@loopress/cli 0.12.0 → 0.14.0

package/dist/hooks/finally.js

@@ -1,12 +1,21 @@
-import * as Sentry from '@sentry/node';
-import { isTelemetryDisabled, runtimeContext } from '../lib/sentry.js';
+import { isTelemetryDisabled, resolveEnvironment, runtimeContext, SENTRY_DSN } from '../lib/sentry.js';
 // oclif has no `command_error` hook (checked @oclif/core@4.11.11's hooks.d.ts). `finally`
 // is the closest equivalent: it always runs at the end of the CLI lifecycle and carries
 // the error, if any, so it's where we report crashes before the process exits.
+//
+// @sentry/node is imported dynamically here, only when there's actually an error to report.
+// It's a heavy module (@opentelemetry deps, import-in-the-middle instrumentation), so loading
+// it eagerly on every command would tax the common case where commands succeed.
 const hook = async function (options) {
     if (!options.error || isTelemetryDisabled())
         return;
     try {
+        const Sentry = await import('@sentry/node');
+        Sentry.init({
+            dsn: SENTRY_DSN,
+            environment: resolveEnvironment(),
+            release: this.config.version,
+        });
         Sentry.captureException(options.error, {
             contexts: { runtime: runtimeContext() },
             extra: { argv: options.argv },

package/dist/hooks/init.js

@@ -1,18 +1,10 @@
-import * as Sentry from '@sentry/node';
-import { consumeErrorReportingFlag, isTelemetryDisabled, resolveEnvironment, SENTRY_DSN } from '../lib/sentry.js';
-const hook = async function (options) {
-    consumeErrorReportingFlag(options.argv);
-    if (isTelemetryDisabled())
-        return;
-    try {
-        Sentry.init({
-            dsn: SENTRY_DSN,
-            environment: resolveEnvironment(),
-            release: this.config.version,
-        });
-    }
-    catch (error) {
-        this.debug('Failed to initialize Sentry: %O', error);
-    }
+import { authManager } from '../config/auth.manager.js';
+import { configManager } from '../config/project-config.manager.js';
+// configManager/authManager start unconfigured and throw if used before a directory is set.
+// This hook runs before any command and points them at oclif's native, per-platform config/data
+// directories as soon as the real CLI Config is available.
+const hook = async function ({ config }) {
+    configManager.setConfigDir(config.configDir);
+    authManager.setDataDir(config.dataDir);
 };
 export default hook;

package/dist/lib/load-snippets.d.ts

@@ -0,0 +1,2 @@
+import { Snippet } from '../types/snippet.js';
+export declare function loadSnippets(path: string, onSkip?: (message: string) => void): Promise<Snippet[]>;

package/dist/lib/load-snippets.js

@@ -0,0 +1,84 @@
+import { readdir, readFile } from 'node:fs/promises';
+import { basename, extname, join } from 'node:path';
+import { defaultLocationForType, parseInsertMethod, parseLocation, parseType, } from '../utils/snippet-format.js';
+const TYPE_BY_EXTENSION = {
+    '.css': 'css',
+    '.html': 'html',
+    '.js': 'js',
+    '.php': 'php',
+    '.txt': 'text',
+};
+// Shared by `snippet push` (pushes to the project's own WordPress site) and `snippet publish`
+// (publishes to the Loopress api as a shared source) — both read the same local `snippets/`
+// directory the same way. `onSkip` is optional so callers that don't care about per-file
+// warnings (e.g. `snippet publish`) can ignore them; skipped files are simply left out either way.
+export async function loadSnippets(path, onSkip) {
+    const snippets = [];
+    let files;
+    try {
+        files = await readdir(path);
+    }
+    catch (error) {
+        throw new Error(`Error loading snippets: ${error.message}`);
+    }
+    for (const file of files) {
+        const ext = extname(file);
+        if (!(ext in TYPE_BY_EXTENSION))
+            continue;
+        const filePath = join(path, file);
+        const metaPath = join(path, `${basename(file, ext)}.json`);
+        // One snippet's files are read in isolation: a corrupted or hand-broken sidecar (bad JSON,
+        // unreadable file, ...) must only skip that snippet, not abort loading every other one.
+        let content;
+        try {
+            content = await readFile(filePath, 'utf8');
+        }
+        catch (error) {
+            onSkip?.(`Skipping "${filePath}": ${error.message}`);
+            continue;
+        }
+        let id;
+        let name;
+        let type;
+        let active = false;
+        let tags = [];
+        let location = null;
+        let insertMethod = null;
+        let priority = 10;
+        let shortcodeAttributes = [];
+        try {
+            const metaContent = await readFile(metaPath, 'utf8');
+            const meta = JSON.parse(metaContent);
+            id = meta.id === undefined ? undefined : Number(meta.id);
+            name = meta.name ? String(meta.name) : undefined;
+            type = parseType(meta.type) ?? undefined;
+            active = Boolean(meta.active);
+            tags = Array.isArray(meta.tags) ? meta.tags.map(String) : [];
+            location = parseLocation(meta.location);
+            insertMethod = parseInsertMethod(meta.insertMethod);
+            priority = meta.priority === undefined ? 10 : Number(meta.priority);
+            shortcodeAttributes = Array.isArray(meta.shortcodeAttributes) ? meta.shortcodeAttributes.map(String) : [];
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT') {
+                onSkip?.(`Skipping "${metaPath}": ${error.message}`);
+                continue;
+            }
+        }
+        const resolvedType = type ?? (ext in TYPE_BY_EXTENSION ? TYPE_BY_EXTENSION[ext] : 'php');
+        snippets.push({
+            active,
+            code: content,
+            id,
+            insertMethod: insertMethod ?? 'auto',
+            location: location ?? defaultLocationForType(resolvedType),
+            name: name ?? basename(file, ext),
+            path: filePath,
+            priority,
+            shortcodeAttributes,
+            tags,
+            type: resolvedType,
+        });
+    }
+    return snippets;
+}

package/dist/lib/local-callback-server.d.ts

@@ -0,0 +1,25 @@
+export type CallbackHelpers<T> = {
+    body: Record<string, string>;
+    rejectWithPage: (page: string, error: Error) => void;
+    resolveWithPage: (page: string, value: T) => void;
+    respondBadRequest: (message: string) => void;
+};
+/**
+ * Sends the user to a URL in their browser and catches the resulting redirect on a short-lived
+ * local server; this factors out the server setup, timeout, and browser-opening boilerplate.
+ */
+export declare function waitForLocalCallback<T>(options: {
+    buildUrl: (callbackBaseUrl: string) => string;
+    handleRequest: (url: URL, helpers: CallbackHelpers<T>) => void;
+    log: (message: string) => void;
+    openingMessage: string;
+    timeoutMessage: string;
+    timeoutMs?: number;
+}): Promise<T>;
+export declare function renderResultPage(options: {
+    background: string;
+    heading: string;
+    headingColor: string;
+    icon: string;
+    tabTitle: string;
+}): string;

package/dist/lib/local-callback-server.js

@@ -0,0 +1,103 @@
+import { createServer } from 'node:http';
+import { openBrowser } from './open-browser.js';
+async function readBody(req) {
+    const chunks = [];
+    for await (const chunk of req)
+        chunks.push(chunk);
+    return Buffer.concat(chunks).toString('utf8');
+}
+function parseFormData(body) {
+    return Object.fromEntries(new URLSearchParams(body));
+}
+/**
+ * Sends the user to a URL in their browser and catches the resulting redirect on a short-lived
+ * local server; this factors out the server setup, timeout, and browser-opening boilerplate.
+ */
+export function waitForLocalCallback(options) {
+    const timeoutMs = options.timeoutMs ?? 5 * 60 * 1000;
+    return new Promise((resolve, reject) => {
+        function finish(res, page, settle) {
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            res.end(page);
+            clearTimeout(timer);
+            server.close();
+            settle();
+        }
+        const server = createServer(async (req, res) => {
+            try {
+                const url = new URL(req.url ?? '/', 'http://localhost');
+                const body = req.method === 'POST' ? parseFormData(await readBody(req)) : {};
+                options.handleRequest(url, {
+                    rejectWithPage: (page, error) => finish(res, page, () => reject(error)),
+                    resolveWithPage: (page, value) => finish(res, page, () => resolve(value)),
+                    respondBadRequest(message) {
+                        res.writeHead(400, { 'Content-Type': 'text/plain' });
+                        res.end(message);
+                    },
+                    body,
+                });
+            }
+            catch (error) {
+                res.writeHead(500);
+                res.end('Internal error');
+                server.close();
+                reject(error);
+            }
+        });
+        server.on('error', (err) => {
+            clearTimeout(timer);
+            reject(err);
+        });
+        const timer = setTimeout(() => {
+            server.close();
+            reject(new Error(options.timeoutMessage));
+        }, timeoutMs);
+        server.listen(0, '127.0.0.1', () => {
+            const { port } = server.address();
+            const targetUrl = options.buildUrl(`http://localhost:${port}`);
+            options.log(options.openingMessage);
+            options.log(`\nIf it doesn't open automatically, visit:\n${targetUrl}\n`);
+            openBrowser(targetUrl);
+        });
+    });
+}
+export function renderResultPage(options) {
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Loopress: ${options.tabTitle}</title>
+  <style>
+    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+    body {
+      font-family: system-ui, -apple-system, sans-serif;
+      background: ${options.background};
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      min-height: 100dvh;
+    }
+    .card {
+      background: #fff;
+      border-radius: 16px;
+      padding: 2.5rem 3rem;
+      text-align: center;
+      box-shadow: 0 4px 32px rgba(0, 0, 0, .08);
+      max-width: 420px;
+      width: 90%;
+    }
+    .icon { font-size: 3rem; margin-bottom: 1rem; }
+    h1 { color: ${options.headingColor}; font-size: 1.5rem; margin-bottom: .5rem; }
+    p { color: #6b7280; font-size: .95rem; line-height: 1.5; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <div class="icon">${options.icon}</div>
+    <h1>${options.heading}</h1>
+    <p>You can close this tab and return to your terminal.</p>
+  </div>
+</body>
+</html>`;
+}

package/dist/lib/open-browser.d.ts

@@ -0,0 +1,2 @@
+/** Opens `url` in the user's default browser, best-effort. */
+export declare function openBrowser(url: string): void;

package/dist/lib/open-browser.js

@@ -0,0 +1,5 @@
+import open from 'open';
+/** Opens `url` in the user's default browser, best-effort. */
+export function openBrowser(url) {
+    open(url).catch(() => { });
+}

package/dist/lib/sentry.d.ts

@@ -1,5 +1,4 @@
 export declare const SENTRY_DSN = "https://a08dd56bfffc2a45d5b8f665e4cb8b7d@o4511586904309760.ingest.de.sentry.io/4511673275973712";
-export declare function consumeErrorReportingFlag(argv: string[]): void;
 export declare function isTelemetryDisabled(): boolean;
 export declare function resolveEnvironment(): string;
 export declare function runtimeContext(): {

package/dist/lib/sentry.js

@@ -1,15 +1,13 @@
 import { platform, release } from 'node:os';
+import { configManager } from '../config/project-config.manager.js';
 // DSNs are write-only and safe to embed in a distributed CLI, see https://docs.sentry.io/product/security/#can-i-make-my-sentry-dsn-private
 export const SENTRY_DSN = 'https://a08dd56bfffc2a45d5b8f665e4cb8b7d@o4511586904309760.ingest.de.sentry.io/4511673275973712';
-export function consumeErrorReportingFlag(argv) {
-    const index = argv.indexOf('--no-error-reporting');
-    if (index === -1)
-        return;
-    argv.splice(index, 1);
-    process.env.LOOPRESS_TELEMETRY_DISABLED = '1';
-}
+// The env var takes priority so CI/ephemeral environments can opt out for a single run
+// without touching the persistent preference in the global config.json.
 export function isTelemetryDisabled() {
-    return process.env.LOOPRESS_TELEMETRY_DISABLED === '1';
+    if (process.env.LOOPRESS_TELEMETRY_DISABLED === '1')
+        return true;
+    return configManager.isTelemetryDisabled();
 }
 export function resolveEnvironment() {
     if (process.env.SENTRY_ENVIRONMENT)

package/dist/lib/wp-authorize-flow.d.ts

@@ -0,0 +1,22 @@
+export type AuthorizeResult = {
+    password: string;
+    userLogin: string;
+};
+/**
+ * Relays the authorization through the Loopress API so that WordPress's
+ * `success_url` / `reject_url` can be valid HTTPS URLs.  The API receives the
+ * redirect from WordPress and forwards the credentials back to a local callback
+ * server via a form POST (keeping them out of the browser's address bar).
+ *
+ * Flow:
+ *   1. Start a local HTTP server on `127.0.0.1`.
+ *   2. Open the browser to `https://api.loopress.dev/auth/wp-authorize` with the local
+ *      callback URL and the target WordPress site as query params.
+ *   3. That page redirects the user to WordPress's authorize-application.php,
+ *      passing the API's callback endpoint as `success_url` (HTTPS).
+ *   4. After the user approves, WordPress redirects to the API callback.
+ *   5. The API callback returns an HTML page that POSTs a form with the
+ *      Application Password to the local callback server.
+ *   6. The local server extracts the credentials and resolves the promise.
+ */
+export declare function authorizeWithBrowser(siteUrl: string, log: (message: string) => void): Promise<AuthorizeResult>;

package/dist/lib/wp-authorize-flow.js

@@ -0,0 +1,60 @@
+import { renderResultPage, waitForLocalCallback } from './local-callback-server.js';
+/**
+ * Relays the authorization through the Loopress API so that WordPress's
+ * `success_url` / `reject_url` can be valid HTTPS URLs.  The API receives the
+ * redirect from WordPress and forwards the credentials back to a local callback
+ * server via a form POST (keeping them out of the browser's address bar).
+ *
+ * Flow:
+ *   1. Start a local HTTP server on `127.0.0.1`.
+ *   2. Open the browser to `https://api.loopress.dev/auth/wp-authorize` with the local
+ *      callback URL and the target WordPress site as query params.
+ *   3. That page redirects the user to WordPress's authorize-application.php,
+ *      passing the API's callback endpoint as `success_url` (HTTPS).
+ *   4. After the user approves, WordPress redirects to the API callback.
+ *   5. The API callback returns an HTML page that POSTs a form with the
+ *      Application Password to the local callback server.
+ *   6. The local server extracts the credentials and resolves the promise.
+ */
+export function authorizeWithBrowser(siteUrl, log) {
+    return waitForLocalCallback({
+        buildUrl(callbackBaseUrl) {
+            const relayUrl = 'https://api.loopress.dev/auth/wp-authorize';
+            const params = new URLSearchParams({
+                callbackUrl: callbackBaseUrl,
+                wpUrl: siteUrl,
+            });
+            return `${relayUrl}?${params}`;
+        },
+        handleRequest(url, { resolveWithPage, rejectWithPage, respondBadRequest, body }) {
+            if (url.searchParams.has('cancelled') || body.cancelled) {
+                rejectWithPage(REJECTED_PAGE, new Error('Authorization rejected in WordPress.'));
+                return;
+            }
+            const password = body.password || url.searchParams.get('password') || '';
+            const userLogin = body.user_login || url.searchParams.get('user_login') || '';
+            if (!password || !userLogin) {
+                respondBadRequest('Missing password or user_login');
+                return;
+            }
+            resolveWithPage(SUCCESS_PAGE, { password, userLogin });
+        },
+        log,
+        openingMessage: 'Opening WordPress in your browser to authorize Loopress...',
+        timeoutMessage: 'Authorization timed out after 5 minutes.',
+    });
+}
+const SUCCESS_PAGE = renderResultPage({
+    background: '#f0fdf4',
+    heading: 'Authorization successful!',
+    headingColor: '#15803d',
+    icon: '✓',
+    tabTitle: 'Authorized',
+});
+const REJECTED_PAGE = renderResultPage({
+    background: '#fef2f2',
+    heading: 'Authorization rejected',
+    headingColor: '#b91c1c',
+    icon: '✗',
+    tabTitle: 'Authorization rejected',
+});

package/dist/lib/wp-client.d.ts

@@ -1,7 +1,7 @@
 export declare const REQUEST_TIMEOUT_MS = 30000;
 /**
  * HTTP client for a WordPress site's REST API.
- * Paths are relative to `<site>/wp-json/`, e.g. `loopress/v1/plugins`.
+ * Paths are relative to `<site>/wp-json/`, e.g. `loopress/v1/snippets` or `wp/v2/plugins`.
  */
 export declare class WpClient {
     private readonly siteUrl;

package/dist/lib/wp-client.js

@@ -2,7 +2,7 @@ import got from 'got';
 export const REQUEST_TIMEOUT_MS = 30_000;
 /**
  * HTTP client for a WordPress site's REST API.
- * Paths are relative to `<site>/wp-json/`, e.g. `loopress/v1/plugins`.
+ * Paths are relative to `<site>/wp-json/`, e.g. `loopress/v1/snippets` or `wp/v2/plugins`.
  */
 export class WpClient {
     siteUrl;

package/dist/lib/wp-site-diagnostic.d.ts

@@ -0,0 +1,13 @@
+export declare const REQUEST_TIMEOUT_MS = 10000;
+export type DiagnosticResult = {
+    ok: false;
+    reason: string;
+} | {
+    ok: true;
+};
+/**
+ * Pre-flight checks run before starting the browser authorization flow, so failures
+ * (unreachable site, blocked REST API, WordPress too old) surface as an actionable
+ * message instead of a confusing timeout once the browser is already open.
+ */
+export declare function diagnoseWpSite(siteUrl: string): Promise<DiagnosticResult>;

package/dist/lib/wp-site-diagnostic.js

@@ -0,0 +1,46 @@
+import got from 'got';
+export const REQUEST_TIMEOUT_MS = 10_000;
+/**
+ * Pre-flight checks run before starting the browser authorization flow, so failures
+ * (unreachable site, blocked REST API, WordPress too old) surface as an actionable
+ * message instead of a confusing timeout once the browser is already open.
+ */
+export async function diagnoseWpSite(siteUrl) {
+    try {
+        await got.get(`${siteUrl}/wp-json/`, { timeout: { request: REQUEST_TIMEOUT_MS } });
+    }
+    catch (error) {
+        return {
+            ok: false,
+            reason: `Could not reach the WordPress REST API at ${siteUrl}/wp-json/. The site may be unreachable, or a security plugin may be blocking it. (${describe(error)})`,
+        };
+    }
+    try {
+        const response = await got.head(`${siteUrl}/wp-admin/authorize-application.php`, {
+            throwHttpErrors: false,
+            timeout: { request: REQUEST_TIMEOUT_MS },
+        });
+        if (response.statusCode === 404) {
+            return {
+                ok: false,
+                reason: `The application authorization page was not found on ${siteUrl}. This WordPress site may be older than 5.6, or the feature may be disabled by a plugin.`,
+            };
+        }
+        if (response.statusCode >= 400) {
+            return {
+                ok: false,
+                reason: `The application authorization page at ${siteUrl}/wp-admin/authorize-application.php returned an error (HTTP ${response.statusCode}).`,
+            };
+        }
+    }
+    catch (error) {
+        return {
+            ok: false,
+            reason: `Could not reach ${siteUrl}/wp-admin/authorize-application.php. (${describe(error)})`,
+        };
+    }
+    return { ok: true };
+}
+function describe(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/types/config.d.ts

@@ -1 +1 @@
-export type { CurrentProjectPointer, EnvironmentConfig, LoopressGlobalConfiguration as LoopressConfig, ProjectConfig, } from './global-config.generated.js';
+export type { CurrentProjectPointer, EnvironmentConfig, LoopressGlobalConfiguration as LoopressConfig, ProjectConfig, TelemetryConfig, } from './global-config.generated.js';

package/dist/types/global-config.generated.d.ts

@@ -1,5 +1,5 @@
 /**
- * Global CLI state stored at ~/.loopress/config.json: known projects, their environments, and which one is currently active.
+ * Global CLI state stored at $XDG_CONFIG_HOME/loopress/config.json (or ~/.config/loopress/config.json): known projects, their environments, and which one is currently active.
  */
 export interface LoopressGlobalConfiguration {
     /**
@@ -12,6 +12,7 @@ export interface LoopressGlobalConfiguration {
     projects: {
         [k: string]: ProjectConfig;
     };
+    telemetry?: TelemetryConfig;
 }
 export interface CurrentProjectPointer {
     /**
@@ -65,3 +66,12 @@ export interface EnvironmentConfig {
      */
     url: string;
 }
+/**
+ * User preferences for error reporting, set via `lps telemetry disable`/`lps telemetry enable`.
+ */
+export interface TelemetryConfig {
+    /**
+     * Whether error reporting to Sentry is disabled.
+     */
+    disabled: boolean;
+}

package/dist/types/plugin.d.ts

@@ -5,11 +5,10 @@ export interface InstalledPlugin {
     slug: string;
     version: string;
 }
-export interface InstallResult {
-    message: string;
+export interface WpNativePlugin {
+    name: string;
+    plugin: string;
+    status: 'active' | 'inactive' | 'network-active';
     version: string;
 }
-export interface ActivateResult {
-    message: string;
-}
 export type PluginManifest = Record<string, string>;

package/dist/types/project-config.generated.d.ts

@@ -16,12 +16,9 @@ export interface LoopressProjectConfiguration {
      */
     projectId?: string;
     /**
-     * Pinned plugin versions. Keys are WordPress.org plugin slugs, values are version constraints.
+     * WordPress.org plugins managed by Loopress. Keys are plugin slugs; values are written as "latest" since installs go through WordPress's native plugin API, which only installs the current version. Older files may still have a pinned version string here from before this was the case; it is read but no longer acted on.
      */
     plugins?: {
-        /**
-         * Version to pin. Use an exact version (e.g. "8.9.1") or "latest".
-         */
         [k: string]: string;
     };
 }

package/dist/utils/plugins.d.ts

@@ -1,16 +1,11 @@
-import { InstalledPlugin, PluginManifest } from '../types/plugin.js';
+import { InstalledPlugin, PluginManifest, WpNativePlugin } from '../types/plugin.js';
 export interface PluginDiff {
-    drifted: Array<{
-        currentVersion: string;
-        slug: string;
-        targetVersion: string;
-    }>;
     toActivate: Array<{
+        file: string;
         slug: string;
     }>;
     toInstall: Array<{
         slug: string;
-        targetVersion: string;
     }>;
     upToDate: string[];
 }
@@ -24,4 +19,5 @@ export interface MergeResult {
     }>;
 }
 export declare function mergePluginManifest(existing: PluginManifest, incoming: PluginManifest): MergeResult;
+export declare function parseInstalledPlugins(raw: WpNativePlugin[]): InstalledPlugin[];
 export declare function diffPlugins(manifest: PluginManifest, installed: InstalledPlugin[]): PluginDiff;

package/dist/utils/plugins.js

@@ -1,3 +1,7 @@
+// Loopress must never manage itself: pulling it into loopress.json would make a later
+// `plugin push` try to reinstall it from WordPress.org, where it doesn't exist, potentially
+// clobbering the plugin's own directory in the process.
+const LOOPRESS_PLUGIN_SLUG = 'loopress';
 export function mergePluginManifest(existing, incoming) {
     const merged = { ...existing, ...incoming };
     const added = Object.keys(incoming).filter((s) => !(s in existing));
@@ -6,29 +10,39 @@ export function mergePluginManifest(existing, incoming) {
         .map((s) => ({ from: existing[s], slug: s, to: incoming[s] }));
     return { added, merged, updated };
 }
+// WordPress core identifies each plugin by a `<folder>/<file>` id (or a bare `<file>` for a
+// single-file plugin) with the `.php` extension stripped; the WordPress.org slug is just the
+// folder name (or the bare id itself for a single-file plugin).
+function slugFromPluginFile(file) {
+    return file.split('/')[0];
+}
+export function parseInstalledPlugins(raw) {
+    return raw
+        .map((item) => ({
+        active: item.status !== 'inactive',
+        file: item.plugin,
+        name: item.name,
+        slug: slugFromPluginFile(item.plugin),
+        version: item.version,
+    }))
+        .filter((plugin) => plugin.slug !== LOOPRESS_PLUGIN_SLUG);
+}
 export function diffPlugins(manifest, installed) {
     const installedMap = new Map(installed.map((p) => [p.slug, p]));
     const toInstall = [];
     const toActivate = [];
-    const drifted = [];
     const upToDate = [];
-    for (const [slug, targetVersion] of Object.entries(manifest)) {
+    for (const slug of Object.keys(manifest)) {
         const live = installedMap.get(slug);
         if (!live) {
-            toInstall.push({ slug, targetVersion });
-            continue;
+            toInstall.push({ slug });
         }
-        if (live.version === targetVersion) {
-            if (live.active) {
-                upToDate.push(slug);
-            }
-            else {
-                toActivate.push({ slug });
-            }
+        else if (live.active) {
+            upToDate.push(slug);
         }
         else {
-            drifted.push({ currentVersion: live.version, slug, targetVersion });
+            toActivate.push({ file: live.file, slug });
         }
     }
-    return { drifted, toActivate, toInstall, upToDate };
+    return { toActivate, toInstall, upToDate };
 }