claude-token-saver 3.28.2 → 3.29.0

package/README.en.md

@@ -173,6 +173,7 @@ Run these in your shell (inside Claude Code, the `/claude-token-saver` Skill is
 | `claude-token-saver update-check` | Is a newer version out? (`--refresh` to ask now, `--dismiss` to mute this version's offer) |
 | `claude-token-saver upgrade` | Install the latest release with the package manager that installed this copy (`--print` shows the command only) |
 | `claude-token-saver install` | Manually register Skill + statusline |
+| `claude-token-saver uninstall [--purge]` | Remove the hooks, statusline and skill it registered. Recorded savings are kept unless `--purge` is given |
 
 Switch output language with `mode ko` / `mode en` (English default; statusline chips stay symbolic).
 
@@ -461,6 +462,20 @@ Conversion is one-way — editing the cached `.md` changes nothing in the source
 
 All four formats were exercised end to end on 2026-09-06: 10 docx run replacements plus three consecutive re-saves, a pptx bar-to-line chart swap with an added data point, xlsx value edits and a new row, and a fig text edit with re-encode and re-parse. In every case the original was byte-identical afterwards and the re-converted copy showed the change. One caveat: removing a chart shape from a pptx leaves the old chart XML part orphaned — PowerPoint ignores it, but delete the part and its rels for a clean file. Charts and images never appear in a conversion, so visual edits must be confirmed in the application itself.
 
+### DRM-wrapped documents
+
+Encryption and DRM are different problems with different answers. Enterprise DRM (Fasoo, MarkAny, SoftCamp and the like) does not password a document — it wraps the whole file, and only processes the vendor's agent has whitelisted ever see plaintext. Python is not one of them, so what sits on disk is ciphertext behind a vendor header, and **no password will open it.**
+
+The first bytes decide which story to tell: a zip header means a truncated download, an OLE container means a password, and neither means the file is not that format at all.
+
+```
+✗ bad-archive: File is not a zip file            → download it again
+✗ encrypted: password-protected Office file      → ask for an unlocked copy
+✗ drm-protected: DRM-wrapped file (FASOO)        → ask for a copy released from DRM
+```
+
+Vendor names are matched only to say which client to go to; the classification stands without recognising the vendor. PDFs are judged the same way through their public DRM security-handler names (FOPN_foweb, EBX_HANDLER, Adobe.APS).
+
 ### Locked documents, and Windows
 
 **A password-protected document is a state, not an error.** Office encrypts by wrapping the package in an OLE compound file rather than a zip, so opening one as a zip used to report "not a zip file" — which reads as a broken download and sends the user after the wrong problem. It is now identified before conversion:

package/README.md

@@ -172,6 +172,7 @@ Claude Code 안에서 `/claude-token-saver` Skill을 실행하거나, 칩에 적
 | `claude-token-saver update-check` | 새 버전이 있는지 확인합니다 (`--refresh`로 즉시 조회, `--dismiss`로 그 버전 안내 끄기) |
 | `claude-token-saver upgrade` | 설치 경로에 맞는 명령으로 최신 버전을 설치합니다 (`--print`로 실행 없이 명령만 확인) |
 | `claude-token-saver install` | Skill·statusline 수동 등록 |
+| `claude-token-saver uninstall [--purge]` | 등록한 훅·statusline·Skill 제거. 기록된 절감액은 남기며, `--purge` 를 붙이면 상태 디렉터리까지 지웁니다 |
 
 출력 언어는 `mode ko`와 `mode en`으로 전환합니다. 기본값은 영어이며, statusline의 칩은 언제나 기호로 표시합니다. 전체 옵션은 [영문 README](./README.en.md#options)를 참고하십시오.
 
@@ -457,6 +458,20 @@ PDF 는 첨부하면 모델이 내용을 그대로 읽습니다. 대신 페이
 
 네 형식 모두 실제로 몇 바퀴 돌려 검증했습니다(2026-09-06): docx 텍스트 치환 10건과 3회 연속 재저장, pptx 막대→꺾은선 차트 교체와 데이터 행 추가, xlsx 값 정정·행 추가, fig 텍스트 수정·재인코드·재파싱. 전 케이스에서 원본은 바이트 그대로였고, 수정본 재변환에 변경 내용이 반영됐습니다. 한 가지 주의: pptx 에서 차트 도형을 제거하면 옛 차트 XML 파트가 고아로 남습니다. PowerPoint 는 무시하지만, 깔끔히 하려면 파트와 rels 도 지우십시오. 차트·이미지 같은 시각 요소는 변환본에 잡히지 않으므로, 시각 편집의 최종 확인은 해당 프로그램에서 해야 합니다.
 
+### DRM 으로 보호된 문서
+
+암호와 DRM 은 다른 문제이고 해법도 다릅니다. 사내 DRM(파수·마크애니·소프트캠프 등)은 문서에 암호를 거는 것이 아니라 파일 전체를 감싸며, 벤더 에이전트가 허용한 프로그램만 평문을 봅니다. 파이썬은 거기 없으므로 디스크에 있는 것은 벤더 헤더가 붙은 암호문입니다. **암호를 입력해서 풀 수 있는 문제가 아닙니다.**
+
+판별은 첫 바이트가 무엇을 말하는지로 갈립니다. zip 헤더면 내려받다 끊긴 파일, OLE 컨테이너면 암호 걸린 문서, 둘 다 아니면 애초에 그 형식이 아닙니다.
+
+```
+✗ bad-archive: File is not a zip file            ← 다시 받으십시오
+✗ encrypted: password-protected Office file      ← 암호를 푼 사본을 요청하십시오
+✗ drm-protected: DRM-wrapped file (FASOO)        ← DRM 해제본이나 반출 승인 사본을 요청하십시오
+```
+
+벤더 이름은 어느 클라이언트로 가야 하는지 알려 주려고 맞춰 볼 뿐이고, 판별 자체는 벤더를 몰라도 성립합니다. PDF 는 공개된 DRM 보안 핸들러 이름(FOPN_foweb·EBX_HANDLER·Adobe.APS)으로 같은 판정을 합니다.
+
 ### 암호가 걸린 문서와 Windows
 
 **암호 문서는 오류가 아니라 상태로 다룹니다.** 사내에서 받는 문서 중 일부는 암호가 걸려 있습니다. 이전에는 암호 걸린 docx 를 "손상된 zip"이라고 알려서 사용자가 원인을 엉뚱한 곳에서 찾게 만들었습니다. 암호가 걸린 Office 문서는 zip 이 아니라 OLE 복합 문서로 저장되기 때문입니다. 지금은 변환 전에 판별해서 이렇게 알립니다.
@@ -468,7 +483,7 @@ PDF 는 첨부하면 모델이 내용을 그대로 읽습니다. 대신 페이
 
 모델에게는 암호를 푼 사본을 사용자에게 요청하라고 안내합니다. 이 도구는 암호를 묻지도 저장하지도 않습니다. 어느 경우에도 원본 `Read` 를 막지 않으므로 작업이 중단되지 않습니다. 열람은 자유롭고 인쇄만 제한된 PDF 는 암호 문서가 아니므로 그대로 변환합니다(오탐 확인 완료). 구형 `.xls` 도 원래 OLE 형식이라 암호로 오인하지 않습니다.
 
-**Windows 를 지원합니다.** 사내에 Windows 사용자가 있어 다음을 맞췄습니다.
+**Windows 를 지원하며, 실제 Windows 러너에서 검증합니다.** 사내에 Windows 사용자가 있어 다음을 맞췄습니다.
 
 - 파이썬 탐색이 `py -3` 런처를 씁니다. Windows 에서는 `python3` 가 PATH 에 없는 경우가 많고, 맨 `python` 은 실행 대신 마이크로소프트 스토어를 여는 별칭 스텁일 수 있습니다. venv 기반 인터프리터도 `Scripts\python.exe` 경로로 찾습니다.
 - `.fig` 파서 설치가 `npm.cmd` 를 셸로 호출합니다. 그리고 패키지 지정자에서 캐럿을 뺐습니다(`openfig-core@0.4.x`). cmd.exe 에서 `^` 는 이스케이프 문자라 npm 에 닿기 전에 먹힙니다.

package/bin/cli.js

@@ -141,6 +141,13 @@ async function main() {
     return (await import('../src/commands/install.js')).run({ hasFlag });
   }
 
+  // The counterpart to `install`. It was in the known-subcommand list from the
+  // start but had no dispatch, so it fell through to the usage report and
+  // exited non-zero — an unhelpful answer to "remove this".
+  if (args[0] === 'uninstall') {
+    return (await import('../src/commands/uninstall.js')).run({ hasFlag, args });
+  }
+
   // Subcommand: mode — persist statusline preferences so future runs pick
   // them up without flags or wrapper edits.
   //   claude-token-saver mode                    # show current config
@@ -395,6 +402,18 @@ async function main() {
       ));
       return;
     }
+    // JSON mode stays JSON. A caller that asked for machine-readable output
+    // and got a paragraph of advice has to parse prose to find out nothing
+    // was found, which is exactly the failure this format exists to avoid.
+    if (getArg('--format') === 'json') {
+      console.log(JSON.stringify({
+        sessions: 0,
+        days,
+        error: 'no-session-data',
+        message: 'No Claude Code session logs found for the given period.',
+      }, null, 2));
+      process.exit(1);
+    }
     console.log('No session data found for the given period.');
     console.log('');
     console.log('This tool analyzes Claude Code session logs (~/.claude/projects/).');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-token-saver",
-  "version": "3.28.2",
+  "version": "3.29.0",
   "description": "Route the easy work your expensive Claude model keeps repeating down to haiku/sonnet — post-hoc session analysis, no realtime router, no extra LLM calls.",
   "type": "module",
   "bin": {

package/presets/doc2md/convert.py

@@ -92,6 +92,62 @@ def encryption_problem(path, ext):
     return None
 
 
+# Enterprise DRM (Fasoo, MarkAny, SoftCamp and the like) does not password a
+# document — it wraps the whole file, and only processes the vendor's agent
+# has whitelisted ever see plaintext. Python is not one of them, so the bytes
+# on disk are ciphertext with a vendor header. Names are matched only to say
+# *which* product to go to; the classification does not depend on them.
+DRM_MARKERS = [b"FASOO", b"MarkAny", b"MAWDRM", b"SoftCamp", b"Sherpa", b"TrustDRM",
+               b"DocuGate", b"WISEDRM", b"UNIDOCS", b"SecureDoc"]
+# PDF DRM announces itself as a security handler, and these names are public.
+PDF_DRM_FILTERS = [b"FOPN_foweb", b"EBX_HANDLER", b"Adobe.APS", b"FOPN_fLock"]
+
+
+def drm_hint(head):
+    """Vendor name found in the file header, or None."""
+    for marker in DRM_MARKERS:
+        if marker in head or marker.decode().encode("utf-16-le") in head:
+            return marker.decode()
+    return None
+
+
+def wrapper_problem(path, ext):
+    """('drm-protected', detail) when the container is not the format at all."""
+    try:
+        with open(path, "rb") as fh:
+            head = fh.read(8192)
+    except OSError:
+        return None
+    if not head:
+        return None
+
+    if ext in ZIP_EXTS:
+        # A truncated download still starts with a zip local-file header; a
+        # wrapped file does not start with anything of the format at all.
+        # Telling those two apart is the difference between "re-download it"
+        # and "get it released from DRM".
+        if head[:2] == b"PK" or head[:8] == OLE_MAGIC:
+            return None
+        vendor = drm_hint(head)
+        return ("drm-protected",
+                "DRM-wrapped file (%s)" % vendor if vendor else "the file is not an Office container at all")
+
+    if ext == ".pdf":
+        if not head.startswith(b"%PDF"):
+            vendor = drm_hint(head)
+            return ("drm-protected",
+                    "DRM-wrapped file (%s)" % vendor if vendor else "the file is not a PDF at all")
+        try:
+            with open(path, "rb") as fh:
+                blob = fh.read(2_000_000)
+        except OSError:
+            return None
+        for f in PDF_DRM_FILTERS:
+            if f in blob:
+                return ("drm-protected", "PDF with a DRM security handler (%s)" % f.decode())
+    return None
+
+
 def check_zip(path):
     """Classify an archive before opening it as a document.
 
@@ -245,6 +301,12 @@ def main():
     if locked:
         fail(locked[0], locked[1])
 
+    # After the password check, because an OLE-wrapped Office file is an
+    # encrypted document rather than a DRM-wrapped one.
+    wrapped = wrapper_problem(path, ext)
+    if wrapped:
+        fail(wrapped[0], wrapped[1])
+
     if ext in ZIP_EXTS:
         problem = check_zip(path)
         if problem:

package/src/commands/harness.js

@@ -268,7 +268,7 @@ export async function run({ args, hasFlag }) {
         try {
           const { spawn } = await import('node:child_process');
           spawn(process.execPath, [process.argv[1], 'route-scan', '--refresh', '--quiet'],
-            { detached: true, stdio: 'ignore' }).unref();
+            { detached: true, stdio: 'ignore', windowsHide: true }).unref();
         } catch (e) { debug('promote:spawn-refresh', e); /* baseline arrives on the next gated rescan */ }
         return;
       }

package/src/commands/route-scan.js

@@ -205,7 +205,7 @@ export async function run({ args, hasFlag, numArg }) {
         try {
           const { spawn } = await import('node:child_process');
           spawn(process.execPath, [process.argv[1], 'route-scan', '--refresh', '--quiet'],
-            { detached: true, stdio: 'ignore' }).unref();
+            { detached: true, stdio: 'ignore', windowsHide: true }).unref();
         } catch (e) { debug('route-scan:spawn-refresh', e); /* stale cache is still usable below */ }
       }
       const open = rs.openCandidates(cache);

package/src/commands/uninstall.js

@@ -0,0 +1,42 @@
+/**
+ * Subcommand: uninstall — take the integration back out of ~/.claude.
+ *
+ *   claude-token-saver uninstall           # hooks, statusline, skill
+ *   claude-token-saver uninstall --purge   # the above plus recorded state
+ *
+ * Recorded savings are kept by default. Someone removing an integration is
+ * usually not asking to throw away the ledger that says what it saved, and
+ * that data cannot be reconstructed once the transcripts age out.
+ */
+
+export async function run({ hasFlag, args = [] }) {
+  const { uninstallAll } = await import('../installer.js');
+  const { userLanguage } = await import('../config.js');
+  const lang = userLanguage();
+  const purge = hasFlag('--purge') || args.includes('--purge');
+
+  const r = uninstallAll({ purge });
+
+  if (r.action === 'skipped') {
+    console.error(lang === 'ko'
+      ? `✗ ${r.path} 를 읽지 못해 아무것도 지우지 않았습니다: ${r.reason}`
+      : `✗ nothing removed — ${r.path} could not be read: ${r.reason}`);
+    process.exitCode = 1;
+    return;
+  }
+
+  if (r.removed.length === 0) {
+    console.log(lang === 'ko' ? '설치된 항목이 없습니다.' : 'Nothing was installed.');
+  } else {
+    console.log(lang === 'ko' ? `✓ 제거했습니다 (${r.path}):` : `✓ removed (${r.path}):`);
+    for (const item of r.removed) console.log(`  - ${item}`);
+  }
+  for (const item of r.kept) {
+    console.log(lang === 'ko' ? `  유지: ${item}` : `  kept: ${item}`);
+  }
+  if (!purge) {
+    console.log(lang === 'ko'
+      ? '  기록된 절감액과 설정까지 지우려면 `claude-token-saver uninstall --purge` 를 실행하십시오.'
+      : '  To remove recorded savings and settings too: `claude-token-saver uninstall --purge`.');
+  }
+}

package/src/doc2md.cjs

@@ -413,8 +413,9 @@ function installConverter({ onProgress = () => {} } = {}) {
 /**
  * Convert one file. Returns `{ ok: true, cacheFile, meta }`, or
  * `{ ok: false, reason, detail }` where reason is one of:
- *   no-markitdown | python-too-old | no-figparser | encrypted | too-large |
- *   sensitive | unsafe-archive | no-text | convert-failed | timeout
+ *   no-markitdown | python-too-old | no-figparser | encrypted |
+ *   drm-protected | too-large | sensitive | unsafe-archive | no-text |
+ *   convert-failed | timeout
  *
  * Every failure is a reason to leave the original Read alone, never to break
  * it. That is the whole contract with the hook.
@@ -680,6 +681,14 @@ function decideForRead(context, opts = {}) {
         + `  진행 상황: ${INSTALL_HINT} 를 직접 실행하면 설치 로그를 볼 수 있습니다.`,
     };
   }
+  if (result.reason === 'drm-protected') {
+    return {
+      deny: false,
+      reason: `[doc2md] ${name} 는 DRM 으로 보호된 파일이라 변환하지 못했습니다(${result.detail || ''}).\n`
+        + '  DRM 은 암호 입력으로 풀리지 않습니다. 벤더 에이전트가 허용한 프로그램에서만 평문이 보이므로, '
+        + '사용자에게 DRM 클라이언트에서 연 뒤 해제본으로 저장하거나 반출 승인을 받은 사본을 요청하십시오.',
+    };
+  }
   if (result.reason === 'encrypted') {
     return {
       deny: false,
@@ -754,7 +763,11 @@ function decideForRead(context, opts = {}) {
 function documentPathsIn(text) {
   if (typeof text !== 'string' || !text) return [];
   const exts = TARGET_EXTENSIONS.map((e) => e.slice(1)).join('|');
-  const re = new RegExp(`[@'"\`]?((?:[A-Za-z]:)?[~./][^\\s'"\`]*\\.(?:${exts}))`, 'gi');
+  // Backslashes count as path characters, not just separators to tolerate:
+  // `C:\\Users\\me\\deck.pptx` and `\\\\server\\share\\deck.pptx` are how
+  // Windows users write a path, and without them the scanner silently sees no
+  // documents at all on that platform.
+  const re = new RegExp(`[@'"\`]?((?:[A-Za-z]:)?[~./\\\\][^\\s'"\`]*\\.(?:${exts}))`, 'gi');
   const found = [];
   for (const m of text.matchAll(re)) {
     const raw = m[1];
@@ -817,6 +830,10 @@ function contextForPrompt(payload, opts = {}) {
       lines.push(lang === 'ko'
         ? `  ${name}: 변환기를 설치하는 중입니다(첫 실행에만 걸립니다). 설치가 끝나면 다음 요청부터 자동 변환됩니다.`
         : `  ${name}: the converter is installing now (first run only). It will convert automatically from the next request.`);
+    } else if (result.reason === 'drm-protected') {
+      lines.push(lang === 'ko'
+        ? `  ${name}: DRM 으로 보호된 파일입니다(${result.detail || ''}). 암호로는 풀 수 없으므로, DRM 클라이언트에서 저장한 해제본이나 반출 승인 사본을 달라고 사용자에게 요청하십시오.`
+        : `  ${name}: the file is DRM-wrapped (${result.detail || ''}). A password will not open it — ask the user for a copy released from DRM.`);
     } else if (result.reason === 'encrypted') {
       lines.push(lang === 'ko'
         ? `  ${name}: 암호가 걸린 문서입니다. 암호를 푼 사본을 달라고 사용자에게 요청하십시오.`

package/src/formatters/statusline.js

@@ -423,9 +423,19 @@ export function formatReport(data, { color = true, verbose = false, timer = true
   if (!singleLine && doc2mdUsd > 0) {
     const head = isIcon ? '📄 Doc2md saved' : 'Doc2md saved';
     const byExt = Array.isArray(doc2md.byExt) ? doc2md.byExt : [];
-    const extText = byExt
-      .map((r) => `${c(GRAY)}${r.ext} ${r.docs}× ${formatMoney(r.usd)}${c(RESET)}`)
-      .join(` ${c(GRAY)}·${c(RESET)} `);
+    // Formats that earned money show it; formats with no baseline to measure
+    // against are counted instead. Printing "$0.00" next to real amounts reads
+    // as "this format saved nothing", when what it means is that there is no
+    // working alternative to price it against — for .fig there is no readable
+    // fallback at all, so the conversion is the only way to open the file.
+    const paid = byExt.filter((r) => r.usd > 0);
+    const unpriced = byExt.filter((r) => !(r.usd > 0));
+    const parts = paid.map((r) => `${c(GRAY)}${r.ext} ${r.docs}× ${formatMoney(r.usd)}${c(RESET)}`);
+    if (unpriced.length) {
+      const counted = unpriced.map((r) => `${r.ext} ${r.docs}×`).join(' · ');
+      parts.push(`${c(GRAY)}${counted} ${verbose ? '(no baseline)' : '(n/a)'}${c(RESET)}`);
+    }
+    const extText = parts.join(` ${c(GRAY)}·${c(RESET)} `);
     doc2mdLine =
       `${c(GREEN)}${c(BOLD)}${head}${c(RESET)} ` +
       `${c(GREEN)}${formatMoney(doc2mdUsd)}${c(RESET)}` +

package/src/harness.js

@@ -11,6 +11,7 @@ import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync } from 'no
 import { join, resolve, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
 import {
   HARNESS_SECTIONS,
   HARNESS_BLOCK_BEGIN,
@@ -368,7 +369,10 @@ export function harnessPull({ root = findProjectRoot(), scope = 'global' } = {})
 /** Parse the bundled preset rules (markdown bullets under presets/). */
 export function presetRules() {
   try {
-    const path = join(dirname(new URL(import.meta.url).pathname), '..', 'presets', 'ratchet-rules.md');
+    // fileURLToPath, not `.pathname`: the latter yields `/D:/repo/src` on
+    // Windows, where the read fails and the catch below turns a missing
+    // file into an empty rule set without ever saying so.
+    const path = join(dirname(fileURLToPath(import.meta.url)), '..', 'presets', 'ratchet-rules.md');
     return readFileSync(path, 'utf8')
       .split('\n')
       .filter((l) => /^\s*-\s+/.test(l))

package/src/installer.js

@@ -13,9 +13,9 @@
  * exist on every platform.
  */
 
-import { writeFileSync, mkdirSync, existsSync, unlinkSync, readFileSync } from 'node:fs';
+import { writeFileSync, mkdirSync, existsSync, unlinkSync, readFileSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
-import { claudeUserDir } from './paths.js';
+import { claudeUserDir, userDataDir } from './paths.js';
 
 const STATUSLINE_COMMAND = 'claude-token-saver --statusline --icon';
 const STATUSLINE_REFRESH_INTERVAL = 5;
@@ -469,6 +469,85 @@ export function removeDoc2mdHook() {
   return { path: file, action: 'removed' };
 }
 
+/**
+ * Undo what `install` did: every hook this tool registered, the statusline
+ * entry when it is still ours, and the skill file.
+ *
+ * Written because `uninstall` was a name in the subcommand list with no
+ * implementation behind it — running it fell through to the usage report and
+ * exited non-zero, which is a poor answer to "get this off my machine". A
+ * company rollout needs the way out to work as well as the way in.
+ *
+ * User data (ledgers, config, conversion cache) is deliberately left alone:
+ * removing an integration should not throw away months of recorded savings.
+ * `--purge` is the separate, explicit request for that.
+ */
+export function uninstallAll({ purge = false } = {}) {
+  const file = join(claudeUserDir(), 'settings.json');
+  const result = { removed: [], kept: [], path: file };
+
+  if (existsSync(file)) {
+    let settings;
+    try {
+      settings = JSON.parse(readFileSync(file, 'utf8'));
+    } catch (e) {
+      return { ...result, action: 'skipped', reason: `unreadable JSON (${e.message})` };
+    }
+
+    // Only our own statusline command goes. Someone else's stays exactly
+    // where they put it.
+    const cur = settings.statusLine;
+    if (cur && typeof cur.command === 'string' && cur.command.includes('claude-token-saver')) {
+      delete settings.statusLine;
+      result.removed.push('statusLine');
+    } else if (cur) {
+      result.kept.push(`statusLine (${cur.command || 'unrecognised'})`);
+    }
+
+    // Every event, every entry whose command is this CLI. Matching on the
+    // binary name rather than a list of exact commands means a hook added by
+    // an older version is still removed by a newer one.
+    for (const event of Object.keys(settings.hooks || {})) {
+      const list = settings.hooks[event];
+      if (!Array.isArray(list)) continue;
+      const kept = list.filter((m) => !(
+        Array.isArray(m?.hooks)
+        && m.hooks.some((h) => typeof h?.command === 'string' && h.command.includes('claude-token-saver'))
+      ));
+      if (kept.length === list.length) continue;
+      result.removed.push(`hooks.${event}`);
+      if (kept.length === 0) delete settings.hooks[event];
+      else settings.hooks[event] = kept;
+    }
+    if (settings.hooks && Object.keys(settings.hooks).length === 0) delete settings.hooks;
+
+    writeFileSync(file, JSON.stringify(settings, null, 2) + '\n');
+  }
+
+  const skillDir = join(claudeUserDir(), 'skills', 'claude-token-saver');
+  if (existsSync(skillDir)) {
+    rmSync(skillDir, { recursive: true, force: true });
+    result.removed.push('skill');
+  }
+  const legacyCommand = join(claudeUserDir(), 'commands', 'token-monitor.md');
+  if (existsSync(legacyCommand)) {
+    rmSync(legacyCommand, { force: true });
+    result.removed.push('legacy command');
+  }
+
+  if (purge) {
+    const data = userDataDir();
+    if (existsSync(data)) {
+      rmSync(data, { recursive: true, force: true });
+      result.removed.push('state directory');
+    }
+  } else {
+    result.kept.push('state directory (savings ledgers, config, cache) — remove with --purge');
+  }
+
+  return { ...result, action: 'removed' };
+}
+
 export function installAll({ force = false } = {}) {
   return {
     skill: installSkill({ force }),

package/src/update-check.js

@@ -119,6 +119,9 @@ export function maybeSpawnUpdateCheck(currentVersion) {
     spawn(process.execPath, [cliEntryPath(), 'update-check', '--refresh', '--quiet'], {
       detached: true,
       stdio: 'ignore',
+      // Without this Windows flashes a console window, and this one
+      // re-spawns from the statusline — several times a minute.
+      windowsHide: true,
     }).unref();
     return true;
   } catch (e) {