feat(package-firewall): add uninstall command and fill ecosystem docs

Add `vulnetix package-firewall uninstall` to reverse configure across all
supported ecosystems. Targeted by default (name ecosystems), with `--all`,
`--except <csv>`, and `--purge` (= all + credential removal) for bulk. The
shared netrc credential is kept unless `--remove-credentials`/`--purge` is
given, and a warning fires if it is dropped while other ecosystems remain
configured. Reversal is auth-free and mirrors each write mode: managed-block
strip (delete if empty), structured-file delete (host-gated), merge restore
from `.vulnetix.bak` (or key strip), and Go shell/env/project reversal.

Docs: new uninstall page, cli-reference flag table, troubleshooting Start
over update. Also fill the pre-existing ecosystem gaps — new homebrew, aur,
and go-dev pages; correct the ecosystem count (21 -> 23) and tier/enforcement
tables; remove the dead shadowed package-firewall.md that never rendered.

Author: 0x73746F66

cmd/package_firewall.go

@@ -114,3 +114,305 @@ func TestUpsertPackageFirewallConfigFile(t *testing.T) {
 		t.Fatalf("managed config was not replaced:\n%s", got)
 	}
 }
+
+func TestRemoveNetrcMachine(t *testing.T) {
+	existing := "machine example.com\nlogin keep\npassword keep\n\nmachine packages.vulnetix.com\nlogin org\npassword key\n"
+	got := removeNetrcMachine(existing, "packages.vulnetix.com")
+	if strings.Contains(got, "packages.vulnetix.com") || strings.Contains(got, "org") {
+		t.Fatalf("firewall entry not removed:\n%s", got)
+	}
+	if !strings.Contains(got, "machine example.com\nlogin keep\npassword keep") {
+		t.Fatalf("unrelated entry not preserved:\n%s", got)
+	}
+
+	// Round-trip with upsert: adding then removing yields the original neighbours.
+	if only := removeNetrcMachine("machine packages.vulnetix.com\nlogin org\npassword key\n", "packages.vulnetix.com"); strings.TrimSpace(only) != "" {
+		t.Fatalf("removing the sole entry should empty the file, got:\n%q", only)
+	}
+}
+
+func TestRemoveManagedBlock(t *testing.T) {
+	existing := "before\n\n# Vulnetix Package Firewall\nold\n# End Vulnetix Package Firewall\n\nafter\n"
+	got, changed := removeManagedBlock(existing)
+	if !changed {
+		t.Fatal("expected block to be found")
+	}
+	if strings.Contains(got, "old") || strings.Contains(got, vulnetixBlockStart) {
+		t.Fatalf("managed block remained:\n%s", got)
+	}
+	if !strings.Contains(got, "before") || !strings.Contains(got, "after") {
+		t.Fatalf("surrounding content lost:\n%s", got)
+	}
+
+	onlyBlock := "# Vulnetix Package Firewall\nx\n# End Vulnetix Package Firewall\n"
+	got, changed = removeManagedBlock(onlyBlock)
+	if !changed || strings.TrimSpace(got) != "" {
+		t.Fatalf("block-only file should become empty, got %q changed=%v", got, changed)
+	}
+
+	if _, changed := removeManagedBlock("no block here\n"); changed {
+		t.Fatal("expected no change when block absent")
+	}
+}
+
+func TestRemoveGoEnvValues(t *testing.T) {
+	existing := "FOO=bar\nexport GOPROXY=\"https://packages.vulnetix.com\"\nexport GOAUTH=\"netrc\"\n"
+	got, changed := removeGoEnvValues(existing)
+	if !changed {
+		t.Fatal("expected change")
+	}
+	if strings.Contains(got, "GOPROXY") || strings.Contains(got, "GOAUTH") {
+		t.Fatalf("Go env values remained:\n%s", got)
+	}
+	if !strings.Contains(got, "FOO=bar") {
+		t.Fatalf("unrelated env lost:\n%s", got)
+	}
+
+	got, changed = removeGoEnvValues("GOPROXY=x\nGOAUTH=netrc\n")
+	if !changed || got != "" {
+		t.Fatalf("file with only Go env should empty, got %q", got)
+	}
+}
+
+func TestRemovePackageFirewallConfigFile_ManagedBlock(t *testing.T) {
+	dir := t.TempDir()
+
+	// File that held ONLY our block -> deleted.
+	solo := filepath.Join(dir, ".npmrc")
+	writeFile(t, solo, "# Vulnetix Package Firewall\nregistry=x\n# End Vulnetix Package Firewall\n")
+	res, err := removePackageFirewallConfigFile(pfw.ConfigFile{Path: solo}, "packages.vulnetix.com", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if res != "deleted file" {
+		t.Fatalf("result = %q", res)
+	}
+	if _, err := os.Stat(solo); !os.IsNotExist(err) {
+		t.Fatal("expected file deleted")
+	}
+
+	// File with user content around our block -> block removed, file kept.
+	mixed := filepath.Join(dir, ".gemrc")
+	writeFile(t, mixed, "keep=1\n\n# Vulnetix Package Firewall\n:sources:\n# End Vulnetix Package Firewall\n")
+	res, err = removePackageFirewallConfigFile(pfw.ConfigFile{Path: mixed}, "packages.vulnetix.com", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if res != "removed managed block" {
+		t.Fatalf("result = %q", res)
+	}
+	if got := readFile(t, mixed); !strings.Contains(got, "keep=1") || strings.Contains(got, vulnetixBlockStart) {
+		t.Fatalf("mixed file wrong after removal:\n%s", got)
+	}
+
+	// Not configured.
+	none := filepath.Join(dir, ".other")
+	writeFile(t, none, "unrelated\n")
+	if res, _ := removePackageFirewallConfigFile(pfw.ConfigFile{Path: none}, "packages.vulnetix.com", false); res != "not configured" {
+		t.Fatalf("result = %q", res)
+	}
+
+	// Dry-run must not modify.
+	dry := filepath.Join(dir, ".dry")
+	before := "# Vulnetix Package Firewall\nx\n# End Vulnetix Package Firewall\n"
+	writeFile(t, dry, before)
+	if res, _ := removePackageFirewallConfigFile(pfw.ConfigFile{Path: dry}, "packages.vulnetix.com", true); res != "would delete file" {
+		t.Fatalf("dry result = %q", res)
+	}
+	if readFile(t, dry) != before {
+		t.Fatal("dry-run modified the file")
+	}
+}
+
+func TestRemovePackageFirewallConfigFile_Structured(t *testing.T) {
+	dir := t.TempDir()
+
+	ours := filepath.Join(dir, "settings.xml")
+	writeFile(t, ours, "<settings><url>https://packages.vulnetix.com/maven/</url></settings>\n")
+	res, err := removePackageFirewallConfigFile(pfw.ConfigFile{Path: ours, Structured: true}, "packages.vulnetix.com", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if res != "deleted file" {
+		t.Fatalf("result = %q", res)
+	}
+	if _, err := os.Stat(ours); !os.IsNotExist(err) {
+		t.Fatal("expected structured file deleted")
+	}
+
+	foreign := filepath.Join(dir, "other.xml")
+	writeFile(t, foreign, "<settings><url>https://repo.maven.apache.org</url></settings>\n")
+	res, _ = removePackageFirewallConfigFile(pfw.ConfigFile{Path: foreign, Structured: true}, "packages.vulnetix.com", false)
+	if res != "not firewall-configured, skipped" {
+		t.Fatalf("result = %q", res)
+	}
+	if _, err := os.Stat(foreign); err != nil {
+		t.Fatal("foreign structured file should be preserved")
+	}
+}
+
+func TestRemovePackageFirewallConfigFile_MergeRestoresBackup(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "paru.conf")
+	writeFile(t, path, "[options]\nAurUrl = https://packages.vulnetix.com/aur\nColor\n")
+	writeFile(t, path+".vulnetix.bak", "[options]\nColor\n")
+
+	res, err := removePackageFirewallConfigFile(pfw.ConfigFile{Path: path, Merge: func(s string) (string, error) { return s, nil }}, "packages.vulnetix.com", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if res != "restored from backup" {
+		t.Fatalf("result = %q", res)
+	}
+	if got := readFile(t, path); strings.Contains(got, "vulnetix.com") || !strings.Contains(got, "Color") {
+		t.Fatalf("backup not restored:\n%s", got)
+	}
+	if _, err := os.Stat(path + ".vulnetix.bak"); !os.IsNotExist(err) {
+		t.Fatal("backup should be removed after restore")
+	}
+}
+
+func TestStripMergeKeys(t *testing.T) {
+	// paru.conf INI
+	paru, changed := stripMergeKeys("/x/paru.conf", "[options]\nColor\nAurUrl = https://packages.vulnetix.com/aur\nAurRpcUrl = https://packages.vulnetix.com/aur/rpc\n")
+	if !changed || strings.Contains(paru, "AurUrl") || !strings.Contains(paru, "Color") {
+		t.Fatalf("paru strip wrong (changed=%v):\n%s", changed, paru)
+	}
+
+	// yay config.json
+	yay, changed := stripMergeKeys("/x/config.json", `{"aururl":"https://packages.vulnetix.com/aur","aurrpcurl":"x","editor":"vim"}`)
+	if !changed || strings.Contains(yay, "aururl") || !strings.Contains(yay, "editor") {
+		t.Fatalf("yay strip wrong (changed=%v):\n%s", changed, yay)
+	}
+}
+
+func TestRemoveNetrcCredential(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, ".netrc")
+	writeFile(t, path, "machine example.com\nlogin a\npassword b\n\nmachine packages.vulnetix.com\nlogin org\npassword key\n")
+
+	if res, _ := removeNetrcCredential(path, "packages.vulnetix.com", true); res != "would remove netrc credential" {
+		t.Fatalf("dry result = %q", res)
+	}
+	if !strings.Contains(readFile(t, path), "packages.vulnetix.com") {
+		t.Fatal("dry-run modified netrc")
+	}
+
+	res, err := removeNetrcCredential(path, "packages.vulnetix.com", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if res != "removed netrc credential" {
+		t.Fatalf("result = %q", res)
+	}
+	got := readFile(t, path)
+	if strings.Contains(got, "packages.vulnetix.com") || !strings.Contains(got, "example.com") {
+		t.Fatalf("netrc wrong after removal:\n%s", got)
+	}
+
+	// Sole entry -> file deleted.
+	solo := filepath.Join(dir, "solo")
+	writeFile(t, solo, "machine packages.vulnetix.com\nlogin org\npassword key\n")
+	res, _ = removeNetrcCredential(solo, "packages.vulnetix.com", false)
+	if res != "removed netrc credential (file deleted)" {
+		t.Fatalf("result = %q", res)
+	}
+	if _, err := os.Stat(solo); !os.IsNotExist(err) {
+		t.Fatal("expected netrc deleted")
+	}
+
+	// Absent.
+	if res, _ := removeNetrcCredential(filepath.Join(dir, "nope"), "packages.vulnetix.com", false); res != "not configured" {
+		t.Fatalf("result = %q", res)
+	}
+}
+
+func TestResolveUninstallTargets(t *testing.T) {
+	if _, err := resolveUninstallTargets(nil, nil, false); err == nil {
+		t.Fatal("expected error with no selector")
+	}
+	if _, err := resolveUninstallTargets([]string{"npm"}, nil, true); err == nil {
+		t.Fatal("expected error with multiple selectors")
+	}
+
+	all, err := resolveUninstallTargets(nil, nil, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(all) != len(pfw.All()) {
+		t.Fatalf("--all returned %d, want %d", len(all), len(pfw.All()))
+	}
+
+	args, err := resolveUninstallTargets([]string{"npm", "pypi"}, nil, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(args) != 2 || args[0].Command != "npm" || args[1].Command != "pypi" {
+		t.Fatalf("targeted returned %+v", args)
+	}
+
+	except, err := resolveUninstallTargets(nil, []string{"aur"}, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(except) != len(pfw.All())-1 {
+		t.Fatalf("--except returned %d, want %d", len(except), len(pfw.All())-1)
+	}
+	for _, e := range except {
+		if e.ID == "aur" {
+			t.Fatal("aur should be excluded")
+		}
+	}
+
+	if _, err := resolveUninstallTargets([]string{"bogus"}, nil, false); err == nil {
+		t.Fatal("expected error for unknown ecosystem")
+	}
+
+	if eco, ok := resolveEcosystem("go-dev"); !ok || eco.ID != "go-dev" {
+		t.Fatal("go-dev should resolve")
+	}
+}
+
+// TestUninstallRoundTripNpm proves configure and uninstall line up: writing the
+// real npm config files then removing them leaves nothing behind.
+func TestUninstallRoundTripNpm(t *testing.T) {
+	home := t.TempDir()
+	eco, _ := pfw.ByCommand("npm")
+	files, err := pfw.ConfigFiles(eco, pfw.ConfigOptions{HomeDir: home, ProxyURL: "https://packages.vulnetix.com", OrgID: "org", APIKey: "key"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, f := range files {
+		if _, err := upsertPackageFirewallConfigFile(f, false); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, f := range files {
+		res, err := removePackageFirewallConfigFile(f, "packages.vulnetix.com", false)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if res != "deleted file" {
+			t.Fatalf("%s: result = %q", f.Path, res)
+		}
+		if _, err := os.Stat(f.Path); !os.IsNotExist(err) {
+			t.Fatalf("%s not removed", f.Path)
+		}
+	}
+}
+
+func writeFile(t *testing.T, path, content string) {
+	t.Helper()
+	if err := os.WriteFile(path, []byte(content), 0600); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func readFile(t *testing.T, path string) string {
+	t.Helper()
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(data)
+}

cmd/package_firewall_test.go

@@ -124,6 +124,30 @@ This command writes a `machine packages.vulnetix.com` entry to `.netrc`, persist
 | `--proxy-url` | string | `https://packages.vulnetix.com` | Package Firewall Go proxy URL |
 | `--dry-run` | bool | `false` | Show planned changes without writing files |
 
+#### package-firewall uninstall
+
+Remove the configuration written for one, some, or every ecosystem. Needs no authentication — it operates on local files only. See [Uninstall](/docs/enterprise/package-firewall/uninstall/).
+
+```bash
+vulnetix package-firewall uninstall npm pypi        # named ecosystems
+vulnetix package-firewall uninstall --all            # every supported ecosystem
+vulnetix package-firewall uninstall --except aur     # all but the named ones
+vulnetix package-firewall uninstall --purge          # every ecosystem + the shared netrc credential
+```
+
+Exactly one selector is required: positional ecosystem(s), `--all`, or `--except`. The shared `~/.netrc` credential is kept unless `--remove-credentials` or `--purge` is given.
+
+**Flags:**
+
+| Flag | Type | Default | Description |
+|------|------|---------|-------------|
+| `--all` | bool | `false` | Unconfigure every supported ecosystem |
+| `--except` | strings | — | Unconfigure all supported ecosystems except these |
+| `--remove-credentials` | bool | `false` | Also remove the shared netrc credential (`machine packages.vulnetix.com`) |
+| `--purge` | bool | `false` | Remove the shared netrc credential and every supported ecosystem |
+| `--proxy-url` | string | `https://packages.vulnetix.com` | Package Firewall proxy URL (host to detect and strip) |
+| `--dry-run` | bool | `false` | Show planned changes without writing files |
+
 ---
 
 ### vulnetix config

website/content/docs/cli-reference/_index.md

@@ -7,7 +7,7 @@ Enterprise features for corporate environments, distribution, and advanced deplo
 
 {{< cards >}}
   {{< card link="corporate-proxy" title="Corporate Proxy" subtitle="Proxy servers, firewalls, and restricted networks." >}}
-  {{< card link="package-firewall" title="Package Firewall" subtitle="Proxy and policy-enforce dependencies across 21 ecosystems — npm, PyPI, Cargo, Go, Maven, Docker/OCI and more." >}}
+  {{< card link="package-firewall" title="Package Firewall" subtitle="Proxy and policy-enforce dependencies across 23 ecosystems — npm, PyPI, Cargo, Go, Maven, Homebrew, Arch Linux, Docker/OCI and more." >}}
   {{< card link="quality-gates" title="Quality Gates" subtitle="Org-wide scan enforcement — severity, exploits, EOL, unpinned deps, SCA autofix." >}}
   {{< card link="publishing" title="Publishing & Distribution" subtitle="How Vulnetix CLI is published and distributed." >}}
 {{< /cards >}}