pushary 1.9.45 → 1.9.47

package/dist/bin/pushary-clean.js

@@ -9,13 +9,13 @@ import {
   planCliKeyRevocations,
   readCliHeldKeys,
   revokeCliKeys
-} from "../chunk-N2K3BSCA.js";
-import "../chunk-P2F3JUFX.js";
+} from "../chunk-K2KGB7TK.js";
+import "../chunk-X6ILS4XE.js";
 import {
   isCursorPluginLeftover,
   releaseSoleGate,
   withoutPusharyCursorHooks
-} from "../chunk-DSGB5JLG.js";
+} from "../chunk-DPF6WDCX.js";
 import {
   HERMES_PIP_PACKAGE,
   readHermesStatus,
@@ -24,20 +24,20 @@ import {
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-NJN5NRHZ.js";
+} from "../chunk-WOE46HSM.js";
 import {
   macAppKeepsMcpEntry,
   mcpServerBearer,
   pusharyKey,
   readMacAppAgentKey,
   setupReceiptKey
-} from "../chunk-FOUK4CBO.js";
-import "../chunk-YWIFK2UB.js";
+} from "../chunk-FWQ2O5BI.js";
+import "../chunk-6WFJCUWO.js";
 import {
   planFxRemoval,
   removeInstructionBlock
-} from "../chunk-XFHISCJM.js";
-import "../chunk-BT57FUMT.js";
+} from "../chunk-N6JNKOKJ.js";
+import "../chunk-UFTPB3LZ.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -49,7 +49,7 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-YXGWG5PO.js";
+} from "../chunk-3F3JHJPS.js";
 import {
   ansiPainter,
   useColor
@@ -61,6 +61,7 @@ import {
   compatibleMcpFile,
   compatiblePermissionRuleFile,
   isClaudeMcpSnapshot,
+  isEmptiedPusharyOwnedDocument,
   readConfigDocument,
   removeClaudeMcpServers,
   removeCompatibleHooks,
@@ -69,10 +70,10 @@ import {
   removePusharyToolPermissions,
   restoreClaudeMcpServer,
   serializeConfigDocument
-} from "../chunk-RBJWPUI6.js";
+} from "../chunk-TP5SLM2I.js";
 import {
   disableDaemonService
-} from "../chunk-AUOSFZJ3.js";
+} from "../chunk-RDVDW3WK.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
@@ -80,12 +81,12 @@ import {
   resolveBridgeStub,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-ASK2MSD2.js";
+} from "../chunk-FDDZEYGM.js";
 import {
   removeGeminiSettings
-} from "../chunk-5DCZL3BC.js";
-import "../chunk-OHFC3GJY.js";
-import "../chunk-U45OINYS.js";
+} from "../chunk-PHKISQPB.js";
+import "../chunk-3KSN65VJ.js";
+import "../chunk-DDS472RO.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
@@ -94,21 +95,21 @@ import {
   isDisabledExport,
   removeClaudeAlias,
   shellProfileCandidates
-} from "../chunk-YK7FGPYS.js";
+} from "../chunk-S3657KK2.js";
 import {
   exitOnHelpFlag
-} from "../chunk-ZSY6BWUD.js";
+} from "../chunk-7JUISFZ7.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-GZSSAY6N.js";
-import "../chunk-HHX6IRSH.js";
-import "../chunk-CFMCV6Z7.js";
-import "../chunk-CDERSTBO.js";
+import "../chunk-ZR2EPWW4.js";
+import "../chunk-6W64IVG3.js";
+import "../chunk-ADKWE35P.js";
+import "../chunk-GLVPA4EK.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-SFQSOBLM.js";
-import "../chunk-PWUIPQ2I.js";
-import "../chunk-6TYKZ4DN.js";
-import "../chunk-4A6VUVXV.js";
+import "../chunk-6VFP72GX.js";
+import "../chunk-KQDHOQRG.js";
+import "../chunk-FY6ZTTDQ.js";
+import "../chunk-VQZ4FP6Z.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
@@ -149,14 +150,14 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-IOVJVGIT.js";
+} from "../chunk-MCL5IS6A.js";
 import "../chunk-AQFEP65J.js";
 import {
   getBaseUrl
-} from "../chunk-EWC4P4ZL.js";
+} from "../chunk-PRQMACC7.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-57M4ERJK.js";
+} from "../chunk-VE4LQ23C.js";
 import {
   CLI_PACKAGE_NAMES,
   HOOK_COMPATIBLE_PROFILES,
@@ -168,10 +169,10 @@ import {
   globalRootFor,
   isValidApiKey,
   redactSecrets
-} from "../chunk-K7EGWMDU.js";
+} from "../chunk-DY5PQSQB.js";
 
 // bin/pushary-clean.ts
-import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync4 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync5 } from "fs";
 import { dirname, join as join6 } from "path";
 import { homedir as homedir5, tmpdir } from "os";
 import { confirm } from "@inquirer/prompts";
@@ -179,10 +180,11 @@ import { parse as parseTOML, stringify as stringifyTOML } from "smol-toml";
 
 // src/cli/mac-leftovers.ts
 import { execSync, execFileSync } from "child_process";
-import { existsSync } from "fs";
+import { existsSync, readdirSync } from "fs";
 import { homedir } from "os";
-import { join } from "path";
+import { isAbsolute, join } from "path";
 var MAC_APP_BUNDLE = "/Applications/Pushary.app";
+var MAC_APP_BUNDLE_ID = "com.pushary.app";
 var installedPusharyBundles = (home = homedir()) => [MAC_APP_BUNDLE, join(home, "Applications", "Pushary.app")];
 var LSREGISTER = "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";
 var TEST_DEFAULTS_PREFIXES = [
@@ -190,28 +192,45 @@ var TEST_DEFAULTS_PREFIXES = [
   "com.pushary.tests.",
   "pushary.tests.",
   "pushary.quiet-mode-test.",
-  "pushary-optin-"
+  "pushary.drafts.test.",
+  "pushary-optin-",
+  "pushary-completion-test-",
+  "pushary-updates-only-"
 ];
-var isTestDefaultsDomain = (domain) => TEST_DEFAULTS_PREFIXES.some((prefix) => domain.startsWith(prefix));
-var leakedTestDefaultsDomains = () => {
+var UUID = "[0-9A-Fa-f]{8}(?:-[0-9A-Fa-f]{4}){3}-[0-9A-Fa-f]{12}";
+var UNPREFIXED_TEST_DEFAULTS_DOMAIN = new RegExp(`^(?:owner-mode|fx-model)-${UUID}$`);
+var DEVELOPER_BUILD_DEFAULTS_DOMAIN = "PusharyMac";
+var isDeveloperDefaultsDomain = (domain) => domain === DEVELOPER_BUILD_DEFAULTS_DOMAIN || UNPREFIXED_TEST_DEFAULTS_DOMAIN.test(domain) || TEST_DEFAULTS_PREFIXES.some((prefix) => domain.startsWith(prefix));
+var PREFERENCES_FILE_EXTENSION = ".plist";
+var preferencesDirectory = (home) => join(home, "Library", "Preferences");
+var preferencesFile = (home, domain) => join(preferencesDirectory(home), `${domain}${PREFERENCES_FILE_EXTENSION}`);
+var namesIn = (directory) => {
   try {
-    return execSync("defaults domains", { encoding: "utf-8", timeout: 2e4 }).split(",").map((entry) => entry.trim()).filter(isTestDefaultsDomain).filter(liveMacStatePresence.defaultsDomain);
+    return readdirSync(directory);
   } catch {
     return [];
   }
 };
+var developerDefaults = (home = homedir()) => namesIn(preferencesDirectory(home)).filter((name) => name.endsWith(PREFERENCES_FILE_EXTENSION)).map((name) => name.slice(0, -PREFERENCES_FILE_EXTENSION.length)).filter(isDeveloperDefaultsDomain).map((domain) => ({ domain, file: preferencesFile(home, domain) }));
 var BUNDLE_NAME = "Pushary.app";
-var DUMP_PATH_LINE = /^\s*path:\s+(.+?)(?: \(0x[0-9a-f]+\))?\s*$/;
+var DUMP_RECORD_SEPARATOR = /^-{20,}$/m;
+var DUMP_PATH_LINES = /^[ \t]*path:[ \t]+(.+?)(?: \(0x[0-9a-f]+\))?[ \t]*$/gm;
+var DUMP_IDENTIFIER_LINES = /^[ \t]*identifier:[ \t]+(\S+)/gm;
+var capturedIn = (text, lines) => [...text.matchAll(lines)].flatMap((match) => match[1] === void 0 ? [] : [match[1]]);
+var appCopyNamedByRecord = (record) => {
+  const paths = capturedIn(record, DUMP_PATH_LINES);
+  const identifiers = capturedIn(record, DUMP_IDENTIFIER_LINES);
+  const namesOneAppCopy = paths.length === 1 && identifiers.length === 1 && identifiers[0] === MAC_APP_BUNDLE_ID;
+  return namesOneAppCopy ? paths : [];
+};
+var isAtOrInside = (path, bundle) => path === bundle || path.startsWith(`${bundle}/`);
+var isUnderBundleNamedPushary = (path) => path.split("/").includes(BUNDLE_NAME);
 var bundlesInLaunchServicesDump = (dump) => {
-  const found = /* @__PURE__ */ new Set();
-  for (const line of dump.split("\n")) {
-    const path = DUMP_PATH_LINE.exec(line)?.[1];
-    const bundle = path?.indexOf(`/${BUNDLE_NAME}`);
-    if (path === void 0 || bundle === void 0 || bundle === -1) continue;
-    found.add(path.slice(0, bundle + BUNDLE_NAME.length + 1));
-  }
-  return [...found];
+  const appCopies = dump.split(DUMP_RECORD_SEPARATOR).flatMap(appCopyNamedByRecord);
+  const isOurs = (path) => isUnderBundleNamedPushary(path) || appCopies.some((copy) => isAtOrInside(path, copy));
+  return [...new Set(capturedIn(dump, DUMP_PATH_LINES).filter(isOurs))];
 };
+var outsideInstalledBundles = (registered, installed) => registered.filter((path) => !installed.some((bundle) => isAtOrInside(path, bundle)));
 var registeredPusharyBundles = (installed = installedPusharyBundles()) => {
   if (!existsSync(LSREGISTER)) return [];
   try {
@@ -220,7 +239,7 @@ var registeredPusharyBundles = (installed = installedPusharyBundles()) => {
       timeout: 6e4,
       maxBuffer: 256 * 1024 * 1024
     });
-    return bundlesInLaunchServicesDump(dump).filter((path) => !installed.includes(path));
+    return outsideInstalledBundles(bundlesInLaunchServicesDump(dump), installed);
   } catch {
     return [];
   }
@@ -269,7 +288,35 @@ var macLibraryState = (home = homedir()) => [
   join(home, "Library", "Caches", "pushary-bridge"),
   join(home, "Library", "HTTPStorages", "com.pushary.app"),
   join(home, "Library", "HTTPStorages", "com.pushary.app.binarycookies"),
-  join(home, "Library", "HTTPStorages", "pushary-bridge")
+  join(home, "Library", "HTTPStorages", "pushary-bridge"),
+  ...MAC_DEFAULTS_DOMAINS.map((domain) => preferencesFile(home, domain))
+];
+var USER_CACHE_ENTRIES = [MAC_APP_BUNDLE_ID, "pushary-bridge", "PusharyBridge"];
+var macUserCacheState = (reportedUserCacheDirectory) => {
+  const directory = reportedUserCacheDirectory.trim();
+  return isAbsolute(directory) ? USER_CACHE_ENTRIES.map((entry) => join(directory, entry)) : [];
+};
+var UNKNOWN_USER_CACHE_DIRECTORY = "";
+var reportedDarwinUserCacheDirectory = () => {
+  try {
+    return execFileSync("getconf", ["DARWIN_USER_CACHE_DIR"], {
+      encoding: "utf-8",
+      timeout: PRESENCE_PROBE_TIMEOUT_MS,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+  } catch {
+    return UNKNOWN_USER_CACHE_DIRECTORY;
+  }
+};
+var CRASH_REPORTER_ENTRY = new RegExp(`^(?:Pushary|PusharyMac|pushary-bridge)_${UUID}\\.plist$`);
+var crashReporterEntries = (home = homedir()) => {
+  const directory = join(home, "Library", "Application Support", "CrashReporter");
+  return namesIn(directory).filter((name) => CRASH_REPORTER_ENTRY.test(name)).map((name) => join(directory, name));
+};
+var storedMacAppState = (home = homedir()) => [
+  ...macLibraryState(home),
+  ...macUserCacheState(reportedDarwinUserCacheDirectory()),
+  ...crashReporterEntries(home)
 ];
 var DUMP_SERVICE_LINE = /^\s*"svce"<blob>="(.+)"\s*$/;
 var pusharyKeychainServices = (dump) => {
@@ -290,7 +337,6 @@ var storedPusharyKeychainServices = () => {
   const stored = pusharyKeychainServices(dump);
   return stored.includes(MAC_KEYCHAIN_SERVICE) ? stored : [MAC_KEYCHAIN_SERVICE, ...stored];
 };
-var MAC_APP_BUNDLE_ID = "com.pushary.app";
 var runningMacAppPIDs = () => {
   if (process.platform !== "darwin") return [];
   try {
@@ -314,17 +360,26 @@ var waitForMacAppExit = (attempts = 20, everyMs = 250) => {
 
 // src/cli/clean-mac.ts
 import { existsSync as existsSync2 } from "fs";
-var removeDeveloperLeftovers = (guards2, domains, bundles) => {
+var deleteDefaultsDomain = (guards2, domain) => {
+  try {
+    guards2.execFile("defaults", ["delete", domain], { stdio: "ignore", timeout: 1e4 }, `delete preferences ${domain}`);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var removeDeveloperLeftovers = (guards2, leftovers) => {
   let removed = 0;
-  for (const domain of domains) {
+  for (const stored of leftovers.defaults) {
+    deleteDefaultsDomain(guards2, stored.domain);
     try {
-      guards2.execFile("defaults", ["delete", domain], { stdio: "ignore", timeout: 1e4 }, `delete preferences ${domain}`);
+      guards2.remove(stored.file, { force: true });
       removed++;
     } catch {
       continue;
     }
   }
-  for (const bundle of bundles) {
+  for (const bundle of leftovers.registrations) {
     try {
       guards2.execFile(LSREGISTER, ["-u", bundle], { stdio: "ignore", timeout: 2e4 }, `unregister ${bundle}`);
       removed++;
@@ -334,14 +389,16 @@ var removeDeveloperLeftovers = (guards2, domains, bundles) => {
   }
   return removed;
 };
-var removeMacAppState = (guards2, readServices, home, present) => {
+var NO_MAC_APP_STATE = { removed: 0, failed: 0, unremovable: [] };
+var removeMacAppState = (guards2, readServices, statePaths, present) => {
   let removed = 0;
   let failed = 0;
+  const unremovable = [];
   let services;
   try {
     services = readServices();
   } catch {
-    return { removed, failed: 1 };
+    return { removed, failed: 1, unremovable };
   }
   for (const service of services) {
     for (const account of MAC_KEYCHAIN_ACCOUNTS.filter((account2) => present.keychainItem(service, account2))) {
@@ -359,19 +416,18 @@ var removeMacAppState = (guards2, readServices, home, present) => {
     }
   }
   for (const domain of MAC_DEFAULTS_DOMAINS.filter(present.defaultsDomain)) {
+    if (deleteDefaultsDomain(guards2, domain)) removed++;
+  }
+  for (const path of statePaths) {
+    if (!existsSync2(path)) continue;
     try {
-      guards2.execFile("defaults", ["delete", domain], { stdio: "ignore", timeout: 1e4 }, `delete preferences ${domain}`);
+      guards2.remove(path, { force: true });
       removed++;
     } catch {
-      continue;
+      unremovable.push(path);
     }
   }
-  for (const path of macLibraryState(home)) {
-    if (!existsSync2(path)) continue;
-    guards2.remove(path, { force: true });
-    removed++;
-  }
-  return { removed, failed };
+  return { removed, failed, unremovable };
 };
 var quitMacApp = (guards2, state) => {
   if (state.platform !== "darwin" || state.running().length === 0) return "not-running";
@@ -388,7 +444,7 @@ var quitMacApp = (guards2, state) => {
 };
 
 // src/cli/editor-extension.ts
-import { existsSync as existsSync3, readFileSync, readdirSync } from "fs";
+import { existsSync as existsSync3, readFileSync, readdirSync as readdirSync2 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
 var EDITOR_EXTENSION_ID = "pushary.pushary";
@@ -416,7 +472,7 @@ var recordWithoutUs = (directory) => {
   }
 };
 var editorExtensionRemovals = (home = homedir2()) => EDITOR_EXTENSION_DIRS.map((relative) => join2(home, relative)).filter(existsSync3).map((directory) => {
-  const folders = readdirSync(directory).filter((name) => name.startsWith(`${EDITOR_EXTENSION_ID}-`)).map((name) => join2(directory, name));
+  const folders = readdirSync2(directory).filter((name) => name.startsWith(`${EDITOR_EXTENSION_ID}-`)).map((name) => join2(directory, name));
   return { directory, folders, record: recordWithoutUs(directory) };
 }).filter((removal) => removal.folders.length > 0 || removal.record !== void 0);
 
@@ -452,14 +508,14 @@ var skillsStoreRemoval = (home = homedir3()) => {
 };
 
 // src/cli/claude-backups.ts
-import { existsSync as existsSync5, readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync3, readdirSync as readdirSync3 } from "fs";
 import { homedir as homedir4 } from "os";
 import { join as join4 } from "path";
 var BACKUP_PREFIX = ".claude.json.backup";
 var claudeJsonBackups = (home = homedir4()) => {
   const rollingDir = join4(home, ".claude", "backups");
   const legacy = join4(home, BACKUP_PREFIX);
-  const rolling = existsSync5(rollingDir) ? readdirSync2(rollingDir).filter((name) => name.startsWith(BACKUP_PREFIX)).sort().map((name) => join4(rollingDir, name)) : [];
+  const rolling = existsSync5(rollingDir) ? readdirSync3(rollingDir).filter((name) => name.startsWith(BACKUP_PREFIX)).sort().map((name) => join4(rollingDir, name)) : [];
   return existsSync5(legacy) ? [...rolling, legacy] : rolling;
 };
 var parsed = (path) => {
@@ -516,7 +572,7 @@ var removeGlobalCliPackages = (guards2, request) => {
 };
 
 // src/cli/config-temp-leftovers.ts
-import { lstatSync, readdirSync as readdirSync3 } from "fs";
+import { lstatSync, readdirSync as readdirSync4 } from "fs";
 import { join as join5 } from "path";
 var MAC_APP_WRITE_TEMP = /^\..+\.pushary-[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}$/;
 var PID_STAMPED_WRITE_TEMP = /^\.\d+-[^/]+\.pushary-tmp$/;
@@ -525,7 +581,7 @@ var isLeakedConfigTempName = (name) => MAC_APP_WRITE_TEMP.test(name) || PID_STAM
 var leakedConfigTemps = (entries, nowMs) => entries.filter((entry) => entry.isFile && isLeakedConfigTempName(entry.name) && nowMs - entry.modifiedAtMs >= CONFIG_TEMP_MIN_AGE_MS).map((entry) => entry.name);
 var directoryEntries = (directory) => {
   try {
-    return readdirSync3(directory).flatMap((name) => {
+    return readdirSync4(directory).flatMap((name) => {
       const stats = lstatSync(join5(directory, name), { throwIfNoEntry: false });
       return stats ? [{ name, isFile: stats.isFile(), modifiedAtMs: stats.mtimeMs }] : [];
     });
@@ -587,7 +643,12 @@ var cleanCompatibleAgent = (profile, scope, io, home) => {
     const document = readConfigDocument(path, file.format, io.files);
     if (document.kind === "missing") return [{ path, outcome: "not_found" }];
     if (document.kind === "unreadable") return [{ path, outcome: "unreadable" }];
-    if (!edits.reduce((changed, remove) => remove(document.value) || changed, false)) return [{ path, outcome: "unchanged" }];
+    const hadPusharyEntries = edits.reduce((changed, remove) => remove(document.value) || changed, false);
+    if (isEmptiedPusharyOwnedDocument(file, document.value)) {
+      io.files.remove(path);
+      return [{ path, outcome: "removed" }];
+    }
+    if (!hadPusharyEntries) return [{ path, outcome: "unchanged" }];
     io.files.write(path, serializeConfigDocument(document.value, file.format));
     return [{ path, outcome: "cleaned" }];
   });
@@ -666,7 +727,7 @@ var guardedRemove = (path, options) => guards.remove(path, options);
 var cursorPluginLeftovers = () => {
   const parent = dirname(CURSOR_PLUGIN_DIR);
   try {
-    return readdirSync4(parent).filter(isCursorPluginLeftover).map((name) => join6(parent, name));
+    return readdirSync5(parent).filter(isCursorPluginLeftover).map((name) => join6(parent, name));
   } catch {
     return [];
   }
@@ -1114,6 +1175,7 @@ var main = async () => {
       if (file.outcome === "not_found") console.log(`  ${skip} ${label2} ${dim("(not found)")}`);
       else if (file.outcome === "unreadable") console.log(`  ${skip} ${label2} ${yellow("(could not read configuration; left unchanged)")}`);
       else if (file.outcome === "cleaned") console.log(`  ${check} ${label2} ${dim(did("cleaned"))}`);
+      else if (file.outcome === "removed") console.log(`  ${check} ${label2} ${dim(did("removed"))}`);
       else console.log(`  ${skip} ${label2} ${dim(keepShared ? "(nothing the CLI wrote)" : "(no pushary entries)")}`);
     }
     if (report.mcpKeptForApp) console.log(`  ${skip} ${profile.label} MCP server ${dim("(kept: the Mac app uses it)")}`);
@@ -1161,7 +1223,7 @@ var main = async () => {
     const sibling = join6(openCodePluginDir(), OPENCODE_PLUGIN_SIBLING);
     const remaining = (() => {
       try {
-        return readdirSync4(openCodePluginDir()).filter((name) => name !== OPENCODE_PLUGIN_SIBLING);
+        return readdirSync5(openCodePluginDir()).filter((name) => name !== OPENCODE_PLUGIN_SIBLING);
       } catch {
         return [];
       }
@@ -1271,7 +1333,7 @@ var main = async () => {
   if (existsSync6(PUSHARY_DIR)) {
     let removed = 0;
     const kept = [];
-    for (const entry of readdirSync4(PUSHARY_DIR)) {
+    for (const entry of readdirSync5(PUSHARY_DIR)) {
       if (keepShared && isAppOwned(entry) || entry === "setup" && (keepShared || incompleteClean)) {
         kept.push(entry);
         continue;
@@ -1293,7 +1355,7 @@ var main = async () => {
   }
   try {
     let swept = 0;
-    for (const f of readdirSync4(tmpdir())) {
+    for (const f of readdirSync5(tmpdir())) {
       if (!f.startsWith("pushary-")) continue;
       try {
         guardedRemove(join6(tmpdir(), f), { force: true });
@@ -1311,18 +1373,22 @@ var main = async () => {
     if (store.skillDir || store.lock) {
       console.log(`  ${check} skills.sh registration ${dim(did("removed"))} ${dim("(~/.agents)")}`);
     }
-    const leftovers = process.platform === "darwin" ? removeDeveloperLeftovers(guards, leakedTestDefaultsDomains(), registeredPusharyBundles()) : 0;
+    const leftovers = process.platform === "darwin" ? removeDeveloperLeftovers(guards, { defaults: developerDefaults(), registrations: registeredPusharyBundles() }) : 0;
     if (leftovers > 0) {
       console.log(`  ${check} Developer leftovers ${dim(did("removed"))} ${dim(`(${leftovers} leaked test preferences and stale app registrations)`)}`);
     }
-    const { removed, failed } = process.platform === "darwin" ? removeMacAppState(guards, storedPusharyKeychainServices, homedir5(), liveMacStatePresence) : { removed: 0, failed: 0 };
+    const { removed, failed, unremovable } = process.platform === "darwin" ? removeMacAppState(guards, storedPusharyKeychainServices, storedMacAppState(), liveMacStatePresence) : NO_MAC_APP_STATE;
     if (failed > 0) {
       incompleteClean = true;
       console.log(`  ${cross} Mac keychain ${dim(`(${failed} operations failed; unlock your keychain and re-run)`)}`);
     }
+    if (unremovable.length > 0) {
+      incompleteClean = true;
+      console.log(`  ${cross} Mac app state ${dim(`(could not remove ${unremovable.map((path) => shortenHome(path)).join(", ")})`)}`);
+    }
     if (removed > 0) {
       console.log(`  ${check} Mac app state ${dim(did("removed"))} ${dim(`(${removed} across the keychain, preferences and caches)`)}`);
-    } else if (failed === 0) {
+    } else if (failed === 0 && unremovable.length === 0) {
       console.log(`  ${skip} Mac app state ${dim("(nothing of ours in the keychain, preferences or caches)")}`);
     }
   }

package/dist/bin/pushary-codex-bridge.js

@@ -1,42 +1,42 @@
 #!/usr/bin/env node
 import {
   transcriptsEnabled
-} from "../chunk-7SGYCU5C.js";
-import "../chunk-YK7FGPYS.js";
+} from "../chunk-4MJ46JA7.js";
+import "../chunk-S3657KK2.js";
 import {
   runCodexBridge
-} from "../chunk-6JPDAUFP.js";
-import "../chunk-EKGQEDQ4.js";
+} from "../chunk-WHHNQA4C.js";
+import "../chunk-UIPZSSBC.js";
 import {
   resolveProviderBinary
-} from "../chunk-WPPKXVV3.js";
+} from "../chunk-M47U54AO.js";
 import "../chunk-RIVNNBEK.js";
 import {
   withSpawnProcessOwnership
-} from "../chunk-H4ODQD3Y.js";
-import "../chunk-SIN7NJD7.js";
-import "../chunk-RFQWB5ZV.js";
+} from "../chunk-P4RKBBHE.js";
+import "../chunk-DRQVZHWE.js";
+import "../chunk-T3QKLW3M.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-CFMCV6Z7.js";
-import "../chunk-CDERSTBO.js";
+import "../chunk-ADKWE35P.js";
+import "../chunk-GLVPA4EK.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-SFQSOBLM.js";
-import "../chunk-PWUIPQ2I.js";
-import "../chunk-6TYKZ4DN.js";
+import "../chunk-6VFP72GX.js";
+import "../chunk-KQDHOQRG.js";
+import "../chunk-FY6ZTTDQ.js";
 import {
   getMachineId
-} from "../chunk-4A6VUVXV.js";
+} from "../chunk-VQZ4FP6Z.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-IOVJVGIT.js";
+import "../chunk-MCL5IS6A.js";
 import "../chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-EWC4P4ZL.js";
-import "../chunk-57M4ERJK.js";
-import "../chunk-K7EGWMDU.js";
+} from "../chunk-PRQMACC7.js";
+import "../chunk-VE4LQ23C.js";
+import "../chunk-DY5PQSQB.js";
 
 // bin/pushary-codex-bridge.ts
 import { existsSync } from "fs";

package/dist/bin/pushary-codex-hook.js

@@ -1,39 +1,39 @@
 #!/usr/bin/env node
 import {
   takeHookHoldBudget
-} from "../chunk-7URSJMAB.js";
+} from "../chunk-MM472M4O.js";
 import {
   askAgentQuestions,
   defersToNativeMode,
   reportMachineDenial
-} from "../chunk-IKYI63RF.js";
+} from "../chunk-YCKGZOKV.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-46F4BRUQ.js";
+} from "../chunk-LFMC5AE2.js";
 import {
   triggerAutoUpdate
-} from "../chunk-IFT3GU7Y.js";
+} from "../chunk-YENJWLN4.js";
 import {
   readHookInput
-} from "../chunk-EH5ZDG6V.js";
+} from "../chunk-MZQ5M6F6.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
-} from "../chunk-ECFEYB6Z.js";
-import "../chunk-3PM62C2R.js";
+} from "../chunk-R7AMICLS.js";
+import "../chunk-CVCOZWSB.js";
 import "../chunk-DWQYCOPI.js";
-import "../chunk-RBJWPUI6.js";
-import "../chunk-AUOSFZJ3.js";
-import "../chunk-ASK2MSD2.js";
-import "../chunk-5DCZL3BC.js";
-import "../chunk-OHFC3GJY.js";
-import "../chunk-U45OINYS.js";
+import "../chunk-TP5SLM2I.js";
+import "../chunk-RDVDW3WK.js";
+import "../chunk-FDDZEYGM.js";
+import "../chunk-PHKISQPB.js";
+import "../chunk-3KSN65VJ.js";
+import "../chunk-DDS472RO.js";
 import "../chunk-GMXKITVA.js";
-import "../chunk-7SGYCU5C.js";
-import "../chunk-YK7FGPYS.js";
-import "../chunk-SIN7NJD7.js";
-import "../chunk-RFQWB5ZV.js";
+import "../chunk-4MJ46JA7.js";
+import "../chunk-S3657KK2.js";
+import "../chunk-DRQVZHWE.js";
+import "../chunk-T3QKLW3M.js";
 import "../chunk-XHKBHWLX.js";
 import "../chunk-6ICPEJY5.js";
 import {
@@ -78,9 +78,9 @@ import {
   toPolicyLookup,
   toPolicyLookups,
   userScope
-} from "../chunk-GZSSAY6N.js";
-import "../chunk-HHX6IRSH.js";
-import "../chunk-CFMCV6Z7.js";
+} from "../chunk-ZR2EPWW4.js";
+import "../chunk-6W64IVG3.js";
+import "../chunk-ADKWE35P.js";
 import {
   askUser,
   cancelQuestion,
@@ -95,30 +95,30 @@ import {
   sendNotification,
   unavailableQuestionUnlessSubscriptionRequired,
   waitForQuestion
-} from "../chunk-CDERSTBO.js";
+} from "../chunk-GLVPA4EK.js";
 import "../chunk-POFBE6ZY.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-SFQSOBLM.js";
-import "../chunk-PWUIPQ2I.js";
-import "../chunk-6TYKZ4DN.js";
+} from "../chunk-6VFP72GX.js";
+import "../chunk-KQDHOQRG.js";
+import "../chunk-FY6ZTTDQ.js";
 import {
   getMachineId
-} from "../chunk-4A6VUVXV.js";
+} from "../chunk-VQZ4FP6Z.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
 import {
   canonicalJson
-} from "../chunk-IOVJVGIT.js";
+} from "../chunk-MCL5IS6A.js";
 import {
   writeFileAtomic
 } from "../chunk-AQFEP65J.js";
 import {
   getApiKey
-} from "../chunk-EWC4P4ZL.js";
-import "../chunk-57M4ERJK.js";
+} from "../chunk-PRQMACC7.js";
+import "../chunk-VE4LQ23C.js";
 import {
   CODEX_RESCUE_TOOL_NAME,
   DECISION_STOP_REASON,
@@ -146,7 +146,7 @@ import {
   resolveGate,
   scopeBreachReasonOf,
   unapprovedScopeReason
-} from "../chunk-K7EGWMDU.js";
+} from "../chunk-DY5PQSQB.js";
 
 // bin/pushary-codex-hook.ts
 import { basename } from "path";
@@ -795,7 +795,7 @@ var decidePreToolUse = async (input) => {
 };
 var repairCodexHoldsQuietly = async () => {
   try {
-    const { repairCodexHolds } = await import("../reapply-LILGWJO3.js");
+    const { repairCodexHolds } = await import("../reapply-Y2EXWAWE.js");
     repairCodexHolds();
   } catch {
     return;