#477 feat(cli): doberman uninstall --global — device-wide removal, then the package itself

[Anonymous]

Originally created by: fu351

Why

pip uninstall doberman-core runs no code, so anyone who removes the package first is left with hook entries pointing at a missing binary and every tool call failing with doberman: command not found (README / RECOVERY already warn about it). The only place that can enforce the right order is Doberman itself.

What

doberman uninstall --global (-g) removes, in order:

1. Claude Code hooks in all three scopes for --path (global, project, local)
2. Codex CLI hooks (user, repo; the plugin scope is read-only and is reported with the codex plugin remove hint)
3. the project's .doberman/
4. the TOTP file, password file, fingerprint key, then the whole device state directory (each resolved through its own module, so DOBERMAN_HOME / DOBERMAN_TOTP_FILE / DOBERMAN_PASSWORD_FILE overrides are honoured)
5. the package: pipx uninstall doberman-core when installed via pipx, python -m pip uninstall -y doberman-core otherwise; dev/editable checkouts are left in place. On Windows the removal is scheduled in a detached cmd helper (2 s ping delay — timeout aborts on redirected stdin) because the running exe is locked; on POSIX it runs synchronously and reports the exit code. --keep-package stops before this step.

Gate (the project flow's or stronger): the possession factor is verified before anything is removed (the TOTP secret is among the targets); typed DOBERMAN confirmation (--yes skips only the typing, never the factor); --dry-run prints the full plan; refuses with neither factor enrolled; still control-plane-blocked for a mediated agent. Removal continues past individual failures and exits 1 with the list. Without --global, behaviour is unchanged.

Tests

tests/unit/test_cli_uninstall.py (+11): dry-run lists every target and removes nothing; no factor / wrong code / typed-word mismatch refuse with the factor files still present; success removes every writable target and schedules the remover with the expected argv (Popen mocked, subprocess.run asserted never called); --keep-package; pipx / editable / pip detection; POSIX synchronous path reports a non-zero exit; a mid-way rmtree failure still removes the rest and exits 1. Control-plane test extended with doberman uninstall --global. All tests monkeypatch Path.home and the state envs into tmp_path.

Locally: ruff check / ruff format --check / lint-imports (4 kept) / focused suites green; full suite green at 91.57% coverage.

Docs

docs/CLI.md row, docs/RECOVERY.md "Removing Doberman from the whole machine", README note now points at --global, CHANGELOG Unreleased. Design: ADR 0086 (memory repo).

Follow-up (not here): doberman doctor could detect hook entries pointing at a missing binary for users who already ran pip uninstall first.

[Anonymous]

Ticket changed by: fu351

• status: open --> closed