@aron98/load-lock 1.2.0 → 1.3.0

package/dist/core/state.js

@@ -830,7 +830,7 @@ export class Machine {
     }
     history = [];
     // ----------------------------------------------------------------- journal
-    /** Held permits to persist for conservative restart reconciliation. */
+    /** Held permits (first) and queued/offered requests to persist across restarts. */
     journalEntries() {
         const out = [];
         for (const e of this.entries.values()) {
@@ -845,6 +845,7 @@ export class Machine {
                 opKey: e.opKey,
                 reason: e.reason,
                 weight: e.weight,
+                state: "held",
                 permitToken: e.permitToken,
                 phase: e.phase ?? "claimed",
                 pid: e.pid,
@@ -855,21 +856,45 @@ export class Machine {
                 leaseDeadline: e.leaseDeadline,
             });
         }
+        for (const e of this.entries.values()) {
+            if (e.state !== "queued" && e.state !== "offered")
+                continue;
+            out.push({
+                requestId: e.id,
+                pool: e.pool,
+                agentId: e.agentId,
+                agentLabel: e.agentLabel,
+                cwd: e.cwd,
+                opKey: e.opKey,
+                reason: e.reason,
+                weight: e.weight,
+                state: "queued",
+                enqueuedAt: e.enqueuedAt ?? e.since,
+                claimedAt: e.since,
+            });
+        }
         return out;
     }
     /**
-     * Restore held permits after a daemon restart (conservative reconciliation):
+     * Restore state after a daemon restart (conservative reconciliation):
+     *  - queued (incl. previously offered): re-queued FIFO by original enqueue
+     *    time, same requestIds so idempotent re-acquire still works; pools no
+     *    longer in the config are dropped. Offered entries restart as queued
+     *    and get a fresh offer (old offer tokens are invalid after restart).
      *  - tracked: re-check liveness via the supplied probe; dead => release,
      *    alive => keep (same token, so a late explicit release still works).
      *  - claimed: keep the start deadline (reclaimed by tick if already past).
      *  - untracked: keep, with a FRESH lease window from restore time.
-     * Queued/offered requests are deliberately NOT restored — queued agents
-     * re-acquire (documented restart behavior).
      */
     restore(journal, liveness) {
         let kept = 0;
         let releasedDead = 0;
+        const queuedEntries = [];
         for (const j of journal) {
+            if (j.state === "queued") {
+                queuedEntries.push({ j, at: j.enqueuedAt ?? j.claimedAt });
+                continue;
+            }
             const e = {
                 id: j.requestId,
                 pool: j.pool,
@@ -882,20 +907,20 @@ export class Machine {
                 state: "held",
                 since: j.claimedAt,
                 permitToken: j.permitToken,
-                phase: j.phase,
+                phase: j.phase ?? "claimed",
                 pid: j.pid,
                 pgid: j.pgid,
                 pidStartTime: j.pidStartTime,
                 startedAt: j.startedAt,
                 lastSeen: this.now(),
             };
-            if (j.phase === "claimed") {
+            if (e.phase === "claimed") {
                 e.startDeadline = j.claimedAt + this.config.startTimeoutMs;
             }
-            else if (j.phase === "running_untracked") {
+            else if (e.phase === "running_untracked") {
                 e.leaseDeadline = this.now() + this.config.untrackedLeaseMs; // fresh window
             }
-            else if (j.phase === "running_tracked") {
+            else if (e.phase === "running_tracked") {
                 const alive = liveness(e);
                 if (alive === false) {
                     // Confirmed dead while we were down: release, but keep a terminal
@@ -915,11 +940,40 @@ export class Machine {
             this.byKey.set(`${e.agentId}\u0000${e.opKey}`, e.id);
             kept++;
         }
+        // Re-queue queued requests, oldest first, preserving FIFO fairness.
+        queuedEntries.sort((a, b) => a.at - b.at);
+        let queued = 0;
+        for (const { j } of queuedEntries) {
+            if (!this.config.pools[j.pool])
+                continue; // pool removed while down
+            const e = {
+                id: j.requestId,
+                pool: j.pool,
+                agentId: j.agentId,
+                agentLabel: j.agentLabel,
+                cwd: j.cwd,
+                opKey: j.opKey,
+                reason: j.reason,
+                weight: j.weight,
+                state: "queued",
+                since: this.now(),
+                enqueuedAt: j.enqueuedAt ?? j.claimedAt,
+            };
+            this.entries.set(e.id, e);
+            this.byKey.set(`${e.agentId}\u0000${e.opKey}`, e.id);
+            if (!this.queues.has(e.pool))
+                this.queues.set(e.pool, []);
+            this.queues.get(e.pool).push(e.id);
+            queued++;
+        }
+        // Admit newly-eligible waiters (capacity freed while we were down).
+        for (const name of this.poolNames())
+            this.admit(name);
         this.pushEvent({
             type: "daemon_recovered",
             targetAgent: "*",
-            detail: `restored ${kept} held permit(s) from journal (${releasedDead} confirmed dead and released)`,
+            detail: `restored ${kept} held permit(s) from journal (${releasedDead} confirmed dead and released); re-queued ${queued} waiting request(s)`,
         });
-        return { kept, releasedDead };
+        return { kept, releasedDead, queued };
     }
 }

package/dist/dashboard/frame.js

@@ -59,13 +59,17 @@ export function renderFrame(view, width = 100, height = 40) {
     const syncAge = view.lastSyncAt ? fmtDuration(Math.max(0, view.now - view.lastSyncAt)) : "never";
     push(`load-lock dashboard — machine-wide heavy-work budget   ${state}   synced ${syncAge} ago`);
     if (view.daemon) {
-        push(`daemon pid ${view.daemon.pid} · uptime ${fmtDuration(view.daemon.uptimeMs)} · config v${view.daemon.configVersion} · protocol v${view.daemon.protocolVersion} · events through #${view.latestEventId}`);
+        push(`daemon pid ${view.daemon.pid} · uptime ${fmtDuration(view.daemon.uptimeMs)} · config v${view.daemon.configVersion} · protocol v${view.daemon.protocolVersion}` +
+            (view.daemon.daemonVersion ? ` · daemon v${view.daemon.daemonVersion}` : "") +
+            ` · events through #${view.latestEventId}`);
     }
     else {
         push(`daemon: unreachable — it auto-spawns on the next load-lock command`);
     }
     if (view.daemonRestartNote)
         push(`note: ${view.daemonRestartNote}`);
+    if (view.versionSkewNote)
+        push(`note: ${view.versionSkewNote}`);
     if (view.machine) {
         const m = view.machine;
         const cg = m.cgroupCpuQuota != null ? ` · cgroup ${m.cgroupVersion ?? ""} quota ${m.cgroupCpuQuota / 100} CPU` : "";

package/dist/dashboard/view.d.ts

@@ -105,6 +105,8 @@ export interface DaemonView {
     uptimeMs: number;
     protocolVersion: number;
     configVersion: number;
+    /** Package version of the daemon's code (pre-handshake daemons omit it). */
+    daemonVersion?: string;
 }
 /** The complete render-ready snapshot of the machine-wide budget. */
 export interface DashboardView {
@@ -112,6 +114,8 @@ export interface DashboardView {
     state: FeedState;
     /** False right after a daemon restart was detected (history was reset). */
     daemonRestartNote?: string;
+    /** Set when the running daemon is older than the installed copy. */
+    versionSkewNote?: string;
     daemon: DaemonView | null;
     pools: PoolView[];
     events: EventLine[];

package/dist/dashboard/view.js

@@ -1,3 +1,4 @@
+import { packageVersion, compareVersions } from "../shared/version.js";
 // ---------------------------------------------------------------- formatters
 /** Compact human duration: "412ms", "3s", "4m 12s", "2h 05m", "3d 4h". */
 export function fmtDuration(ms) {
@@ -189,6 +190,9 @@ export function buildDashboardView(inps) {
         now,
         state: inps.state,
         daemonRestartNote: inps.daemonRestartNote,
+        versionSkewNote: d && typeof d.daemonVersion === "string" && compareVersions(d.daemonVersion, packageVersion()) < 0
+            ? `daemon v${d.daemonVersion} is older than installed v${packageVersion()} — it self-restarts on newer-client contact`
+            : undefined,
         daemon: d
             ? {
                 pid: d.pid,
@@ -196,6 +200,7 @@ export function buildDashboardView(inps) {
                 uptimeMs: now - d.startedAt,
                 protocolVersion: d.protocolVersion,
                 configVersion: inps.status?.config.version ?? 0,
+                daemonVersion: d.daemonVersion,
             }
             : null,
         pools,

package/dist/shared/client.js

@@ -29,6 +29,7 @@ import { setTimeout as delay } from "node:timers/promises";
 import { ProtocolError } from "./protocol.js";
 import { socketPath as defaultSocket, stateDir as defaultStateDir } from "../core/persist.js";
 import { probeTransport } from "./transport.js";
+import { packageVersion } from "./version.js";
 export class LLClient {
     sock = null;
     nextId = 1;
@@ -170,7 +171,9 @@ export class LLClient {
                 },
             });
             const sock = this.ensureSock();
-            sock.write(JSON.stringify({ id, method, params }) + "\n");
+            // clientVersion: lets the daemon detect version skew and self-restart
+            // onto newer on-disk code (pre-handshake daemons ignore the field).
+            sock.write(JSON.stringify({ id, method, params, clientVersion: packageVersion() }) + "\n");
         });
     }
     /** Subscribe to daemon events targeted at agentId (or "*" for all). */

package/dist/shared/protocol.d.ts

@@ -6,6 +6,11 @@
  * receive unsolicited event lines.
  *
  * Request:  {"id": <number>, "method": "<name>", "params": {...}}
+ *           Newer clients also stamp the envelope with their package
+ *           version: {..., "clientVersion": "1.2.1"}. Old daemons ignore
+ *           the extra field (forward-compatible); newer daemons use it
+ *           for the update handshake: a client strictly newer than the
+ *           running daemon triggers a daemon self-restart (issue #34).
  * Response: {"id": <number>, "ok": true, "result": {...}}
  *           {"id": <number>, "ok": false, "error": {"code": "...", "message": "..."}}
  * Watch push: {"event": true, ...event fields...}
@@ -140,14 +145,40 @@ export interface JournalEntry {
     opKey: string;
     reason: string;
     weight: number;
-    permitToken: string;
-    phase: PermitPhase;
+    /** Held permits only; queued entries carry no token. */
+    permitToken?: string;
+    /** Held permits only. */
+    phase?: PermitPhase;
     pid?: number;
     pgid?: number;
     pidStartTime?: string;
+    /** When the permit was claimed (held) / the request was journaled. */
     claimedAt: number;
     startedAt?: number;
     leaseDeadline?: number;
+    /**
+     * Journaled lifecycle state (issue #34): "held" (permit — liveness is
+     * reconciled on restore) or "queued" (FIFO position preserved across
+     * restarts/self-restarts; offered entries are journaled as queued and
+     * re-offered with a fresh token after the restart). Absent in journals
+     * written before the update story => "held" (the original format).
+     */
+    state?: "held" | "queued";
+    /** Queue insertion time (queued only) — restores FIFO order. */
+    enqueuedAt?: number;
+}
+/**
+ * Result of `hello`. `daemonVersion` is the running daemon's package
+ * version. OPTIONAL in responses from daemons older than the handshake —
+ * clients must treat a missing value as "unknown (old daemon)" and warn
+ * instead of failing.
+ */
+export interface HelloResult {
+    protocolVersion: number;
+    pid: number;
+    startedAt: number;
+    configVersion: number;
+    daemonVersion?: string;
 }
 export interface PoolStatus {
     pool: string;
@@ -163,6 +194,13 @@ export interface StatusResult {
         pid: number;
         startedAt: number;
         protocolVersion: number;
+        /**
+         * Running daemon's package version (update handshake, issue #34).
+         * Optional because daemons older than the handshake never send it —
+         * clients must treat a missing value as "unknown, old daemon" and
+         * warn rather than fail.
+         */
+        daemonVersion?: string;
     };
     config: {
         version: number;

package/dist/shared/protocol.js

@@ -6,6 +6,11 @@
  * receive unsolicited event lines.
  *
  * Request:  {"id": <number>, "method": "<name>", "params": {...}}
+ *           Newer clients also stamp the envelope with their package
+ *           version: {..., "clientVersion": "1.2.1"}. Old daemons ignore
+ *           the extra field (forward-compatible); newer daemons use it
+ *           for the update handshake: a client strictly newer than the
+ *           running daemon triggers a daemon self-restart (issue #34).
  * Response: {"id": <number>, "ok": true, "result": {...}}
  *           {"id": <number>, "ok": false, "error": {"code": "...", "message": "..."}}
  * Watch push: {"event": true, ...event fields...}

package/dist/shared/version.d.ts

@@ -0,0 +1,10 @@
+/** Version of THIS copy of load-lock (the on-disk install running now). */
+export declare function packageVersion(): string;
+/**
+ * Best-effort dotted-version comparison ("1.2.1" vs "1.10.0"): numeric
+ * segments compared left to right, missing segments as 0, non-numeric
+ * prefixes of a segment ("2-beta" → 2) tolerated. Returns -1 / 0 / 1.
+ * Unparseable input never throws — it compares as 0.0.0, so the daemon
+ * never acts (restarts) on a garbage version.
+ */
+export declare function compareVersions(a: string, b: string): number;

package/dist/shared/version.js

@@ -0,0 +1,57 @@
+/**
+ * Package-version plumbing for the update story (issue #34).
+ *
+ * Every load-lock process — daemon, CLI, MCP server, plugin — learns its
+ * own on-disk package version by reading the package.json that ships next
+ * to its compiled dist/ tree. That version takes part in the client→daemon
+ * handshake: clients stamp every request envelope with it
+ * (`clientVersion`), the daemon stamps every hello with it
+ * (`daemonVersion`), and a strictly-newer client triggers a daemon
+ * self-restart (see core/daemon.ts).
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+let cached;
+/** Version of THIS copy of load-lock (the on-disk install running now). */
+export function packageVersion() {
+    if (cached === undefined) {
+        try {
+            // dist/shared/version.js → <package root>/package.json — resolves the
+            // same way in the repo checkout, a global CLI install, and an
+            // opencode cache copy. npm always ships package.json with the tarball.
+            const pkgPath = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json");
+            cached = String(JSON.parse(readFileSync(pkgPath, "utf8")).version ?? "0.0.0");
+        }
+        catch {
+            cached = "0.0.0";
+        }
+    }
+    return cached;
+}
+/**
+ * Best-effort dotted-version comparison ("1.2.1" vs "1.10.0"): numeric
+ * segments compared left to right, missing segments as 0, non-numeric
+ * prefixes of a segment ("2-beta" → 2) tolerated. Returns -1 / 0 / 1.
+ * Unparseable input never throws — it compares as 0.0.0, so the daemon
+ * never acts (restarts) on a garbage version.
+ */
+export function compareVersions(a, b) {
+    const pa = parse(a);
+    const pb = parse(b);
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+        const x = pa[i] ?? 0;
+        const y = pb[i] ?? 0;
+        if (x !== y)
+            return x < y ? -1 : 1;
+    }
+    return 0;
+}
+function parse(v) {
+    return v
+        .split(".")
+        .map((seg) => {
+        const m = /^(\d+)/.exec(seg.trim());
+        return m ? Number(m[1]) : 0;
+    });
+}

package/dist/test/install.test.js

@@ -5,7 +5,7 @@
  */
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { mkdtempSync, rmSync, mkdirSync, readFileSync, writeFileSync, existsSync } from "node:fs";
+import { mkdtempSync, rmSync, mkdirSync, readFileSync, writeFileSync, existsSync, cpSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -656,3 +656,183 @@ test("cursor: uninstall with nothing installed is a harmless no-op", async () =>
     assert.ok(!existsSync(join(proj, ".cursor")), "no files created by uninstall");
     rmSync(home, { recursive: true, force: true });
 });
+// --------------------------------------------------------------------- omac
+// The omac profile the installer must merge into without damaging it:
+// entries in every known section plus an unknown field (a newer omac
+// would accept it; we must preserve it untouched).
+function omacUserProfile(home) {
+    return JSON.stringify({
+        workdir: { access: "readwrite" },
+        network: { allow_domain: ["example.com"], allow_tcp_connect: [22] },
+        filesystem: {
+            allow: ["/data"],
+            read: ["/docs"],
+            write: ["/out"],
+            allow_unix_dir: ["/tmp/other-socks"],
+            deny: [".env"],
+        },
+        environment: { allow_vars: ["ANTHROPIC_API_KEY", "MY_*"] },
+        someFutureField: { nested: true },
+    }, null, 2) + "\n";
+}
+function omacProfilePath(home) {
+    return join(home, ".config", "omac", "sandbox-profiles", "default.json");
+}
+test("omac: install/uninstall round-trip on a populated profile; re-install is byte-identical", async () => {
+    const home = tempHome();
+    const xdg = join(home, ".config");
+    const profileFile = omacProfilePath(home);
+    mkdirSync(dirname(profileFile), { recursive: true });
+    const before = omacUserProfile(home);
+    writeFileSync(profileFile, before);
+    const stateDir = join(home, "ll-state");
+    const env = { XDG_CONFIG_HOME: xdg, LOAD_LOCK_STATE_DIR: stateDir, XDG_STATE_HOME: join(home, ".local", "state") };
+    // -- install
+    let r = await runCli(home, ["install", "--harness", "omac"], env);
+    assert.equal(r.code, 0, `install failed: ${r.stderr}`);
+    // honesty: live-verified claim, the env prefix entry, and the state-dir grant
+    assert.match(r.stdout, /live-verified.*omac 0\.11\.0|verified live against omac 0\.11\.0/i, "installer output must state the verification status");
+    assert.match(r.stdout, /LOAD_LOCK_\*/, "installer output must mention the LOAD_LOCK_* allow_vars entry");
+    assert.match(r.stdout, /allow_unix_dir \+=/, "installer output must mention the state-dir grant");
+    assert.match(r.stdout, /skipped filesystem\.read.*repo checkout/, "installer output must honestly note the skipped read grant (CLI runs from a repo checkout)");
+    const p = JSON.parse(readFileSync(profileFile, "utf8"));
+    // user entries preserved everywhere
+    assert.deepEqual(p.workdir, { access: "readwrite" }, "user workdir section preserved");
+    assert.deepEqual(p.network, { allow_domain: ["example.com"], allow_tcp_connect: [22] }, "user network section preserved");
+    assert.deepEqual(p.filesystem.allow, ["/data"], "user filesystem.allow preserved");
+    assert.deepEqual(p.filesystem.write, ["/out"], "user filesystem.write preserved");
+    assert.deepEqual(p.filesystem.deny, [".env"], "user filesystem.deny preserved");
+    assert.deepEqual(p.filesystem.read, ["/docs"], "read untouched — repo checkout needs no package-tree grant");
+    assert.deepEqual(p.someFutureField, { nested: true }, "unknown (newer-omac) field preserved");
+    // our grants, exactly once, alongside the user's
+    assert.deepEqual(p.filesystem.allow_unix_dir, ["/tmp/other-socks", stateDir], "state dir appended to allow_unix_dir");
+    assert.deepEqual(p.environment.allow_vars, ["ANTHROPIC_API_KEY", "MY_*", "LOAD_LOCK_*"], "LOAD_LOCK_* appended to allow_vars");
+    assert.equal(p.filesystem.allow_unix_dir.filter((e) => e === stateDir).length, 1, "state dir granted exactly once");
+    // -- idempotent re-install: the file is not rewritten at all
+    const afterInstall = readFileSync(profileFile, "utf8");
+    r = await runCli(home, ["install", "--harness", "omac"], env);
+    assert.equal(r.code, 0, `re-install failed: ${r.stderr}`);
+    assert.equal(readFileSync(profileFile, "utf8"), afterInstall, "re-install must be byte-identical");
+    assert.match(r.stdout, /already present.*nothing to do/, "re-install must say nothing was needed");
+    // -- uninstall removes exactly our entries
+    r = await runCli(home, ["uninstall", "--harness", "omac"], env);
+    assert.equal(r.code, 0, `uninstall failed: ${r.stderr}`);
+    const u = JSON.parse(readFileSync(profileFile, "utf8"));
+    assert.deepEqual(u.filesystem.allow_unix_dir, ["/tmp/other-socks"], "our state dir removed, user entry kept");
+    assert.ok(!u.filesystem.read.includes(stateDir), "no stray read grant");
+    assert.deepEqual(u.filesystem.read, ["/docs"], "user read entry kept");
+    assert.deepEqual(u.environment.allow_vars, ["ANTHROPIC_API_KEY", "MY_*"], "our env entry removed, user entries kept");
+    assert.deepEqual(u.workdir, { access: "readwrite" }, "user sections untouched by uninstall");
+    assert.deepEqual(u.someFutureField, { nested: true }, "unknown field untouched by uninstall");
+    rmSync(home, { recursive: true, force: true });
+});
+test("omac: install on a missing profile creates a minimal valid one (XDG_STATE_HOME honored); uninstall cleans it", async () => {
+    const home = tempHome();
+    const xdg = join(home, ".config");
+    const profileFile = omacProfilePath(home);
+    const xdgState = join(home, ".local", "state");
+    // LOAD_LOCK_STATE_DIR: "" clears any inherited override so XDG_STATE_HOME is honored
+    const env = { XDG_CONFIG_HOME: xdg, LOAD_LOCK_STATE_DIR: "", XDG_STATE_HOME: xdgState };
+    let r = await runCli(home, ["install", "--harness", "omac"], env);
+    assert.equal(r.code, 0, `install failed: ${r.stderr}`);
+    assert.ok(existsSync(profileFile), "profile created");
+    const p = JSON.parse(readFileSync(profileFile, "utf8"));
+    // minimal valid profile: only known fields, no empty arrays, no read grant (repo checkout)
+    assert.deepEqual(p, {
+        environment: { allow_vars: ["LOAD_LOCK_*"] },
+        filesystem: { allow_unix_dir: [join(xdgState, "load-lock")] },
+    }, "created profile holds exactly our grants");
+    // XDG_STATE_HOME honored: default state dir, not ~/.local/state off the real HOME
+    assert.ok(p.filesystem.allow_unix_dir[0].startsWith(xdgState), "state dir derived from XDG_STATE_HOME");
+    // idempotent re-install: byte-identical
+    const bytes = readFileSync(profileFile, "utf8");
+    r = await runCli(home, ["install", "--harness", "omac"], env);
+    assert.equal(r.code, 0, `re-install failed: ${r.stderr}`);
+    assert.equal(readFileSync(profileFile, "utf8"), bytes, "re-install is byte-identical");
+    // uninstall removes the file (nothing user-owned was ever in it) and prunes dirs
+    r = await runCli(home, ["uninstall", "--harness", "omac"], env);
+    assert.equal(r.code, 0, `uninstall failed: ${r.stderr}`);
+    assert.ok(!existsSync(profileFile), "our file removed");
+    assert.ok(!existsSync(join(xdg, "omac")), "empty omac config tree pruned");
+    rmSync(home, { recursive: true, force: true });
+});
+test("omac: a global-style install (package outside any repo) adds the package-tree read grant; uninstall removes it by shape", async () => {
+    const home = tempHome();
+    const xdg = join(home, ".config");
+    const stateDir = join(home, "ll-state");
+    const env = { XDG_CONFIG_HOME: xdg, LOAD_LOCK_STATE_DIR: stateDir, XDG_STATE_HOME: join(home, ".local", "state") };
+    // simulate a global install: package tree under node_modules, outside any .git
+    const pkgMock = join(home, "bun-mock", "install", "global", "node_modules", "@aron98", "load-lock");
+    mkdirSync(dirname(pkgMock), { recursive: true });
+    cpSync(join(HERE, ".."), join(pkgMock, "dist"), { recursive: true }); // dist/ from the worktree build
+    const mockCli = join(pkgMock, "dist", "cli", "main.js");
+    const profileFile = omacProfilePath(home);
+    const runMock = (args) => new Promise((resolveP, reject) => {
+        const child = spawn(process.execPath, [mockCli, ...args], { env: { ...process.env, HOME: home, ...env } });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (b) => (stdout += b));
+        child.stderr.on("data", (b) => (stderr += b));
+        child.stdin.end();
+        child.once("exit", (code) => resolveP({ code, stdout, stderr }));
+        child.once("error", reject);
+    });
+    let r = await runMock(["install", "--harness", "omac"]);
+    assert.equal(r.code, 0, `install failed: ${r.stderr}`);
+    assert.match(r.stdout, /filesystem\.read \+=/, "installer output must mention the package-tree read grant");
+    const p = JSON.parse(readFileSync(profileFile, "utf8"));
+    const pkgReal = resolve(pkgMock);
+    assert.deepEqual(p.filesystem.read, [pkgReal], "read grant is the realpath of the package root");
+    assert.ok(p.filesystem.allow_unix_dir.includes(stateDir), "state dir granted too");
+    // idempotent re-install from the global copy: byte-identical
+    const bytes = readFileSync(profileFile, "utf8");
+    r = await runMock(["install", "--harness", "omac"]);
+    assert.equal(r.code, 0, `re-install failed: ${r.stderr}`);
+    assert.equal(readFileSync(profileFile, "utf8"), bytes, "re-install is byte-identical");
+    // uninstall from the WORKTREE CLI (a different location, readTree is null
+    // there): the read entry still matches by its node_modules/@aron98/load-lock shape
+    r = await runCli(home, ["uninstall", "--harness", "omac"], env);
+    assert.equal(r.code, 0, `uninstall failed: ${r.stderr}`);
+    assert.ok(!existsSync(profileFile), "profile held only our grants — removed");
+    rmSync(home, { recursive: true, force: true });
+});
+test("omac: uninstall with nothing installed is a harmless no-op", async () => {
+    const home = tempHome();
+    const r = await runCli(home, ["uninstall", "--harness", "omac"], { XDG_CONFIG_HOME: join(home, ".config"), LOAD_LOCK_STATE_DIR: join(home, "ll-state") });
+    assert.equal(r.code, 0, `uninstall failed: ${r.stderr}`);
+    assert.ok(!existsSync(join(home, ".config", "omac")), "no files created by uninstall");
+    rmSync(home, { recursive: true, force: true });
+});
+test("omac: install refuses to touch a broken or misshapen profile", async () => {
+    const home = tempHome();
+    const xdg = join(home, ".config");
+    const profileFile = omacProfilePath(home);
+    mkdirSync(dirname(profileFile), { recursive: true });
+    const env = { XDG_CONFIG_HOME: xdg, LOAD_LOCK_STATE_DIR: join(home, "ll-state") };
+    // (a) invalid JSON
+    const broken = "{ not json";
+    writeFileSync(profileFile, broken);
+    let r = await runCli(home, ["install", "--harness", "omac"], env);
+    assert.notEqual(r.code, 0, "install must refuse invalid JSON");
+    assert.match(r.stderr + r.stdout, /not valid JSON|refus/i, "error must explain the refusal");
+    assert.equal(readFileSync(profileFile, "utf8"), broken, "file untouched on refusal");
+    // (b) allow_vars present but not an array of strings
+    const misshapen = JSON.stringify({ environment: { allow_vars: "PATH" } }, null, 2) + "\n";
+    writeFileSync(profileFile, misshapen);
+    r = await runCli(home, ["install", "--harness", "omac"], env);
+    assert.notEqual(r.code, 0, "install must refuse a non-array allow_vars");
+    assert.match(r.stderr + r.stdout, /allow_vars.*not an array/i, "error must name the offending field");
+    assert.equal(readFileSync(profileFile, "utf8"), misshapen, "file untouched on refusal");
+    // uninstall also refuses (never "fixes" the file by overwriting it) on invalid JSON
+    writeFileSync(profileFile, broken);
+    r = await runCli(home, ["uninstall", "--harness", "omac"], env);
+    assert.notEqual(r.code, 0, "uninstall must refuse invalid JSON too");
+    assert.equal(readFileSync(profileFile, "utf8"), broken, "file untouched on refusal");
+    // on a merely misshapen value (valid JSON, allow_vars not an array) uninstall
+    // is a graceful no-op: it never wrote that value, so it leaves it alone
+    writeFileSync(profileFile, misshapen);
+    r = await runCli(home, ["uninstall", "--harness", "omac"], env);
+    assert.equal(r.code, 0, `uninstall failed: ${r.stderr}`);
+    assert.equal(readFileSync(profileFile, "utf8"), misshapen, "file untouched by uninstall");
+    rmSync(home, { recursive: true, force: true });
+});

package/dist/test/update.test.d.ts

@@ -0,0 +1 @@
+export {};