@canonical/pragma-cli 0.36.0 → 0.37.0

package/src/capabilities/resources/resources.test.ts

@@ -61,8 +61,31 @@ const EVERYTHING: McpListable = { sources: [{ as: "entities" }] };
  * only. Payload SIZE is the property that actually regressed (712 entries /
  * ~155 KB on every connect), and it is the one an agent pays for twice: once in
  * transfer, once in the context window it can no longer spend on the task.
+ *
+ * **Raised from 60,000 to 100,000 on 2026-09-01**, when the
+ * `@canonical/token-ontology` pack took the payload to 65,119 bytes. The
+ * listing was kept whole rather than trimmed to fit: the per-class counts are
+ * how an agent gets the shape of the graph before spending a single lookup,
+ * and that is worth more than the bytes.
+ *
+ * **Cost scales with the number of T-Box terms and their metadata, not with
+ * the number of packs.** The `ontology` noun emits one resource per matching
+ * T-Box entity (`provider.ts`), so a pack costs what its own vocabulary
+ * costs — this one happened to add ~23 KB, which is a fact about this
+ * ontology and not a rate. The headroom here does not convert into "one more
+ * pack" of any size.
+ *
+ * It is also the only listing that grows this way: every other noun lists
+ * collections with their counts, so those grow with the number of nouns. When
+ * this ceiling is next reached, the fix is to scope the T-Box slice or
+ * paginate it — not to raise the number again, which would turn a gate into a
+ * formality.
+ *
+ * It is deliberately not removed. The regression it was written for is still
+ * worth catching, and a ceiling with headroom catches it while a deleted one
+ * catches nothing.
  */
-const LISTING_BUDGET_BYTES = 60_000;
+const LISTING_BUDGET_BYTES = 100_000;
 
 describe("resource listing (storeless, over the pack index)", () => {
   it("degrades to a recovery entry on a missing or legacy index", () => {
@@ -322,7 +345,20 @@ describe("resource surface over the server (embedded pack)", () => {
   let harness: Awaited<ReturnType<typeof projectMcp>>;
   beforeAll(async () => {
     harness = await projectMcp(capabilities);
-  });
+    // Boot the store HERE, not in whichever test happens to read first.
+    //
+    // `createLazyStore` memoises the boot PROMISE, and vitest's per-test
+    // timeout aborts the test without aborting the work — so a cold boot that
+    // overruns is charged partly to the test that triggered it and partly to
+    // the next one, which merely awaits the same promise. That reads as a
+    // sudden per-read regression and is nothing of the kind; it cost a real
+    // investigation to find that out.
+    //
+    // Paying it in the hook attributes it where it belongs, keeps every `it`
+    // in this file measuring what it claims to, and bounds it by hookTimeout
+    // rather than by a 5 s default that pack growth will keep outgrowing.
+    await harness.readResource(BUTTON_URI);
+  }, 60_000);
   afterAll(async () => {
     await harness.cleanup();
   });

package/src/capabilities/setup/operations/setupCompletions.ts

@@ -204,11 +204,18 @@ export function composeCompletions(d: CompletionsDetection): Task<void> {
  * machine that never installed one reverses zero steps and says so.
  *
  * @param d - The detection gathered up front.
+ * @param undoKey - Correlation key stamped on the reversal(s), echoed on
+ *   their undo outcomes so the caller can read results back per row.
  * @returns A Task whose undo deletes the installed script.
  */
-export function composeCompletionsRemoval(d: CompletionsDetection): Task<void> {
+export function composeCompletionsRemoval(
+  d: CompletionsDetection,
+  undoKey?: string,
+): Task<void> {
   if (d.path === null || d.script === null || d.state === "absent") {
     return sequence_([]);
   }
-  return sequence_([writeFile(d.path, d.script, { undo: deleteFile(d.path) })]);
+  return sequence_([
+    writeFile(d.path, d.script, { undo: deleteFile(d.path), undoKey }),
+  ]);
 }

package/src/capabilities/setup/operations/setupConfig.ts

@@ -110,12 +110,17 @@ export function composeConfigFile(d: ConfigDetection): Task<void> {
  * delete as its `undo`, which is what the undo interpreter executes.
  *
  * @param d - The detection gathered up front.
+ * @param undoKey - Correlation key stamped on the reversal(s), echoed on
+ *   their undo outcomes so the caller can read results back per row.
  * @returns A Task whose undo removes a seed-only config, or an empty Task.
  */
-export function composeConfigRemoval(d: ConfigDetection): Task<void> {
+export function composeConfigRemoval(
+  d: ConfigDetection,
+  undoKey?: string,
+): Task<void> {
   if (!d.exists || !d.isSeed) return sequence_([]);
   return sequence_([
-    writeFile(d.path, SEED_CONFIG, { undo: deleteFile(d.path) }),
+    writeFile(d.path, SEED_CONFIG, { undo: deleteFile(d.path), undoKey }),
   ]);
 }
 

package/src/capabilities/setup/operations/setupGenerator.ts

@@ -34,6 +34,7 @@ import {
   type TaskError,
   warn,
 } from "@canonical/task";
+import type { UndoOutcome } from "@canonical/task/node";
 import { BIN_NAME } from "../../../constants.js";
 import { PragmaError } from "../../../kernel/error/index.js";
 import type { PragmaRuntime } from "../../../kernel/runtime/index.js";
@@ -103,6 +104,20 @@ export interface SetupRun {
   readonly generator: GeneratorDefinition;
   /** The plan with the wizard's selection and the run's outcomes applied. */
   applied(answers: Record<string, unknown>): SetupPlan;
+  /**
+   * The plan graded by the EXECUTED reversals — `--undo`'s own `applied`.
+   *
+   * A real `--undo` never interprets the composed task for real: the undo
+   * interpreter walks it with every effect mocked (to collect the
+   * reversals), so the {@link OutcomeSink} the forward run fills stays
+   * empty, and only the interpreter's per-undo outcomes — correlated by the
+   * `undoKey` each reversal was stamped with in `generate` — say what
+   * actually happened. This projection writes those outcomes onto the SAME
+   * sink and reads the plan back through the SAME `outcomeFor` the forward
+   * run uses: one outcome model, both directions. An actionable row none of
+   * whose reversals reported back is a failure, never a quiet `removed`.
+   */
+  appliedUndo(outcomes: readonly UndoOutcome[]): SetupPlan;
   /**
    * Register THE live row listener (the Ink wizard's step adapter). The
    * composed rows emit through it while they are interpreted — which means
@@ -463,8 +478,15 @@ export async function buildSetupRun(
         // MCP file paths to every other target's compose.
         const key = CHILD_ANSWER[row.target];
         const children = key === undefined ? undefined : readList(answers, key);
+        // A removal stamps the row's identity on every reversal it composes:
+        // `--undo` executes those reversals in a LATER phase (the undo
+        // interpreter's), whose outcomes come back correlated by this key —
+        // see `appliedUndo`.
         const task = removal
-          ? hit.target.composeRemoval(hit.detection)
+          ? hit.target.composeRemoval(
+              hit.detection,
+              rowKey(row.scope, row.target),
+            )
           : hit.target.compose(hit.detection, children);
         // The row's progress sentence — the `target  detail — note` shape
         // `renderProgressLine` prints — so the live view and the recap say the
@@ -509,7 +531,17 @@ export async function buildSetupRun(
     // outcome at all left a converged re-run with a plan-shaped output that
     // claimed nothing had run — while the row still rendered a bare green ✓.
     // Convergence is a real result: one quiet line per row, zero writes.
-    if (row.action === "none") return { status: "noop", note: "unchanged" };
+    //
+    // On a REMOVAL the same state is `kept`, not `noop`: the run owned
+    // nothing here and deliberately left the machine's state standing (the
+    // config the user edited, the editor with no extension copy). That is
+    // standing aside, which the vocabulary marks inert (○), where `noop`'s
+    // green ✓ would claim removal work that never existed.
+    if (row.action === "none") {
+      return removal
+        ? { status: "kept" }
+        : { status: "noop", note: "unchanged" };
+    }
     if (!isChosen(row, chosen)) return undefined;
     const error = sink.get(rowKey(row.scope, row.target));
     if (error !== undefined) {
@@ -530,25 +562,62 @@ export async function buildSetupRun(
     };
   };
 
+  /** The one answers→plan projection both `applied` faces share. */
+  const project = (answers: Record<string, unknown>): SetupPlan => {
+    const chosen = readList(answers, ROWS_ANSWER);
+    return withRows(
+      plan,
+      plan.rows.map((row): PlanRow => {
+        const outcome = outcomeFor(row, chosen, answers);
+        return {
+          ...row,
+          selected: isChosen(row, chosen),
+          ...(outcome === undefined ? {} : { outcome }),
+        };
+      }),
+    );
+  };
+
   return {
     plan,
     generator,
     setRowListener: (listener) => {
       rowListener = listener;
     },
-    applied: (answers) => {
-      const chosen = readList(answers, ROWS_ANSWER);
-      return withRows(
-        plan,
-        plan.rows.map((row): PlanRow => {
-          const outcome = outcomeFor(row, chosen, answers);
-          return {
-            ...row,
-            selected: isChosen(row, chosen),
-            ...(outcome === undefined ? {} : { outcome }),
-          };
-        }),
+    applied: project,
+    appliedUndo: (outcomes) => {
+      // The undo path's sink fill. The forward run's recover frames write the
+      // sink WHILE the task is interpreted; a real `--undo` interprets the
+      // task only as the mocked collection walk, so the executed reversals'
+      // outcomes land here instead — same sink, same reader (`outcomeFor`),
+      // other direction. The first failure per row wins: it is the earliest
+      // cause, and the row's note should name it, not the knock-on.
+      sink.clear();
+      for (const outcome of outcomes) {
+        if (outcome.status !== "failed" || outcome.key === undefined) continue;
+        if (sink.get(outcome.key) !== undefined) continue;
+        sink.record(outcome.key, outcome.error);
+      }
+      // A row that owed reversals and heard back from NONE of them cannot
+      // report `removed` — nothing proved anything happened. Structurally
+      // every actionable removal row composes at least one keyed reversal,
+      // so this is a guard against a future target breaking that invariant,
+      // not a path any current target takes.
+      const reported = new Set(
+        outcomes.flatMap((o) => (o.key === undefined ? [] : [o.key])),
       );
+      for (const row of plan.rows) {
+        const id = rowKey(row.scope, row.target);
+        if (!isActionable(row.action) || !row.selected) continue;
+        if (reported.has(id) || sink.get(id) !== undefined) continue;
+        sink.record(id, {
+          code: "UNSUPPORTED",
+          message: "no reversal was executed for this target",
+        });
+      }
+      // No answers: `--undo` asks nothing, so every row falls back to its
+      // own default selection — exactly the set `generate` composed from.
+      return project({});
     },
   };
 }

package/src/capabilities/setup/operations/setupLsp.ts

@@ -36,13 +36,21 @@ import type { EditorCliDefinition, PlatformEnv } from "@canonical/harnesses";
 import {
   type ExecResult,
   exec,
+  exists,
   flatMap,
   mkdir,
+  pure,
+  sequence,
   sequence_,
   type Task,
 } from "@canonical/task";
 import { BIN_NAME } from "../../../constants.js";
-import { checkExecOk, guardMissingBinary } from "../../shared/index.js";
+import { PragmaError } from "../../../kernel/error/index.js";
+import {
+  checkExecOk,
+  failPragma,
+  guardMissingBinary,
+} from "../../shared/index.js";
 import type { LspState } from "../types.js";
 
 /** The full extension id, as the editor's extensions dir spells it. */
@@ -76,6 +84,15 @@ export interface DetectedEditor {
    * {@link composeLspRemoval}); when `present` is true, this is that path.
    */
   readonly extensionsDir: string;
+  /**
+   * The matching entry NAMES under {@link extensionsDir} — the artifacts
+   * `present` is true about. The removal's postcondition probes exactly
+   * these after the uninstall (see {@link composeLspRemoval}): the editor
+   * CLI's exit code and the directory listing are DIFFERENT success
+   * criteria, and only the directory is the one detection (and doctor)
+   * believe.
+   */
+  readonly presentEntries: readonly string[];
 }
 
 /**
@@ -187,12 +204,13 @@ const compareVersions = (left: number[], right: number[]): number => {
 const extensionState = (
   editor: EditorCliDefinition,
   platform: PlatformEnv,
-): { present: boolean; current: boolean } => {
+): { present: boolean; current: boolean; entries: string[] } => {
   let entries: string[];
   try {
     entries = readdirSync(editor.extensionsDir(platform));
   } catch {
-    return { present: false, current: false }; // No dir — nothing installed.
+    // No dir — nothing installed.
+    return { present: false, current: false, entries: [] };
   }
   const prefix = `${EXTENSION_ID}-`;
   const matching = entries.filter((entry) =>
@@ -203,7 +221,7 @@ const extensionState = (
     if (version === undefined) return false; // Unreadable: cannot vouch for it.
     return compareVersions(version, MINIMUM) >= 0;
   });
-  return { present: matching.length > 0, current };
+  return { present: matching.length > 0, current, entries: matching };
 };
 
 /**
@@ -221,12 +239,13 @@ export async function detectLsp(_cwd: string): Promise<LspDetection> {
   const editors: DetectedEditor[] = editorClis
     .filter((editor) => cliOnPath(executableCandidates(editor.cli, platform)))
     .map((editor) => {
-      const { present, current } = extensionState(editor, platform);
+      const { present, current, entries } = extensionState(editor, platform);
       return {
         editor,
         present,
         installed: current,
         extensionsDir: editor.extensionsDir(platform),
+        presentEntries: entries,
       };
     });
   const state: LspState =
@@ -377,7 +396,8 @@ export const ownedLspEditors = (d: LspDetection): readonly DetectedEditor[] =>
 
 /**
  * Compose the removal: one `<editor cli> --uninstall-extension <id>` per owned
- * editor, carried as the `undo` of a forward no-op.
+ * editor, carried as the `undo` of a forward no-op — and each uninstall
+ * asserts its own GOAL, not just its exit code.
  *
  * The docblock this replaces claimed "an `exec` carries no reversal". That was
  * factually wrong about the effect model — `Exec` has an `undo` slot and `exec`
@@ -391,37 +411,90 @@ export const ownedLspEditors = (d: LspDetection): readonly DetectedEditor[] =>
  * `present` proves already exists — reads nothing and is a genuine no-op. Phase
  * two then runs the uninstall against the real editor.
  *
+ * THE POSTCONDITION is the removal's real success criterion. The exec's exit
+ * code and the extensions DIRECTORY are two different judges — detection
+ * deliberately reads the directory (probing via the CLI can launch an
+ * editor), and VS Code-family CLIs are known to exit 0 while deferring or
+ * skipping the deletion — so after `checkExecOk` the undo probes the exact
+ * entries detection said this command owns, and FAILS (with the manual
+ * deletion as the remedy — never the command that just claimed success) when
+ * any survived. An in-task failure here is safe precisely because
+ * `runCollectedUndos` executes each undo isolated: it used to abort every
+ * reversal still pending, which is why no removal could afford to assert its
+ * own goal.
+ *
  * @param d - The detection gathered up front.
- * @returns A Task whose undo uninstalls the extension from each owned editor.
+ * @param undoKey - Correlation key stamped on each reversal, echoed on its
+ *   `UndoOutcome` so the caller can read the outcomes back per row.
+ * @returns A Task whose undo uninstalls the extension from each owned editor
+ *   and verifies the copy is gone.
  */
-export function composeLspRemoval(d: LspDetection): Task<void> {
+export function composeLspRemoval(
+  d: LspDetection,
+  undoKey?: string,
+): Task<void> {
   const owned = ownedLspEditors(d);
   // Nothing on this machine carries a copy — there is no honest work to model,
   // and the plan row says so. Same shape as the other rows' empty removals.
   if (owned.length === 0) return sequence_([]);
   return sequence_(
-    owned.map(({ editor, extensionsDir }) => {
+    owned.map(({ editor, extensionsDir, presentEntries }) => {
       const command = `${editor.cli} --uninstall-extension ${EXTENSION_ID}`;
+      const ownedPaths = presentEntries.map((entry) =>
+        join(extensionsDir, entry),
+      );
+      const uninstall = flatMap(
+        exec(
+          editor.cli,
+          ["--uninstall-extension", EXTENSION_ID],
+          extensionsDir,
+        ),
+        (result) =>
+          checkExecOk(command, result as ExecResult, {
+            message:
+              `${editor.name} refused the uninstall (its output is above). ` +
+              `Remove it by hand with \`${command}\`.`,
+          }),
+      );
+      // The probe must apply DETECTION'S presence criterion, or the check can
+      // quietly stop checking: `extensionState` calls an entry present when
+      // `readdirSync` lists it, and a default `exists` (`fs.access`) follows
+      // symlinks — so a dangling matching symlink would be "installed" to
+      // detection and "absent" here, and an editor that exits 0 without
+      // removing it would report `undone` while the next detection finds it
+      // again. `followSymlinks: false` is `lstat` semantics: the entry
+      // itself, exactly what the directory listing answers.
+      const verified = flatMap(uninstall, () =>
+        flatMap(
+          sequence(ownedPaths.map((p) => exists(p, { followSymlinks: false }))),
+          (stillThere) => {
+            const survivors = ownedPaths.filter((_, i) => stillThere[i]);
+            if (survivors.length === 0) return pure(undefined);
+            // The remedy presents the surviving paths as DATA, never as a
+            // synthesized shell line: the names come from `readdirSync`, so
+            // no quoting is trustworthy, and one command cannot be right for
+            // every platform the editor registry supports.
+            return failPragma(
+              new PragmaError({
+                code: "UNSUPPORTED",
+                message: `\`${command}\` exited 0, but the extension is still present after the undo ran.`,
+                recovery: {
+                  message: `Delete ${survivors.length === 1 ? "this entry" : "these entries"} from ${editor.name}'s extensions folder by hand, then restart it: ${survivors.join(" · ")}`,
+                },
+              }),
+            );
+          },
+        ),
+      );
       return mkdir(extensionsDir, true, {
         undo: guardMissingBinary(
           editor.cli,
           {
             message: `The \`${editor.cli}\` CLI disappeared from PATH mid-run — restore it, then run \`${BIN_NAME} setup lsp --undo\` again.`,
           },
-          flatMap(
-            exec(
-              editor.cli,
-              ["--uninstall-extension", EXTENSION_ID],
-              extensionsDir,
-            ),
-            (result) =>
-              checkExecOk(command, result as ExecResult, {
-                message:
-                  `${editor.name} refused the uninstall (its output is above). ` +
-                  `Remove it by hand with \`${command}\`.`,
-              }),
-          ),
+          verified,
         ),
+        undoKey,
       });
     }),
   );

package/src/capabilities/setup/operations/setupMcp.ts

@@ -356,9 +356,14 @@ export const ownedMcpGroups = (d: McpDetection): readonly TargetGroup[] =>
  * same file is never touched.
  *
  * @param d - The detection gathered up front.
+ * @param undoKey - Correlation key stamped on the reversal(s), echoed on
+ *   their undo outcomes so the caller can read results back per row.
  * @returns A Task whose undo removes the pragma entry from each owned file.
  */
-export function composeMcpRemoval(d: McpDetection): Task<void> {
+export function composeMcpRemoval(
+  d: McpDetection,
+  undoKey?: string,
+): Task<void> {
   return sequence_(
     ownedMcpGroups(d).map((group) =>
       mkdir(dirname(group.path), true, {
@@ -367,6 +372,7 @@ export function composeMcpRemoval(d: McpDetection): Task<void> {
             d.removeMcpConfigFrom(write, MCP_SERVER_NAME),
           ),
         ),
+        undoKey,
       }),
     ),
   );

package/src/capabilities/setup/operations/setupSkills.ts

@@ -754,14 +754,19 @@ export const ownedSkillLinks = (
  * this command owns, never from what a fresh forward plan would create.
  *
  * @param d - The detection gathered up front.
+ * @param undoKey - Correlation key stamped on the reversal(s), echoed on
+ *   their undo outcomes so the caller can read results back per row.
  * @returns A Task whose undo removes every owned link.
  */
-export function composeSkillsRemoval(d: SkillsDetection): Task<void> {
+export function composeSkillsRemoval(
+  d: SkillsDetection,
+  undoKey?: string,
+): Task<void> {
   const owned = ownedSkillLinks(d);
   if (owned.length === 0) return sequence_([]);
   return sequence_(
     owned.map((a) =>
-      symlink(a.target, a.linkPath, { undo: deleteFile(a.linkPath) }),
+      symlink(a.target, a.linkPath, { undo: deleteFile(a.linkPath), undoKey }),
     ),
   );
 }