4(await repositoryRoot(cwd), ARCANE_HOOKS_DIR, "pre-push");
+}
+async function hooksPathValue(cwd) {
+  return join4(await repositoryRoot(cwd), ARCANE_HOOKS_DIR).replace(/\\/g, "/");
 }
 async function installPrePushHook(cwd) {
+  const root = await repositoryRoot(cwd);
   const existing = await readHooksPath(cwd);
-  if (existing !== void 0 && existing.value !== ARCANE_HOOKS_DIR) {
+  if (existing?.unreadable === true) return { status: "refused-unreadable-config" };
+  if (existing !== void 0 && !isArcaneHooksPath(root, existing.value)) {
     return {
       status: "refused-foreign-hooks-path",
       existing: existing.value,
       scope: existing.scope
     };
   }
-  const hookPath = hookFilePath(cwd);
-  if (existing?.value === ARCANE_HOOKS_DIR && await fileExists(hookPath)) {
-    const current = await readFile4(hookPath, "utf-8");
-    if (current === HOOK_BODY) return { status: "already-ours" };
+  if (existing === void 0) {
+    const displaced = await defaultHooks(cwd);
+    if (displaced.length > 0) {
+      return { status: "refused-default-hooks", hooks: displaced };
+    }
   }
-  await mkdir4(join4(cwd, ARCANE_HOOKS_DIR), { recursive: true });
+  const hookPath = join4(root, ARCANE_HOOKS_DIR, "pre-push");
+  if (existing !== void 0 && await hookBodyMatches(cwd)) return { status: "already-ours" };
+  await mkdir4(join4(root, ARCANE_HOOKS_DIR), { recursive: true });
   await writeFile5(hookPath, HOOK_BODY, "utf-8");
   await chmod(hookPath, 493);
-  await runGit(cwd, ["config", "--local", "core.hooksPath", ARCANE_HOOKS_DIR]);
+  await runGit(cwd, ["config", "--local", "core.hooksPath", await hooksPathValue(cwd)]);
   return { status: "installed", path: hookPath };
 }
 async function isHookEnforced(cwd) {
   const hooksPath = await readHooksPath(cwd);
-  if (hooksPath?.value !== ARCANE_HOOKS_DIR) return false;
-  return fileExists(hookFilePath(cwd));
+  if (hooksPath === void 0 || hooksPath.unreadable === true) return false;
+  if (!isArcaneHooksPath(await repositoryRoot(cwd), hooksPath.value)) return false;
+  return hookBodyMatches(cwd);
+}
+async function defaultHooks(cwd) {
+  let hooksDir;
+  try {
+    const { stdout } = await runGit(cwd, ["rev-parse", "--git-common-dir"]);
+    hooksDir = join4(resolve(cwd, stdout.trim()), "hooks");
+  } catch {
+    return [];
+  }
+  try {
+    return (await readdir3(hooksDir)).filter((name) => !name.endsWith(".sample")).sort();
+  } catch {
+    return [];
+  }
+}
+async function hookBodyMatches(cwd) {
+  const hookPath = await hookFilePath(cwd);
+  if (!await fileExists(hookPath)) return false;
+  try {
+    if (await readFile4(hookPath, "utf-8") !== HOOK_BODY) return false;
+  } catch {
+    return false;
+  }
+  if (process.platform === "win32") return true;
+  try {
+    await access3(hookPath, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
 }
 async function removePrePushHook(cwd) {
   const existing = await readHooksPath(cwd);
-  if (existing?.value !== ARCANE_HOOKS_DIR || existing.scope !== "local") return;
+  if (existing === void 0 || existing.unreadable === true) return;
+  if (!isArcaneHooksPath(await repositoryRoot(cwd), existing.value)) return;
+  if (existing.scope !== "local" && existing.scope !== "worktree") return;
+  const scopeFlag = existing.scope === "worktree" ? "--worktree" : "--local";
+  try {
+    await runGit(cwd, ["config", scopeFlag, "--unset", "core.hooksPath"]);
+  } catch {
+  }
   try {
-    await runGit(cwd, ["config", "--local", "--unset", "core.hooksPath"]);
+    await rm2(await hookFilePath(cwd), { force: true });
   } catch {
   }
 }
@@ -2098,62 +2197,203 @@ async function listRemotes(cwd) {
     return [];
   }
 }
-async function disablePushUrls(cwd) {
-  const results = [];
+async function pushTargets(cwd) {
+  const targets = [];
   for (const remote of await listRemotes(cwd)) {
-    let current;
     try {
-      const { stdout } = await runGit(cwd, ["remote", "get-url", "--push", remote]);
-      current = stdout.trim();
+      const { stdout } = await runGit(cwd, ["remote", "get-url", "--push", "--all", remote]);
+      targets.push({
+        remote,
+        urls: stdout.split("\n").map((line) => line.trim()).filter(Boolean)
+      });
     } catch {
-      continue;
+      targets.push({ remote, urls: [] });
     }
-    if (current === DISABLED_PUSH_URL) {
-      results.push({ remote, status: "already-disabled" });
-      continue;
+  }
+  return targets;
+}
+function originalPushUrlKey(remote) {
+  return `remote.${remote}.arcaneOriginalPushUrl`;
+}
+async function readLocalAll(cwd, key) {
+  try {
+    const { stdout } = await runGit(cwd, ["config", "--local", "--get-all", key]);
+    return stdout.split("\n").map((line) => line.trim()).filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+async function readScopedAll(cwd, key) {
+  let stdout;
+  try {
+    ({ stdout } = await runGit(cwd, ["config", "--show-scope", "--get-all", key]));
+  } catch {
+    return [];
+  }
+  return stdout.split("\n").filter((line) => line !== "").map((line) => {
+    const separator = line.indexOf("	");
+    if (separator === -1) return { scope: "unknown", value: line.trim() };
+    return { scope: line.slice(0, separator).trim(), value: line.slice(separator + 1).trim() };
+  });
+}
+async function effectivePushUrls(cwd, remote) {
+  const scoped = await readScopedAll(cwd, `remote.${remote}.pushurl`);
+  return scoped.map((entry) => entry.value);
+}
+async function disablePushUrls(cwd) {
+  const results = [];
+  for (const remote of await listRemotes(cwd)) {
+    try {
+      results.push(await disableOneRemote(cwd, remote));
+    } catch (error) {
+      results.push({ remote, status: "failed", reason: describeError(error) });
     }
-    await runGit(cwd, ["config", "--local", `arcane.originalPushUrl.${remote}`, current]);
-    await runGit(cwd, ["remote", "set-url", "--push", remote, DISABLED_PUSH_URL]);
-    results.push({ remote, status: "disabled" });
   }
   return results;
 }
+async function disableOneRemote(cwd, remote) {
+  const scoped = await readScopedAll(cwd, `remote.${remote}.pushurl`);
+  const OVERRIDABLE = /* @__PURE__ */ new Set(["local", "worktree"]);
+  const foreign = scoped.filter(
+    (entry) => !OVERRIDABLE.has(entry.scope) && entry.value !== DISABLED_PUSH_URL
+  );
+  if (foreign.length > 0) {
+    const scopes = [...new Set(foreign.map((entry) => entry.scope))];
+    const where = scopes.join(", ");
+    const flag = scopes[0] === "unknown" ? "<scope>" : `--${scopes[0]}`;
+    return {
+      remote,
+      status: "failed",
+      reason: `a push URL for this remote is configured at ${where} scope, which this repository cannot override \u2014 git would still deliver the push there. Remove it with \`git config ${flag} --unset-all remote.${remote}.pushurl\` and re-apply.`
+    };
+  }
+  const currentPushUrls = scoped.map((entry) => entry.value);
+  if (currentPushUrls.length === 1 && currentPushUrls[0] === DISABLED_PUSH_URL) {
+    return { remote, status: "already-disabled" };
+  }
+  const key = originalPushUrlKey(remote);
+  if ((await readLocalAll(cwd, key)).length === 0 && !await hadNoPushUrl(cwd, remote)) {
+    if (currentPushUrls.length > 0) {
+      await runGit(cwd, ["config", "--local", "--replace-all", key, currentPushUrls[0]]);
+      for (const extra of currentPushUrls.slice(1)) {
+        await runGit(cwd, ["config", "--local", "--add", key, extra]);
+      }
+    } else {
+      await runGit(cwd, ["config", "--local", NO_PUSH_URL_MARKER(remote), "true"]);
+    }
+  }
+  await runGit(cwd, [
+    "config",
+    "--local",
+    "--replace-all",
+    `remote.${remote}.pushurl`,
+    DISABLED_PUSH_URL
+  ]);
+  const after = await effectivePushUrls(cwd, remote);
+  if (after.length !== 1 || after[0] !== DISABLED_PUSH_URL) {
+    const live = after.filter((url) => url !== DISABLED_PUSH_URL);
+    return {
+      remote,
+      status: "failed",
+      reason: `the sentinel was written but git still resolves a live push URL for this remote (${live.join(", ")}). It most likely comes from a file this repository \`include\`s, which \`--replace-all\` cannot remove. Run \`git config --show-origin --get-all remote.${remote}.pushurl\` to find the file, and clear it there.`
+    };
+  }
+  return { remote, status: "disabled" };
+}
 async function undisabledRemotes(cwd) {
   const open = [];
   for (const remote of await listRemotes(cwd)) {
-    try {
-      const { stdout } = await runGit(cwd, ["remote", "get-url", "--push", remote]);
-      if (stdout.trim() !== DISABLED_PUSH_URL) open.push(remote);
-    } catch {
-      open.push(remote);
-    }
+    const urls = await effectivePushUrls(cwd, remote);
+    if (urls.length === 0 || urls.some((url) => url !== DISABLED_PUSH_URL)) open.push(remote);
   }
   return open;
 }
+async function blockedRemotes(cwd) {
+  const blocked = [];
+  for (const remote of await listRemotes(cwd)) {
+    const urls = await effectivePushUrls(cwd, remote);
+    if (urls.some((url) => url === DISABLED_PUSH_URL)) blocked.push(remote);
+  }
+  return blocked;
+}
 async function restorePushUrls(cwd) {
-  const restored = [];
+  const results = [];
   for (const remote of await listRemotes(cwd)) {
-    let original = "";
     try {
-      const { stdout } = await runGit(cwd, [
-        "config",
-        "--local",
-        "--get",
-        `arcane.originalPushUrl.${remote}`
-      ]);
-      original = stdout.trim();
-    } catch {
-      continue;
+      results.push(await restoreOneRemote(cwd, remote));
+    } catch (error) {
+      results.push({ remote, status: "failed", reason: describeError(error) });
+    }
+  }
+  return results;
+}
+async function restoreOneRemote(cwd, remote) {
+  const key = originalPushUrlKey(remote);
+  let recorded = await readLocalAll(cwd, key);
+  let hadNone = await hadNoPushUrl(cwd, remote);
+  if (recorded.length === 0 && !hadNone) {
+    const legacy = await readLegacyRecord(cwd, remote);
+    if (legacy.status !== "usable") return { remote, status: legacy.status, reason: legacy.reason };
+    recorded = legacy.values;
+    hadNone = false;
+  }
+  if (hadNone) {
+    await unsetIgnoringMissing(cwd, `remote.${remote}.pushurl`);
+  } else {
+    await runGit(cwd, [
+      "config",
+      "--local",
+      "--replace-all",
+      `remote.${remote}.pushurl`,
+      recorded[0]
+    ]);
+    for (const extra of recorded.slice(1)) {
+      await runGit(cwd, ["config", "--local", "--add", `remote.${remote}.pushurl`, extra]);
     }
-    if (original === "") continue;
-    await runGit(cwd, ["remote", "set-url", "--push", remote, original]);
+  }
+  for (const staleKey of [key, NO_PUSH_URL_MARKER(remote), `arcane.originalPushUrl.${remote}`]) {
     try {
-      await runGit(cwd, ["config", "--local", "--unset", `arcane.originalPushUrl.${remote}`]);
+      await unsetIgnoringMissing(cwd, staleKey);
     } catch {
     }
-    restored.push(remote);
   }
-  return restored;
+  return { remote, status: "restored" };
+}
+async function unsetIgnoringMissing(cwd, key) {
+  try {
+    await runGit(cwd, ["config", "--local", "--unset-all", key]);
+  } catch (error) {
+    if (error.code !== 5) throw error;
+  }
+}
+async function hadNoPushUrl(cwd, remote) {
+  return (await readLocalAll(cwd, NO_PUSH_URL_MARKER(remote)))[0] === "true";
+}
+async function readLegacyRecord(cwd, remote) {
+  const values = await readLocalAll(cwd, `arcane.originalPushUrl.${remote}`);
+  if (values.length === 0) return { status: "nothing-recorded" };
+  const current = await effectivePushUrls(cwd, remote);
+  if (!current.includes(DISABLED_PUSH_URL)) {
+    return {
+      status: "failed",
+      reason: `found a push URL recorded by 0.20.0 ("${values.join(", ")}") but this remote is not currently blocked by Arcane, so the record may belong to a different remote of the same name. Not applying it \u2014 set the URL yourself if it is correct.`
+    };
+  }
+  const names = await listRemotes(cwd);
+  const collides = names.some(
+    (other) => other !== remote && other.toLowerCase() === remote.toLowerCase()
+  );
+  if (collides) {
+    return {
+      status: "failed",
+      reason: `this repository has remotes whose names differ only by case, and 0.20.0 stored their original push URLs under one shared key, so the recorded value ("${values.join(", ")}") cannot be attributed to a specific remote. Not applying it \u2014 set the URLs yourself.`
+    };
+  }
+  return { status: "usable", values };
+}
+function describeError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.split("\n")[0].trim();
 }
 
 // src/commands/init.ts
@@ -2483,22 +2723,37 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
     try {
       if (push_policy === "blocked") {
         const hook = await installPrePushHook(targetDir);
-        if (hook.status === "refused-foreign-hooks-path") {
+        if (hook.status === "refused-unreadable-config") {
           printWarning(
-            `Did not install the pre-push hook: core.hooksPath is already "${hook.existing}" (set ${hook.scope === "local" ? "for this repository" : "globally"}), so another hook manager owns it. Overwriting would silently disable those hooks. Chain an Arcane pre-push guard into that directory yourself, or unset core.hooksPath first.`
+            "Did not install the pre-push hook: git could not report the current core.hooksPath (unreadable config, or a git too old for `--show-scope`). Installing without knowing whether another hook manager owns that setting could silently disable it. Fix the config and run `spell doctor`."
+          );
+        } else if (hook.status === "refused-default-hooks") {
+          printWarning(
+            `Did not install the pre-push hook: this repository has hooks in git's default directory (${hook.hooks.join(", ")}). Setting core.hooksPath would silently stop them running. Move them under \`${ARCANE_HOOKS_DIR}\` yourself and re-run, or add the push guard to your existing pre-push hook.`
+          );
+        } else if (hook.status === "refused-foreign-hooks-path") {
+          printWarning(
+            `Did not install the pre-push hook: core.hooksPath is already "${hook.existing}" (${describeConfigScope(hook.scope)}), so another hook manager owns it. Overwriting would silently disable those hooks. Chain an Arcane pre-push guard into that directory yourself, or unset core.hooksPath first.`
           );
         } else {
           printInfo("Installed a pre-push hook that blocks pushes from this repository.");
         }
         const urls = await disablePushUrls(targetDir);
+        const unprotected = urls.filter((u) => u.status === "failed");
+        if (unprotected.length > 0) {
+          printWarning(
+            `Could not disable the push URL for: ${unprotected.map((u) => `${u.remote} (${u.reason ?? "unknown error"})`).join("; ")}. Those remotes are still pushable with \`--no-verify\`. Run \`spell doctor\` \u2014 it lists exactly which remotes are still live.`
+          );
+        }
         if (urls.length === 0) {
           printWarning(
             "No remote is configured, so only the pre-push hook is active. A remote added later will NOT have its push URL disabled automatically, and a `--no-verify` push to it would succeed. Run `spell doctor` after adding one \u2014 it reports this gap."
           );
         } else {
-          printInfo(
-            `Disabled the push URL for: ${urls.map((u) => u.remote).join(", ")} (fetch still works).`
-          );
+          const covered = urls.filter((u) => u.status !== "failed").map((u) => u.remote);
+          if (covered.length > 0) {
+            printInfo(`Disabled the push URL for: ${covered.join(", ")} (fetch still works).`);
+          }
         }
         printInfo("Run `spell unblock-push` from a terminal to undo this.");
       } else {
@@ -2636,7 +2891,7 @@ import { join as join8 } from "path";
 
 // src/modules/hub.ts
 import { confirm as confirm2, select as select3, input as input3 } from "@inquirer/prompts";
-import { readdir as readdir3, writeFile as writeFile6 } from "fs/promises";
+import { readdir as readdir4, writeFile as writeFile6 } from "fs/promises";
 import { join as join7 } from "path";
 var MANIFEST_RETROFITS = [
   {
@@ -2780,7 +3035,7 @@ async function offerRegistryScaffold(targetDir, businessRoot) {
   const businessRootPath = join7(targetDir, businessRoot);
   let ventureDirs;
   try {
-    const entries = await readdir3(businessRootPath, { withFileTypes: true });
+    const entries = await readdir4(businessRootPath, { withFileTypes: true });
     ventureDirs = entries.filter((e) => e.isDirectory() && e.name !== "_template").map((e) => e.name);
   } catch {
     return;
@@ -2987,7 +3242,7 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
 
 // src/modules/version-check.ts
 import { readFile as readFile5, writeFile as writeFile7, mkdir as mkdir5 } from "fs/promises";
-import { dirname, join as join9 } from "path";
+import { dirname as dirname2, join as join9 } from "path";
 import { homedir as homedir2 } from "os";
 import { createRequire } from "module";
 var require2 = createRequire(import.meta.url);
@@ -3016,7 +3271,7 @@ async function readCache(cachePath) {
   }
 }
 async function writeCache(cachePath, latest) {
-  await mkdir5(dirname(cachePath), { recursive: true });
+  await mkdir5(dirname2(cachePath), { recursive: true });
   const entry = { latest, checkedAt: (/* @__PURE__ */ new Date()).toISOString() };
   await writeFile7(cachePath, JSON.stringify(entry, null, 2), "utf-8");
 }
@@ -3130,7 +3385,7 @@ async function runStatus(targetDir, packageVersion) {
 }
 
 // src/commands/uninstall.ts
-import { rm as rm2 } from "fs/promises";
+import { rm as rm3 } from "fs/promises";
 import { join as join10 } from "path";
 import { confirm as confirm3 } from "@inquirer/prompts";
 async function runUninstall(options, targetDir) {
@@ -3145,6 +3400,21 @@ async function runUninstall(options, targetDir) {
     }
     throw err;
   }
+  const policy = manifest.push_policy ?? "open";
+  const controlsInForce = await isHookEnforced(targetDir) || (await blockedRemotes(targetDir)).length > 0;
+  if ((policy === "blocked" || controlsInForce) && !options.dryRun) {
+    const why = policy === "blocked" ? `this repository's push_policy is "blocked"` : `this repository still has Arcane's push block in force (the manifest says "${policy}", but the controls are actually installed)`;
+    console.error(
+      `Refusing to uninstall: ${why}.
+Uninstalling now would delete .arcane.json while leaving the pre-push hook and the
+disabled push URLs in place \u2014 the repository could not push, and \`spell unblock-push\`
+would no longer recognise it.
+
+Run \`spell unblock-push\` first (interactive), then uninstall.`
+    );
+    process.exit(1);
+    return;
+  }
   const allFiles = manifest.components.flatMap((c) => c.files);
   const totalFiles = allFiles.length;
   if (options.dryRun) {
@@ -3159,6 +3429,11 @@ async function runUninstall(options, targetDir) {
     console.log(`[dry-run] Would strip arcane sections from: CLAUDE.md, AGENTS.md, copilot-instructions.md`);
     console.log(`
 [dry-run] ${totalFiles} file(s) + manifest + agent outputs would be removed.`);
+    if (policy === "blocked" || controlsInForce) {
+      console.log(
+        `[dry-run] BUT the real run would refuse: Arcane's push block is in force. Run \`spell unblock-push\` first.`
+      );
+    }
     return;
   }
   if (!options.yes) {
@@ -3176,22 +3451,22 @@ async function runUninstall(options, targetDir) {
     for (const file of component.files) {
       const filePath = join10(targetDir, file);
       try {
-        await rm2(filePath, { force: true });
+        await rm3(filePath, { force: true });
         removed++;
       } catch {
       }
     }
   }
-  await rm2(join10(targetDir, ".arcane.json"), { force: true });
+  await rm3(join10(targetDir, ".arcane.json"), { force: true });
   const agentDirs = [
     ".github/agents",
     ".arcane/agents",
     ".arcane/generated"
   ];
   for (const dir of agentDirs) {
-    await rm2(join10(targetDir, dir), { recursive: true, force: true });
+    await rm3(join10(targetDir, dir), { recursive: true, force: true });
   }
-  await rm2(join10(targetDir, ".arcane/agents.yaml"), { force: true });
+  await rm3(join10(targetDir, ".arcane/agents.yaml"), { force: true });
   const markerFiles = [
     "CLAUDE.md",
     "AGENTS.md",
@@ -3205,8 +3480,8 @@ async function runUninstall(options, targetDir) {
 }
 
 // src/commands/doctor.ts
-import { access as access3, readFile as readFile6, mkdir as mkdir6, copyFile as fsCopyFile2 } from "fs/promises";
-import { join as join11, dirname as dirname2 } from "path";
+import { access as access4, readFile as readFile6, mkdir as mkdir6, copyFile as fsCopyFile2 } from "fs/promises";
+import { join as join11, dirname as dirname3 } from "path";
 import { execFile as execFile2 } from "child_process";
 import { promisify } from "util";
 
@@ -3299,8 +3574,8 @@ async function checkVSCodeExtension(id, label) {
   ];
   for (const dir of extDirs) {
     try {
-      const { readdir: readdir4 } = await import("fs/promises");
-      const entries = await readdir4(dir);
+      const { readdir: readdir5 } = await import("fs/promises");
+      const entries = await readdir5(dir);
       const prefix = id.toLowerCase() + "-";
       const found = entries.some(
         (e) => e.toLowerCase() === id.toLowerCase() || e.toLowerCase().startsWith(prefix)
@@ -3331,7 +3606,7 @@ async function checkArcaneManifest(targetDir) {
   const name = "Arcane manifest (.arcane.json)";
   const manifestPath2 = join11(targetDir, ".arcane.json");
   try {
-    await access3(manifestPath2);
+    await access4(manifestPath2);
   } catch {
     const selfHostedManifestPath = join11(targetDir, "src", "assets", ".arcane.json");
     try {
@@ -3427,7 +3702,7 @@ async function checkSessionContinuity(targetDir) {
     const name = `Session file: ${file}`;
     const filePath = join11(targetDir, file);
     try {
-      await access3(filePath);
+      await access4(filePath);
       results.push({ name, passed: true, message: "present" });
     } catch {
       results.push({
@@ -3445,10 +3720,10 @@ async function fixSessionContinuity(targetDir, assetsDir) {
   for (const file of SESSION_CONTINUITY_FILES) {
     const destPath = join11(targetDir, file);
     try {
-      await access3(destPath);
+      await access4(destPath);
     } catch {
       const srcPath = join11(assetsDir, file);
-      await mkdir6(dirname2(destPath), { recursive: true });
+      await mkdir6(dirname3(destPath), { recursive: true });
       await fsCopyFile2(srcPath, destPath);
       created.push(file);
     }
@@ -3468,8 +3743,8 @@ async function checkPushPolicy(targetDir) {
     return { name, passed: true, message: "open \u2014 pushes allowed" };
   }
   if (policy === "guarded") {
-    const remotes2 = await listRemotes(targetDir);
-    const where = remotes2.length === 0 ? "none configured" : remotes2.join(", ");
+    const targets = await pushTargets(targetDir);
+    const where = targets.length === 0 ? "none configured" : targets.map(({ remote, urls }) => `${remote} \u2192 ${urls.length > 0 ? urls.join(", ") : "unknown"}`).join("; ");
     return {
       name,
       passed: false,
@@ -3559,7 +3834,7 @@ async function runDoctor(targetDir, options = {}, assetsDir) {
 }
 
 // src/commands/unblock-push.ts
-import { basename, resolve } from "path";
+import { basename as basename2, resolve as resolve2 } from "path";
 import { input as input4 } from "@inquirer/prompts";
 async function runUnblockPush(targetDir) {
   let manifest;
@@ -3574,10 +3849,16 @@ async function runUnblockPush(targetDir) {
     throw err;
   }
   const policy = manifest.push_policy ?? "open";
-  if (policy === "open") {
+  const stillInForce = await isHookEnforced(targetDir) || (await blockedRemotes(targetDir)).length > 0;
+  if (policy === "open" && !stillInForce) {
     printInfo("This repository is not push-blocked \u2014 nothing to undo.");
     return;
   }
+  if (policy === "open") {
+    printWarning(
+      "The manifest says push_policy: open, but this repository still has Arcane's push block in force \u2014 most likely a previous unblock only partly succeeded. Continuing so it can be finished."
+    );
+  }
   if (!process.stdin.isTTY) {
     console.error(
       "spell unblock-push must be run from an interactive terminal.\nLifting a push block is a deliberate decision, so it cannot be scripted, piped, or run in CI."
@@ -3585,7 +3866,7 @@ async function runUnblockPush(targetDir) {
     process.exit(1);
     return;
   }
-  const repoName = basename(resolve(targetDir));
+  const repoName = basename2(resolve2(targetDir));
   if (repoName === "") {
     console.error(
       "Could not determine a repository name to confirm against (is this repository at a filesystem root?). Refusing to unblock."
@@ -3608,17 +3889,43 @@ Name did not match ("${typed.trim()}" \u2260 "${repoName}"). Nothing changed.`);
     return;
   }
   await removePrePushHook(targetDir);
-  const restored = await restorePushUrls(targetDir);
+  const results = await restorePushUrls(targetDir);
+  const restored = results.filter((r) => r.status === "restored").map((r) => r.remote);
+  const failed = results.filter((r) => r.status === "failed");
+  const stillBlocked = await blockedRemotes(targetDir);
   const updated = {
     ...manifest,
     push_policy: "open",
     push_policy_unblocked_at: (/* @__PURE__ */ new Date()).toISOString()
   };
   await writeManifest(targetDir, updated);
-  printSuccess(`Push unblocked for "${repoName}".`);
+  const hookStillOn = await isHookEnforced(targetDir);
+  const fullyLifted = failed.length === 0 && stillBlocked.length === 0 && !hookStillOn;
+  if (fullyLifted) {
+    printSuccess(`Push unblocked for "${repoName}".`);
+  } else {
+    printWarning(
+      `Push only PARTIALLY unblocked for "${repoName}". The manifest now says open; the repository is not fully open yet. Details below.`
+    );
+  }
   if (restored.length > 0) {
     printInfo(`Restored push URL for: ${restored.join(", ")}.`);
   }
+  if (hookStillOn) {
+    printWarning(
+      "The pre-push hook is still in force. Arcane did not remove it because `core.hooksPath` is not one it owns, or could not be read. Check `git config --show-scope --get core.hooksPath`."
+    );
+  }
+  if (failed.length > 0) {
+    printWarning(
+      `Could not restore the push URL for: ${failed.map((r) => `${r.remote} (${r.reason ?? "unknown error"})`).join("; ")}.`
+    );
+  }
+  if (stillBlocked.length > 0) {
+    printWarning(
+      `These remotes still have a blocked push URL and no recorded original: ${stillBlocked.join(", ")}. Set them yourself with \`git remote set-url --push <name> <url>\` \u2014 until then, pushing to them will fail even though the manifest now says open.`
+    );
+  }
   printInfo(
     "Recorded in .arcane.json as push_policy: open, with the time it was lifted. Commit that change so the repository's actual posture stays visible to everyone."
   );
@@ -3628,7 +3935,7 @@ Name did not match ("${typed.trim()}" \u2260 "${repoName}"). Nothing changed.`);
 import { realpathSync } from "fs";
 var require3 = createRequire2(import.meta.url);
 var pkg = require3("../package.json");
-var ASSETS_DIR = process.env["ARCANE_ASSETS_DIR"] ?? join12(dirname3(fileURLToPath(import.meta.url)), "assets");
+var ASSETS_DIR = process.env["ARCANE_ASSETS_DIR"] ?? join12(dirname4(fileURLToPath(import.meta.url)), "assets");
 var program = new Command();
 program.name("spell").description("Arcane framework CLI \u2014 scaffold and manage governance files").version(pkg.version).action(async () => {
   await printWelcome(pkg.version, process.cwd());