@kylecheng3146/agent-ops 0.1.14 → 0.1.16

package/README.md

@@ -67,8 +67,8 @@ agent-ops uninstall --dry-run --json
 ### Project-local loop
 
 `loop` is an explicit, project-only profile for Codex, Claude Code, or both.
-It requires a POSIX-compatible `bash`; the generated native launchers are
-`.sh` files, so Windows is not currently a supported loop host. Preview it
+Claude Code supports native Windows through a generated PowerShell launcher;
+Codex's loop launcher still requires POSIX-compatible `bash`. Preview it
 first, then install only after reviewing the plan. `loop` also implies the
 `core` baseline, so the project retains the managed rules and routing files:
 
@@ -77,12 +77,16 @@ agent-ops init --dry-run --scope project --harness codex,claude --profile loop -
 agent-ops init --scope project --harness codex,claude --profile loop --yes
 ```
 
-It creates one small managed launcher per selected native host:
+On native Windows, select `--harness claude` unless Codex is running in a
+POSIX environment; the Codex loop still invokes `bash`.
+
+It creates managed launchers per selected native host:
 
 - Codex: `.codex/hooks/agent-ops-loop.sh`, `.codex/config.toml` when absent,
   `.codex/loop-goal.md`, `.codex/loop-state.md`, and
   `.codex/loop-telemetry.jsonl`.
-- Claude Code: `.claude/hooks/agent-ops-loop.sh`, `.claude/loop-goal.md`,
+- Claude Code: `.claude/hooks/agent-ops-loop.sh`,
+  `.claude/hooks/agent-ops-loop.ps1`, `.claude/loop-goal.md`,
   `.claude/loop-state.md`, and `.claude/loop-telemetry.jsonl`.
 
 The launchers delegate to one installed Node runtime; agent-ops does not copy
@@ -146,8 +150,10 @@ node dist/packages/cli/src/bin.js init \
   --dry-run --scope project --harness all --profile core --json
 ```
 
-After reviewing the plan, apply it explicitly with `--yes`. Trust, diagnostics,
-updates, and removal are separate commands:
+After reviewing the plan, apply it explicitly with `--yes`. Confirmed
+project-scope init/update automatically grants the displayed trust binding when
+verification commands are configured; uninstall revokes it. Diagnostics and
+manual trust management remain separate commands:
 
 ```bash
 node dist/packages/cli/src/bin.js init --scope project --harness all --profile core --yes
@@ -165,11 +171,9 @@ directory. `update` also requires that the project already has a valid managed
 `.agent-ops/manifest.json` created by `init`.
 
 The commands after `init --yes` are post-apply operations. `doctor` reports
-`UNKNOWN` for a probe that has nothing to verify yet: `repository-trust`
-until `trust grant` runs (only actionable once `verification.commands` is
-configured — a project that never runs verification has nothing for trust
-to unlock), and `smoke-availability` until the configuration declares a
-verification command. Every non-`PASS` check carries a `remediation` string
+`UNKNOWN` for a probe that has nothing to verify yet: `repository-trust` when
+no verification command exists, and `smoke-availability` until the
+configuration declares one. Every non-`PASS` check carries a `remediation` string
 explaining what, if anything, to do about it; text output prints it as an
 indented `  → ` line, and `--json` exposes it as a field. `doctor` never
 writes: it only reports what `agent-ops update` or `agent-ops trust grant`
@@ -239,9 +243,9 @@ only with confirmed commands, for example the relevant config fragment is:
 }
 ```
 
-After changing Stop configuration, run `agent-ops update` so native
-registrations match the config, then `agent-ops trust grant` to bind the
-current config. Stop is report-only: `PASS`, `FAIL`, and `UNKNOWN` continue
+After changing Stop configuration, run `agent-ops update`; its approved plan
+updates native registrations and the exact trust binding together. Stop is
+report-only: `PASS`, `FAIL`, and `UNKNOWN` continue
 the harness, emit bounded command evidence, and never complete a task.
 Config v1 migrates to config v2 with Stop disabled; migration invalidates the
 old trust binding, and pre-v1 binaries cannot read the migrated config.
@@ -277,19 +281,22 @@ the project configuration defines those workflows.
 
 `agent-ops review` can hand the review to another agent CLI, so the work is not
 judged by the agent that produced it. Enable it during `agent-ops init` (the
-default is off). Reviews require an attached task, current required
-verification evidence, and a deterministic worktree (or `--base`) scope. The
-native-schema detailed report is displayed but not persisted.
+default is off). A bare review applies the built-in `change-quality` criterion
+to a deterministic worktree (or `--base`) scope. `--task` reviews keep their
+task criteria and require current verification evidence. The detailed report
+is displayed; a minimal source-fingerprint attestation is persisted after PASS.
 
 Each attempt uses a fresh temporary cwd, a small allowlisted environment, and a
-target-native read-only/context-isolation mode. Currently only Claude safe mode
-meets the full isolation contract; configured Codex and Agy entries return
-`capability-unavailable` rather than run with a weaker boundary. `opencode` is
-not a review target.
-
-The first target that actually runs produces the verdict. A `FAIL` is final:
-the chain never retries elsewhere after a real verdict. `--yes` is still
-required for every run, since each run spends another provider's quota.
+target-native read-only mode. Claude additionally uses its complete safe mode;
+Codex ignores user config and persistence, while Agy disables slash-command
+expansion. Codex and Agy preserve their existing login environment, so their
+context isolation is intentionally weaker than Claude's. `opencode` is not a
+review target.
+
+The first valid `PASS` or `FAIL` is final. Attempts that produce no verdict —
+including login failures and unparseable output — advance to the next target
+and remain visible in the result's `attempts`. `--yes` is still required for
+every run, since each run spends another provider's quota.
 
 Authentication is diagnosed, never guessed:
 

package/dist/packages/cli/src/args.js

@@ -376,6 +376,11 @@ export function parseArgs(argv) {
         (title !== undefined || sessionId !== undefined)) {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Review accepts harness, criteria, evidence, scope, dry-run, json, and yes options.");
     }
+    if (command === "review" &&
+        taskId === undefined &&
+        (criteria.length > 0 || evidence.length > 0)) {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Review criteria and evidence require --task.");
+    }
     if (command === "review" && harness !== undefined && harness.length !== 1) {
         invalidValue("--harness", harness.join(","));
     }

package/dist/packages/cli/src/bin.js

@@ -10,15 +10,14 @@ import { parseInstallManifest } from "../../../runtime/src/fs/manifest.js";
 import { NpmRegistryClient } from "../../../runtime/src/registry/npm.js";
 import { TaskService } from "../../../runtime/src/task/service.js";
 import { FileTaskStore } from "../../../runtime/src/task/store.js";
-import { FileTrustStore, calculateTrustBinding } from "../../../runtime/src/security/trust.js";
+import { FileTrustStore } from "../../../runtime/src/security/trust.js";
 import { localStatePaths } from "../../../runtime/src/security/permissions.js";
 import { calculateConfigHash } from "../../../runtime/src/config/hash.js";
-import { sha256 } from "../../../runtime/src/fs/hash.js";
 import { FileEvidenceStore } from "../../../runtime/src/verify/evidence.js";
 import { VerificationService } from "../../../runtime/src/verify/service.js";
 import { NodeVerificationProcessRunner } from "../../../runtime/src/verify/spawn.js";
 import { runCli } from "./cli.js";
-import { loadEffectiveConfig, repositoryTrust } from "./context.js";
+import { loadEffectiveConfig, repositoryTrust, repositoryTrustBinding } from "./context.js";
 import { runHookProcess } from "./hook-process.js";
 import { selectYesNo, writeBanner } from "./ui.js";
 import { CLI_VERSION } from "./version.js";
@@ -93,18 +92,28 @@ function gitRunner(root) {
         }
     };
 }
-async function confirmInit(plan) {
+async function confirmInit(plan, trust) {
     writeBanner({
         isTTY: process.stdout.isTTY === true,
         columns: process.stdout.columns,
         write: (value) => process.stdout.write(value)
     });
-    return await confirmPlan(formatInstallPlan(plan));
+    return await confirmPlan(formatInstallPlan(plan, trust));
 }
 async function confirmPlan(text) {
     process.stdout.write(text);
     return await selectYesNo("Apply this installation plan?", { input: process.stdin, output: process.stdout }, false);
 }
+function trustStore() {
+    const state = localStatePaths(process.env.AGENT_OPS_HOME ?? homedir());
+    return new FileTrustStore(state.trustStore, state.anchorDirectory);
+}
+async function plannedTrustBinding(root, projectConfig) {
+    const config = (await loadEffectiveConfig(root, "project", projectConfig)).config;
+    return config.verification.commands.length === 0
+        ? null
+        : await repositoryTrustBinding(root, config, CLI_VERSION);
+}
 const argv = process.argv.slice(2);
 if (argv[0] === "hook") {
     process.exitCode = await runHookProcess(argv.slice(1), {
@@ -140,6 +149,7 @@ else {
                     process.stdin.isTTY === true &&
                     process.stdout.isTTY === true;
                 if (args.command === "init") {
+                    const store = trustStore();
                     return await runInitCommand({
                         args,
                         root,
@@ -150,7 +160,9 @@ else {
                         ...(args.hookTargets === undefined
                             ? {}
                             : { hookTargets: args.hookTargets }),
-                        confirm: async (plan) => await confirmInit(plan)
+                        trustStore: store,
+                        calculateTrustBinding: async (config) => await plannedTrustBinding(root, config),
+                        confirm: async (plan, trust) => await confirmInit(plan, trust)
                     });
                 }
                 if (args.command === "doctor") {
@@ -222,14 +234,18 @@ else {
                     });
                 }
                 if (args.command === "uninstall") {
+                    const store = trustStore();
                     return await runUninstallCommand({
                         args,
                         root,
                         isTTY,
-                        confirm: async (plan) => await confirmPlan(formatUninstallPlan(plan))
+                        trustStore: store,
+                        calculateTrustBinding: async () => await plannedTrustBinding(root),
+                        confirm: async (plan, trust) => await confirmPlan(formatUninstallPlan(plan, trust))
                     });
                 }
                 if (args.command === "update") {
+                    const store = trustStore();
                     return await runUpdateCommand({
                         args,
                         root,
@@ -241,7 +257,9 @@ else {
                         ...(args.hookTargets === undefined
                             ? {}
                             : { hookTargets: args.hookTargets }),
-                        confirm: async (plan) => await confirmPlan(formatUpdatePlan(plan)),
+                        trustStore: store,
+                        calculateTrustBinding: async (config) => await plannedTrustBinding(root, config),
+                        confirm: async (plan, trust) => await confirmPlan(formatUpdatePlan(plan, trust)),
                         ...(args.targetVersion === undefined
                             ? {}
                             : { targetVersion: args.targetVersion })
@@ -326,24 +344,7 @@ else {
                 }
                 if (args.command === "trust") {
                     const config = (await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project")).config;
-                    const state = localStatePaths(process.env.AGENT_OPS_HOME ?? homedir());
-                    const remote = (() => {
-                        try {
-                            return execFileSync("git", ["config", "--get", "remote.origin.url"], {
-                                cwd: root,
-                                encoding: "utf8"
-                            }).trim();
-                        }
-                        catch {
-                            return `local:${root}`;
-                        }
-                    })();
-                    const binding = await calculateTrustBinding({
-                        repositoryPath: root,
-                        remoteUrl: remote,
-                        configHash: calculateConfigHash(config),
-                        runtimeHash: sha256(CLI_VERSION)
-                    });
+                    const binding = await repositoryTrustBinding(root, config, CLI_VERSION);
                     return await runTrustCommand({
                         action: args.action,
                         yes: args.yes,
@@ -351,7 +352,7 @@ else {
                         calculateBinding: async () => binding,
                         presentBinding: async () => undefined,
                         confirmGrant: async () => await confirmPlan(JSON.stringify(binding, null, 2)),
-                        store: new FileTrustStore(state.trustStore, state.anchorDirectory)
+                        store: trustStore()
                     });
                 }
                 return errorEnvelope("CLI_COMMAND_UNAVAILABLE", `Command is not implemented yet: ${args.command}`);

package/dist/packages/cli/src/commands/init.js

@@ -4,7 +4,8 @@ import { applyInstallPlan } from "../../../../runtime/src/install/apply.js";
 import { okEnvelope } from "../output.js";
 import { formatOperationPlan } from "../plan-output.js";
 import { toPublicInstallPlan } from "../public-plan.js";
-export function formatInstallPlan(plan) {
+import { formatTrustChange, planTrustGrant } from "./trust.js";
+export function formatInstallPlan(plan, trust) {
     const hooks = plan.manifest.hooks ?? [];
     const detectedVerification = plan.detectedVerification;
     return formatOperationPlan({
@@ -13,6 +14,7 @@ export function formatInstallPlan(plan) {
             `Scope: ${plan.scope}`,
             `Harness: ${plan.harness}`,
             `Profiles: ${plan.profiles.join(", ")}`,
+            ...(trust === undefined ? [] : formatTrustChange(trust)),
             ...(hooks.length === 0
                 ? ["Hooks: none selected"]
                 : [
@@ -40,14 +42,27 @@ function appliedMessage(plan) {
         ...hooks.map((hook) => `- ${hook.harness}: ${hook.path} (${hook.events.join(", ")})`)
     ].join("\n");
 }
-function initError(code, message, plan) {
+function initError(code, message, plan, trust, applied = false) {
     return {
         code,
         status: "error",
-        data: { applied: false, plan: toPublicInstallPlan(plan), message },
+        data: { applied, plan: toPublicInstallPlan(plan, trust), message },
         errors: [{ code, message }]
     };
 }
+async function trustChange(options, plan) {
+    if (plan.scope === "user") {
+        return { action: "skipped", reason: "user-scope" };
+    }
+    if (options.calculateTrustBinding === undefined ||
+        options.trustStore === undefined) {
+        return { action: "skipped", reason: "not-configured" };
+    }
+    const binding = await options.calculateTrustBinding(plan.config);
+    return binding === null
+        ? { action: "skipped", reason: "no-verification-commands" }
+        : await planTrustGrant(binding, options.trustStore);
+}
 export async function runInitCommand(options) {
     const { args } = options;
     if (args.command !== "init" ||
@@ -75,26 +90,38 @@ export async function runInitCommand(options) {
             ? {}
             : { reviewTargets: args.reviewTargets })
     });
+    const trust = await trustChange(options, plan);
     if (args.dryRun) {
         return okEnvelope("INIT_PLAN_READY", {
             applied: false,
-            plan: toPublicInstallPlan(plan),
+            plan: toPublicInstallPlan(plan, trust),
             message: "Installation plan calculated; no files were written.",
-            text: formatInstallPlan(plan)
+            text: formatInstallPlan(plan, trust)
         });
     }
     if (!args.yes && !options.isTTY) {
-        return initError("INIT_CONFIRMATION_REQUIRED", "Non-interactive init requires --yes after all choices are explicit.", plan);
+        return initError("INIT_CONFIRMATION_REQUIRED", "Non-interactive init requires --yes after all choices are explicit.", plan, trust);
     }
     if (!args.yes &&
         options.isTTY &&
-        !(await options.confirm(plan))) {
-        return initError("INIT_CANCELLED", "Installation was cancelled; no files were written.", plan);
+        !(await options.confirm(plan, trust))) {
+        return initError("INIT_CANCELLED", "Installation was cancelled; no files were written.", plan, trust);
     }
     await applyInstallPlan(options.root, plan);
+    if (trust.action === "grant") {
+        try {
+            if (options.trustStore === undefined) {
+                throw new Error("Trust store is unavailable.");
+            }
+            await options.trustStore.grant(trust.binding);
+        }
+        catch {
+            return initError("INIT_TRUST_FAILED", "Installation was applied, but repository trust was not granted. Run `agent-ops trust grant --yes`.", plan, trust, true);
+        }
+    }
     return okEnvelope("INIT_APPLIED", {
         applied: true,
-        plan: toPublicInstallPlan(plan),
+        plan: toPublicInstallPlan(plan, trust),
         message: appliedMessage(plan)
     });
 }

package/dist/packages/cli/src/commands/review.js

@@ -1,6 +1,7 @@
 import { buildReviewPacket } from "../../../../runtime/src/review/packet.js";
 import { runIndependentReview } from "../../../../runtime/src/review/runner.js";
 import { renderReviewResult } from "../../../../runtime/src/review/render.js";
+import { saveReviewAttestation } from "../../../../runtime/src/review/attestation.js";
 import { resolveReviewRole } from "../../../../runtime/src/review/roles.js";
 import { AgentOpsError } from "../../../../runtime/src/fs/paths.js";
 import { assertSafeSupportingPaths, isReviewerPolicyPath, resolveReviewScope, reviewScopeSignature } from "../../../../runtime/src/review/scope.js";
@@ -20,6 +21,11 @@ function harness(value) {
         ? undefined
         : selected;
 }
+const GENERIC_REQUEST = "Review the current Git change surface.";
+const GENERIC_CRITERIA = [{
+        id: "change-quality",
+        description: "The change is correct, safe, backward compatible, focused, and verified in proportion to its risk; report every material defect as a finding."
+    }];
 /**
  * Criterion descriptions come from the task store, never from the id. A
  * reviewer handed `criterion: tests` cannot review anything, so a review with
@@ -42,8 +48,13 @@ async function taskContext(options) {
     try {
         record = await tasks.status(query);
     }
-    catch {
-        return undefined;
+    catch (error) {
+        if (options.taskId === undefined &&
+            error instanceof AgentOpsError &&
+            error.code === "TASK_SESSION_UNATTACHED") {
+            return undefined;
+        }
+        throw error;
     }
     const requested = options.args.criteria ?? [];
     const criteria = record.task.criteria
@@ -55,7 +66,7 @@ async function taskContext(options) {
     }));
     if (criteria.length === 0 ||
         (requested.length > 0 && criteria.length !== requested.length)) {
-        return undefined;
+        throw new AgentOpsError("REVIEW_CRITERIA_NOT_FOUND", "Every requested review criterion must exist on the selected task.");
     }
     return {
         taskId: record.task.id,
@@ -111,7 +122,7 @@ async function currentEvidence(options, context, criterionId, commandId, configH
     }
     return { current, hasReference, unreadable, stale };
 }
-async function preflightReview(options, context, scope) {
+async function preflightReview(options, context, sourceFingerprint) {
     if (options.config === undefined ||
         options.evidenceStore === undefined ||
         options.root === undefined ||
@@ -120,7 +131,6 @@ async function preflightReview(options, context, scope) {
         return { ok: false, reason: "stale-verification" };
     }
     const configHash = calculateConfigHash(options.config);
-    const sourceFingerprint = await calculateSourceFingerprint(options.root, scope, options.gitRunner);
     const commands = [];
     for (const criterion of context.criteria) {
         for (const commandId of criterion.verifierIds ?? []) {
@@ -207,6 +217,7 @@ function sourceChangedResult(result) {
         ...(result.independence === undefined
             ? {}
             : { independence: result.independence }),
+        ...(result.attempts === undefined ? {} : { attempts: result.attempts }),
         ...(result.verification === undefined
             ? {}
             : { verification: result.verification })
@@ -224,17 +235,8 @@ export async function runReviewCommand(options) {
             requirement: separator < 0 ? value : value.slice(separator + 1)
         };
     });
-    if (context === undefined) {
-        return notRunEnvelope({
-            status: "NOT_RUN",
-            reason: "no-task-context",
-            harness: target,
-            model: role?.model ?? options.model ?? "configured",
-            effort: role?.effort ?? options.effort ?? "configured",
-            prompt: ""
-        });
-    }
     let scope;
+    let sourceFingerprint;
     let verification;
     if (options.root !== undefined && options.gitRunner !== undefined) {
         try {
@@ -269,7 +271,8 @@ export async function runReviewCommand(options) {
                 scope
             });
         }
-        if (options.policyConfigHash !== undefined) {
+        sourceFingerprint = await calculateSourceFingerprint(options.root, scope, options.gitRunner);
+        if (context !== undefined && options.policyConfigHash !== undefined) {
             if (context.policyConfigHash === null) {
                 return notRunEnvelope({
                     status: "NOT_RUN", reason: "reviewer-policy-baseline-missing",
@@ -285,21 +288,25 @@ export async function runReviewCommand(options) {
                 });
             }
         }
-        const preflight = await preflightReview(options, context, scope);
-        if (!preflight.ok) {
-            return notRunEnvelope({
-                status: "NOT_RUN", reason: preflight.reason,
-                harness: target, model: role?.model ?? options.model ?? "configured",
-                effort: role?.effort ?? options.effort ?? "configured", prompt: "", scope
-            });
+        if (context !== undefined) {
+            const preflight = await preflightReview(options, context, sourceFingerprint);
+            if (!preflight.ok) {
+                return notRunEnvelope({
+                    status: "NOT_RUN", reason: preflight.reason,
+                    harness: target, model: role?.model ?? options.model ?? "configured",
+                    effort: role?.effort ?? options.effort ?? "configured", prompt: "", scope
+                });
+            }
+            verification = preflight.summary;
         }
-        verification = preflight.summary;
     }
-    const criteria = [...context.criteria];
+    const criteria = [
+        ...(context?.criteria ?? GENERIC_CRITERIA)
+    ];
     let packet;
     try {
         packet = buildReviewPacket({
-            request: context.title,
+            request: context?.title ?? GENERIC_REQUEST,
             criteria,
             artifactRefs: scope?.changedFiles ?? [],
             evidenceRequirements
@@ -371,13 +378,10 @@ export async function runReviewCommand(options) {
             const currentHash = options.currentPolicyConfigHash === undefined
                 ? options.policyConfigHash
                 : await options.currentPolicyConfigHash();
-            const postflightFingerprint = verification === undefined
-                ? undefined
-                : await calculateSourceFingerprint(options.root, postflight, options.gitRunner);
+            const postflightFingerprint = await calculateSourceFingerprint(options.root, postflight, options.gitRunner);
             if (reviewScopeSignature(scope) !== reviewScopeSignature(postflight) ||
                 (options.policyConfigHash !== undefined && currentHash !== options.policyConfigHash) ||
-                (verification !== undefined &&
-                    postflightFingerprint !== verification.sourceFingerprint)) {
+                postflightFingerprint !== sourceFingerprint) {
                 return notRunEnvelope(sourceChangedResult(result));
             }
         }
@@ -387,7 +391,8 @@ export async function runReviewCommand(options) {
     }
     // Evidence is only appended while the task is active: a completed record
     // must stay exactly as it was verified.
-    if (options.tasks !== undefined &&
+    if (context !== undefined &&
+        options.tasks !== undefined &&
         result.status === "PASS" &&
         context.active &&
         result.results !== undefined) {
@@ -396,6 +401,21 @@ export async function runReviewCommand(options) {
             item.evidence.map((reference) => `review:${result.harness}:${reference}`)
         ])));
     }
+    // The attestation is what a Stop gate reads. It is keyed by the verified
+    // source fingerprint, so it stops satisfying the gate the moment the tree
+    // changes again.
+    if (options.root !== undefined &&
+        result.status === "PASS" &&
+        sourceFingerprint !== undefined) {
+        await saveReviewAttestation(options.root, {
+            schemaVersion: 1,
+            ...(context === undefined ? {} : { taskId: context.taskId }),
+            harness: result.harness,
+            status: "PASS",
+            sourceFingerprint,
+            createdAt: new Date().toISOString()
+        });
+    }
     const message = result.status === "PASS"
         ? "Independent review passed."
         : result.status === "FAIL"

package/dist/packages/cli/src/commands/trust.js

@@ -1,4 +1,32 @@
 import { okEnvelope } from "../output.js";
+export async function planTrustGrant(binding, store) {
+    const trust = await store.status(binding);
+    return {
+        action: trust.status === "TRUSTED" ? "unchanged" : "grant",
+        binding,
+        status: trust.status
+    };
+}
+export async function planTrustRevoke(binding, store) {
+    const trust = await store.status(binding);
+    return {
+        action: trust.status === "TRUSTED" ? "revoke" : "unchanged",
+        binding,
+        status: trust.status
+    };
+}
+export function formatTrustChange(trust) {
+    if (trust.action === "skipped") {
+        return [`Trust: skipped (${trust.reason})`];
+    }
+    return [
+        `Trust: ${trust.action} (current: ${trust.status})`,
+        `  - canonical path: ${trust.binding.canonicalPath}`,
+        `  - remote identity: ${trust.binding.remoteIdentity}`,
+        `  - config hash: ${trust.binding.configHash}`,
+        `  - runtime hash: ${trust.binding.runtimeHash}`
+    ];
+}
 function trustError(code, message, binding) {
     return {
         code,

package/dist/packages/cli/src/commands/uninstall.js

@@ -2,11 +2,13 @@ import { applyUninstallPlan, createUninstallPlan } from "../../../../runtime/src
 import { okEnvelope } from "../output.js";
 import { formatOperationPlan } from "../plan-output.js";
 import { toPublicUninstallPlan } from "../public-plan.js";
-function formatUninstallPlan(plan) {
+import { formatTrustChange, planTrustRevoke } from "./trust.js";
+function formatUninstallPlan(plan, trust) {
     return formatOperationPlan({
         title: "Uninstall plan",
         metadata: [
             `Installed: ${plan.installed ? "yes" : "no"}`,
+            ...(trust === undefined ? [] : formatTrustChange(trust)),
             ...(plan.manifest === null
                 ? []
                 : [
@@ -17,14 +19,27 @@ function formatUninstallPlan(plan) {
         operations: toPublicUninstallPlan(plan).operations
     });
 }
-function uninstallError(code, message, plan) {
+function uninstallError(code, message, plan, trust, applied = false) {
     return {
         code,
         status: "error",
-        data: { applied: false, plan: toPublicUninstallPlan(plan), message },
+        data: { applied, plan: toPublicUninstallPlan(plan, trust), message },
         errors: [{ code, message }]
     };
 }
+async function trustChange(options, plan) {
+    if (plan.manifest?.scope === "user") {
+        return { action: "skipped", reason: "user-scope" };
+    }
+    if (options.calculateTrustBinding === undefined ||
+        options.trustStore === undefined) {
+        return { action: "skipped", reason: "not-configured" };
+    }
+    const binding = await options.calculateTrustBinding();
+    return binding === null
+        ? { action: "skipped", reason: "no-verification-commands" }
+        : await planTrustRevoke(binding, options.trustStore);
+}
 export async function runUninstallCommand(options) {
     const plan = await createUninstallPlan(options.root);
     if (!plan.installed) {
@@ -34,25 +49,37 @@ export async function runUninstallCommand(options) {
             message: "No managed installation exists."
         });
     }
+    const trust = await trustChange(options, plan);
     if (options.args.dryRun) {
         return okEnvelope("UNINSTALL_PLAN_READY", {
             applied: false,
-            plan: toPublicUninstallPlan(plan),
+            plan: toPublicUninstallPlan(plan, trust),
             message: "Uninstall plan calculated; no files were changed.",
-            text: formatUninstallPlan(plan)
+            text: formatUninstallPlan(plan, trust)
         });
     }
     if (!options.args.yes && !options.isTTY) {
-        return uninstallError("UNINSTALL_CONFIRMATION_REQUIRED", "Non-interactive uninstall requires --yes.", plan);
+        return uninstallError("UNINSTALL_CONFIRMATION_REQUIRED", "Non-interactive uninstall requires --yes.", plan, trust);
     }
     if (!options.args.yes &&
-        !(await options.confirm(plan))) {
-        return uninstallError("UNINSTALL_CANCELLED", "Uninstall was cancelled; no files were changed.", plan);
+        !(await options.confirm(plan, trust))) {
+        return uninstallError("UNINSTALL_CANCELLED", "Uninstall was cancelled; no files were changed.", plan, trust);
     }
     await applyUninstallPlan(options.root, plan);
+    if (trust.action === "revoke") {
+        try {
+            if (options.trustStore === undefined ||
+                !(await options.trustStore.revoke(trust.binding))) {
+                throw new Error("Trust record changed during uninstall.");
+            }
+        }
+        catch {
+            return uninstallError("UNINSTALL_TRUST_FAILED", "Uninstall was applied, but repository trust was not revoked. Run `agent-ops trust revoke`.", plan, trust, true);
+        }
+    }
     return okEnvelope("UNINSTALL_APPLIED", {
         applied: true,
-        plan: toPublicUninstallPlan(plan),
+        plan: toPublicUninstallPlan(plan, trust),
         message: "Managed installation content was removed."
     });
 }