Gemini uninstall leaves integrity hash file

Summary

rtk init -g --gemini stores an RTK-owned integrity hash next to the Gemini hook, but rtk init -g --gemini --uninstall does not remove that hash file.

This is a small uninstall hygiene issue, not an accusation of malware. It leaves an RTK-owned metadata file after uninstall.

Version / tag / commit

• Tag: v0.39.0
• Commit: 2fbc7514f6964acabcfac65501b8bb6b525e3aa8

Evidence

Gemini install writes the hook and stores an integrity hash:

• src/hooks/init.rs:2466-2472 creates ~/.gemini/hooks/rtk-hook-gemini.sh.
• src/hooks/init.rs:2480-2482 calls integrity::store_hash(&hook_path).
• src/hooks/integrity.rs:48-54 derives the hash path as a .rtk-hook.sha256 file in the hook's parent directory.
• src/hooks/integrity.rs:67-85 writes the hash file.

Gemini uninstall removes the hook, GEMINI.md, and settings entry, but not the hash:

• src/hooks/init.rs:2608-2614 removes ~/.gemini/hooks/rtk-hook-gemini.sh.
• src/hooks/init.rs:2616-2622 removes ~/.gemini/GEMINI.md.
• src/hooks/init.rs:2624-2643 removes RTK hook entries from ~/.gemini/settings.json.
• No call to integrity::remove_hash(&hook_path) appears in uninstall_gemini.

Contrast: Claude uninstall removes the integrity hash:

• src/hooks/init.rs:591-601 removes the legacy Claude hook and then calls integrity::remove_hash(&hook_path).
• src/hooks/integrity.rs:98-116 already provides the removal helper.

Duplicate search performed:

• gh issue list -R rtk-ai/rtk --search "Gemini uninstall .rtk-hook.sha256"
• gh issue list -R rtk-ai/rtk --search "uninstall_gemini integrity hash"
• gh issue list -R rtk-ai/rtk --search "orphaned hash Gemini hook"
• gh issue list -R rtk-ai/rtk --search "rtk-hook.sha256 uninstall"

No focused duplicate was found.

Impact

After uninstall, ~/.gemini/hooks/.rtk-hook.sha256 can remain even though the Gemini hook was removed. This is not sensitive and does not execute, but it makes uninstall incomplete and can confuse later hook integrity checks or manual audits of RTK-owned files.

Verification steps

1. Inspect src/hooks/init.rs:2453-2494 for Gemini install.
2. Inspect src/hooks/integrity.rs:48-85 for the hash file location and write.
3. Inspect src/hooks/init.rs:2601-2643 for Gemini uninstall.
4. Confirm there is no integrity::remove_hash(&hook_path) in uninstall_gemini.

Suggested mitigation

In uninstall_gemini, call integrity::remove_hash(&hook_path) for the Gemini hook path, mirroring the Claude uninstall cleanup. Add an idempotent regression test that installs/removes Gemini artifacts and verifies both rtk-hook-gemini.sh and .rtk-hook.sha256 are removed while user settings content is preserved.