@lyupro/codex-bridge 0.6.7 → 0.6.9

package/cli/removal-plan.mjs

@@ -0,0 +1,187 @@
+/**
+ * Decides, from gathered facts, what happens to every file of the package home.
+ *
+ * Plan_65 D12 uses one plan for uninstall and purge: decisions precede any deletion,
+ * so edited images and entries the inspection could not read stay visible to the caller.
+ * The record has its own operation because removing one owner can preserve the shared record.
+ */
+import {
+  HOME_ARTIFACTS,
+  HOME_DIRECTORIES,
+  classifyHomePath,
+  homeArtifact,
+} from '../src/home/lib/home-registry.mjs';
+
+const byRelative = (left, right) => (
+  left.relative < right.relative ? -1 : left.relative > right.relative ? 1 : 0
+);
+
+// The record changes only after the host is detached (cli/uninstall.mjs, hostSide.detached), so
+// every operation that changes it carries that dependency and nothing else does.
+function recordOutcome(operation, reason, blocked = false) {
+  const dependsOnDetach = operation === 'delete' || operation === 'remove-current-owner';
+  return { operation, reason, dependsOnDetach, blocked };
+}
+
+// The command that asked for the plan. Not "mode": that word already meant six things in this
+// package, and a guard (tests/mode-is-not-a-name.test.mjs) keeps it from meaning a seventh.
+function assertCommand(command) {
+  if (command !== 'uninstall' && command !== 'purge') throw new TypeError(`Invalid removal command: ${command}`);
+}
+
+function metadata(relative, imageMembers) {
+  const match = classifyHomePath(relative, { imageMembers });
+  return match
+    ? { ...match, removal: homeArtifact(match.id).removal }
+    : { id: null, role: null, removal: null };
+}
+
+function fileDecision(file, command, imageEvidence, imagePolicy) {
+  if (file.id === 'install-image') {
+    if (!imagePolicy.remove) return { action: 'keep', reason: imagePolicy.reason };
+    if (file.role !== 'primary') return { action: 'remove', reason: imagePolicy.reason };
+    const evidence = imageEvidence.get(file.relative);
+    if (!evidence) throw new TypeError(`Missing image evidence for ${file.relative}`);
+    if (!['remove', 'keep', 'missing'].includes(evidence.verdict)) {
+      throw new TypeError(`Invalid image evidence for ${file.relative}`);
+    }
+    return {
+      action: evidence.verdict,
+      reason: evidence.verdict === 'remove' ? `evidence: ${evidence.reason}` : evidence.reason,
+    };
+  }
+  if (file.id === 'install-record') {
+    // D12 item 2 reserves the record operation for B16c; D8/D11 keep its lifecycle sides.
+    if (file.role === 'primary' || file.role === 'atomic-temporary') return null;
+    if (file.role === 'lock') return { action: 'keep', reason: 'lifecycle lock' };
+    if (file.role === 'clear-gate') return { action: 'keep', reason: 'clear queue' };
+  }
+  if (file.removal === 'purge-only') {
+    return command === 'purge'
+      ? { action: 'remove', reason: 'purge' }
+      : { action: 'keep', reason: 'purge-only' };
+  }
+  if (file.removal === 'protected') return { action: 'keep', reason: 'protected' };
+  throw new TypeError(`Unsupported home file classification for ${file.relative}`);
+}
+
+function ancestorDecision(relative, inspection) {
+  const isAncestor = (entry) => entry.relative === '' || relative.startsWith(`${entry.relative}/`);
+  // D12 item 1: a path hidden by an ancestor is uninspected, not absent.
+  for (const [entries, reason] of [
+    [inspection.links, 'link at'],
+    [inspection.errors, 'unreadable ancestor'],
+    [inspection.unknown, 'unknown ancestor'],
+  ]) {
+    const ancestor = entries.find(isAncestor);
+    if (ancestor) return { action: 'blocked', reason: `${reason} ${ancestor.relative}` };
+  }
+  return { action: 'missing', reason: 'missing' };
+}
+
+export function planHomeFiles({ command, inspection, imageMembers, imageEvidence, imagePolicy }) {
+  assertCommand(command);
+  if (inspection.root === 'missing') return { rows: [], blocked: false };
+  if (inspection.root === 'error') return { rows: [], blocked: true };
+  if (inspection.root !== 'present') throw new TypeError(`Invalid home root state: ${inspection.root}`);
+
+  const rowsByPath = new Map();
+  const add = (relative, classification, decision) => {
+    if (!rowsByPath.has(relative)) rowsByPath.set(relative, { relative, ...classification, ...decision });
+  };
+  for (const entry of inspection.links) {
+    add(entry.relative, metadata(entry.relative, imageMembers), { action: 'blocked', reason: 'link' });
+  }
+  for (const entry of inspection.errors) {
+    add(entry.relative, metadata(entry.relative, imageMembers), {
+      action: 'blocked', reason: `unreadable: ${entry.code}`,
+    });
+  }
+  for (const entry of inspection.unknown) {
+    add(entry.relative, { id: null, role: null, removal: null }, {
+      action: 'keep', reason: entry.kind === 'directory' ? 'unknown directory' : 'unknown',
+    });
+  }
+  for (const file of inspection.files) {
+    if (rowsByPath.has(file.relative)) continue;
+    const decision = fileDecision(file, command, imageEvidence, imagePolicy);
+    if (decision) add(file.relative, { id: file.id, role: file.role, removal: file.removal }, decision);
+  }
+
+  const expected = new Set(imageMembers);
+  for (const artifact of HOME_ARTIFACTS) {
+    if (artifact.id === 'install-image' || artifact.id === 'install-record') continue;
+    if (Array.isArray(artifact.primary)) {
+      for (const relative of artifact.primary) expected.add(relative);
+    }
+  }
+  const inspected = new Set([
+    ...inspection.files, ...inspection.links, ...inspection.errors,
+    ...inspection.unknown, ...inspection.directories,
+  ].map((entry) => entry.relative));
+  for (const relative of expected) {
+    if (!inspected.has(relative)) {
+      add(relative, metadata(relative, imageMembers), ancestorDecision(relative, inspection));
+    }
+  }
+  const rows = [...rowsByPath.values()].sort(byRelative);
+  return { rows, blocked: rows.some((row) => row.action === 'blocked') };
+}
+
+export function planRecordOperation({ command, recordState, format2, ownerKey, imagePolicy }) {
+  assertCommand(command);
+  if (!['missing', 'corrupt', 'valid'].includes(recordState)) {
+    throw new TypeError(`Invalid installation record state: ${recordState}`);
+  }
+  if (recordState === 'missing') {
+    return recordOutcome('none', 'no installation record');
+  }
+  // D12 item 4: an unreadable record blocks removal rather than becoming an absent record.
+  if (recordState === 'corrupt') {
+    return recordOutcome('retain', 'unreadable installation record', true);
+  }
+  if (command === 'purge' || imagePolicy.remove) {
+    return recordOutcome('delete', command === 'purge' ? 'purge' : 'last owner');
+  }
+  if (Object.keys(format2.owners).length === 0) {
+    return recordOutcome('retain', 'no host is recorded as using it');
+  }
+  if (Object.hasOwn(format2.owners, ownerKey)) {
+    return recordOutcome('remove-current-owner', imagePolicy.reason);
+  }
+  return recordOutcome('retain', 'not an owner of this home');
+}
+
+export function planHomeDirectories({ command, inspection, imageMembers, imagePolicy }) {
+  if (inspection.root !== 'present') return [];
+  const decide = (relative) => {
+    if (command === 'purge') return { relative, action: 'remove-if-empty', reason: 'purge' };
+    if (!imagePolicy.remove) return { relative, action: 'keep', reason: imagePolicy.reason };
+    const imageDirectory = relative === '' || (
+      !HOME_DIRECTORIES.includes(relative)
+      && imageMembers.some((member) => member.startsWith(`${relative}/`))
+    );
+    // D12 item 1: even image ancestors can only be removed once they are empty.
+    return imageDirectory
+      ? { relative, action: 'remove-if-empty', reason: 'image' }
+      : { relative, action: 'keep', reason: 'holds purge-only data' };
+  };
+  return [...inspection.directories.map((entry) => decide(entry.relative)), decide('')];
+}
+
+export function planHomeRemoval(facts) {
+  const files = planHomeFiles(facts);
+  const record = planRecordOperation(facts);
+  const directories = planHomeDirectories(facts);
+  const rowsByPath = new Map(files.rows.map((row) => [row.relative, row]));
+  for (const file of facts.inspection.files) {
+    if (file.id !== 'install-record' || file.role !== 'atomic-temporary' || rowsByPath.has(file.relative)) continue;
+    rowsByPath.set(file.relative, {
+      relative: file.relative, id: file.id, role: file.role, removal: file.removal,
+      action: record.operation === 'delete' ? 'remove' : 'keep',
+      reason: record.operation === 'delete' ? 'record deleted' : 'record in use',
+    });
+  }
+  const rows = [...rowsByPath.values()].sort(byRelative);
+  return { rows, directories, record, blocked: files.blocked || record.blocked };
+}

package/cli/remove-layout.mjs

@@ -1,6 +1,10 @@
-/** Removes emptied directories of an installed layout without walking out of the package's own. */
+/**
+ * Removes emptied directories of an installed layout without walking out of the package's own.
+ * Home folders use the adapter and link check (Plan_65 D3, D4 item 4); host folders keep the raw route.
+ */
 import fs from 'node:fs/promises';
 import path from 'node:path';
+import { inspectSegments } from './link-segments.mjs';
 
 /**
  * These four helpers existed as two copies — one in uninstall.mjs, one in update.mjs — and the
@@ -57,3 +61,38 @@ export function claudeBoundary(host, target) {
 export async function removeEmptyLayout(directory) {
   await removeEmpty(directory);
 }
+
+// The segment check runs before every rmdir, not once per walk: on Windows rmdir on a junction
+// removes the junction itself, and a folder above the target may be a link even when the target's
+// own folder is not. A folder already gone keeps the walk going — its parent may still be empty.
+export async function removeEmptyHomeParents(writer, id, target, homeRoot) {
+  const root = path.resolve(homeRoot);
+  let current = path.dirname(path.resolve(target));
+  for (;;) {
+    const relative = path.relative(root, current);
+    if (!relative || path.isAbsolute(relative) || relative === '..'
+      || relative.startsWith(`..${path.sep}`)) break;
+
+    const finding = inspectSegments(current, root);
+    if (finding.kind !== 'missing') {
+      if (finding.kind !== 'clear') return { kept: finding };
+      try {
+        if ((await fs.readdir(current)).length !== 0) break;
+        await writer.rmdir(id, current);
+      } catch (error) {
+        if (error.code !== 'ENOENT') throw error;
+      }
+    }
+    current = path.dirname(current);
+  }
+  return { kept: null };
+}
+
+export async function removeEmptyHome(writer, id, homeRoot) {
+  // Plan_65 D4 item 1 trusts the root as written, including a deliberately relocated home.
+  try {
+    if ((await fs.readdir(homeRoot)).length === 0) await writer.rmdir(id, homeRoot);
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+  }
+}

package/cli/rules-owners.mjs

@@ -4,7 +4,8 @@ import { randomUUID } from 'node:crypto';
 import path from 'node:path';
 import { normalizeRepoPath } from '../src/home/lib/runner/project-dir.mjs';
 import { readJsonFile } from '../src/home/lib/json-file.mjs';
-import { withFileLock } from '../src/home/lib/file-lock.mjs';
+import { withOutsideFileLock } from '../src/home/lib/file-lock.mjs';
+import { createHomeWriter } from '../src/home/lib/home-write.mjs';
 export { isLockTaken } from '../src/home/lib/file-lock.mjs';
 
 export const RULES_REGISTRY_NAME = '.codex-bridge-rules.json';
@@ -76,7 +77,8 @@ function registryLockPath(host) {
 }
 
 async function withRegistryLock(host, action) {
-  return withFileLock(registryLockPath(host), action, { description: 'rules ownership registry' });
+  const writer = createHomeWriter({ root: host.brandRoot });
+  return withOutsideFileLock(writer, registryLockPath(host), action, { description: 'rules ownership registry' });
 }
 
 export async function readRulesRegistry(host) {

package/cli/session-hosts.mjs

@@ -0,0 +1,51 @@
+/** Judges every observed session host after the 2026-09-25 PATH host identity incident. */
+import { contractStatus, PROBE_COMMAND } from './host-contract.mjs';
+import { DISPATCHER_CONTRACTS, dispatcherContractStatus } from './dispatcher-contract.mjs';
+
+export function sessionHostVersions(observations) {
+  return Object.entries(observations?.hosts ?? {})
+    .map(([version, entry]) => ({ version, timestamp: Date.parse(entry?.lastSeen) }))
+    .filter(({ timestamp }) => Number.isFinite(timestamp))
+    .sort((a, b) => b.timestamp - a.timestamp)
+    .map(({ version }) => version);
+}
+
+export function sessionHostCheck(versions, observations) {
+  if (!versions.length) {
+    return {
+      key: 'sessionHost',
+      status: 'warn',
+      value: 'No Claude Code session has been observed by this installation yet; host contracts are judged once a session runs a shell command.',
+    };
+  }
+  const newest = versions[0];
+  const lastSeen = new Date(observations.hosts[newest].lastSeen).toISOString();
+  const others = versions.slice(1);
+  return {
+    key: 'sessionHost',
+    status: 'ok',
+    value: `Sessions run on host ${newest} (last seen ${lastSeen})${others.length ? `; also seen: ${others.join(', ')}` : ''}`,
+  };
+}
+
+export function otherHostCheck({ version, contractRecord, dispatcherRecord }) {
+  const refusal = contractStatus({ record: contractRecord, version });
+  const dispatchers = dispatcherContractStatus({ record: dispatcherRecord, version });
+  const key = `otherHost:${version}`;
+  if (refusal.state === 'ignored' || dispatchers.some(({ state }) => state === 'changed')) {
+    const changed = dispatchers.filter(({ state }) => state === 'changed').map(({ contract }) => contract);
+    return { key, status: 'fail', value: [refusal.state === 'ignored' ? 'refusal contract ignored' : '', ...changed].filter(Boolean).join('; ') };
+  }
+  if (refusal.state === 'verified' && dispatchers.every(({ state }) => state === 'verified')) {
+    return { key, status: 'ok', value: `Host ${version} refusal and dispatcher contracts are verified.` };
+  }
+  const missing = [];
+  if (refusal.state !== 'verified') missing.push('refusal');
+  missing.push(...dispatchers.filter(({ state }) => state !== 'verified').map(({ contract }) => contract));
+  const probe = `${PROBE_COMMAND} --probe-executable <path to a ${version} executable>`;
+  return {
+    key,
+    status: 'warn',
+    value: `Host ${version} contracts not yet measured: ${missing.join(', ')}; run ${probe}.`,
+  };
+}

package/cli/terminal-question.mjs

@@ -0,0 +1,41 @@
+/**
+ * The one terminal yes/no question. Plan_65 D9 needs three outcomes kept apart, because each leads
+ * to a different action: 'yes', 'no' (a no, a bare Enter, or input that ended — EOF is no answer,
+ * never consent) and 'cancel' (Ctrl+C: the caller exits 130 and changes nothing). prune's private
+ * copy folded all of them into "no"; a second copy in install would have drifted from it.
+ */
+import readline from 'node:readline/promises';
+
+// One spelling only. A guard that answers to several option names is a guard with several ways
+// to be switched off by accident.
+export function isInteractive(options) {
+  if (options.isTTY !== undefined) return Boolean(options.isTTY);
+  return Boolean((options.stdin || process.stdin).isTTY);
+}
+
+function outcome(answer) {
+  if (answer === 'cancel') return 'cancel';
+  return answer === true || (typeof answer === 'string' && /^(y|yes)$/i.test(answer.trim()))
+    ? 'yes'
+    : 'no';
+}
+
+/** `options.prompt` is the test seam: it may answer a boolean, a string, or the string 'cancel'. */
+export async function askYesNo(question, options) {
+  if (options.prompt !== undefined) return outcome(await options.prompt(question));
+
+  const input = options.stdin || process.stdin;
+  const output = options.promptOutput || process.stderr;
+  const interfaceHandle = readline.createInterface({ input, output });
+  const ended = new Promise((resolve) => {
+    interfaceHandle.once('SIGINT', () => resolve('cancel'));
+    interfaceHandle.once('close', () => resolve('no'));
+  });
+  // A closed interface rejects the pending question; the close itself already decided the answer.
+  const answered = interfaceHandle.question(`${question} [y/N] `).then(outcome, () => ended);
+  try {
+    return await Promise.race([answered, ended]);
+  } finally {
+    interfaceHandle.close();
+  }
+}

package/cli/uninstall-purge.mjs

@@ -0,0 +1,139 @@
+/**
+ * Uninstalls one host and purges the package home behind one preflight.
+ * Plan_65 D12 items 5-7 and D14 item 1 require both consents and authorization before any
+ * host mutation; D10 item 4 forbids removing the home until this host's hooks are gone.
+ */
+import fs from 'node:fs';
+import { uninstall, removePermissions, stillAttachedLine } from './uninstall.mjs';
+import { legacyInstallRecordPath, readInstallRecord } from './manifest.mjs';
+import { normalizeRepoPath } from '../src/home/lib/runner/project-dir.mjs';
+import { inspectHost } from './host-inspection.mjs';
+import { removeHostSide } from './host-removal.mjs';
+import { withSettingsRun } from './settings-merge.mjs';
+import { withLifecycle } from './lifecycle-transaction.mjs';
+import { readRulesRegistry } from './rules-owners.mjs';
+import { rulesDryRunLines, removeRulesForHost } from './uninstall-rules.mjs';
+import { removeEmpty, removeEmptyLayout } from './remove-layout.mjs';
+import { recordHomeWriter, removeOutside } from './record-removal.mjs';
+import { runPurgePreflight, diagnosePurge } from './purge-preflight.mjs';
+import { executeHomePlan } from './home-plan-execute.mjs';
+import { inspectHome } from './home-inspection.mjs';
+import {
+  purgeDryRunLines, purgeDryRunExitCode, outcomeLines, outcomeExitCode,
+} from './removal-outcomes.mjs';
+
+const ACCOUNTED = new Set(['kept', 'blocked', 'failed']);
+
+/**
+ * Plan_65 D12 item 7: a run started during purge (D14 item 3) or any other writer can recreate a registry
+ * file after its removal, and "Purged" would then be a false report. One more pass names every registry
+ * file present that the outcomes did not already name as kept. It does not defend against a deliberate
+ * swap of a folder between check and removal (D4 item 6); that limit is documented, not compensated.
+ */
+export function appearedLines(host, plan, outcomes) {
+  const inspection = inspectHome(host.brandRoot, { imageMembers: plan.imageMembers });
+  if (inspection.root === 'missing') return [];
+  if (inspection.root === 'error') {
+    return [`Could not re-check ${host.brandRoot} after purge (${inspection.rootCode}).`];
+  }
+  const named = new Set(outcomes.filter((entry) => entry.kind !== 'directory' && ACCOUNTED.has(entry.result))
+    .map((entry) => entry.relative));
+  return inspection.files.filter((file) => !named.has(file.relative)).map((file) =>
+    `Appeared during purge: brand/${file.relative}; run uninstall --purge again once nothing writes to the home.`);
+}
+
+async function purgeInRun(options, ticket) {
+  const { host } = options;
+  let registry = null;
+  let registryError = null;
+  try {
+    registry = await readRulesRegistry(host);
+  } catch (err) {
+    registryError = err;
+  }
+  const preflight = await runPurgePreflight({
+    host, ticket, packageRoot: options.packageRoot,
+    ...(options.liveRunCheck !== undefined ? { liveRunCheck: options.liveRunCheck } : {}),
+    options: { ...options, candidates: options.candidates ?? registry?.owners ?? [] },
+  });
+  if (preflight.verdict === 'refused') {
+    return { exitCode: 1, output: ['Purge refused; nothing was changed.', ...preflight.lines].join('\n') };
+  }
+  if (preflight.verdict === 'cancelled') {
+    return { exitCode: 130, output: 'Cancelled; nothing was changed.' };
+  }
+  const { plan, authorization } = preflight;
+  const owner = plan.format2?.owners[normalizeRepoPath(host.root)] ?? null;
+  const inspection = await inspectHost(host, { owner });
+  const record = await readInstallRecord(host);
+  const writer = record ? recordHomeWriter(host, record.files) : null;
+  const permissionLine = await removePermissions(host, inspection, false);
+  const hostSide = await removeHostSide(host, inspection, { owner });
+  if (!hostSide.detached) {
+    return {
+      exitCode: 1,
+      output: [stillAttachedLine(host), permissionLine, ...hostSide.lines,
+        `Left ${host.brandRoot} untouched: purge removes the home only after this host's hooks are gone.`]
+        .join('\n'),
+    };
+  }
+  const rules = await removeRulesForHost({ host, record, registry, registryError, detached: true, writer });
+  const { outcomes } = await executeHomePlan(host, plan, {
+    detached: true, imageMembers: plan.imageMembers, authorization,
+  });
+  await removeEmpty(host.commandsDir);
+  if (record) await removeOutside(writer, legacyInstallRecordPath(host));
+  await removeEmpty(host.agentsDir);
+  await removeEmptyLayout(host.legacyAgentsDir);
+  await removeEmptyLayout(host.legacyCommandsDir);
+  const appeared = appearedLines(host, plan, outcomes);
+  return {
+    exitCode: appeared.length ? 1 : outcomeExitCode(outcomes),
+    output: ['Purged codex-bridge.', permissionLine, ...hostSide.lines, ...rules.lines,
+      ...outcomeLines(outcomes, { host }), ...appeared].join('\n'),
+  };
+}
+
+async function purgeDryRun(options) {
+  const { host } = options;
+  let registry = null;
+  let registryError = null;
+  try {
+    registry = await readRulesRegistry(host);
+  } catch (err) {
+    registryError = err;
+  }
+  const diagnosis = await diagnosePurge({
+    host, packageRoot: options.packageRoot,
+    ...(options.liveRunCheck !== undefined ? { liveRunCheck: options.liveRunCheck } : {}),
+  });
+  // D12: a corrupt inventory is a diagnosis, never a throwing host-record read.
+  const corrupt = diagnosis.plan.recordState === 'corrupt';
+  const owner = corrupt ? null : diagnosis.plan.format2?.owners[normalizeRepoPath(host.root)] ?? null;
+  const inspection = await inspectHost(host, { owner });
+  const record = corrupt ? null : await readInstallRecord(host);
+  const permissionLine = await removePermissions(host, inspection, true);
+  const hostSide = await removeHostSide(host, inspection, { owner, dryRun: true });
+  const lines = [permissionLine, ...hostSide.lines];
+  if (!hostSide.detached) {
+    lines.push(`Would leave ${host.brandRoot} untouched: this host's hooks could not be removed.`);
+  }
+  lines.push(...await rulesDryRunLines({ host, record, registry, registryError, detached: hostSide.detached }));
+  lines.push(...purgeDryRunLines(diagnosis, { host }));
+  return { exitCode: hostSide.detached ? purgeDryRunExitCode(diagnosis) : 1, output: lines.join('\n') };
+}
+
+async function missingHome(options) {
+  const result = await uninstall(options);
+  return { ...result, output: `${result.output}\nNothing to purge: ${options.host.brandRoot} does not exist.` };
+}
+
+export async function purge(options) {
+  const { host } = options;
+  if (options.dryRun) return withSettingsRun(host.settingsPath, () => purgeDryRun(options));
+  if (!fs.existsSync(host.brandRoot)) return missingHome(options);
+  return withLifecycle(host, 'purge', (ticket) => {
+    if (ticket === undefined) return missingHome(options);
+    return withSettingsRun(host.settingsPath, () => purgeInRun(options, ticket));
+  }, { waitMs: options.lifecycleWaitMs });
+}

package/cli/uninstall-rules.mjs

@@ -0,0 +1,72 @@
+/**
+ * Decides and performs what happens to the Codex rules file when a host leaves the package.
+ * Plan_65 B20a: uninstall and purge detach hosts alike, so sharing rules ownership and fingerprint
+ * decisions prevents their behavior and output from drifting apart.
+ */
+import { fileFingerprint } from './manifest.mjs';
+import { removeRulesOwner, remainingRulesOwners } from './rules-owners.mjs';
+import { removeOutside } from './record-removal.mjs';
+
+export function remainingOwnersText(count) {
+  return `${count} other owner${count === 1 ? '' : 's'} ${count === 1 ? 'remains' : 'remain'}`;
+}
+
+export async function rulesDryRunLines({ host, record, registry, registryError, detached }) {
+  const lines = [];
+  if (!record?.rules || !detached) return lines;
+  if (registryError) {
+    lines.push(`Would leave ${record.rules.path} because the rules ownership registry is invalid; \
+ownership is unknown.`);
+  } else {
+    const remainingOwners = remainingRulesOwners(registry, host);
+    const currentFingerprint = await fileFingerprint(record.rules.path);
+    if (remainingOwners?.length) {
+      lines.push(`Would leave ${record.rules.path} because ${remainingOwnersText(remainingOwners.length)}.`);
+    } else if (currentFingerprint === record.rules.fingerprint) {
+      lines.push(`Would remove ${record.rules.path}; no other owners remain and its fingerprint is unchanged.`);
+    } else if (currentFingerprint !== null) {
+      lines.push(`Would leave ${record.rules.path} because its contents changed after installation.`);
+    } else {
+      lines.push(`Would leave ${record.rules.path} because it is already absent.`);
+    }
+    if (!registry) {
+      lines.push(`Warning: the rules ownership registry was missing; \
+other installations may use ${record.rules.path}.`);
+    }
+  }
+  return lines;
+}
+
+export async function removeRulesForHost({ host, record, registry, registryError, detached, writer }) {
+  const detachedRecord = record && detached ? record : null;
+  let ownership = null;
+  if (detachedRecord && !registryError) {
+    try {
+      ownership = await removeRulesOwner(host);
+    } catch (err) {
+      registryError = err;
+    }
+  }
+  const lines = [];
+  if (detachedRecord?.rules) {
+    if (registryError) {
+      lines.push(`Left ${record.rules.path} because the rules ownership registry is invalid; ownership is unknown.`);
+    } else {
+      if (ownership?.owners.length) {
+        lines.push(`Left ${record.rules.path} because ${remainingOwnersText(ownership.owners.length)}.`);
+      } else {
+        const currentFingerprint = await fileFingerprint(record.rules.path);
+        if (currentFingerprint === record.rules.fingerprint) {
+          await removeOutside(writer, record.rules.path);
+        } else if (currentFingerprint !== null) {
+          lines.push(`Left ${record.rules.path} because its contents changed after installation.`);
+        }
+      }
+      if (!registry) {
+        lines.push(`Warning: the rules ownership registry was missing; \
+other installations may use ${record.rules.path}.`);
+      }
+    }
+  }
+  return { lines, registryError };
+}