@loopress/cli 0.13.0 → 0.14.0

package/dist/config/project-config.manager.d.ts

@@ -1,7 +1,7 @@
 import { EnvironmentConfig, LoopressConfig, ProjectConfig } from '../types/config.js';
 export declare class ProjectConfigManager {
-    private readonly homeDir;
-    constructor(homeDir?: string);
+    private configDir?;
+    constructor(configDir?: string | undefined);
     createProjectId(name: string): string;
     ensureConfigDir(): void;
     findProjectByApiId(apiProjectId: string): null | (ProjectConfig & {
@@ -14,6 +14,7 @@ export declare class ProjectConfigManager {
     });
     getEnvironment(projectId: string, envName: string): EnvironmentConfig | null;
     getProject(id: string): null | ProjectConfig;
+    isTelemetryDisabled(): boolean;
     listEnvironments(projectId: string): Array<EnvironmentConfig & {
         isCurrent: boolean;
     }>;
@@ -24,15 +25,19 @@ export declare class ProjectConfigManager {
     readConfig(): LoopressConfig;
     removeEnvironment(projectId: string, envName: string): void;
     removeProject(id: string): void;
+    setConfigDir(configDir: string): void;
     setCurrent(projectId: string, envName: string): void;
     setEnvironment(projectId: string, envName: string, env: EnvironmentConfig): void;
     setEnvironmentApiId(projectId: string, envName: string, apiEnvironmentId: string): void;
     setProject(id: string, project: ProjectConfig): void;
     setProjectApiId(id: string, apiProjectId: string): void;
+    setTelemetryDisabled(disabled: boolean): void;
     writeConfig(config: LoopressConfig): void;
     private isProjectConfig;
+    private requireConfigDir;
     private sanitizeConfig;
     private sanitizeCurrentProject;
     private sanitizeProjects;
+    private sanitizeTelemetry;
 }
 export declare const configManager: ProjectConfigManager;

package/dist/config/project-config.manager.js

@@ -1,12 +1,11 @@
 import { existsSync, mkdirSync } from 'node:fs';
-import { homedir } from 'node:os';
 import { join } from 'node:path';
 import slugify from 'slugify';
 import { readJsonFile, writeJsonFileAtomic } from './json-file.js';
 export class ProjectConfigManager {
-    homeDir;
-    constructor(homeDir = homedir()) {
-        this.homeDir = homeDir;
+    configDir;
+    constructor(configDir) {
+        this.configDir = configDir;
     }
     createProjectId(name) {
         const config = this.readConfig();
@@ -20,7 +19,7 @@ export class ProjectConfigManager {
         return id;
     }
     ensureConfigDir() {
-        const dir = join(this.homeDir, '.loopress');
+        const dir = this.requireConfigDir();
         if (!existsSync(dir)) {
             mkdirSync(dir, { recursive: true });
         }
@@ -38,7 +37,7 @@ export class ProjectConfigManager {
         return null;
     }
     getConfigFilePath() {
-        return join(this.homeDir, '.loopress', 'config.json');
+        return join(this.requireConfigDir(), 'config.json');
     }
     getCurrentEnv() {
         const config = this.readConfig();
@@ -68,6 +67,9 @@ export class ProjectConfigManager {
         const config = this.readConfig();
         return config.projects[id] ?? null;
     }
+    isTelemetryDisabled() {
+        return this.readConfig().telemetry?.disabled ?? false;
+    }
     listEnvironments(projectId) {
         const config = this.readConfig();
         const project = config.projects[projectId];
@@ -116,6 +118,12 @@ export class ProjectConfigManager {
         }
         this.writeConfig(config);
     }
+    // Repointed by the `init` hook to oclif's native configDir once the real CLI Config is
+    // available. The constructor default only serves contexts that bypass the oclif lifecycle
+    // (e.g. commands instantiated directly in unit tests).
+    setConfigDir(configDir) {
+        this.configDir = configDir;
+    }
     setCurrent(projectId, envName) {
         const config = this.readConfig();
         if (!config.projects[projectId])
@@ -159,6 +167,11 @@ export class ProjectConfigManager {
         project.apiProjectId = apiProjectId;
         this.writeConfig(config);
     }
+    setTelemetryDisabled(disabled) {
+        const config = this.readConfig();
+        config.telemetry = { disabled };
+        this.writeConfig(config);
+    }
     writeConfig(config) {
         writeJsonFileAtomic(this.getConfigFilePath(), config);
     }
@@ -168,13 +181,23 @@ export class ProjectConfigManager {
         const candidate = value;
         return typeof candidate.name === 'string' && typeof candidate.environments === 'object' && candidate.environments !== null;
     }
+    // Real CLI runs get this from the `init` hook (src/hooks/init.ts) before any command runs.
+    // Throwing when it's unset (rather than falling back to a hardcoded path) surfaces tests that
+    // forgot to configure the manager instead of silently touching some default location.
+    requireConfigDir() {
+        if (!this.configDir)
+            throw new Error('ProjectConfigManager used before setConfigDir() was called');
+        return this.configDir;
+    }
     sanitizeConfig(value) {
         if (typeof value !== 'object' || value === null)
             return { currentProject: null, projects: {} };
         const candidate = value;
+        const telemetry = this.sanitizeTelemetry(candidate.telemetry);
         return {
             currentProject: this.sanitizeCurrentProject(candidate.currentProject),
             projects: this.sanitizeProjects(candidate.projects),
+            ...(telemetry && { telemetry }),
         };
     }
     sanitizeCurrentProject(value) {
@@ -193,5 +216,11 @@ export class ProjectConfigManager {
         }
         return projects;
     }
+    sanitizeTelemetry(value) {
+        if (typeof value !== 'object' || value === null)
+            return undefined;
+        const candidate = value;
+        return typeof candidate.disabled === 'boolean' ? { disabled: candidate.disabled } : undefined;
+    }
 }
 export const configManager = new ProjectConfigManager();

package/dist/hooks/finally.js

@@ -1,12 +1,21 @@
-import * as Sentry from '@sentry/node';
-import { isTelemetryDisabled, runtimeContext } from '../lib/sentry.js';
+import { isTelemetryDisabled, resolveEnvironment, runtimeContext, SENTRY_DSN } from '../lib/sentry.js';
 // oclif has no `command_error` hook (checked @oclif/core@4.11.11's hooks.d.ts). `finally`
 // is the closest equivalent: it always runs at the end of the CLI lifecycle and carries
 // the error, if any, so it's where we report crashes before the process exits.
+//
+// @sentry/node is imported dynamically here, only when there's actually an error to report.
+// It's a heavy module (@opentelemetry deps, import-in-the-middle instrumentation), so loading
+// it eagerly on every command would tax the common case where commands succeed.
 const hook = async function (options) {
     if (!options.error || isTelemetryDisabled())
         return;
     try {
+        const Sentry = await import('@sentry/node');
+        Sentry.init({
+            dsn: SENTRY_DSN,
+            environment: resolveEnvironment(),
+            release: this.config.version,
+        });
         Sentry.captureException(options.error, {
             contexts: { runtime: runtimeContext() },
             extra: { argv: options.argv },

package/dist/hooks/init.js

@@ -1,18 +1,10 @@
-import * as Sentry from '@sentry/node';
-import { consumeErrorReportingFlag, isTelemetryDisabled, resolveEnvironment, SENTRY_DSN } from '../lib/sentry.js';
-const hook = async function (options) {
-    consumeErrorReportingFlag(options.argv);
-    if (isTelemetryDisabled())
-        return;
-    try {
-        Sentry.init({
-            dsn: SENTRY_DSN,
-            environment: resolveEnvironment(),
-            release: this.config.version,
-        });
-    }
-    catch (error) {
-        this.debug('Failed to initialize Sentry: %O', error);
-    }
+import { authManager } from '../config/auth.manager.js';
+import { configManager } from '../config/project-config.manager.js';
+// configManager/authManager start unconfigured and throw if used before a directory is set.
+// This hook runs before any command and points them at oclif's native, per-platform config/data
+// directories as soon as the real CLI Config is available.
+const hook = async function ({ config }) {
+    configManager.setConfigDir(config.configDir);
+    authManager.setDataDir(config.dataDir);
 };
 export default hook;

package/dist/lib/local-callback-server.d.ts

@@ -1,12 +1,12 @@
 export type CallbackHelpers<T> = {
+    body: Record<string, string>;
     rejectWithPage: (page: string, error: Error) => void;
     resolveWithPage: (page: string, value: T) => void;
     respondBadRequest: (message: string) => void;
 };
 /**
- * Both `login` and `authorizeWithBrowser` send the user to a URL in their browser and need to
- * catch the resulting redirect on a short-lived local server; this factors out the server setup,
- * timeout, and browser-opening boilerplate they'd otherwise duplicate.
+ * Sends the user to a URL in their browser and catches the resulting redirect on a short-lived
+ * local server; this factors out the server setup, timeout, and browser-opening boilerplate.
  */
 export declare function waitForLocalCallback<T>(options: {
     buildUrl: (callbackBaseUrl: string) => string;

package/dist/lib/local-callback-server.js

@@ -1,9 +1,17 @@
 import { createServer } from 'node:http';
 import { openBrowser } from './open-browser.js';
+async function readBody(req) {
+    const chunks = [];
+    for await (const chunk of req)
+        chunks.push(chunk);
+    return Buffer.concat(chunks).toString('utf8');
+}
+function parseFormData(body) {
+    return Object.fromEntries(new URLSearchParams(body));
+}
 /**
- * Both `login` and `authorizeWithBrowser` send the user to a URL in their browser and need to
- * catch the resulting redirect on a short-lived local server; this factors out the server setup,
- * timeout, and browser-opening boilerplate they'd otherwise duplicate.
+ * Sends the user to a URL in their browser and catches the resulting redirect on a short-lived
+ * local server; this factors out the server setup, timeout, and browser-opening boilerplate.
  */
 export function waitForLocalCallback(options) {
     const timeoutMs = options.timeoutMs ?? 5 * 60 * 1000;
@@ -15,9 +23,10 @@ export function waitForLocalCallback(options) {
             server.close();
             settle();
         }
-        const server = createServer((req, res) => {
+        const server = createServer(async (req, res) => {
             try {
                 const url = new URL(req.url ?? '/', 'http://localhost');
+                const body = req.method === 'POST' ? parseFormData(await readBody(req)) : {};
                 options.handleRequest(url, {
                     rejectWithPage: (page, error) => finish(res, page, () => reject(error)),
                     resolveWithPage: (page, value) => finish(res, page, () => resolve(value)),
@@ -25,6 +34,7 @@ export function waitForLocalCallback(options) {
                         res.writeHead(400, { 'Content-Type': 'text/plain' });
                         res.end(message);
                     },
+                    body,
                 });
             }
             catch (error) {

package/dist/lib/open-browser.d.ts

@@ -1,2 +1,2 @@
-/** Opens `url` in the user's default browser, best-effort (no-op on unknown platforms). */
+/** Opens `url` in the user's default browser, best-effort. */
 export declare function openBrowser(url: string): void;

package/dist/lib/open-browser.js

@@ -1,12 +1,5 @@
-import { execFile } from 'node:child_process';
-/** Opens `url` in the user's default browser, best-effort (no-op on unknown platforms). */
+import open from 'open';
+/** Opens `url` in the user's default browser, best-effort. */
 export function openBrowser(url) {
-    const commands = {
-        darwin: ['open', [url]],
-        linux: ['xdg-open', [url]],
-        win32: ['cmd', ['/c', 'start', '', url]],
-    };
-    const command = commands[process.platform];
-    if (command)
-        execFile(...command);
+    open(url).catch(() => { });
 }

package/dist/lib/sentry.d.ts

@@ -1,5 +1,4 @@
 export declare const SENTRY_DSN = "https://a08dd56bfffc2a45d5b8f665e4cb8b7d@o4511586904309760.ingest.de.sentry.io/4511673275973712";
-export declare function consumeErrorReportingFlag(argv: string[]): void;
 export declare function isTelemetryDisabled(): boolean;
 export declare function resolveEnvironment(): string;
 export declare function runtimeContext(): {

package/dist/lib/sentry.js

@@ -1,15 +1,13 @@
 import { platform, release } from 'node:os';
+import { configManager } from '../config/project-config.manager.js';
 // DSNs are write-only and safe to embed in a distributed CLI, see https://docs.sentry.io/product/security/#can-i-make-my-sentry-dsn-private
 export const SENTRY_DSN = 'https://a08dd56bfffc2a45d5b8f665e4cb8b7d@o4511586904309760.ingest.de.sentry.io/4511673275973712';
-export function consumeErrorReportingFlag(argv) {
-    const index = argv.indexOf('--no-error-reporting');
-    if (index === -1)
-        return;
-    argv.splice(index, 1);
-    process.env.LOOPRESS_TELEMETRY_DISABLED = '1';
-}
+// The env var takes priority so CI/ephemeral environments can opt out for a single run
+// without touching the persistent preference in the global config.json.
 export function isTelemetryDisabled() {
-    return process.env.LOOPRESS_TELEMETRY_DISABLED === '1';
+    if (process.env.LOOPRESS_TELEMETRY_DISABLED === '1')
+        return true;
+    return configManager.isTelemetryDisabled();
 }
 export function resolveEnvironment() {
     if (process.env.SENTRY_ENVIRONMENT)

package/dist/lib/wp-authorize-flow.d.ts

@@ -3,8 +3,20 @@ export type AuthorizeResult = {
     userLogin: string;
 };
 /**
- * Runs WordPress's native "authorize application" flow: opens a local callback server,
- * sends the user to `<siteUrl>/wp-admin/authorize-application.php`, and resolves with the
- * generated Application Password once WordPress redirects back.
+ * Relays the authorization through the Loopress API so that WordPress's
+ * `success_url` / `reject_url` can be valid HTTPS URLs.  The API receives the
+ * redirect from WordPress and forwards the credentials back to a local callback
+ * server via a form POST (keeping them out of the browser's address bar).
+ *
+ * Flow:
+ *   1. Start a local HTTP server on `127.0.0.1`.
+ *   2. Open the browser to `https://api.loopress.dev/auth/wp-authorize` with the local
+ *      callback URL and the target WordPress site as query params.
+ *   3. That page redirects the user to WordPress's authorize-application.php,
+ *      passing the API's callback endpoint as `success_url` (HTTPS).
+ *   4. After the user approves, WordPress redirects to the API callback.
+ *   5. The API callback returns an HTML page that POSTs a form with the
+ *      Application Password to the local callback server.
+ *   6. The local server extracts the credentials and resolves the promise.
  */
 export declare function authorizeWithBrowser(siteUrl: string, log: (message: string) => void): Promise<AuthorizeResult>;

package/dist/lib/wp-authorize-flow.js

@@ -1,53 +1,60 @@
-import { randomBytes } from 'node:crypto';
 import { renderResultPage, waitForLocalCallback } from './local-callback-server.js';
-const APP_NAME = 'Loopress';
 /**
- * Runs WordPress's native "authorize application" flow: opens a local callback server,
- * sends the user to `<siteUrl>/wp-admin/authorize-application.php`, and resolves with the
- * generated Application Password once WordPress redirects back.
+ * Relays the authorization through the Loopress API so that WordPress's
+ * `success_url` / `reject_url` can be valid HTTPS URLs.  The API receives the
+ * redirect from WordPress and forwards the credentials back to a local callback
+ * server via a form POST (keeping them out of the browser's address bar).
+ *
+ * Flow:
+ *   1. Start a local HTTP server on `127.0.0.1`.
+ *   2. Open the browser to `https://api.loopress.dev/auth/wp-authorize` with the local
+ *      callback URL and the target WordPress site as query params.
+ *   3. That page redirects the user to WordPress's authorize-application.php,
+ *      passing the API's callback endpoint as `success_url` (HTTPS).
+ *   4. After the user approves, WordPress redirects to the API callback.
+ *   5. The API callback returns an HTML page that POSTs a form with the
+ *      Application Password to the local callback server.
+ *   6. The local server extracts the credentials and resolves the promise.
  */
 export function authorizeWithBrowser(siteUrl, log) {
-    const state = randomBytes(32).toString('hex');
     return waitForLocalCallback({
         buildUrl(callbackBaseUrl) {
-            const successUrl = `${callbackBaseUrl}/callback?state=${state}`;
-            const rejectUrl = `${callbackBaseUrl}/reject?state=${state}`;
-            return (`${siteUrl}/wp-admin/authorize-application.php?app_name=${encodeURIComponent(APP_NAME)}` +
-                `&success_url=${encodeURIComponent(successUrl)}&reject_url=${encodeURIComponent(rejectUrl)}`);
+            const relayUrl = 'https://api.loopress.dev/auth/wp-authorize';
+            const params = new URLSearchParams({
+                callbackUrl: callbackBaseUrl,
+                wpUrl: siteUrl,
+            });
+            return `${relayUrl}?${params}`;
         },
-        handleRequest(url, { rejectWithPage, resolveWithPage, respondBadRequest }) {
-            if (url.searchParams.get('state') !== state) {
-                respondBadRequest('Invalid or missing state');
+        handleRequest(url, { resolveWithPage, rejectWithPage, respondBadRequest, body }) {
+            if (url.searchParams.has('cancelled') || body.cancelled) {
+                rejectWithPage(REJECTED_PAGE, new Error('Authorization rejected in WordPress.'));
                 return;
             }
-            if (url.pathname === '/reject') {
-                rejectWithPage(REJECTED_PAGE, new Error('Authorization rejected in WordPress. You can enter credentials manually instead.'));
-                return;
-            }
-            const userLogin = url.searchParams.get('user_login');
-            const password = url.searchParams.get('password');
-            if (!userLogin || !password) {
-                respondBadRequest('Missing user_login or password');
+            const password = body.password || url.searchParams.get('password') || '';
+            const userLogin = body.user_login || url.searchParams.get('user_login') || '';
+            if (!password || !userLogin) {
+                respondBadRequest('Missing password or user_login');
                 return;
             }
             resolveWithPage(SUCCESS_PAGE, { password, userLogin });
         },
         log,
         openingMessage: 'Opening WordPress in your browser to authorize Loopress...',
-        timeoutMessage: 'Authorization timed out after 5 minutes. You can enter credentials manually instead.',
+        timeoutMessage: 'Authorization timed out after 5 minutes.',
     });
 }
 const SUCCESS_PAGE = renderResultPage({
     background: '#f0fdf4',
     heading: 'Authorization successful!',
     headingColor: '#15803d',
-    icon: '✅',
+    icon: '&#10003;',
     tabTitle: 'Authorized',
 });
 const REJECTED_PAGE = renderResultPage({
     background: '#fef2f2',
     heading: 'Authorization rejected',
     headingColor: '#b91c1c',
-    icon: '✕',
+    icon: '&#10007;',
     tabTitle: 'Authorization rejected',
 });

package/dist/lib/wp-client.d.ts

@@ -1,7 +1,7 @@
 export declare const REQUEST_TIMEOUT_MS = 30000;
 /**
  * HTTP client for a WordPress site's REST API.
- * Paths are relative to `<site>/wp-json/`, e.g. `loopress/v1/plugins`.
+ * Paths are relative to `<site>/wp-json/`, e.g. `loopress/v1/snippets` or `wp/v2/plugins`.
  */
 export declare class WpClient {
     private readonly siteUrl;

package/dist/lib/wp-client.js

@@ -2,7 +2,7 @@ import got from 'got';
 export const REQUEST_TIMEOUT_MS = 30_000;
 /**
  * HTTP client for a WordPress site's REST API.
- * Paths are relative to `<site>/wp-json/`, e.g. `loopress/v1/plugins`.
+ * Paths are relative to `<site>/wp-json/`, e.g. `loopress/v1/snippets` or `wp/v2/plugins`.
  */
 export class WpClient {
     siteUrl;

package/dist/types/config.d.ts

@@ -1 +1 @@
-export type { CurrentProjectPointer, EnvironmentConfig, LoopressGlobalConfiguration as LoopressConfig, ProjectConfig, } from './global-config.generated.js';
+export type { CurrentProjectPointer, EnvironmentConfig, LoopressGlobalConfiguration as LoopressConfig, ProjectConfig, TelemetryConfig, } from './global-config.generated.js';

package/dist/types/global-config.generated.d.ts

@@ -1,5 +1,5 @@
 /**
- * Global CLI state stored at ~/.loopress/config.json: known projects, their environments, and which one is currently active.
+ * Global CLI state stored at $XDG_CONFIG_HOME/loopress/config.json (or ~/.config/loopress/config.json): known projects, their environments, and which one is currently active.
  */
 export interface LoopressGlobalConfiguration {
     /**
@@ -12,6 +12,7 @@ export interface LoopressGlobalConfiguration {
     projects: {
         [k: string]: ProjectConfig;
     };
+    telemetry?: TelemetryConfig;
 }
 export interface CurrentProjectPointer {
     /**
@@ -65,3 +66,12 @@ export interface EnvironmentConfig {
      */
     url: string;
 }
+/**
+ * User preferences for error reporting, set via `lps telemetry disable`/`lps telemetry enable`.
+ */
+export interface TelemetryConfig {
+    /**
+     * Whether error reporting to Sentry is disabled.
+     */
+    disabled: boolean;
+}

package/dist/types/plugin.d.ts

@@ -5,11 +5,10 @@ export interface InstalledPlugin {
     slug: string;
     version: string;
 }
-export interface InstallResult {
-    message: string;
+export interface WpNativePlugin {
+    name: string;
+    plugin: string;
+    status: 'active' | 'inactive' | 'network-active';
     version: string;
 }
-export interface ActivateResult {
-    message: string;
-}
 export type PluginManifest = Record<string, string>;

package/dist/types/project-config.generated.d.ts

@@ -16,12 +16,9 @@ export interface LoopressProjectConfiguration {
      */
     projectId?: string;
     /**
-     * Pinned plugin versions. Keys are WordPress.org plugin slugs, values are version constraints.
+     * WordPress.org plugins managed by Loopress. Keys are plugin slugs; values are written as "latest" since installs go through WordPress's native plugin API, which only installs the current version. Older files may still have a pinned version string here from before this was the case; it is read but no longer acted on.
      */
     plugins?: {
-        /**
-         * Version to pin. Use an exact version (e.g. "8.9.1") or "latest".
-         */
         [k: string]: string;
     };
 }

package/dist/utils/plugins.d.ts

@@ -1,16 +1,11 @@
-import { InstalledPlugin, PluginManifest } from '../types/plugin.js';
+import { InstalledPlugin, PluginManifest, WpNativePlugin } from '../types/plugin.js';
 export interface PluginDiff {
-    drifted: Array<{
-        currentVersion: string;
-        slug: string;
-        targetVersion: string;
-    }>;
     toActivate: Array<{
+        file: string;
         slug: string;
     }>;
     toInstall: Array<{
         slug: string;
-        targetVersion: string;
     }>;
     upToDate: string[];
 }
@@ -24,4 +19,5 @@ export interface MergeResult {
     }>;
 }
 export declare function mergePluginManifest(existing: PluginManifest, incoming: PluginManifest): MergeResult;
+export declare function parseInstalledPlugins(raw: WpNativePlugin[]): InstalledPlugin[];
 export declare function diffPlugins(manifest: PluginManifest, installed: InstalledPlugin[]): PluginDiff;

package/dist/utils/plugins.js

@@ -1,3 +1,7 @@
+// Loopress must never manage itself: pulling it into loopress.json would make a later
+// `plugin push` try to reinstall it from WordPress.org, where it doesn't exist, potentially
+// clobbering the plugin's own directory in the process.
+const LOOPRESS_PLUGIN_SLUG = 'loopress';
 export function mergePluginManifest(existing, incoming) {
     const merged = { ...existing, ...incoming };
     const added = Object.keys(incoming).filter((s) => !(s in existing));
@@ -6,29 +10,39 @@ export function mergePluginManifest(existing, incoming) {
         .map((s) => ({ from: existing[s], slug: s, to: incoming[s] }));
     return { added, merged, updated };
 }
+// WordPress core identifies each plugin by a `<folder>/<file>` id (or a bare `<file>` for a
+// single-file plugin) with the `.php` extension stripped; the WordPress.org slug is just the
+// folder name (or the bare id itself for a single-file plugin).
+function slugFromPluginFile(file) {
+    return file.split('/')[0];
+}
+export function parseInstalledPlugins(raw) {
+    return raw
+        .map((item) => ({
+        active: item.status !== 'inactive',
+        file: item.plugin,
+        name: item.name,
+        slug: slugFromPluginFile(item.plugin),
+        version: item.version,
+    }))
+        .filter((plugin) => plugin.slug !== LOOPRESS_PLUGIN_SLUG);
+}
 export function diffPlugins(manifest, installed) {
     const installedMap = new Map(installed.map((p) => [p.slug, p]));
     const toInstall = [];
     const toActivate = [];
-    const drifted = [];
     const upToDate = [];
-    for (const [slug, targetVersion] of Object.entries(manifest)) {
+    for (const slug of Object.keys(manifest)) {
         const live = installedMap.get(slug);
         if (!live) {
-            toInstall.push({ slug, targetVersion });
-            continue;
+            toInstall.push({ slug });
         }
-        if (live.version === targetVersion) {
-            if (live.active) {
-                upToDate.push(slug);
-            }
-            else {
-                toActivate.push({ slug });
-            }
+        else if (live.active) {
+            upToDate.push(slug);
         }
         else {
-            drifted.push({ currentVersion: live.version, slug, targetVersion });
+            toActivate.push({ file: live.file, slug });
         }
     }
-    return { drifted, toActivate, toInstall, upToDate };
+    return { toActivate, toInstall, upToDate };
 }