pushary 1.9.7 → 1.9.9

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 1.9.9
+
+- The VS Code hooks setup writes now run the gate through the same shell guard as every other agent. Before, a missing Node or a deleted plugin folder made the VS Code hooks fail on every tool call; now they stay silent and VS Code carries on as if Pushary were not installed. Run setup again for VS Code to get the guarded hooks.
+- `pushary doctor`, `pushary status` and `pushary pair` recognise a computer the Pushary Mac app connects when the CLI has no key of its own. Doctor and status say the computer is connected through the Pushary Mac app instead of reporting a missing key, and pair tells you to pair a phone from the app's Settings > Phone. The CLI does not use, copy or save the app's key.
+- A default `pushary setup` turns on phone-start when `~/.pushary/config.json` exists but has no `controlMode`, as `pushary login` and the Mac app's Hermes connection leave it. Before, setup skipped phone-start on those machines. `--control off`, or a saved `controlMode` of `off`, still keeps it off, and upgrades still never add the background service on their own.
+- `pushary setup` keeps an OpenCode plugin the Pushary Mac app installed, as it already did for the other agents, and lists it as kept. It used to overwrite the app's plugin, MCP key and instructions. Pass `--take-over-hooks` if you want the CLI to own it. If the app is signed into a different account, setup reports that for OpenCode and changes nothing.
+
+## 1.9.8
+
+- `pushary upgrade` and automatic updates no longer take over agents the Pushary Mac app connected. They used to replace the app's hooks with the CLI's and overwrite its MCP key for Claude Code, Codex, Gemini CLI, VS Code and OpenCode. An agent the app owns is now left exactly as the app wrote it and listed as kept for the Mac app, using the same rule setup uses. Pass `--take-over-hooks` to setup if you want the CLI to own it.
+- `pushary clean` keeps the Mac app's wiring for Qwen Code, CodeBuddy, Qoder, Droid and Devin while the app is installed, as it already did for the other agents. `clean --everything` still removes it.
+- `pushary disconnect cursor` removes the Cursor plugin setup installed in `~/.cursor/plugins/local/pushary`, including the `mcp.json` that held your API key, and setup's leftover copies of it. The plugin is kept, and the output says so, when the gate in `~/.cursor/hooks.json` that points into it could not be removed.
+- `pushary disconnect` removes the Pushary block it wrote to `AGENTS.md` (Codex, OpenCode), `GEMINI.md`, `QWEN.md` and `CODEBUDDY.md`. Only the text between the Pushary markers is removed. Skills are left in place.
+- `pushary disconnect <agent>` is no longer undone by the Mac app. It records the agent in `~/.pushary/declined-agents.json`, and Pushary.app versions that read that file leave the agent off until you connect it again from the app or with `pushary setup`.
+- `pushary mode`, `mode clear`, `wait <seconds>` and `suggestions` no longer say "This key was rejected" when the key is fine. Keys from `pushary login`, phone pairing and the Mac app cannot change approval settings, and these commands now say so, point you to the Pushary app, your phone or the dashboard, and exit with code 2.
+- `pushary sign-out --revoke` revokes those keys too, and then checks with pushary.com and tells you whether the key still works. Before, it could not revoke them and always said the key was still valid. `--json` adds `keyStillValid`.
+- When the Mac app signs out of the key setup borrowed from it, the background service stops once instead of restarting every 10 seconds, and `pushary doctor`, `pushary status` and commands that report a rejected key say the key was signed out on this Mac, tell you to run `pushary login`, and name the shell profile line that still exports the old key. Pushary does not edit that line. A background service with no key at all also stops instead of restarting.
+
 ## 1.9.7
 
 - `pushary claude` and the `pushary daemon` commands wait at most 5 seconds for the background service again. Only setup and upgrade allow the 30 seconds a cold Windows start can need, so launching Claude no longer sits silent while the service starts.

package/README.md

@@ -210,11 +210,11 @@ claude       Run Claude Code through Pushary, reachable from your phone even whe
 daemon       Keep this machine reachable so your phone can START a new session
 status       One screen: which key is in force, whether the server accepts it, what can receive an approval
 login        Sign in from this terminal, no key to copy (--with-token to pipe one in)
-logout       Remove the key this machine stores, and say what it does not remove
-connect      Connect a phone without re-running setup (--app for the Pushary app)
+sign-out     Sign out: remove the key this machine stores, and say what it does not remove (also: logout)
+pair         Pair a phone without re-running setup (--app for the Pushary app; also: connect)
 bell         Free local bell when an agent finishes or needs you. No account, no key, no network
 doctor       Verify your Pushary installation is working
-disconnect   Turn off one agent (claude|codex|gemini|cursor)
+disconnect   Turn off one agent (claude|codex|gemini|cursor|opencode|qwen|codebuddy|qoder|droid|devin|fx)
 clean        Remove Pushary from this machine (--everything: the Mac app's setup too, --dry-run: preview)
 mode         Choose where approval requests appear
 wait         Show or set the "wait for your phone" ladder (pushary wait 45)

package/data/cursor-plugin/README.md

@@ -26,11 +26,7 @@ There are three things.
 
 You need two things: the plugin, and an API key.
 
-### Option 1: Cursor Marketplace (recommended)
-
-Open the Marketplace panel in Cursor, search for Pushary, and click install. Then set your API key (see below).
-
-### Option 2: CLI
+### Option 1: CLI (recommended)
 
 This also sets up Claude Code, Codex, and Hermes if you use them.
 
@@ -38,7 +34,7 @@ This also sets up Claude Code, Codex, and Hermes if you use them.
 npx pushary@latest setup
 ```
 
-### Option 3: Manual MCP
+### Option 2: Manual MCP
 
 Add this to `.cursor/mcp.json` in your project, or `~/.cursor/mcp.json` for every project:
 
@@ -106,7 +102,7 @@ Then reload Cursor with Developer: Reload Window.
 
 ## Security
 
-This repository has no secrets. Your key is read at runtime from `PUSHARY_API_KEY`. The gate script has no dependencies and only talks to pushary.com. Read `scripts/pushary-gate.mjs` to see exactly what it sends. See `SECURITY.md` for details.
+Your key is read at runtime from `PUSHARY_API_KEY`. The gate script has no dependencies. It sends approval and activity data to pushary.com by default; `PUSHARY_BASE_URL` can change that endpoint. Read `scripts/pushary-gate.mjs` to see exactly what it sends. See `SECURITY.md` for details.
 
 ## License
 

package/data/vscode-plugin/README.md

@@ -121,7 +121,7 @@ echo '{"hook_event_name":"PreToolUse","tool_name":"runTerminalCommand","tool_inp
 
 ## Security
 
-This repository has no secrets. Your key is read at runtime from `PUSHARY_API_KEY`, the plugin `.mcp.json`, or `~/.pushary/config.json`. The gate script has no dependencies and only talks to pushary.com. Command text is redacted for common secret shapes before it is sent. Read `scripts/pushary-gate.mjs` to see exactly what it sends. See `SECURITY.md` for details.
+Your key is read at runtime from `PUSHARY_API_KEY`, the plugin `.mcp.json`, or `~/.pushary/config.json`. The gate script has no dependencies. It sends approval and activity data to pushary.com by default; `PUSHARY_BASE_URL` and `PUSHARY_API_URL` can change its API endpoints. Command text is redacted for common secret shapes before it is sent. Read `scripts/pushary-gate.mjs` to see exactly what it sends. See `SECURITY.md` for details.
 
 ## License
 

package/dist/bin/pushary-bell-hook.js

@@ -1,39 +1,37 @@
 #!/usr/bin/env node
 import {
   handleBell
-} from "../chunk-H37L7TT3.js";
+} from "../chunk-G7RIDXAT.js";
 import {
   readHookInput
-} from "../chunk-XWAYAO3V.js";
-import "../chunk-BTQGAXZ3.js";
+} from "../chunk-R5RIVOPL.js";
+import "../chunk-COQ64C4F.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-SD3272LS.js";
-import "../chunk-SBLPHUEB.js";
-import "../chunk-MNWRUGMH.js";
-import "../chunk-4YO4T5FV.js";
-import "../chunk-VXRXFU6Q.js";
-import "../chunk-JCWZ23MJ.js";
-import "../chunk-7264S5HZ.js";
-import "../chunk-AUUXS44H.js";
-import "../chunk-4FK6RZVJ.js";
-import "../chunk-HPRZJKRO.js";
+import "../chunk-SZ4Q6ZVS.js";
+import "../chunk-APP43AW7.js";
+import "../chunk-462EQA6K.js";
+import "../chunk-VIIHC42X.js";
 import "../chunk-XHKBHWLX.js";
+import "../chunk-BYLKCZ2G.js";
+import "../chunk-M3STIAGU.js";
+import "../chunk-ZGADIZDS.js";
+import "../chunk-MLGIVVSG.js";
+import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
-import "../chunk-6DJTDHBI.js";
-import "../chunk-AVNKVF7N.js";
+import "../chunk-REU2VQPH.js";
+import "../chunk-MD4SVNT6.js";
+import "../chunk-UPIZSCYD.js";
 import "../chunk-POFBE6ZY.js";
-import "../chunk-GMXKITVA.js";
-import "../chunk-ADSQDYYG.js";
-import "../chunk-JXISQ7DT.js";
-import "../chunk-KYO45G5L.js";
+import "../chunk-5N5L6DNN.js";
+import "../chunk-KOWFRUIT.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-4D2AYNSE.js";
-import "../chunk-ZUTU43FT.js";
+import "../chunk-BNSKVIAW.js";
+import "../chunk-Z23ZBYDW.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-Z6HPS67T.js";
-import "../chunk-STQRUH3S.js";
-import "../chunk-QR6VE5ME.js";
+import "../chunk-IRHABAQT.js";
+import "../chunk-5DCDQ5VW.js";
+import "../chunk-5RGA636G.js";
 
 // bin/pushary-bell-hook.ts
 var main = async () => {

package/dist/bin/pushary-bell.js

@@ -5,37 +5,37 @@ import {
   liveAgentCount,
   ring,
   upgradeThreshold
-} from "../chunk-H37L7TT3.js";
-import {
-  addBellHooks,
-  bellInstalled,
-  removeBellHooks
-} from "../chunk-7264S5HZ.js";
+} from "../chunk-G7RIDXAT.js";
 import {
   createIo
 } from "../chunk-U4TMAANR.js";
 import {
   exitOnHelpFlag
-} from "../chunk-UFVGSEWH.js";
+} from "../chunk-TO3PS646.js";
+import {
+  addBellHooks,
+  bellInstalled,
+  removeBellHooks
+} from "../chunk-MLGIVVSG.js";
 import {
   parseFlags
 } from "../chunk-GMXKITVA.js";
-import "../chunk-ADSQDYYG.js";
+import "../chunk-REU2VQPH.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-4D2AYNSE.js";
+import "../chunk-BNSKVIAW.js";
 import {
   claudeSettings
-} from "../chunk-ZUTU43FT.js";
+} from "../chunk-Z23ZBYDW.js";
 import {
   readJsonSafe,
   writeJsonAtomic
 } from "../chunk-T7E75EKA.js";
-import "../chunk-Z6HPS67T.js";
-import "../chunk-STQRUH3S.js";
-import "../chunk-QR6VE5ME.js";
+import "../chunk-IRHABAQT.js";
+import "../chunk-5DCDQ5VW.js";
+import "../chunk-5RGA636G.js";
 
 // bin/pushary-bell.ts
 exitOnHelpFlag("bell");

package/dist/bin/pushary-claude.js

@@ -8,7 +8,7 @@ import {
   describeIdleWindow,
   startProcessOwnership,
   withSpawnProcessOwnership
-} from "../chunk-JWQZSYCK.js";
+} from "../chunk-NUVGDBZC.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer
@@ -18,29 +18,29 @@ import {
   loadSessionKey,
   registerTranscript,
   registeredTranscriptEnabled
-} from "../chunk-BTQGAXZ3.js";
+} from "../chunk-COQ64C4F.js";
 import "../chunk-SGZJ5LYH.js";
-import "../chunk-SD3272LS.js";
-import "../chunk-SBLPHUEB.js";
-import "../chunk-MNWRUGMH.js";
-import "../chunk-4YO4T5FV.js";
 import {
   ensureDaemonRunning
-} from "../chunk-VXRXFU6Q.js";
-import "../chunk-JCWZ23MJ.js";
-import "../chunk-7264S5HZ.js";
+} from "../chunk-SZ4Q6ZVS.js";
 import {
   encryptRecord
-} from "../chunk-AUUXS44H.js";
-import "../chunk-4FK6RZVJ.js";
+} from "../chunk-APP43AW7.js";
+import "../chunk-462EQA6K.js";
 import {
   transcriptsEnabled
-} from "../chunk-HPRZJKRO.js";
+} from "../chunk-VIIHC42X.js";
 import {
   needsShell,
   spawnClaude
 } from "../chunk-XHKBHWLX.js";
+import "../chunk-BYLKCZ2G.js";
+import "../chunk-M3STIAGU.js";
+import "../chunk-ZGADIZDS.js";
+import "../chunk-MLGIVVSG.js";
+import "../chunk-GMXKITVA.js";
 import "../chunk-6ICPEJY5.js";
+import "../chunk-REU2VQPH.js";
 import {
   UNNAMED_ACTION,
   deriveToolTarget,
@@ -51,7 +51,7 @@ import {
   repoKeyFor,
   reportEvent,
   scopePathFor
-} from "../chunk-QFEM7R6T.js";
+} from "../chunk-KQFTBQ66.js";
 import {
   DEFAULT_SESSION,
   markPendingCommandDelivered,
@@ -61,10 +61,8 @@ import {
   removePendingCommand,
   savePendingCommand
 } from "../chunk-N6IOSZOE.js";
-import "../chunk-6DJTDHBI.js";
+import "../chunk-MD4SVNT6.js";
 import {
-  DECISION_STOP_REASON,
-  UNVERIFIABLE_APPROVAL_REASON,
   askUser,
   cancelQuestion,
   isDecisionStopped,
@@ -72,36 +70,36 @@ import {
   nextLongPollMs,
   waitForAnswer,
   withdrawQuestion
-} from "../chunk-D6S5EKXA.js";
-import "../chunk-AVNKVF7N.js";
-import "../chunk-POFBE6ZY.js";
-import "../chunk-GMXKITVA.js";
-import "../chunk-ADSQDYYG.js";
+} from "../chunk-WRPYCIV2.js";
 import {
   SubscriptionRequiredError
-} from "../chunk-L76HTPU6.js";
-import "../chunk-KFKL3FHS.js";
-import "../chunk-JXISQ7DT.js";
+} from "../chunk-6AYSKVLL.js";
+import "../chunk-QRXPWW3M.js";
+import "../chunk-UPIZSCYD.js";
+import "../chunk-POFBE6ZY.js";
+import "../chunk-5N5L6DNN.js";
 import {
   getMachineId
-} from "../chunk-KYO45G5L.js";
+} from "../chunk-KOWFRUIT.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-4D2AYNSE.js";
-import "../chunk-ZUTU43FT.js";
+import "../chunk-BNSKVIAW.js";
+import "../chunk-Z23ZBYDW.js";
 import "../chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "../chunk-Z6HPS67T.js";
+} from "../chunk-IRHABAQT.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-STQRUH3S.js";
+} from "../chunk-5DCDQ5VW.js";
 import {
+  DECISION_STOP_REASON,
   KILL_REASON,
+  UNVERIFIABLE_APPROVAL_REASON,
   redactSecretsFromContent,
   resolveGate
-} from "../chunk-QR6VE5ME.js";
+} from "../chunk-5RGA636G.js";
 
 // src/wrapper/localPassthrough.ts
 var SIGNAL_NUMBERS = {

package/dist/bin/pushary-clean.js

@@ -2,29 +2,37 @@
 import {
   PUSHARY_SKILL_NAME,
   PUSHARY_SKILL_SOURCE,
-  createGuards,
+  createGuards
+} from "../chunk-EUW7JL2K.js";
+import {
+  isCursorPluginLeftover,
   withoutPusharyCursorHooks
-} from "../chunk-EB4XGVBG.js";
+} from "../chunk-LENBKYRB.js";
 import {
   HERMES_PIP_PACKAGE,
-  planFxRemoval,
   readHermesStatus,
-  removeInstructionBlock,
   resolveHermesPython,
   runHermesConfigScript,
   shortenHome,
   unregisterPluginLocation,
   vscodeSettingsTargets
-} from "../chunk-QQ4HBXZC.js";
-import "../chunk-W2KI5KPD.js";
+} from "../chunk-UAP5DS6P.js";
 import {
-  compatibleConfigFile,
-  compatibleInstructionsFile,
-  compatibleMcpFile,
-  compatiblePermissionRuleFile,
-  removeCompatibleHooks,
-  removeCompatibleMcpServer
-} from "../chunk-MZPXVH4A.js";
+  planFxRemoval,
+  removeInstructionBlock
+} from "../chunk-6W5M3MSE.js";
+import "../chunk-H5T27W7M.js";
+import {
+  disableDaemonService
+} from "../chunk-SZ4Q6ZVS.js";
+import "../chunk-XHKBHWLX.js";
+import {
+  macAppKeepsMcpEntry,
+  mcpServerBearer,
+  pusharyKey,
+  readMacAppAgentKey,
+  setupReceiptKey
+} from "../chunk-E5HOHIUV.js";
 import {
   OPENCODE_PLUGIN_SIBLING,
   OPENCODE_PLUGIN_SIBLING_CONTENTS,
@@ -36,67 +44,65 @@ import {
   openCodePluginDir,
   openCodePluginFile,
   removeOpenCodeMcpServer
-} from "../chunk-X5NXPCIC.js";
+} from "../chunk-BZLHTMT6.js";
 import {
+  compatibleConfigFile,
+  compatibleInstructionsFile,
+  compatibleMcpFile,
+  compatiblePermissionRuleFile,
   isClaudeMcpSnapshot,
   removeClaudeMcpServers,
+  removeCompatibleHooks,
+  removeCompatibleMcpServer,
   removePusharySettings,
   removePusharyToolPermissions,
   restoreClaudeMcpServer
-} from "../chunk-ANEAA37E.js";
+} from "../chunk-UF6RBP5V.js";
+import {
+  ansiPainter,
+  useColor
+} from "../chunk-U4TMAANR.js";
+import {
+  exitOnHelpFlag
+} from "../chunk-TO3PS646.js";
 import {
   hookOwnerOf,
   isHookTakeoverReceipt,
+  liveBridgeProbe,
+  resolveBridgeStub,
   restoreHookTakeover,
   restoreMcpServer
-} from "../chunk-SD3272LS.js";
-import "../chunk-SBLPHUEB.js";
-import {
-  liveBridgeProbe,
-  resolveBridgeStub
-} from "../chunk-MNWRUGMH.js";
-import "../chunk-4YO4T5FV.js";
-import {
-  disableDaemonService
-} from "../chunk-VXRXFU6Q.js";
+} from "../chunk-BYLKCZ2G.js";
 import {
   removeGeminiSettings
-} from "../chunk-JCWZ23MJ.js";
-import "../chunk-7264S5HZ.js";
-import "../chunk-XHKBHWLX.js";
-import "../chunk-6ICPEJY5.js";
-import "../chunk-QFEM7R6T.js";
-import "../chunk-N6IOSZOE.js";
-import "../chunk-6DJTDHBI.js";
-import "../chunk-D6S5EKXA.js";
-import "../chunk-AVNKVF7N.js";
-import "../chunk-POFBE6ZY.js";
-import {
-  ansiPainter,
-  useColor
-} from "../chunk-U4TMAANR.js";
-import {
-  exitOnHelpFlag
-} from "../chunk-UFVGSEWH.js";
+} from "../chunk-M3STIAGU.js";
+import "../chunk-ZGADIZDS.js";
+import "../chunk-MLGIVVSG.js";
 import {
   rejectUnknownFlags
 } from "../chunk-GMXKITVA.js";
+import "../chunk-6ICPEJY5.js";
 import {
   CANDIDATE_RCS,
   isDisabledExport,
   removeClaudeAlias
-} from "../chunk-ADSQDYYG.js";
-import "../chunk-L76HTPU6.js";
-import "../chunk-KFKL3FHS.js";
-import "../chunk-JXISQ7DT.js";
-import "../chunk-KYO45G5L.js";
+} from "../chunk-REU2VQPH.js";
+import "../chunk-KQFTBQ66.js";
+import "../chunk-N6IOSZOE.js";
+import "../chunk-MD4SVNT6.js";
+import "../chunk-WRPYCIV2.js";
+import "../chunk-6AYSKVLL.js";
+import "../chunk-QRXPWW3M.js";
+import "../chunk-UPIZSCYD.js";
+import "../chunk-POFBE6ZY.js";
+import "../chunk-5N5L6DNN.js";
+import "../chunk-KOWFRUIT.js";
 import "../chunk-7QLSKOSU.js";
 import {
   EXIT
 } from "../chunk-KZERVKTD.js";
-import "../chunk-4D2AYNSE.js";
+import "../chunk-BNSKVIAW.js";
 import {
-  bridgeAgentKey,
   claudeJson,
   claudeMcpReceipt,
   claudeSettings,
@@ -132,12 +138,12 @@ import {
   restoreCodexHookTrust,
   vscodePluginDir,
   vscodePluginMcp
-} from "../chunk-ZUTU43FT.js";
+} from "../chunk-Z23ZBYDW.js";
 import "../chunk-T7E75EKA.js";
-import "../chunk-Z6HPS67T.js";
+import "../chunk-IRHABAQT.js";
 import {
   NPX_LATEST_COMMAND
-} from "../chunk-STQRUH3S.js";
+} from "../chunk-5DCDQ5VW.js";
 import {
   CLI_PACKAGE_NAMES,
   HOOK_COMPATIBLE_PROFILES,
@@ -149,7 +155,7 @@ import {
   globalRootFor,
   isValidApiKey,
   redactSecrets
-} from "../chunk-QR6VE5ME.js";
+} from "../chunk-5RGA636G.js";
 
 // bin/pushary-clean.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4, copyFileSync, readdirSync as readdirSync4 } from "fs";
@@ -526,21 +532,47 @@ var APP_OWNED_ENTRIES = [
   // does the CLI. Not attributable, so it is kept whenever the app is installed
   // rather than removed and left registered against a path that is gone.
   "plugins",
-  "bridge-auth"
+  "bridge-auth",
+  "declined-agents.json"
 ];
 var isAppOwned = (name) => APP_OWNED_ENTRIES.includes(name);
 
-// src/shared-mcp-key.ts
-var asRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-var pusharyKey = (value) => typeof value === "string" && isValidApiKey(value.trim()) ? value.trim() : null;
-var bearerKey = (authorization) => typeof authorization === "string" && authorization.startsWith("Bearer ") ? pusharyKey(authorization.slice("Bearer ".length)) : null;
-var mcpServerBearer = (mcpServers) => bearerKey(asRecord(asRecord(asRecord(mcpServers)?.pushary)?.headers)?.Authorization);
-var appAgentKey = (bridgeAgentKey2) => pusharyKey(asRecord(bridgeAgentKey2)?.key);
-var setupReceiptKey = (claudeMcpReceipt2) => bearerKey(asRecord(asRecord(asRecord(claudeMcpReceipt2)?.installedPushary)?.headers)?.Authorization);
-var macAppKeepsMcpEntry = (entryKey, keys) => {
-  if (!entryKey) return true;
-  if (keys.appKey) return entryKey === keys.appKey;
-  return entryKey !== keys.setupKey;
+// src/compatible-clean.ts
+var keepsMcpServer = (profile, scope, io, home) => {
+  const mcpPath = compatibleMcpFile(profile, home);
+  if (!mcpPath) return false;
+  const mcp = io.readJson(mcpPath);
+  return mcp !== null && scope.keepsMcpEntry(profile.agentType, mcpServerBearer(mcp.mcpServers));
+};
+var removalsByPath = (profile, removalScope2, home) => {
+  const removals = /* @__PURE__ */ new Map();
+  const add = (path, removal) => {
+    if (path) removals.set(path, [...removals.get(path) ?? [], removal]);
+  };
+  add(compatibleConfigFile(profile, home), (config) => removeCompatibleHooks(config, profile, removalScope2));
+  if (removalScope2.keepMcpServer !== true) {
+    add(compatibleMcpFile(profile, home), (config) => removeCompatibleMcpServer(config, profile));
+    add(compatiblePermissionRuleFile(profile, home), removePusharyToolPermissions);
+  }
+  return removals;
+};
+var cleanInstructions = (profile, scope, io, home) => {
+  const path = compatibleInstructionsFile(profile, home);
+  if (!path) return null;
+  if (scope.keepAppWiring) return { path, outcome: "kept_for_app" };
+  return { path, outcome: io.removeInstructionBlock(path) ? "removed" : "absent" };
+};
+var cleanCompatibleAgent = (profile, scope, io, home) => {
+  const mcpKeptForApp = keepsMcpServer(profile, scope, io, home);
+  const removalScope2 = { keepAppWiring: scope.keepAppWiring, keepMcpServer: mcpKeptForApp };
+  const files = [...removalsByPath(profile, removalScope2, home)].map(([path, removals]) => {
+    const config = io.readJson(path);
+    if (!config) return { path, outcome: "not_found" };
+    if (!removals.reduce((changed, remove) => remove(config) || changed, false)) return { path, outcome: "unchanged" };
+    io.writeJson(path, config);
+    return { path, outcome: "cleaned" };
+  });
+  return { profile, files, mcpKeptForApp, instructions: cleanInstructions(profile, scope, io, home) };
 };
 
 // bin/pushary-clean.ts
@@ -598,12 +630,10 @@ var wouldNote = (action, path) => {
 var guards = createGuards(() => dryRun, wouldNote);
 var guardedWrite = (path, contents) => guards.write(path, contents);
 var guardedRemove = (path, options) => guards.remove(path, options);
-var CURSOR_PLUGIN_STAGING = ".pushary-staging-";
 var cursorPluginLeftovers = () => {
   const parent = dirname(CURSOR_PLUGIN_DIR);
-  const backupPrefix = `${CURSOR_PLUGIN_DIR.split("/").pop()}.pushary-backup-`;
   try {
-    return readdirSync4(parent).filter((name) => name.startsWith(backupPrefix) || name.startsWith(CURSOR_PLUGIN_STAGING)).map((name) => join6(parent, name));
+    return readdirSync4(parent).filter(isCursorPluginLeftover).map((name) => join6(parent, name));
   } catch {
     return [];
   }
@@ -823,7 +853,7 @@ var main = async () => {
   );
   if (keepShared) restoreTakeoverReceipts();
   const sharedMcpKeys = {
-    appKey: appAgentKey(readJson(bridgeAgentKey())),
+    appKey: readMacAppAgentKey(),
     setupKey: setupReceiptKey(readJson(CLAUDE_MCP_RECEIPT))
   };
   const macAppKeeps = (agent, entryKey) => keepShared && (restoredByTakeover.has(agent) || macAppKeepsMcpEntry(entryKey, sharedMcpKeys));
@@ -1023,34 +1053,23 @@ var main = async () => {
   } else {
     console.log(`  ${skip} Codex skill directory ${dim("(not found)")}`);
   }
+  const compatibleScope = { keepAppWiring: keepShared, keepsMcpEntry: macAppKeeps };
+  const compatibleIo = { readJson, writeJson, removeInstructionBlock: guardedInstructionBlockRemoval };
   for (const profile of HOOK_COMPATIBLE_PROFILES) {
-    const edits = [
-      [compatibleConfigFile(profile), (config) => removeCompatibleHooks(config, profile)],
-      ...compatibleMcpFile(profile) ? [[compatibleMcpFile(profile), (config) => removeCompatibleMcpServer(config, profile)]] : [],
-      ...compatiblePermissionRuleFile(profile) ? [[compatiblePermissionRuleFile(profile), removePusharyToolPermissions]] : []
-    ];
-    const byPath = /* @__PURE__ */ new Map();
-    for (const [path, edit] of edits) byPath.set(path, [...byPath.get(path) ?? [], edit]);
-    for (const [path, removals] of byPath) {
-      const config = readJson(path);
-      if (!config) {
-        console.log(`  ${skip} ${profile.label} ${shortenHome(path)} ${dim("(not found)")}`);
-        continue;
-      }
-      if (removals.reduce((changed, remove) => remove(config) || changed, false)) {
-        writeJson(path, config);
-        console.log(`  ${check} ${profile.label} ${shortenHome(path)} ${dim(did("cleaned"))}`);
-      } else {
-        console.log(`  ${skip} ${profile.label} ${shortenHome(path)} ${dim("(no pushary entries)")}`);
-      }
+    const report = cleanCompatibleAgent(profile, compatibleScope, compatibleIo);
+    for (const file of report.files) {
+      const label2 = `${profile.label} ${shortenHome(file.path)}`;
+      if (file.outcome === "not_found") console.log(`  ${skip} ${label2} ${dim("(not found)")}`);
+      else if (file.outcome === "cleaned") console.log(`  ${check} ${label2} ${dim(did("cleaned"))}`);
+      else console.log(`  ${skip} ${label2} ${dim(keepShared ? "(nothing the CLI wrote)" : "(no pushary entries)")}`);
     }
-    const instructions = compatibleInstructionsFile(profile);
+    if (report.mcpKeptForApp) console.log(`  ${skip} ${profile.label} MCP server ${dim("(kept: the Mac app uses it)")}`);
+    const instructions = report.instructions;
     if (!instructions) continue;
-    if (guardedInstructionBlockRemoval(instructions)) {
-      console.log(`  ${check} ${profile.label} ${shortenHome(instructions)} ${dim("(removed Pushary block)")}`);
-    } else {
-      console.log(`  ${skip} ${profile.label} ${shortenHome(instructions)} ${dim("(no pushary block)")}`);
-    }
+    const label = `${profile.label} ${shortenHome(instructions.path)}`;
+    if (instructions.outcome === "kept_for_app") console.log(`  ${skip} ${label} ${dim("(kept: the Mac app uses it)")}`);
+    else if (instructions.outcome === "removed") console.log(`  ${check} ${label} ${dim("(removed Pushary block)")}`);
+    else console.log(`  ${skip} ${label} ${dim("(no pushary block)")}`);
   }
   const geminiSettingsPath = geminiSettings();
   const geminiSettings2 = readJson(geminiSettingsPath);